# Why do we need extra hashing if we could use simpler scheme?

Lets say that we use init vector IV, key K and HMAC key H. Message is M.

Mode of operation is CBC !!!

We usually encrypt as this

C = crypt(M,K,IV) #encrypted data
R = C + MAC(C)  # final result and + is for con cat


But we could use just:

R = len + crypt(M + H,K, IV)  # notice M + H


Is it something wrong whit such scheme? It looks much faster for me and requires like twice less computation and complexity.

-
Yes, it does not give message authenticity and it leaves crypt accessible to chosen-ciphertext attacks. –  Ricky Demer Jul 30 '12 at 10:48
If HMAC is too slow for you, I'd look into authenticated encryption modes. They use much faster MAC techniques. –  CodesInChaos Jul 30 '12 at 11:36

This scheme is totally insecure. If an attacker modifies any part of the ciphertext except the last block before the ciphertext corresponding to H, your scheme won't catch it.

CBC decryption of a block only depends on the ciphertext of the previous and current block.

(Based on Cbc decryption.png from Wikipedia)

The red parts are left totally unprotected by your MAC scheme. The green parts affect your MAC, but even on them there are some attacks.

-
Oh, I see, what about replacing whit some other mode. That propagates trough all –  ralu Jul 30 '12 at 11:31
That depends on the exact mode. –  CodesInChaos Jul 30 '12 at 11:36
Crazy, I just had a similar thought earlier today after getting pissed off at HMAC, but using CFB instead. I came to the same conclusion after a few minutes, the diagram illustrates it all very neatly, +1. –  Thomas Jul 30 '12 at 13:37