# Reason for two random numbers in DSA?

Why is the signature in DSA the way it is?

I am referring to $$r$$ and $$k$$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $$r$$ and $$s$$, or would it still be secure if only one of them is used?

In the Schnorr-Signature only one random number is involved, for example. • $k$ is drawn at random. $r$ and $s$ are not, they are obtained by applying a function. So I see no more random numbers in DSA than in Schnorr Signature.
– fgrieu
Aug 1 at 9:38
• Sorry, I confused $s$ with $k$. So my question essentially is: why could the signature not be $s:=H(m)+xr$ or $s:=k^{-1}(H(m)+x)$? Aug 1 at 15:41
• Well, both those alternatives you listed would allow easy forgery. For the first one, given a valid signature, the attacker knows $s, H(m), r$, so they can easily recover the private key $x$. For the second one, the validation formula is $r^s = g^{H(m)}g^x$; from a valid signature, the attacker can recover $g^x$. Then, to forge a signature to message $m'$, he just sets $r = g^{H(m')}g^x$ and $s= 1$ Aug 1 at 16:19

So my question essentially is: why could the signature not be $$s=H(m)+xr$$ or $$s=k^{−1}(H(m)+x)$$?
For $$s=H(m)+xr$$, the adversary with a valid message/signature pair knows $$s, H(m), r$$. With that, simple algebra allows him to recover $$x$$, the private key (and with that, he can sign anything).
For $$s=k^{−1}(H(m)+x)$$, the validation formula (because $$r=g^k$$) is $$g^{ks} = r^s = g^{H(m)+x} = g^{H(m)}g^x$$. With a single valid message/signature pair, the adversary knows $$r, s, H(m)$$ (and $$g$$); that allows him to recover the value $$g^x$$ (alternatively, if the adversary has the public key, that's $$g^x$$, so the attacker might not even need a valid signature).
Then, to sign a message $$m'$$, the adversary can compute $$r = g^{H(m')}g^x$$ and $$s=1$$ - it is easy to see that satisfies the validation formula.