Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key is required, but that that appears to be the implication. I don't see why a different key is necessary for encrypting the last block. Double encryption with the block cipher $E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}}$ could be rewritten as $F_{1}(K, X) = E(K, X)$. Then, the entire MAC procedure can be reformulated as:

• $m$ is the number of message blocks to be authenticated.
• $M_{i} \in \{0, 1\}^{\ell_{X}}$ is the $i$th zero-based message block to be authenticated where $0 \leq i < m$.
• $t_{0} = F_{1}(K, M_{0})$.
• For $0 < i < m - 1$, $t_{i} = F_{1}(K, t_{i - 1} \oplus M_{i})$.
• The MAC, T, is calculated from $F_{2}(K, t_{m- 2} \oplus M_{m - 1})$.

With two calls to the block cipher, $F_{2}$ is a different function than $F_{1}$, the same way $E(K_{0}, X)$ is a different function of $X$ than $E(K_{1}, X)$.

Note that re-encrypting the output of CBC-MAC with the same key as it was calculated with is equivalent to appending a single all-zero cipher block to the message: $$E_K(\text{CBC-MAC}_K(m)) = E_K(\text{CBC-MAC}_K(m) \oplus 0^b) = \text{CBC-MAC}_K(m \,\|\, 0^b),$$ where $0^b$ represents a $b$-bit block of all zero bits and $b$ is the block size of the cipher.
Thus, the classic attack on unmodified CBC-MAC with variable-length messages can be easily adapted to your scheme. Specifically, let \begin{aligned} t\phantom{'} &= E_K(\text{CBC-MAC}_K(m)), \\ t' &= E_K(\text{CBC-MAC}_K(m')), \end{aligned} and construct the message $m'' = m \,\|\, 0^b \,\|\, (t \oplus m')$, where $t \oplus m'$ represents $m'$ modified by XORing its first block with $t$. Then $$E_K(\text{CBC-MAC}_K(m'')) = E_K(\text{CBC-MAC}_K(m')) = t'.$$
• What is $m'$ and where does it come from? – Melab Mar 19 '18 at 1:23
• @Melab: $m$ and $m'$ are any two arbitrary messages whose MAC tags $t$ and $t'$ under your one-key-ECBC-MAC scheme are known to the attacker (and whose length, for simplicity, I assume to be a multiple of the block size). They can even be the same message, if that's what you want. – Ilmari Karonen Mar 19 '18 at 10:58