# Tag Info

First since E is an encryption algorithm, it has a Decryption counterpart, lets name it D. From the correcntess equation we get that $E(x,D(x,c)) = c$ for every $x$. Then we can easily see that if $$y= x \oplus D(x,c)$$ then $$f_2(x,y) = E(x, y \oplus x) = E(x, x \oplus D(x,c) \oplus x) = E(x,D(x,c)) = c$$ Again this holds for every $x$. So we have just ...