Past exam of the computer science course of the University of Oxford / 2015 / Computer security / 3 / e / ii / Solution

A failure of collision resistance supplies distinct messages $x,x^{\prime }$ withAsk the legitimate signer to sign $x$, obtaining $s=f(sk,h(x))$. Output $(x^{\prime },s)$ without ever requesting a digital signature on $x^{\prime }$. Its verification succeeds becauseThusThe adversary chooses the collision pair, but cannot in general insist that one member equal an independently specified target. A known-message signature attack would require the stronger ability to collide with an already signed message; finding an arbitrary collision alone does not provide that.