Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery? In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message attack.



The proof requires a simulator that can produce transcripts that are indistinguishable from the actual messages generated by the signer, without knowing the secret key.



I apologize if my understanding is wrong. Can someone shed some light on what they mean by simulating the transcripts without knowing the secret key?

Because – if that is possible – would it not become universal forgery?
Here and in many other signature schemes, $f$ is modeled as a "random oracle."  This means that on each distinct input, $f$ outputs a uniformly random value in $\mathbb{Z}_q$ that is independent of all other outputs.  (When queried on the same input multiple times, it always returns the same answer.)

The trick here is that the simulator has the power to "program" the output $f(m,r)$ to be the value of $e$ that the simulator chose.  In the "real" world, an attacker cannot control the outputs of $f$ like the simulator can.

Many more details can be found in the classic Bellare and Rogaway paper "Random oracles are practical."