Forge CBC-MAC given the MAC of two messages and of their concatenation I found this question about CBC-MAC forging and want to make sure I understand it:


  Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-MAC}(b)), (a||b, \text{CBC-MAC}(a||b))$. Find new messages / MAC pair which the attack can now forge from the messages / MACs given above.


I have:
$\text{CBC-MAC}(x) = t$ and
$\text{CBC-MAC}(y) = t'$,
then $\text{CBC-MAC}(x || y \oplus t) = t'$.
Then can I forge the permutation combination of the given pairs with that formula?
i.e. if $\text{CBC-MAC}(a) = x$ and $\text{CBC-MAC}(b) = y$, then $\text{CBC-MAC}(a || b \oplus x) = y$.
Yes, your understanding is correct.  With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages:

$(a||b \oplus MAC(a)), \\
(b||a \oplus MAC(b)), \\
(b||b \oplus MAC(b)),\\
(a||a \oplus MAC(a)),\\
(a||b||a \oplus MAC(a||b)), \\
(a||b||b \oplus MAC(a||b)), \\
(a||b \oplus MAC(a)||a \oplus MAC(b))\\
(a||b \oplus MAC(a)||b \oplus MAC(b))\\$

...And so on and so forth until you get tired of pwning CBC-MAC with forgeries (assuming the recipient accepts messages longer than the one-to-two blocks we know from the question).