# MAC algorithm difficulties

Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES.

MAC algorithm consists of letting the MAC of message M (which consists of message blocks M1,M2,... ,Mn) be the AES encryption with key K of the XOR of all the message blocks.

i.e. MACK(M)=EK(M1 XOR M2 XOR ... XOR Mn)

It's trivial to calculate collisions because the message blocks M1..Mn can be interchanged without issue. So EK(M1 XOR M2) = EK(M1' XOR M2') where M1' = M2 and M2' = M1. Different messages should obviously not calculate to the same MAC authentication tag.

The problem is with XOR-ing the message blocks together to make a single compressed block. This reduces the message in a highly regular way, meaning it would be very easy to construct collisions. A length extension attack on this MAC design can consist of any data at all provided one of the blocks was the binary complement of the remainder - trivial to calculate.