# Using AES to create a secured MAC

Considering public message M and private key K, would it be safe to create the MAC tag this way:

$$MAC(M,K) = AES(m_1) \oplus AES(m_2) \oplus \cdots \oplus AES(m_n)$$

when $$m_1,m_2,\ldots,m_n$$ are n blocks of fixed size (let's say 128).

I can't prove that it's secured although my intuition says it is.

• Welcome to Cryptography. What is the definition of MAC for you? What is the definition of MAC forgery? Since this is HW you are going to get some hints if you show your effort. Commented Dec 4, 2020 at 12:26
• Hint: Does XOR have some commonly known properties that could help you here? Commented Dec 4, 2020 at 12:37
• @SEJPM an implicitly saying that there are at least $n!-1$ forgeries is better :) Commented Dec 4, 2020 at 12:44
• @kelaka you can do even better than that; you can generate a forgery for an infinite number of messages (assuming $n$ is not fixed), without seeing any valid message/tag pairs; for example, what's the MAC tag of "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" (32 'A';s) Commented Dec 4, 2020 at 18:28
• If I understand correctly if m1=m2=m3... then the result XOR will be 0, therefore this tag can be used for all of the messages with equal blocks. Is that right? Commented Dec 5, 2020 at 12:14