Consider the following variant of DSA in which the message space is [Z_q]:

To generate a signature:

1. Choose a random number [k Zq]
2. Calculate [r = g^k mod p]
3. Compute [s = (m + xr )k¹ mod q]

The signature is [r, s] .

To verify the signature:

1. Compute [u₁ = ms¹ mod q]
2. Compute [u₂ = rs¹ mod q]
3. Test whether [r = g^u1 h^u2 mod p]

This is not secure because the adversary, after intercepting a message [m₁] and its signature [r, s], can create a valid signature [r', s'] of another message [m₂]. Which of the following is correct regarding the forged signature?

1: [r' r, s' s]

2: [r' = r, s' s]

3: [r' = r , s' s]

4: [r' r, s' = s]