In a typical digital signature scheme in which in order to sign we compute:
- hash of the message: $h(m)$
- resulting hash signed with the private key $[h(m)](private key)$
If there were a collision on the hash, what an adversary could do?
An adversary can find a different message $m_2$ with the same hash of $m_1$. The user (good guy) signs $m_1$. The adversary can claim that $m_2$ has been signed by the user because $m_1$ and $m_2$ have the same signature.
Is this the correct answer? How can the adversary claim that? I mean… the hash of the message is signed with the user's private key. The adversay does not know that key.