AES CBC MAC splicing attack

Question

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

AES_KEY_SIZE = 16
BLOCK_SIZE = AES.block_size


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("f1", type=str, help="f1")
    parser.add_argument("f2", type=str, help="f2")
    parser.add_argument("tag1", type=str, help="tag1")
    parser.add_argument("tag2", type=str, help="tag2")
    parser.add_argument("k", type=str, help="key")
    args = parser.parse_args()
    with open(args.tag2, "rb") as tag2:
        stored_tag = pickle.load(tag2)
    with open(args.k, mode="rb") as f:
        key = pickle.load(f)
    assert len(key) == AES_KEY_SIZE
    cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
    with open(args.f2, mode="rb") as f2:
        f2_block1 = f2.read(BLOCK_SIZE)
        b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
        with open(args.f1, mode="rb") as f1:
            file1 = f1.read()
        file2 = f2.read()
        the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
        new = open('newfile.file','w')
        s = file1 + b1 + the_rest_of_the_file
        new.write(s)


if __name__=="__main__":
    main()

Answer 1

Just for completeness sake, CBC is defined as follows:

The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.