# Tag Info

4

No, it is not necessarily secure. Here is a simplified example of why not. Assume one block zero messages are encrypted without padding. The ciphertext is $I||E(I \oplus 0)$. The MAC value is thus $E(E(I) \oplus E(I)) = E(0)$. So regardless of the IV, the MAC is the same for all such messages. So if you encrypt several zero messages you can leak that fact ...

2

When you get the first part of the decryption wrong, but the rest correct, it almost always means that you got the IV wrong. However, with CBC mode, what usually happens is that you get the first 16 bytes wrong; instead, you got only 6 bytes wrong; that may indicate that you got the first 6 bytes of the IV wrong (and the other 10 bytes correct). In ...

1

It is not secure. Suppose an attacker Mallory has oracle access to the encryption device of Alice. Mallory is able to get Alice to encrypt any chosen plain text, but Mallory is not able to decrypt any cipher text that is not chosen by Mallory. A typical, practical, scenario could be that Mallory controls javascript that is executed by Alice's web browser, ...

Only top voted, non community-wiki answers of a minimum length are eligible