# An insecure signature with message recovery, Dan Boneh

Someone can help me to resolve this questions from the book of Dan Boneh (University of Standford)

• What have you tried? Where are you getting stuck? – Aman Grewal Apr 24 at 16:29
• Suggestion: first, make a clear mental picture of how the scheme works, by getting familiar with the notation. For example, the first equation tells that the signature step takes the secret key $sk$ and message fragments $m_0$ and $m_1$ to sign, hashes $m_0$, combines the outcome with $m_1$ using XOR/$\oplus$, then pass that thru the inverse trapdoor permutation $I$ which (using the secret key) yields the signature $\sigma$. The next line describes verification. All the math necessary to solve (a) and (b) boils down to understanding how things work and using that $\oplus$ is a group operation. – fgrieu Apr 24 at 17:01
• fgrieu j'ai fait un tour sur ton profil et j'ai vu que tu t’étais sur Paris. j'écrirais en français pour faciliter la communication. Merci de ta réponse. J'hesite pour la quesion (a), j'aimerais savoir si pour trouver le message m1, il faut utiliser l'équation H(m0) XOR m1 ? – Adam Kd Apr 24 at 17:38
• Oui, vous utilizer l'équation. – poncho Apr 24 at 17:43
• Je suis pas vraiment sur mais comme je connais m0 je peux ecrire H(m1) XOR m1 XOR H(m1)=m1 – Adam Kd Apr 24 at 17:48