= Solution
For encrypt-and-authenticate, the transmitted pair is $(E_k(x),s)$ with $s=f(\mathit{sk},x)$. The recovery map is public, so any observer computes
$$
\boxed{x=g(\mathit{pk},s).}
$$
No symmetric key, <exhaustive key search> or oracle is needed. Publishing this message-recovery <digital signature> reveals the entire <plaintext> and breaks <cryptographic confidentiality> outright. A <digital signature> of a suitable digest would have different leakage properties, but the printed construction signs the raw block.
Back to article page
