Why is authenticated CFB mode insecure?

Question

I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it:

Let $P_1,P_2,\ldots P_n$ be the plaintext blocks, $C_1,C_2,\ldots C_n$ the CFB encrypted ciphertext blocks and consider the authentication tag is computed as:

$$ T = E_k(C_n) \oplus P_1 \oplus P_2 \ldots \oplus P_n$$

(this is basically appending an extra block of plaintext containing the XOR of all plaintext blocks and using this final encrypted block as an authentication tag).

Can anybody point me out what is the major mistake in this?

Answer 1

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message.

This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the corresponding ciphertext $(C_1, C_2, ..., C_n, T)$ (using some IV; we don't care what it is).

Here is how the attacker can generate a ciphertext that would decrypt and validate to $(P_1, P_2, ..., P_k)$ for a $k$ of his choosing.

First of all, he can truncate the ciphertext $(C_1, C_2, ..., C_k)$; that will obviously decrypt into the message he wants; all he needs to do is compute the corresponding tag so that it would validate.

He can do this because we already knows that $C_{k+1} = E(C_k) \oplus P_{k+1}$; this is how CFB mode works. Because of this, he can then compute the tag:

$T' = C_{k+1} \oplus P_1 \oplus P_2 \oplus ... \oplus P_k \oplus P_{k+1} = E(C_k) \oplus P_1 \oplus P_2 \oplus ... \oplus P_k$

And there, his job is done...