Existential forgery

Existential forgery is even possible with a key-only attack in all signature schemes built from trap-door one-way permutations as described in Section 2.4 The attacker chooses a value and calls it a signature, computes the permutation with the pubhc key, and calls the result a message. 

By the way, the situation with the ElGamal scheme is similar to that with RSA, although that scheme is not directly constructed from trap-door one-way permutations Existential forgery is possible with a key-only attack. However, no method for selective forgery with an active attack is known. 

A second step was to formalize security not only as the infeasibility of computing the inverse of a function. Instead, the definition must comprise an active attack and exclude existential forgery. 

---