Because the auth tag is not encrypted, given two ciphertexts, we can recover `H`. Then, CTR bit-flipping and compute the auth tag ourselves.

Original writeup (https://www.nevivur.net/writeups/2019/02/nullcon-hackim-2019/#genuinecountermode).