This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse

Show how one could exploit an implementation ElGamal signature scheme in which it is not checked that $0 \leq \gamma \leq p-1.$

As far as I can see, we have to find a $\gamma$ such that $\alpha^{a\gamma-x}\gamma^\delta \equiv 1 \pmod{p}$ for a message $x$.

Anyone happens to see a good choice of $\gamma$?


1 Answer 1


As Wikipedia’s Chinese remainder theorem article states:

The Chinese remainder theorem is a theorem of number theory, which states that if one knows the remainders of the Euclidean division of an integer n by several integers, then one can determine uniquely the remainder of the division of n by the product of these integers, under the condition that the divisors are pairwise coprime.

Using that, you can solve this by finding a $\gamma$ satisfying

$$\gamma \equiv 0 \pmod{p-1}$$


$$\gamma \equiv \alpha^x \pmod{p}$$

and you’re done.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.