Hot answers tagged

3

No, it is not necessarily secure. Here is a simplified example of why not. Assume one block zero messages are encrypted without padding. The ciphertext is $I||E(I \oplus 0)$. The MAC value is thus $E(E(I) \oplus E(I)) = E(0)$. So regardless of the IV, the MAC is the same for all such messages. So if you encrypt several zero messages you can leak that fact ...


1

It is not secure. Suppose an attacker Mallory has oracle access to the encryption device of Alice. Mallory is able to get Alice to encrypt any chosen plain text, but Mallory is not able to decrypt any cipher text that is not chosen by Mallory. A typical, practical, scenario could be that Mallory controls javascript that is executed by Alice's web browser, ...



Only top voted, non community-wiki answers of a minimum length are eligible