MAC algorithm difficulties Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES.

MAC algorithm consists of letting the MAC of message M
(which consists of message blocks M1,M2,... ,Mn) be the AES encryption with key K of the XOR of all the message blocks.

i.e. MACK(M)=EK(M1 XOR M2 XOR ... XOR Mn)
It's trivial to calculate collisions because the message blocks M1..Mn can be interchanged without issue. So EK(M1 XOR M2) = EK(M1' XOR M2') where M1' = M2 and M2' = M1. Different messages should obviously not calculate to the same MAC authentication tag.