I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it:
Let $P_1,P_2,\ldots P_n$ be the plaintext blocks, $C_1,C_2,\ldots C_n$ the CFB encrypted ciphertext blocks and consider the authentication tag is computed as:
$$ T = E_k(C_n) \oplus P_1 \oplus P_2 \ldots \oplus P_n$$
(this is basically appending an extra block of plaintext containing the XOR of all plaintext blocks and using this final encrypted block as an authentication tag).
Can anybody point me out what is the major mistake in this?