New answers tagged


If the second plaintext block is all-zero, then the second ciphertext block is IV2, which is testable. This blows CPA security, which is a fatal flaw.


I am wondering, why the second XOR operation is necessary. If it is omitted, then an arbitrary permutation of the ciphertext blocks would not modify the tag, and hence any such modification would not be detected. In the decrypt direction, the checksum (which is what the tag depends on) is an xor of all the values generated by the AES block decryption ...

Top 50 recent answers are included