Past exam of the computer science course of the University of Oxford / 2015 / Computer security / 3 / e / iv

The stated ability is a complete failure of second-preimage resistance. Given an arbitrary target message $x$, compute $x^{\prime }\ne x$ with $h(x^{\prime })=h(x)$. Ask the signer for a digital signature on $x^{\prime }$ only, obtaining $s=f(sk,h(x^{\prime }))$. Thenso $(x,s)$ is a forgery of the chosen target. The inequality $x^{\prime }\ne x$ ensures that the adversary has not requested the target's own digital signature.

Under a known-message signature attack, the same weakness also gives an existential forgery: take an observed signed $x$, find its different second preimage, and reuse the digital signature. The universal forgery claim uses the stronger chosen-message signature attack capability to request the companion of whichever target was specified.