Why do we need extra hashing if we could use simpler scheme?

Question

Lets say that we use init vector IV, key K and HMAC key H. Message is M.

Mode of operation is CBC !!!

We usually encrypt as this

C = crypt(M,K,IV) #encrypted data  
R = C + MAC(C)  # final result and + is for con cat

But we could use just:

R = len + crypt(M + H,K, IV)  # notice M + H

Is it something wrong whit such scheme? It looks much faster for me and requires like twice less computation and complexity.

Answer 1

This scheme is totally insecure. If an attacker modifies any part of the ciphertext except the last block before the ciphertext corresponding to H, your scheme won't catch it.

CBC decryption of a block only depends on the ciphertext of the previous and current block.

(Based on Cbc decryption.png from Wikipedia)

The red parts are left totally unprotected by your MAC scheme. The green parts affect your MAC, but even on them there are some attacks.