Duplicate Signature Key Selection (DSKS) Attack

Updated 13 Sep 2026

•
What it is
- •
  A named, well-studied attack class against any signature-verification scheme that trusts a self-supplied public key rather than a fixed, pre-established one. If a verifier accepts "here's my message, my public key, and a signature" and simply checks that the signature validates under the attacker-chosen key, the attacker can construct a public key custom-built to make an already-known value verify as a "signature" over any message they want — without ever knowing any matching private key. The simplest version: setting $e=1$ collapses RSA verification to $S \bmod n = m$ ; choosing $n = S - m$ (for a fixed value $S$ the attacker possesses and a target digest $m$ with $S > 2m$ ) makes that congruence hold by construction.
•
When to apply
- •
  A signature-verification service lets the caller supply their own $(N, e)$ alongside a message and signature, rather than checking against one fixed, trusted public key — this is the deciding factor, not anything about the signature algorithm's underlying hardness
•
Math
- •
  With $e=1$ , $n=S-m$ : $S \bmod (S-m) = S - (S-m) = m$ (valid whenever $0 \le m < n$ , i.e. $S > 2m$ ).
•
Worked example
- •
  A toy 1024-bit "signature" value $S$ and a target digest $m$ chosen so $S>2m$ : setting $e=1$ , $n=S-m$ and checking $S \bmod n$ returned exactly $m$ — a valid "forged" verification with no private key involved at all.

Python

n = S - m_target
e = 1
# verifier computes pow(S, e, n) == S % n == m_target  -- passes