Consider the following proposal for a hash scheme. USE RSA with a known key to encrypt the first block, XOR the result with the second block and encrypt again, etc. Show that this scheme is not secure by solving the following problem. Assume the attacker has a way to decrypt RSA.

Given a two-block message M1 | M2, and its hash: RSAH(M1|M2) = RSA(RSA(M1) XOR M2) Given an arbitrary block C1, please find C2 so that RSAH(C1,C2) = RSAH(M1,M2)