Return to Revisions

This attack requires that $r' = ru \bmod p-1$ and $r' = r \bmod p$. If $r'$ were less than $p-1$, it would have to be that $r'=r=ru$ over the integers (no modulus), which is unlikely as $u$ is computed from two hashed values (and thus, $u$ is likely not $1$). Thus, for this attack to work, $r'$ must be larger than $p-1$.