I have a primitive that is able to generate a AES-128-CMAC from a message.
$\operatorname{CMAC}(\text{MessageAddress}, \text{MessageLength}) \rightarrow \text{result}$
I cannot change this primitive. I don't have direct access to the key, nor to the internals of that function.
Let's say that I want to authenticate a message that is split over non-contiguous chunks. How is it possible to chain calls to this primitive while not opening a breach to an attack?
For example, if $M = M_1 || M_2 || \ldots || M_n$, compute
$\operatorname{CMAC}(\operatorname{CMAC}(M_1) || \operatorname{CMAC}(M_2) || \ldots || \operatorname{CMAC}(M_n))$
Of course, the result is completely different than $\operatorname{CMAC}(M)$ but that doesn't matter because both sides would implement the same algorithm for signing and verification.
However, is it still secure? Would it be better to use a XOR operation instead?
$\operatorname{CMAC}(\operatorname{CMAC}(M_1) \oplus \operatorname{CMAC}(M_2) \oplus \ldots \oplus \operatorname{CMAC}(M_n))$
Any other idea?