How does hash function in Elgamal signature scheme prevent existential forgery attack? I have heard that hashing the message M prevents an existential forgery attack. I was wondering how.
Existential forgery attacks allow the attacker to choose (or calculate) a signature, and then the message is derived from this signature (and the public key) using the existential forgery attack algorithm.

The signature is valid for the derived message, but the problem is that the attacker cannot control the message. It could be anything.

Hashing the message before verification requires the attacker, Oscar, to additionally find some data that hashes to his derived message, which is practically impossible.