# Why $s=0$ is not allowed in Elgamal signature?

In Elgamal signature scheme $$\text{sig}_{k_{pr}}(x,k_E)=(r,s)$$, $$s=0$$ is not allowed. How does this lead to finding the private key $$d$$?

• Did you check that the signature can be verifiable? Commented Jan 4, 2022 at 16:45
• Thanks. For verification we should have $\beta^r.r^s \bmod p=\alpha^x$, which in this particular case leads to $\alpha^{d.r+0}\neq \alpha^x$. And using hash functions will not solve this problem, is it true? Commented Jan 4, 2022 at 19:39
• The $m$ should be already the hash of the message, otherwise, the signature space will be limited. I couldn't find a dupe for this. If you want you can write an answer to your question. Commented Jan 4, 2022 at 19:55
• Thanks dear Henry. Commented Jan 4, 2022 at 20:55

For $$s=0$$, we will have problem verifying the signature. For verification, we should have $$\beta^r \cdot r^s=\alpha^x$$. This special case, $$s=0$$, leads to $$\beta^r \cdot r^0=\beta^r=\alpha^{d \cdot r}$$ which must be equal to $$\alpha^x$$, i.e. $$d \cdot r=x$$, but $$d \cdot r$$ is equal for every $$x$$ and this have no meaning.
• That is more than that. $r$ is public in the signature, then you find the $d$ :) Commented Jan 4, 2022 at 21:06