Question 15

In a digital signature scheme, a message $m$ is signed by computing its cryptographic hash $h(m)$ and encrypting the hash using the sender S's private key: $\sigma = \text{Sign}_{SK_S}(h(m))$.

In a birthday attack on a digital signature:

• The attacker prepares two messages with different semantics: a benign message $m$ and a fraudulent message $m'$, structured with minor variations (e.g., spaces or synonyms) until a hash collision is found: $h(m) = h(m')$.
• If an attacker can get the sender to sign $m$, the signature $\sigma$ is also valid for $m'$ because $h(m) = h(m')$.
• However, a third-party attacker or receiver R cannot generate a valid digital signature on their own because they do not have S's private key. Nor can they present $m'$ to a third party without S having signed $h(m)$.

The sender S, however, has full control over both message preparation and signing. S can prepare $m$ and $m'$ such that $h(m) = h(m')$, sign $m$, deliver $(m, \sigma)$ to R to commit to an agreement, and later repudiate or substitute $m'$ claiming that $m'$ was the message signed by S. Hence, only S can launch this birthday attack.

Thus, only security violation (I) is possible.