# encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, we can design a Message Authentication Code (MAC) in this manner, so given a message $m$ and the secret key $k$, the mac is the encrypted digest, $t=E(k, H(m))$.

Is it susceptible to forgery if the encryption is in CBC mode or CTR mode? My intuition tells me that it is possible, but I have no idea of constructing the forgery for them. Any suggestion is welcome, thanks!

• What should run in CTR / CBC mode? The $E$ function? – SEJPM Sep 28 '16 at 14:02
• @SEJPM: Yes you are right. – meta_warrior Sep 28 '16 at 14:03
• Trivial attack against CTR: Modify the message as you wish, calculate the XOR of the old and the new hash and XOR that into the encrypted hash. Voila, you have a forgery. – SEJPM Sep 28 '16 at 14:04
• @SEJPM: Sorry, but can you explain it further? Equations/diagrams are better. – meta_warrior Sep 28 '16 at 14:07
• What is the block size of the underlying cipher? 128-bit? Is the IV (for the modes) always prepended to the cipher text? (I need this info to see how hard it is to attack CBC in this scenario and then I'll write a full answer). – SEJPM Sep 28 '16 at 14:09

Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m)) = IV, E(k, IV, H(m))$; he has a message $m'$ he wants to form the message to. He computes $\delta = H(m) \oplus H(m')$, then:
• For CTR mode, he computes $IV, E(k, IV, H(m)) \oplus \delta$, when this is decrypted, this results in $H(m) \oplus \delta = H(m')$
• For CBC mode, we computes $IV \oplus \delta, E(k, IV, H(m))$; because of how CBC mode works, the first block (128 bits for AES) are the first 128 bits of $H(m) \oplus \delta = H(m')$; because $H$ generates only 128 bits, that's the entire message (nit: depending on CBC mode is padded, that may also be an issue; I'm assuming no padding).
Also, there is no such thing as a "collision resistant hash function with 128 bits output"; assuming that the hash function takes an arbitrary bitstring, we can find a collision in $O(2^{64})$ time, and that's generally considered feasible.
• @SEJPM: on the other hand, freak_warrior stated that $E$ was a semantically secure mechanism, and so $E$ must be randomized somehow. It could be done by, say, passing an encoding of the IV, however that's starting to get away from standard CBC mode... – poncho Sep 28 '16 at 14:21