When Alice sends a message M to Bob, she and Bob agree to use the following protocol:
(i) Alice computes S = [Mj^hce-
(ii) Alice sends (M, S) to Bob.
(iii) Bob computes V = {SJAlice-
(iv) Bob accepts the signature as valid provided V = M.
With this protocol it's possible for Trudy to forge Alice's signature on a random "message" as follows. Trudy generates a value R. She then computes Λ = {.R} Alice an(^ sen ds (N, R) to Bob. Following the protocol above, Bob computes V = {A} Alice anciî since V = N, Bob accepts the signature. Bob then believes that Alice sent him the signed nonsense "message" N. As a result, Bob gets very annoyed with Alice.
a. Is this attack a serious concern, or just an annoyance? Justify your answer.
b. Suppose we modify the protocol as follows:
(i) Alice computes S = [F(M)]^]ice.
(ii) Alice sends (M, S) to Bob.
(iii) Bob computes V = {>S}Alice·
(iv) Bob accepts the signature as valid provided V = F(M).
What conditions must the function F satisfy so as to prevent this annoying attack?