- and show that if the `message' -- the hash -- is more than a third the size
- of the modulus. In particular, existential forgery is possible in
- polynomial time, and selective forgery in subexponential time (though much
- faster than factoring the modulus).
+ and show that the schemes can be broken if the `message' -- the hash -- is
+ more than a third the size of the modulus. In particular, existential
+ forgery is possible in polynomial time, and selective forgery in
+ subexponential time (though much faster than factoring the modulus).