Single-pass authentication with a block cipher that accepts a counter Suppose we have a tweakable block cipher ($E(K, T, X)$ and $D(K, T, X)$) that is used in a scheme where the tweak, either in whole or in part, is used as a counter to make each block encrypt to a distinct ciphertext. If we XOR all of the blocks together and then encrypt the result, do we have a secure tag?
It is not secure if you use the $E(K, T, X)$ values as the exposed ciphertext; it is secure if you're using this scheme as a MAC (and use an independent scheme to encrypt).

If you send the $C_i = E(K, T_i, X_i)$ as the ciphertext (and send $E(K, 0, \bigoplus C_i)$ as the tag, then what the attacker could do is flip the same bit on two different $C_i$ values.  The resulting $\bigoplus C_i$ will remain the same, and so the tag would validate (and the decrypted plaintext would be incorrect).

On the other hand, if you keep all the $C_i$ values internal, then this system can be viewed as a Carter-Wegman MAC.  All you need to show is that $\bigoplus C_i$ is an almost universal hash function (which is fairly easy to do, assuming you get the message padding right), and the standard CW proofs apply.