3. In this exercise, you will prove that the CBC-MAC in its plain form is not secure to authenticate variable-length messages (a) Consider the CBC-MAC scheme with an n-bit block cipher where the CBC checksum of a message is calculated with a zero IV. Describe an attack where an attacker Eve can construct the MAC of a message different from those she obtained from the legitimate sender. (Hint Let the attacker obtain the MAC of two n-bit messages and from them compute the MAC of a 2n-bit message.) (b) An attempt to solve this problem could be to append the number of blocks in the message as a final block to the message: i.e., to apply CBC on (M2) instead of M alone, where denotes the number of blocks in M. Show that this construction is not secure either. (Hint: Let the attacker obtain the MAC of some more messages of his choice (c) How about prepending the number of blocks; i.e., to apply CBC on (C|M)? Does a similar attack work on this construction as well? How would its performance compare to thel appending scheme of part (b)? 3. In this exercise, you will prove that the CBC-MAC in its plain form is not secure to authenticate variable-length messages (a) Consider the CBC-MAC scheme with an n-bit block cipher where the CBC checksum of a message is calculated with a zero IV. Describe an attack where an attacker Eve can construct the MAC of a message different from those she obtained from the legitimate sender. (Hint Let the attacker obtain the MAC of two n-bit messages and from them compute the MAC of a 2n-bit message.) (b) An attempt to solve this problem could be to append the number of blocks in the message as a final block to the message: i.e., to apply CBC on (M2) instead of M alone, where denotes the number of blocks in M. Show that this construction is not secure either. (Hint: Let the attacker obtain the MAC of some more messages of his choice (c) How about prepending the number of blocks; i.e., to apply CBC on (C|M)? Does a similar attack work on this construction as well? How would its performance compare to thel appending scheme of part (b)