Suppose that Alice and Bob use the Encrypt$-$then$-$MAC $($EtM$)$ scheme in their communication. Specifically,

they adopt the Advanced Encryption Standard $($AES$)$ with the counter $($CTR$)$ mode to encrypt their data

using key $K_1.$ Additionally, they employ the AES with cipher block chaining $(CBC)$ mode to compute the

MAC using key $K_2.$ Suppose Alice has two blocks of plaintext, $P_1$ and $P_2.$ According to the cryptosystem

discussed, Alice sends the IV$,$ the ciphertext $C_1$ and $C_2,$ and the MAC to Bob. What should Bob do to verify

the integrity of the data?

He must encrypt the ciphertext blocks using AES$-$CTR$,$ received IV$,$ and $K_1.$ If the final ciphertext block

obtained is equal to the received MAC, he can trust the integrity of the plaintext.

He must first decrypt the ciphertext using AES$-$CTR$,$ received IV$,$ and $K_1$ to obtain the putative plaintext.

Then, he must re$-$encrypt this plaintext using AES$-CBC,$ received IV$,$ and $K_2$ to obtain the MAC. If the

obtained MAC is equal to the received MAC, he can trust the integrity of the plaintext.

He must first decrypt the ciphertext using AES$-$CTR$,$ received IV$,$ and $K_1$ to obtain the putative plaintext.

Then, he must re$-$encrypt this plaintext using AES$-$CTR$,$ received IV$,$ and $K_1$ to obtain the MAC. If the

obtained MAC is equal to the received MAC, he can trust the integrity of the plaintext.

He must encrypt the ciphertext blocks using AES$-$CBC$,$ received IV$,$ and $K_2.$ If the final ciphertext block

obtained is equal to the received MAC, he can trust the integrity of the plaintext.

Bob cannot verify the integrity of the data due to the mixed block cipher modes used.