# encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, we can design a Message Authentication Code (MAC) in this manner, so given a message $m$ and the secret key $k$, the mac is the encrypted digest, $t=E(k, H(m))$.

Is it susceptible to forgery if the encryption is in CBC mode or CTR mode? My intuition tells me that it is possible, but I have no idea of constructing the forgery for them. Any suggestion is welcome, thanks!

• What should run in CTR / CBC mode? The $E$ function? Sep 28, 2016 at 14:02
• @SEJPM: Yes you are right. Sep 28, 2016 at 14:03
• Trivial attack against CTR: Modify the message as you wish, calculate the XOR of the old and the new hash and XOR that into the encrypted hash. Voila, you have a forgery. Sep 28, 2016 at 14:04
• @SEJPM: Sorry, but can you explain it further? Equations/diagrams are better. Sep 28, 2016 at 14:07
• What is the block size of the underlying cipher? 128-bit? Is the IV (for the modes) always prepended to the cipher text? (I need this info to see how hard it is to attack CBC in this scenario and then I'll write a full answer). Sep 28, 2016 at 14:09

Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m)) = IV, E(k, IV, H(m))$; he has a message $m'$ he wants to form the message to. He computes $\delta = H(m) \oplus H(m')$, then:
• For CTR mode, he computes $IV, E(k, IV, H(m)) \oplus \delta$, when this is decrypted, this results in $H(m) \oplus \delta = H(m')$
• For CBC mode, we computes $IV \oplus \delta, E(k, IV, H(m))$; because of how CBC mode works, the first block (128 bits for AES) are the first 128 bits of $H(m) \oplus \delta = H(m')$; because $H$ generates only 128 bits, that's the entire message (nit: depending on CBC mode is padded, that may also be an issue; I'm assuming no padding).
Also, there is no such thing as a "collision resistant hash function with 128 bits output"; assuming that the hash function takes an arbitrary bitstring, we can find a collision in $O(2^{64})$ time, and that's generally considered feasible.
• @SEJPM: on the other hand, freak_warrior stated that $E$ was a semantically secure mechanism, and so $E$ must be randomized somehow. It could be done by, say, passing an encoding of the IV, however that's starting to get away from standard CBC mode... Sep 28, 2016 at 14:21