# Tag Info

Ask a CPA-query with a known $m$ and get back $c_0,c_1'$. Compute $c_1'' = c_1' \oplus m$. Then, compute $F^{-1}_r(c_1'')$ and this will be $k$. Now you know the key. Of course, this attack assumes that you can invert $F$, but nothing in the definition says you cannot (and in practice you often can).