Editing Birthday attack (section)

===Reverse attack===
The same fraud is possible if the signer is Mallory, not Bob.  Bob could suggest a contract to Mallory for a signature.  Mallory could find both an inoffensively-modified version of this fair contract that has the same signature as a fraudulent contract, and Mallory could provide the modified fair contract and signature to Bob.  Later, Mallory could produce the fraudulent copy.  If Bob doesn't have the inoffensively-modified version contract (perhaps only finding their original proposal), Mallory's fraud is perfect.  If Bob does have it, Mallory can at least claim that it is Bob who is the fraudster.