A key substitution attack on SFLASHv3
Willi Geiselmann, Rainer Steinwandt · Journal of Discrete Mathematical Sciences and Cryptography · 2005
A practical key substitution attack on SFLASHv3 is described: Given a valid (message, signature) pair (m, σ) for some public key v 0, one can derive another public key v 1 (along with matching secret data) such that (m, σ) is also valid for v 1. The computational effort needed for finding such a ‘duplicate’ key is comparable to the effort needed for ordinary key generation.