Finding the private key for this signature scheme Assume the signature scheme where $x$ is the private key and the public key $y = g^x \pmod{p}$. The signature works as:

Choose $h \in \{0, \dots, p-2 \}$ s.t.: $\mathcal{H}(m) + x + h \equiv 0 \pmod{p-1}$, $\mathcal{H}(m)$ collision-resistant hash function.

The signature is the triple $(m, (x+h) \pmod{p-1},g^h \pmod{p}) = (m,a,b)$

Verification checks if:
\begin{align}
yb &amp;\equiv g^a \pmod{p} \tag{1} \\
g^{\mathcal{H}(m)}yb &amp;\equiv 1 \pmod{p} \tag{2}
\end{align}


The objective is to achieve and forge signatures for arbitrary messages of our choice.
Let $m'$ be an arbitrary message. Then, the triple $(m', a', b')$ with:
\begin{align}
a' &amp;= -\mathcal{H}(m') \pmod{p-1} \\
b' &amp;= g^{-\mathcal{H}(m')} \cdot y^{-1} \pmod{p}
\end{align}
is a valid signature on $m'$. Since we forged a signature on an arbitrary message, we've achieved total break for this scheme.