# Tag Info

Before continuing to read this answer, read my above hint: Try writing down all the equations for the different s and try to solve the system of equations. If you still can't solve this one, you may read the remainder of the answer. First observe that $s_1 \equiv k_1 \cdot h(m) + r_1\cdot x \pmod {53}$ and $s_2 \equiv k_2 \cdot h(m') + r_2\cdot x ... 0 Key generation Select prime p and a generator g; Sender S selects a random integer r (secret key) such that 0 < r < p − 1 and calculates K=(g^r)(modp); K, g and p are in public domain; Signing To authenticate message M, the sender selects another random integer R (0 < R < p − 1 and gcd(R,p-1)=1 and computes X=(g^R)(modp); The sender ... 0 Daniel Bleichenbacher has described such kind of attacks in his article Generating ElGamal signatures without knowing the secret key. He noticed that if verifier would accept signatures where$r$is larger than$p$then any signature$(r,s)$on$H(M)$could be used to generate a signature$(r2, s2)$on arbitrary hash value$H(M2)\$. For that attacker should ...