I know that you're a Google U alumni, but can you give me an example of a modern symmetric cipher that is susceptible to a chosen ciphertext attack?