Let (E,D) be a CPA-secure cipher defined over (K,M,C) and let H : M --> T be a collision-resistant hash function. Show that the following cipher is not AE-secure:

E1(k,m) = ( E(k,m) , H(m) ) = ( c1 , c2 )

D1( k , (c1,c2) ) = D(k,c1) , if H( D(k,c1 ) ) = c2

(reject), otherwise