I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.

Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a pseudorandom permutation.) Show that basic CBC-MAC is not necessarily a secure MAC (even for fixed-length messages) when instantiated with $F$.

My idea was to construct the secure MAC $F'_k = m \| F_k(m)$, which would leak information on $F_k(m_1)$. However, that would double the size of the MAC with every step.

Is there another/better/working solution?

Why are PRFs required for the CBC-MAC domain extension?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.

Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a pseudorandom permutation.) Show that basic CBC-MAC is not necessarily a secure MAC (even for fixed-length messages) when instantiated with $F$.

My idea was to construct the secure MAC $F'_k = m \| F_k(m)$, which would leak information on $F_k(m_1)$. However, that would double the size of the MAC with every step.

Is there another/better/working solution?

Why are PRFs required for the CBC-MAC domain extension?

Edit: basic CBC-MAC refers to the following construction:

The book states that basic CBC-MAC is secure for fixed length messages when instantiated with a PRF.