Selective and existential unforgability of signature schemes I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must output a pair (m, s) such that s is a valid signature of m, and m has not been queried before. My questions are the following:


How does one select selective unforgability under chosen message attack in terms of a game?
Are there examples of signatures which are SUF-CMA, but not EUF-CMA?
1) In the selective unforgeability game (often also denoted universal unforgeability), the adversary is given the public key and a target message for which it needs to produce a forgery (instead of giving the adversary only the public key and letting the adversary choose the target message). 

2) No, any scheme that is EUF-CMA is also SUF-CMA (this is easy to show; build an EUF-CMA adversary from any SUF-CMA one by simply running the SUF one on an arbitrarily chosen message).