CBC-MAC using predictable IV Imagine you have a string of plaintext (a), IV (ai) and the MAC (am) for the plaintext (a).

How can you generate a MAC (bm) for a different string of plaintext (b) - using an IV (ib) of your choice, using the same key - which you don't know and can't retrieve.

You can also assume both plaintexts are the same length.


  Edit: I have found this question which I think provides a clue: CBC-MAC insecure with random IV
  
  But I'm not sure if I understand correctly. You can also assume your
  plaintexts are one-block plaintexts.


This should prove that cbc-mac with random IV is insecure.

Thank you.
You're saying we're looking at messages of length one block and a variant of CBC-MAC that uses a random IV. (I'm assuming we're looking at CBC-MAC for fixed length messages, i.e. we can ignore padding issues.) Then we have
$$am:=(ai,E(k,a\oplus ai))$$
To forge a MAC for message $b$ we can reuse the second part of the tag if we choose $bi$ such that $$b \oplus bi = a \oplus ai$$$$ \implies bi = a\oplus ai \oplus b$$

I.e., given $a$ and $am=(ai,t)$ simply output $bm=(a\oplus ai \oplus b,t)$.