Weakness in message recovery signature schemes based on discrete logarithm problems 1

Nyberg and Rueppel recently proposed a new ElGamal-type digital signature scheme with message recovery feature and its six variants([7, 8]). They also pointed out two forgeries against some of their signatures. But they did not investigate explicitly how to apply these forgeries to all variants including elliptic curves. The author presented new two forgeries and investigated deeply how to apply the two forgeries and already presented one forgery on all variants([4]). In this paper, we present the further two forgeries and investigate explicitly how to apply the two forgeries and the other presented forgery on all variants. discrete logarithm problems, message-recovery signature, attack