Does this pairing-based signature scheme work? Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign.

Setup


Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, where $a$ and $p$ are some secret values.
The public key is then defined as a tuple $(A, P)$.


Signature


Hash message $M$ to a number using a hash function: $m=Hash(M)$.
Compute  $C = \frac{p}{a \cdot m} \cdot G_2$.
The signature is then defined as $C$.


Verification


Compute $m = Hash(M)$.
Verify that $e(A, C)^m = e(G_1, P)$.


Are there any holes in this scheme?
Your proposed signature scheme falls to universal forgeries under a known message attack (UF-KMA).

The adversary $\mathcal{A}$ receives the public key $(A,P)$, a single message signature pair $(M,C)$ and the challenge message $M^*$.
It outputs $$C' := \frac{H(M)}{H(M^*)} \cdot C.$$

The adversary described above is succesful with probability $1$.
To see this, consider that $C$ is by definition
$$C = \frac{p}{a\cdot H(M)} \cdot G_2.$$
We now have 
\begin{align}
C' &amp;= \frac{H(M)}{H(M^*)} \cdot C\\
&amp;= \frac{H(M)}{H(M^*)}\cdot\frac{p}{a\cdot H(M)} \cdot G_2\\
&amp;=\frac{p\cdot H(M)}{a\cdot H(M) H(M^*)} \cdot G_2\\
&amp;=\frac{p}{a\cdot H(M^*)} \cdot G_2,
\end{align}
which is exactly the signature of $M^*$ and will therefore be accepted by the verification equation.