# Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme:

AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector taken from the first 16 bytes of the HMACSHA256 mac of the plaintext. I use the same key for confidentiality and integrity. Ciphertext is Base64Encode( MSB(128, mac(k, plaintext)) || E(iv, k, plaintext) ) where MSB(b, v) stands for the b most significant bits (left-most) of v.

Note that it doesn't actually seem to be using SIV mode, but rather what looks like a custom synthetic IV scheme.

My question is: does this scheme have any security flaws? How would it compare, for example, with using SIV mode as described in RFC 5297? Specifically, does it provide the same guarantee for message authentication and integrity?

-
The one flaw I see is the one the author pointed out; it uses "the same key for confidentiality and integrity." $\;$ –  Ricky Demer Apr 9 at 17:17
(Also, this scheme does not support associated data.) $\;$ –  Ricky Demer Apr 9 at 17:18
There is also no MAC on the ciphertext –  Richie Frame Apr 9 at 18:08
@RichieFrame : $\:$ SIV mode doesn't have a MAC on the ciphertext either. $\;\;\;\;\;$ –  Ricky Demer Apr 9 at 18:30
"The same key for confidentiality and integrity" is bad in principle, but since integrity is with HMAC-SHA256, and confidentiality with CBC, I see no theoretical attack possible. "There is no MAC on the ciphertext", but as long as as the alleged plaintext is discarded when the MAC does not check, I do not see a theoretical issue. On a practical standpoint, the decryption is directly exposed to side-channel attacks (DPA..), and if the encryption key leaks due to that, integrity also goes down the drain. Of course indentical plaintext leads to identical ciphertext. –  fgrieu Apr 10 at 11:25