How can birthday maths help forge a digitally signed contract?

Because a forger doesn't need to match one particular fingerprint; she only needs any fair contract and any fraudulent contract that share one. A digital signature usually signs a hash of the message, a short digital fingerprint, rather than the message itself. Finding some pair of inputs with the same hash, a collision, takes about 2 to the power of l/2 attempts for an l-bit hash, while hitting one specific hash takes about 2 to the power of l−1. That shortcut is called a birthday attack.

The name comes from the birthday problem. In a class of 30 students, the chance that at least two share a birthday is around 70 percent, which feels far too high, because you are comparing every student with every other. Ask instead whether anyone was born on one specific day, and the chance drops to about 7.9 percent. 'Any match' is a much easier target than 'this match'.

Here is the classic scenario. Mallory wants Bob to sign a fraudulent contract. She writes a fair contract and a fraudulent one, then finds spots in the fair one that can change without changing its meaning, such as extra commas, empty lines, one or two spaces after a sentence, or synonyms. Combining those tweaks gives a huge number of fair variations, and she varies the fraudulent one too. She hashes them all until one fair version and one fraudulent version share a hash. Bob signs the fair version; Mallory moves his signature onto the fraudulent one, and the signature now 'proves' Bob signed it.

There is a limit: although digital signatures have vulnerabilities linked to the birthday attack, it cannot break an encryption scheme any faster than plain brute force.