# First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.

i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why? (not for encryption/confidentiality, and just for authentication)

i.e. tag $t$ = $F(m_x \oplus ... F(m_4 \oplus F(m_3 \oplus F(m_1 \oplus m_2)))...)$

Thank you.

Suppose with this scheme, you have the MAC for the message $[m_1, m_2, m_3]$. Could someone without the key compute the MAC for the message $[m_2, m_1, m_3]$?
• Thank you for your reply. I have one more question. Then, if a system allows reordering, (for example, if $m_1$ is a header), then the MAC is still insecure? – takita Apr 17 '18 at 20:37
• How about $[m_1 \oplus 1, m_2 \oplus 1, m_3]$. Now, if $m_1$ is fixed, it works, but if it's fixed, why include it in the MAC? – poncho Apr 17 '18 at 20:56