Could a symmetric encrypted communication with a SHA-512 hash still be manipulated?

Question

I just got back from an exam review and there was a question I remembered that I apparently got wrong. I wonder if someone could help me with this, since it bothers me.

The question was something like that:

Between a client and server, a symmetric encryption algorithm is used for the communication. The encrypted data is then hashed with SHA-512 and added to the data stream. Would a man-in-the-middle be able to meddle with the message in a way, the software would not be able to identify the manipulation? It's important that the attacker does not need to get access to the content of the message or manipulate it in a meaningful way. Just the general possibility.

In my answer, I said that, yes, it was possible, but got 0 points on my explanation. I would be interested in the correct answer to that question, out of sheer interest.

Answer 1

Let the message $m$ is encrypted as $c =\operatorname{E}(k,m)$, the hash of ciphertext is $h = \operatorname{H}(c)$, and send as $(c,h)$ pair. Then the attacker captures the transmission, (possibly stop and send) and

1. Random ciphertext: change the ciphertext $c$ into any value $c'$ and calculate the hash of it $h' = \operatorname{H}(c')$ and sends. The message will have no meaning at all.

2. The Replay attack; the attacker sends old messages on their behalf. This is more serious since if not protected, all messages are meaningful. Consider that you send a money transfer message, and it is replayed again and again.

3. Bit-Flipping attack: If the attackers know the message and for encryption, the CTR or CFB mode of operation is used then they modify the ciphertext bits to their advantage and calculate the hash of the modified ciphertext. This is the strongest assumption, however, can have devastating effects. Like $\texttt{attack at fall}$ can be turned into $\texttt{attack at down}$.

4. Length extension attack: the attacjer executes a length extension attack on SHA-512 on the hash value $h$. $$h' = \operatorname{SHA512}(c\mathbin\|pad1\mathbin\|extension)$$

   Then modifies $c$ as $c' = c \mathbin\|pad1\|extension$ and sends the message pair as $(c',h')$.

   The receiver checks the hash of $c'$ and sees that it is a valid hash then decrypt the $c'$ as the intended ciphertext. done!

   This length extension attack has almost no cost for the attacker, however, they have no control of the decryption of the appended text.

   To make the length extension attack easier the attacker can define a new $\operatorname{SHA-512}$ as $\operatorname{SHA-512x}(IV,m) $. If the $IV$ is equal to initial values of $\operatorname{SHA-512}$ then it is exactly $\operatorname{SHA-512}$, in the other case they can use the $h$ as an $IV$ to execute the attacks as $\operatorname{SHA-512x}(h,extension)$. This will reduce the cost of the extension attack.