= Solution
An <existential forgery> produces a valid <digital signature> on at least one new message, even if the adversary has no useful control over that message's meaning. A <universal forgery> gives a way to forge a <digital signature> on an arbitrary specified message. Recovering the <private key> suffices for a <universal forgery>, but is not required if another general signing method exists.
In a <key-only signature attack>, the adversary knows the verification <public key> and the public scheme. In a <known-message signature attack>, it additionally obtains valid message–<digital signature> pairs whose messages it did not choose. In a <chosen-message signature attack>, it can ask for <digital signatures> on messages it chooses, possibly adaptively. Its final forged message must not be one of the messages already submitted for signing; otherwise simply returning a supplied pair would count as a forgery.
$$
\boxed{\text{Existential: some new message; universal: an arbitrary target message.}}
$$
Back to article page
