Is DSA still secure without the factor "r"?

Question

If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^k$ then computes the signature: $s=\frac{H(m)+xF(g^k)}{k}$ where F is some "reasonably uniform function" $F: G \rightarrow \frac{\mathbb{Z}}{|G|\mathbb{Z}}$. To verify the signature, Victor checks that $g^{\frac{H(m)}{s}}(g^x)^{\frac{F(g^k)}{s}} = g^k$.

My question is about the factor $F(g^k)$ (named $r$ in many expositions, e.g. in Wikipedia). How necessary is it security-wise? More concretely: suppose Peggy were to compute a signature $s=\frac{H(m)+x}{k}$ (and, accordingly, Victor would compute: $g^{\frac{H(m)}{s}}(g^x)^{\frac{1}{s}} = g^k$). Does this make the scheme vulnerable to a specific, known attack?

Duplicate of this question (asked February 2019, no answers). See also this past question, where the answer asserts that a collision in $r$ doesn't allow a cryptographic break.

Answer 1

This signature scheme is trivial to forge.

Notice that there is $s$ is only used on the right hand side of the verification equation and $g^k$ is only used on the left hand side. Fred the forger is at liberty to choose any $s$; compute the left hand side say $\ell=g^{\frac{h(m)}s}(g^x)^{\frac1s}$ and then publish the signature $(\ell,s)$ which will be accepted by Victor.