CBC encryption + CBC MAC reusing key in MAC-then-Encrypt
Why is the comment needed that encrypted MAC part is constant?


With the scheme in the question, in a cryptogram with the correct MAC, the last block of the encrypted message is a constant. Importantly, that goes both ways: if the last block of the encrypted message is that constant, then the MAC is correct and whatever plaintext is deciphered will pass the MAC test.

This allows forgery: an adversary can observe one encrypted message, get that constant, and from then on forge encrypted messages that will pass the MAC check after decryption. That goes against the purpose of ensuring integrity of the (deciphered) message.

We combined a secure encryption, and a secure MAC (for constant message length), and got an insecure combination (w.r.t. the goal of the MAC) because we did not obey the principle: a key shall only serve one purpose (or: one usage, one key).



In the context, it gets worse than letting garbage pass the MAC check: CBC encryption is malleable enough that the adversaries can partially choose the deciphered plaintext. For example, with a long known plaintext, they can copy/paste large segments of ciphertext, cutting at block boundaries, and that does the same for deciphered plaintext, albeit with one block of garbage after each cut. Other example (that can combine): an adversary can put an arbitrary chosen value one block wide in the deciphered plaintext, by putting it in a ciphertext block followed by a copy of the last block $E_k(0)$.