A challenger C{\displaystyle C} provides the algorithms G,S,V{\displaystyle G,S,V} of a digital signature method as well as the public part of a key pair generated with G{\displaystyle G}. An attacker A{\displaystyle A} generates several messages m0,m1,…,mn−1{\displaystyle m_{0},m_{1},\dots ,m_{n-1}} and retrieves the signatures σ0,σ1,…,σn−1{\displaystyle \sigma _{0},\sigma _{1},\dots ,\sigma _{n-1}}.
Finally, the attacker provides a pair of a message m∗{\displaystyle m^{*}} and a signature σ∗{\displaystyle \sigma ^{*}}. If the challenger can validate this signature with his private key, the attacker has been successful.
Own work
Sn KGS