forgery, the challenger can ask for the signature of a “difficult” message. Example of an existential forgery The RSA cryptosystem has the following multiplicative property: . This property can be exploited by creating a message with a signature . A common defense to this attack is to hash the messages before signing them. Weak existential forgery (strong existential unforgeability, strong unforgeability; sEUF, or SUF) This notion is a stronger (more secure) variant of the existential forgery detailed above. Weak existential forgery is the creation (by an adversary) of at least one message/signature pair, , given a message and different signature produced by the legitimate signer. Strong existential forgery is essentially the weakest adversarial goal, therefore the strongest schemes are those that are strongly existentially unforgeable. References Forgery