# ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse

Show how one could exploit an implementation ElGamal signature scheme in which it is not checked that $0 \leq \gamma \leq p-1.$

As far as I can see, we have to find a $\gamma$ such that $\alpha^{a\gamma-x}\gamma^\delta \equiv 1 \pmod{p}$ for a message $x$.

Anyone happens to see a good choice of $\gamma$?

-
I've posted one hint. Would you like another hint, or would you like a chance to think about this some more yourself before hearing a spoiler? –  D.W. Sep 7 '11 at 1:35
add comment

## 1 Answer

Hint #1: Chinese remainder theorem.

-
Please, correct me if I am wrong. We find a $\gamma$ satisfying $\gamma \equiv 1 \pmod{p-1}$ and $\gamma \equiv \alpha^x \pmod{p}$ and we are done. –  Azooo Sep 7 '11 at 11:15
@Azooo: Exactly. That was my solution, too. (Typo: you probably mean $\gamma \equiv 0 \pmod{p-1}$, not $\equiv 1$.) –  D.W. Sep 7 '11 at 18:17
add comment