Existential Forgery of rsa Let (sl, s2) be the signatures of the messages(Ml, M2) namely S1=Mid mod n, S2=M2d mod n Then S=S1*S2 mod n is the signature ofm=M1*M2 mod n, because S=S1*S2=M1d M2d=(M1*M2) mod n he message M must be randomized before signing The message M is usually signed by S=h(M)d mod n, where h is the hash function h: 0, 1*->Z/nz (h(M=h(Mi)* h(M2)mod n does not hold 2020 Existential Forgery of RSA Let (S1, S2) be the signatures of the messages (M1,M2), namely S1 = M1d mod n, S2 = M2d mod n. Then S = S1*S2 mod n is the signature of M = M1*M2 mod n, because S = S1*S2 = M1d M2d = (M1*M2)d mod n. The message M must be randomized before signing. The message M is usually signed by S = h(M)d mod n, where h is the hash function h: {0,1}* -> Z/nZ. (h(M) = h(M1)*h(M2) mod n does not hold)