# Why does the authenticated cipher CCM encrypt the MAC too?

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?

In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".

But I can not imagine an attack based on an not-encrypted MAC. Can anyone give me an example of such an attack?

Let $$M_k$$ be CBC-MAC under the key $$k$$: for blocks $$b_1, b_2, \dots, b_\ell$$, $$M_k(b_1 \mathbin\| b_2 \mathbin\| \cdots \mathbin\| b_\ell) = E_k(\cdots E_k(E_k(b_1) \oplus b_2) \cdots \oplus b_\ell).$$
The message $$m = m_1 \mathbin\| m_2$$ collides with the message $$m' = M_k(m_1) \oplus m_2$$ under $$M_k$$, since
\begin{align} M_k(m_1) &= E_k(m_1), \\ M_k(m_1 \mathbin\| m_2) &= E_k(E_k(m_1) \oplus m_2), \\ M_k(M_k(m_1) \oplus m_2) &= M_k(E_k(m_1) \oplus m_2) = E_k(E_k(m_1) \oplus m_2). \end{align}
If the CCM ciphertext for $$m_1$$ revealed $$M_k(m_1)$$, then an adversary could use that and the CCM ciphertext for $$m$$ to forge the CCM ciphertext for $$m'$$ since the CTR encryption preserves $$\oplus$$. To thwart this, CCM encrypts the authentication tag too, with an additional block in the one-time pad generated by CTR.