Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse

Show how one could exploit an implementation ElGamal signature scheme in which it is not checked that $0 \leq \gamma \leq p-1.$

As far as I can see, we have to find a $\gamma$ such that $\alpha^{a\gamma-x}\gamma^\delta \equiv 1 \pmod{p}$ for a message $x$.

Anyone happens to see a good choice of $\gamma$?

share|improve this question
I've posted one hint. Would you like another hint, or would you like a chance to think about this some more yourself before hearing a spoiler? –  D.W. Sep 7 '11 at 1:35

1 Answer 1

Hint #1: Chinese remainder theorem.

share|improve this answer
Please, correct me if I am wrong. We find a $\gamma$ satisfying $\gamma \equiv 1 \pmod{p-1}$ and $\gamma \equiv \alpha^x \pmod{p}$ and we are done. –  Azooo Sep 7 '11 at 11:15
@Azooo: Exactly. That was my solution, too. (Typo: you probably mean $\gamma \equiv 0 \pmod{p-1}$, not $\equiv 1$.) –  D.W. Sep 7 '11 at 18:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.