Question :
Suppose message (a) is one block long. Suppose that an attacker has received the MAC (t) for a using CBC-MAC under some random key unknown to the attacker.
Explain how to forge the MAC for a two-block message of your choice. What is the two-block message that you chose?
What is the tag that you chose? Why is your chosen tag a valid tag for your two-block message?
Tips on how to solve this problem from Cryptography Engineering.