= Solution
A failure of <collision resistance> supplies distinct messages $x,x'$ with
$$
h(x)=h(x').
$$
Ask the legitimate signer to sign $x$, obtaining $s=f(\mathit{sk},h(x))$. Output $(x',s)$ without ever requesting a <digital signature> on $x'$. Its verification succeeds because
$$
g(\mathit{pk},s)=h(x)=h(x').
$$
Thus
$$
\boxed{\text{Collision finding gives an existential forgery under chosen-message attack.}}
$$
The adversary chooses the collision pair, but cannot in general insist that one member equal an independently specified target. A <known-message signature attack> would require the stronger ability to collide with an already signed message; finding an arbitrary collision alone does not provide that.
Back to article page
