CBC-MAC forging textbook question

I found this question about CBC-MAC forging and want to make sure I understand it:

Let a and be be two strings of block length one. Suppose the sender sends (a, CBC-MAC(a)), (b, CBC-MAC(b)), (a||b, CBC-MAC(a||b)). Find new messages / MAC pair which the attack can now forge from the messages / MACs given above.

Since given: CBC-MAC(x) = t, CBC-MAC(y) = t', then CBC-MAC(x || y $\oplus$ t) = t'

Then I can forge the permutation combination of the given pairs with that formula? ie. If CBC-MAC(a) = x, CBC-MAC(b) = y, then CBC-MAC(a || b $\oplus$ x) = y

-
CBC-MAC(x || y $\oplus$ t) = t' is to be read as CBC-MAC(x ||(y $\oplus$ t)) = t' with t right-padded with enough zeros to match the length of y . –  fgrieu Nov 6 '13 at 14:11
which textbook is this from? I can't find this is any Cryptography textbook –  user9293 Nov 7 '13 at 21:10

Yes, your understanding is correct. With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages:

$(a||b \oplus MAC(a)), \\ (b||a \oplus MAC(b)), \\ (b||b \oplus MAC(b)),\\ (a||a \oplus MAC(a)),\\ (a||b||a \oplus MAC(a||b)), \\ (a||b||b \oplus MAC(a||b)), \\ (a||b \oplus MAC(a)||a \oplus MAC(b))\\ (a||b \oplus MAC(a)||b \oplus MAC(b))\\$

...And so on and so forth until you get tired of pwning CBC-MAC with forgeries (assuming the recipient accepts messages longer than the one-to-two blocks we know from the question).

-

protected by Community♦Nov 9 '13 at 2:46

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.