# Tag Info

Sounds a bit like coursework. (: Some ideas to get you started: Are you aware of how a ciphertext $C = (c_1, c_2)$ is constructed? That is, can you state $c_1$ and $c_2$ in terms of the message $m$, and the key pair $x, y$? Can you then state what form a ciphertext would have to have, in order to be a valid encryption of $m \cdot m'$? Once done, can you ...
It seems while this scheme fixes the "ciphertext-swapping" problem, it permits modifying the first block of ciphertext $C_1$ and the $IV$ together without affecting the decryption of the message at all. This is because the first block of plaintext $P_1 = D(C_1 \oplus IV)$, so therefore $C_1$ and $IV$ can be modified "together" without ...