# Tag Info

There are two major problems with this method. The first problem is that Susan is likely to be able to recover significant amount of data from a series of such blocks. For example, if Susan knows $subkey_1$, then she could recover the value $subblock_1 \oplus subblock_2 \oplus subkey_2$; if a single block is encrypted with this key, she can't deduce ...
The condition is that: $$g(0, x_2, x_3, ..., x_n) \ne g(1, x_2, x_3, ..., x_n)$$ for all $x_2, x_3, ..., x_n$ This can easily be derived from the condition that implies bijectivity of $f$; that is, $f(x_1, x_2, ..., x_n) = f(y_1, y_2, ..., y_n)$ implies that $x_1 = y_1$, $x_2 = y_2$, ..., $x_n = y_n$