I found this question from a textbook but I don't really understand what it is asking:
Suppose $c$ is $1$ block long, $a$ and $b$ are strings that are a multiple of the block length, and $\text{CBC-MAC}(a||c) = \text{CBC-MAC}(b||c)$. An ideal block cipher is used in $\text{CBC-MAC}$.
Explain for which most general class of messages $d$, $\text{CBC-MAC}(a||d) = \text{CBC-MAC}(b||d)$.
I don't understand how can $CBC-MAC(a||c) = CBC-MAC(b||c)$ unless $a = b$?
CBC-MAC is calculated by iterating a block cipher in CBC mode over the blocks of the message, using a start value of 0 - i.e. $CBC{-}MAC(a)$ is actually $CBC{-}MAC(0,a)$.
Since the first part of the messages (i.e. $a$,$b$) in your example have sizes that are multiples of the block length, the $CBC{-}MAC$ of each of them creates a chaining value that can be used as the input to $CBC{-}MAC$ of the second part of the message ($c$,any $d$)
For your example:
$CBC{-}MAC(a||c)$
$= CBC{-}MAC(0, a||c)$
$= CBC{-}MAC(CBC{-}MAC(0, a), c)$
So $CBC{-}MAC(a||c) = CBC{-}MAC(b||c)$ when $a = b$, but more generally when $CBC{-}MAC(a) = CBC{-}MAC(b)$
When this is true, it's easy to see that $CBC{-}MAC(a||d) = CBC{-}MAC(b||d)$ for all $d$.
i.e. once a collision is found with $CBC{-}MAC$ for two messages $a,b$ whose lengths are multiples of the block size, then the $CBC-MAC$ of $a||d,b||d$ will also be equal for all $d$.
I'm not sure why the exercise focuses on this property (except to illustrate what's obvious from the CBC basis of the design).
