Ciphers, MACs, and cryptographic hash functions

4. [Message extension attack against the “raw CBC” MAC] Consider the so-called “raw CBC” MAC
(see Slide 13 of Lecture 5-2, it is marked by the grey shape):

In fact, this is a variant of ECBC-MAC where the last encryption step (on key k1) is omitted.
Task: Show the message extension attack against this MAC.
Specifically, show that given the message (m[0], m[1], m[2], m[3]) and the tag as above,
an adversary in the chosen-message attack game is able to produce a valid tag for the message
(m[0], m[1], m[2], m[3], m) for an arbitrary message block “m”.
Hints: Remember that in the chosen-message attack game, the adversary is allowed to query
the challenger with arbitrary messages, in order to obtain valid tags for them.
However, the adversary is not allowed to output these message/pairs as forgery.
For instance, the adversary is not allowed to simply query the message (m[0], m[1], m[2], m[3], m),
obtain a tag for it, and output it as the forgery (because this would be a trivial attack).
As a hint, you may consider a similar attack against NMAC as described on Slide 15 of Lecture 5-2.
[15 points]

5. [AES-CTR is not CCA-secure] Show that AES in the counter mode (CTR) is not CCA-secure.
Specifically, you must show an adversary which breaks semantic security of this encryption scheme
using a chosen-ciphertext attack.
Hint: An example of Slide 17 of Lecture 9-1 may be helpful.
[15 points]

6. [Insecure AE cipher] Let (E,D) be an AE-secure cipher (i.e., the cipher which securely implements
authenticated encryption). Consider the following derived cipher:
E1(k,m) := ( E(k,m) , E(k,m) ) = ( c1 , c2 )
D1( k, (c1,c2) ) := D(k,c