Rating: 5.0
* Send 255 blocks $-1, -2, ..., -255$ to make all ciphertext blocks
equal to $E(iv)$.
* Receive $T = E(iv) (1+H)^{255}$.
* For each of the 16 possible values of $E(iv)$, compute $h = T \cdot
E(iv)^{-1}$ and test if $h^{(2^{128}-1)/255} = 1$.
* Assuming no false positives, only one value will pass the test --
output it and proceed to the next round.
* If we have multiple positives, just guess and hope we are lucky
to speed things up a bit.
