# Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?

• Note that CBC-MAC is not secure for dynamically sized input, you'd have to use CMAC for that (which actually uses CBC-MAC underneath). – Maarten Bodewes Apr 16 '16 at 9:18

More specifically, consider a chosen message attack scenario where an attacker had some $$(IV, M, T)$$ with $M = M_1M_2M_3$. If the $IV$ was not constant, the attacker could construct another tuple $$(IV', M', T')$$ with the property that:
$$IV' \oplus M_1' = IV \oplus M_1$$
Then, $M_2'$ and $M_3'$ could literally be anything at all and the tag would remain valid $(T = T')$.
If, however, the $IV$ was constant (which it should be in practice), the attacker could just keep $M_1$ the same, so $M' = M_1M_2'M_3'$, and the tag would still be valid.