Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size.
Encryption using CTR mode:
\begin{align}
C_0 &amp;= P_0 \oplus E_k(nonce\mathbin\|0) \\
C_1 &amp;= P_1 \oplus E_k(nonce\mathbin\|1) \\
\vdots &amp;  \quad\quad\vdots\\
C_{n-1} &amp;= P_{n-1} \oplus E_k(nonce\mathbin\|(n-1))
\end{align}
Why is the following MAC tag not secure: $T = (P_0 \oplus P_1 \oplus \cdots P_{n-1}) \oplus E_k(nonce\mathbin\||n)$ ?
Bit flipping
Flip the bit in the position $x$ on ciphertext block $C_i$ then on the block $C_j$ where $i \neq j$ and similarly for the plaintext $P_i$ and $P_j$. The the new MAC result
$$T = (P_0 \oplus P_1 \oplus \cdots \oplus \bar{P_i} \oplus \cdots \oplus \bar{P_j} \oplus \cdots \oplus P_{n-1}) \oplus E_k(nonce||n)$$ will be the same for the plaintext $Q = (P_0\mathbin\| P_1 \mathbin| \cdots \mathbin\|\bar{P_i}\mathbin\|\cdots \mathbin\|\bar{P_j}\mathbin\|\cdots \mathbin\|P_{n-1})$
Now, send $(Q,T)$ as the message and the tag to the target and they will accept it as a valid tag. This flipping is not related to a single position. The attacker can choose more than one position as longs as the resulting x-or is the same.
Details
Flip is $\bar{x} := x \oplus 1 $ then
\begin{align}
\bar{C_i} &amp;= \bar{P_i} \oplus E_k(nonce\mathbin\|i-1)\\
C_i \oplus 1 &amp;= P_i \oplus 1 \oplus E_k(nonce\mathbin\|i-1)\\
C_i  &amp;= P_i \oplus E_k(nonce\mathbin\||1)\\
\end{align}
So $\bar{C_i}$ and $\bar{P_i}$ work as an attack on the ciphertext. The tag calculates on the messages, therefore one-bit change will be not enough. We need to modify even pairs exactly at the same positions.