> This system uses CBC so changes to the ciphertext have predictable consequences for some of the plaintext including the MAC. Specifically they have predictab

> This system uses CBC so changes to the ciphertext have predictable consequences for some of the plaintext including the MAC. Specifically they have predictable consequences for the next block so if the MAC is at the end of the Nth block you can change the ciphertext of block N-1. You still have the problem that this changes both the plaintext and the MAC so the attack would still fail. Or so I thought until I read through https://gist.github.com/defuse/0822a9c6d70ab4939c95 https://gist.github.com/defuse/0822a9c6d70ab4939c95 to understand the attack. The MAC here fills at least a whole block allowing independent changes to the MAC and the plaintext.