I have a question I can't solve from one of the courses I'm currently taking:
Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker
can compute a signature on messages of the form: $m'=(m+bS)a\mod p - 1$,
when $b\in Z_p^*$ is chosen as the attacker wishes and $a=g^b\mod p$.Hint: Observe the value of $g^{ma+baS}$