Chosen-Message-Attack RSA-Signature I know that because of the multplicative property of RSA 

$s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$

If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=1$ and he calculates $m_2 = m\cdot m_1^{-1} \bmod n$

After this part I don't understand the attack...

How is he able to sign now his own message $m$ ?
Suppose you want to obtain the signature $s = m^d \bmod n$ on a chosen message $m$.  Here is that attack.


You ask the signer to sign a random message $m_1$ and obtain the corresponding signature $s_1 = m_1^d \bmod n$;
You compute message $m_2 := m\cdot m_1^{-1} \bmod n$ and ask the signer to sign message $m_2$; you obtain the signature $s_2 = m_2^d \bmod n$.


From the pairs $(m_1,s_1)$ and $(m_2,s_2)$, the signature $s$ on chosen message $m$ can be recovered as $s = s_1 \cdot s_2 \bmod n$.

To see it, observe that $s \equiv s_1 \cdot s_2 \equiv m_1^d \cdot m_2^d \equiv m_1^d \cdot (m\cdot m_1^{-1})^d \equiv m_1^d \cdot m^d \cdot m_1^{-d} \equiv m^d \pmod n$.



Note that you could obtain the signature on message $m$ by only asking one signature to the signer.  Indeed, you can construct the pair $(m_1,s_1)$ in Step 1 above by yourself as follows: choose a random $s_1$ modulo $n$ and define $m_1 = s_1^e \bmod n$ (where $e$ is the public verification exponent).  We then have $m_1^d \equiv s_1 \pmod n$ as required.