I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really bad idea. And I also know that there's a trivial attack if two messages have the same prefix as the "hash" gets truncated to the first q bits (q being bitlength of the order of the curve).
However I wanted to know: What are the "worst" possible attack(s) against this signature scheme?
The worst attack is hereby defined to be the attack that needs the least known or chosen signatures while being executable in reasonable amount of time.