How to show Hash-Then-Encrypt is not AE-secure

(E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions. E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject.

ps:the question is from the book <A Graduate Course in Applied Cryptography[Boneh]> exercise 9.2 can use cpa and cca to proof

• Hint: Can you somehow modify a ciphertext and make the changed one be accepted? – SEJPM Dec 18 '20 at 13:40
• If I'm reading this correctly, what you're describing is Encrypt-then-Hash. – Maeher Dec 18 '20 at 13:48
• It's a bit hard to read, I think something got lost in translation. C2 seems to be the authentication tag? Strange variable name, C was the input to the hash before, and is likely the ciphertext (?). – Maarten Bodewes Dec 18 '20 at 13:55
• I'm sorry for my bad English. I have upload the picture of the problem. I aggre with the second comment , but I don't know how to show it use cca or cpa. – Redomichelan Dec 19 '20 at 6:13
• first one is simple as $H_1{(m)}$ leaks the information about the message in the ciphertext. So it is not CPA secure. – SSA Dec 19 '20 at 8:04

• first one is simple as $${H_1(m)}$$ leaks the information about the message in the ciphertext. So it is not CPA secure.
• second one , the scheme will be under CCA. as @SEJPM mentioned attacker can modify the c1 such that new ciphertext c2 will be the result of $${H_2(c1)=c2}$$, so ciphertext integrity is not preserved, required in AE.
• yes, right. Here, ${H_2}$ doesn't seem to be not one-way function. we know that ${H_2^{-1}(c_2)=c_1}$, we have both value (c1,c2) then ${H_2}$ is a function C to C. ${H_2:C--> C}$. – SSA Dec 19 '20 at 14:01
• We have two things , (E,D) a CPA-secure cipher and a Hash function. consider m1 is having same length as single block of CBC mode. once Attacker receives the ${c_1}$ along with IV it will modify IV as ${IV \oplus 1}$ , this new ${c_1}'$ will be given to Hash function to get ${c_2}'$. now modified ${c_1}$ will be given for decryption and he will receive ${m_1 \oplus 1}$ . – SSA Dec 20 '20 at 2:20