Suppose that $(m, r, s)$ is a message signed with an Elgamal signature scheme. Choose $h$ with $(h, p − 1) = 1$, and let $r_1 ≡ r^h\pmod p$, $s_1 ≡ sr_1h^{−1}r^{−1}\pmod {p − 1}$, and $m_1 ≡ mr_1r^{−1}\pmod {p − 1}$. Show that $(m_1, r_1, s_1)$ is a valid (forged) signature. Why should this not cause problems?

I don't understand how I am supposed to show this. Any help is appreciated

  • $\begingroup$ You need to check that $(m_1,r_s,s_1)$ will pass the verification step of the scheme. $\endgroup$ – Clement C. Apr 1 '15 at 3:14
  • $\begingroup$ I understand this. But how do I proceed to show that? $\endgroup$ – mike russel Apr 1 '15 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.