Problem 5 (7 pts) CBC-MAC In class, we discussed HMAC. Another commonly used MAC scheme is Ci- pher Block Chaining Message Authentication Code, abbreviated CBC-MAC. This constructs a mes- sage authentication code scheme from a block cipher. To compute the CBC-MAC of a message given a key K, one uses the key K to encrypt the message in CBC mode, using 0 as the IV, and the final ciphertext block is the MAC value. = a (2 pts) Let Ek be the encryption function with block size b and key K, Bo = 00...O be the IV used in CBC-MAC, and to denote bit-by-bite XOR. Write the formula for the CBC-MAC of a two-block message M M1M2, i.e. CBC-MACK(M1M2) =, b (5 pts) CBC-MAC is only secure for fixed-length messages. Show that when variable-length mes- sages are allowed, CBC-MAC is insecure against a chosen-plaintext attack. That is, show that given M and CBC-MACK[M], how to come up M' and CBC-MACK[M'] for some M'. Problem 5 (7 pts) CBC-MAC In class, we discussed HMAC. Another commonly used MAC scheme is Ci- pher Block Chaining Message Authentication Code, abbreviated CBC-MAC. This constructs a mes- sage authentication code scheme from a block cipher. To compute the CBC-MAC of a message given a key K, one uses the key K to encrypt the message in CBC mode, using 0 as the IV, and the final ciphertext block is the MAC value. = a (2 pts) Let Ek be the encryption function with block size b and key K, Bo = 00...O be the IV used in CBC-MAC, and to denote bit-by-bite XOR. Write the formula for the CBC-MAC of a two-block message M M1M2, i.e. CBC-MACK(M1M2) =, b (5 pts) CBC-MAC is only secure for fixed-length messages. Show that when variable-length mes- sages are allowed, CBC-MAC is insecure against a chosen-plaintext attack. That is, show that given M and CBC-MACK[M], how to come up M' and CBC-MACK[M'] for some M