Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?
In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".
But I can not imagine an attack based on an not-encrypted MAC. Can anyone give me an example of such an attack?
Let $M_k$ be CBC-MAC under the key $k$: for blocks $b_1, b_2, \dots, b_\ell$, $$M_k(b_1 \mathbin\| b_2 \mathbin\| \cdots \mathbin\| b_\ell) = E_k(\cdots E_k(E_k(b_1) \oplus b_2) \cdots \oplus b_\ell).$$
The message $m = m_1 \mathbin\| m_2$ collides with the message $m' = M_k(m_1) \oplus m_2$ under $M_k$, since
\begin{align} M_k(m_1) &= E_k(m_1), \\ M_k(m_1 \mathbin\| m_2) &= E_k(E_k(m_1) \oplus m_2), \\ M_k(M_k(m_1) \oplus m_2) &= M_k(E_k(m_1) \oplus m_2) = E_k(E_k(m_1) \oplus m_2). \end{align}
If the CCM ciphertext for $m_1$ revealed $M_k(m_1)$, then an adversary could use that and the CCM ciphertext for $m$ to forge the CCM ciphertext for $m'$ since the CTR encryption preserves $\oplus$. To thwart this, CCM encrypts the authentication tag too, with an additional block in the one-time pad generated by CTR.
