# Tag Info

5

I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and $$s = H(m)\cdot x + k \mod q,$$ where $h = H(m)$ depends solely on the message $m$ being signed. Here $x$ denotes the secret signing key and $q$ the order of the generator $g$ of a prime ...

3

Your attack on $S$ involves computing $S'(k,m_i)$ for arbitrary messages $m_1,\dots,m_q$. In order to do that, you must compute $S(k,m_i)$ and $S(k,0^n)$, and thus you have obtained $S(k,0^n)$. This means that $0^n$ must be added to the list of invalid forgeries, and so in order to present a valid forgery for $S$, you must have (m,S(k,m)) \notin \{(0^n,S(k,...

2

First remark: Throw at $S′$ some $m\neq0^n$, and extract the value $s=S(k,0^n)$ out of the tag. Then, the message $0^n$ and tag $(s,s)$ is our forgery. Building a forgery is exposing $m$ and $m'$ such as $S'(m,k) = S(m',k')$. Here you computed: $S'(k,m) = (S(k,m),s) = (\sigma,s)$ and $S'(k,0^n) = (s,s)$ but you do not have a collision between \$(\sigma,...

Top 50 recent answers are included