Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which checks if its valid or not and accepts Ben's connection if it is. Assuming Ben then signs and sends emails on this server using his private key.
Pretend he uses the same private key to log in to a server and sign his emails. How could Ben's emails be forged. Assuming that the authentication mechanism signs the bare challenge without hashing, while for emails Ben signs the hash of the message body.
Only idea that come to mind at this point is it could be more or less an attack such as a Kerberos attack, where a malicious entity pretends to be the server and gives false positives to Ben. It could also be a chosen message attack or possibly having used the onetime of ElGamal signature again. What other things could it be and if one were to run into such a thing, what could be done to prevent it happening?
