Finding the private key for this signature scheme

Question

Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as:

• Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{p-1}$, $\mathcal{H}(m)$ collision-resistant hash function.

• The signature is the triple $(m, (x+h) \pmod{p-1},g^h \pmod{p}) = (m,a,b)$

• Verification checks if: \begin{align} yb &\equiv g^a \pmod{p} \tag{1} \\ g^{\mathcal{H}(m)}yb &\equiv 1 \pmod{p} \tag{2} \end{align}

The objective is to achieve and forge signatures for arbitrary messages of our choice.

Answer 1

Let $m'$ be an arbitrary message. Then, the triple $(m', a', b')$ with:

\begin{align} a' &= -\mathcal{H}(m') \pmod{p-1} \\ b' &= g^{-\mathcal{H}(m')} \cdot y^{-1} \pmod{p} \end{align}

is a valid signature on $m'$. Since we forged a signature on an arbitrary message, we've achieved total break for this scheme.