Definition (CBC-MAC). Given an n-bit blockcipher E, defined as E:{0,1}k{0,1}n{0,1}n and a fixed input message space MgSp={0,1}mn for a fixed block count m, CBC-MAC is defined as the sequential XOR of each n-bit block with the encrypted version of the previous block (defining the "zero'th" block as 0n ). Formally, the tag T is defined as T=E(MmE(Mm1E(Mm2E(E(M1))))) where Mi is the ithn-bit block of the plaintext M. (Refer to the module and/or the lecture notes for more details. This refresher is not meant to be comprehensive.) We know that if E is a secure PRF, CBC-MAC is UF-CMA secure for a fixed m. Now, consider a world in which we extend the domain to contain messages of arbitrary length (but multiples of n bits), where n is the underlying blockcipher's block length. 3.2.1 (15 points) Prove that the CBC-MAC we studied is not UF-CMA secure under the new conditions. 3.2.2 (15 points) Consider the following attempt to make it secure: MAC(K,M)=CBCMac(K,MMn) As before, x for a bitstring x means its bitwise length and yx means the x-bit encoding of an integer y (e.g. 54=0101 ). In other words, we append a block containing the length of the input message to the end of the message. Verification is defined in the same way. Prove that this variation is not UF-CMA secure