And if you are a dishonest cryptographer, you only need to find one attack to pull this off.