I was doing some self-initiated knowledge gathering about digests, signatures and hmacs and I ran across the fact that you can use CBC as a MAC, but if the message size is not fixed; then it is not secure.
In layman's terms why is this so? Lets say that Johnnyboy has sent a message to QueenElizabeth such that a being the MAC and m being message (m consists of three blocks). If an adversary saw the transmission, the data would look like $(a,m)$ in this particular instance.
The adversary would not know the key used in the CBC-MAC algorithm (it is still unknown), but it is known that the tag which is $a$, message $m$ and the number of blocks.
How could the adversary generate another valid MAC value $a'$ for $m'$ if $m'=m_1||m_2||m_3||m_1 \oplus a||m_2||m_3$ without knowing $K$? and how would fixed length solve this?
From what I understand, all you need to do is take $m_1 \oplus a \oplus a$ which would result in $x_1$ then concatenating the rest - $m_2 || m_3$ - would result in $a' == a$ because the last block would be the same as the output from $m_1.
Lastly, to prevent this attack, the application or system receiving the transmission should check for a specific sized message in order to prevent this existential attack, but I am also guessing this is only secure when message blocks == 1?