Does this simple signature scheme work?

Question

Let's say my public key is defined as $P = p \cdot G$, where $p$ is my private key and $G$ is a generator point of an elliptic curve. If I wanted to sign a message $m$, could I do the following?

1. Hash $m$ to a number using a hash function: $h = Hash(m)$.
2. Compute signature as $S = \frac{p}{h} \cdot G$.

The verification of the signature can then be done by checking that $P = Hash(m) \cdot S$.

This seems like it should work - but also seems too simple - so, I'm wondering if there is anything I'm missing here.

Answer 1

This signature scheme doesn't even provide UF-KOA security.

The attack is simple: When you want to forge a signature for a message $m$, given a public key $P$, simply compute $h=H(m), h'=h^{-1}\bmod q$ and $S=h'\cdot P$, with $q$ being the order of the subgroup generated by $G$ (usually the curve order). $S$ is then your forged signature for $m$.

This works as:

• We can efficiently compute the order of a curve.
• We can efficiently find modular multiplicative inverses.