Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have a question I can't solve from one of the courses I'm currently taking:

Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker
can compute a signature on messages of the form: $m'=(m+bS)a\mod p - 1$,
when $b\in Z_p^*$ is chosen as the attacker wishes and $a=g^b\mod p$.

Hint: Observe the value of $g^{ma+baS}$

share|improve this question

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.