= Solution
The stated ability is a complete failure of <second-preimage resistance>. Given an arbitrary target message $x$, compute $x'\ne x$ with $h(x')=h(x)$. Ask the signer for a <digital signature> on $x'$ only, obtaining $s=f(\mathit{sk},h(x'))$. Then
$$
g(\mathit{pk},s)=h(x')=h(x),
$$
so $(x,s)$ is a forgery of the chosen target. The inequality $x'\ne x$ ensures that the adversary has not requested the target's own <digital signature>.
$$
\boxed{\text{Alternative preimages for every message give universal chosen-message forgery.}}
$$
Under a <known-message signature attack>, the same weakness also gives an <existential forgery>: take an observed signed $x$, find its different second preimage, and reuse the <digital signature>. The <universal forgery> claim uses the stronger <chosen-message signature attack> capability to request the companion of whichever target was specified.
Back to article page
