An Overview of Cryptography
"This scheme also provides nonrepudiation since it proves that Alice sent the message; if the hash value recovered by Bob using Alice's public key proves that the message has not been altered, then only Alice could have created the digital signature."<p>This is a common misconception.<p>Just because a signature verifies under Alice's public key, it does not necessarily imply Alice generated the signature. For many common signature schemes, if Bob makes a signature using their public/private key, Alice can produce a different private/public key such that Bob's signature will verify under Alice's key.<p>Paper (we) wrote on the impacts of this: <a href="https://eprint.iacr.org/2019/779" rel="nofollow">https://eprint.iacr.org/2019/779</a>