ElGamal signature scheme

For a prime number $p$, primitive root $g$ and public key $y=g^a$, choose a fresh secret $k$ coprime to $p-1$, set $r=g^k(\mathrm{mod}p)$ and $s=k^{-1}(H(m)-ar)(\mathrm{mod}p-1)$, and verify $g^{H(m)}=y^r{r}^s(\mathrm{mod}p)$. Reusing the cryptographic nonce can reveal secret information. The unhashed historical construction allows existential forgery of specially chosen message exponents, so authentication claims require suitable hashing and protocol assumptions.