Where's the Flaw in Blum-Feldman-Micali's Method
I have not read the details of their flawed protocol, but I've heard about it on several occasions.  My impression was that their error was in how they used the PRG seed.  Their protocol puts the pseudorandom generator (PRG) seed in the public common reference string, and they attempt to argue that PRG security forces some statistical property of the PRG output to hold even with a known seed.  While it is possible to do this in a sound way (the signature schemes of Hohenberger and Waters here and here spring to mind), something went wrong in their argument.