# IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days.

Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a common mistake made in “roll-your-own” cryptosystems is to try to use the last ciphertext block to compute a MAC on the plaintext, e.g. to encrypt the message m, we compute the ciphertext $$c = \verb|CBCEncrypt|^E _K(m)$$, let $$c^∗$$ be the last block, compute tag $$\tau = E_K(c^*)$$. and use $$⟨c, τ⟩$$ as an “authenticated encryption” scheme. Prove that this scheme fails to provide chosen-ciphertext security.

I'm making the assumption that an encryption oracle for $$\verb|CBCEncrypt|^{E}_K(m)$$ uniformly chooses an IV and then makes it public after encryption. Also, $$E_K$$ is the block function.

One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message. However, since each IV is random and unpredictable, I don't see how an adversary could exploit this.

Another thought I had was if an adversary could compute a valid tag $$\tau_{\tau}$$, then they could decrypt $$⟨\tau, \tau_{\tau}⟩$$ and check whether or not the resultant decryption (with IV=0) is equal to the last block of the corresponding ciphertext $$\tau$$ was generated from. But again, I can't see how an adversary could compute $$\tau_{\tau}$$.

Any help would be appreciated.

• No idea if it's exploitable, but at the very minimum, it defeats the purpose of Encrypt then MAC which is done so that you don't decrypt before verifying. If one of the intermediate cipher text blocks is tampered, the verification will succeed & you will know something is wrong only after you do the decryption. – user93353 Mar 19 at 1:13

So, what would happen if the adversary took a valid $$⟨c, \tau⟩$$ pair and modified $$c$$ by repeating the last block, that is, converting it into the pair $$⟨c || c^*, \tau⟩$$ and forwarding that to the decryptor?