As the paper explains, there is no "signing" involved (in the sense of a public-key cryptosystem). Each encrypted bitstream includes an HMAC, but because the H

As the paper explains, there is no "signing" involved (in the sense of a public-key cryptosystem). Each encrypted bitstream includes an HMAC, but because the HMAC key is part of the encrypted bitstream itself, it basically only acts like a non-cryptographic checksum. An attacker who knows the encryption key can simply choose an arbitrary HMAC key and generate a valid HMAC for arbitrary data. EDIT: I should clarify that this attack doesn't appear to actually let someone extract the AES encryption key. But they can use an FPGA that has the key programmed as a decryption oracle. And a weakness of CBC mode is that a decryption oracle can be used for encryption as well.