# MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV).

Source: an old course on Network Security

Are there some obvious attacks I can't see?

-
Hint: what happens to the tag when two blocks of plaintext are exchanged? –  fgrieu Jul 22 '14 at 16:03
Thanks for the hint. Pretty simple then ;). –  user16511 Jul 22 '14 at 16:21
@fgrieu: why don't you convert your comment into an answer? That way, it can be upvoted and accepted. –  poncho Jul 22 '14 at 17:18
What have you tried? What are your thoughts? What kinds of attacks have you considered? Have you tried to see if you could prove it secure? Have you looked at the special case where there are exactly 2 plaintext blocks? I don't think copy-pasting an exercise from an earlier course is a great fit for this site. We want to help clear up any confusions you might have, but as for doing an exercise problem for you -- well, maybe not so much. I don't think it benefits the world for us to be a site where people can paste exercises and have someone else produce a complete solution for them. –  D.W. Jul 22 '14 at 21:27

First and foremost, the tag/MAC is unchanged when two blocks of plaintext are exchanged (because of the commutativity and associativity of the $\oplus$ operation). If follows that from any message with at least two different blocks, we can make a different message for which we know the tag/MAC. This conclusively proves that this MAC is not secure, for any modern definition of security (which must include that a new message crafted by an adversary ignoring the key from other messages+MAC will pass verification with odds marginally above $2^{-n}$, where $n$ is the width of the MAC in bits).