# Tag Info

1

During verification you perform $u^1 = H ( m ) w \mod q$ would return the same $u^1$ for multple hash values. In general you only want one hash to succeed, even if it is unlikely that an adversary can generate a hash that equals $n q + H(m) w$. Of course this means that any hash with the leftmost bits identical to the org. hash is also acceptable, but at ...

Only top voted, non community-wiki answers of a minimum length are eligible