. . "To learn more about this sort of attack, see my answer do not use encryption without message authentication, where I detail many examples of systems that were broken because they used encryption without authentication." . .