MAC using a modified CBC mode of operation I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV).


  


Source: an old course on Network Security

Are there some obvious attacks I can't see?
This scheme is not worth the name MAC; it is horribly weak.

First and foremost, the tag/MAC is unchanged when two blocks of plaintext are exchanged (because of the commutativity and associativity of the $\oplus$ operation). If follows that from any message with at least two different blocks, we can make a different message for which we know the tag/MAC. This conclusively proves that this MAC is not secure, for any modern definition of security (which must include that a new message crafted by an adversary ignoring the key from other messages+MAC will pass verification with odds marginally above $2^{-n}$, where $n$ is the width of the MAC in bits).

Further, if we happen to know the tag/MAC of a message with two identical blocks, we can change these blocks to anything, and that will leave the MAC unchanged.

If the message length is allowed to vary, things get worse: the tag/MAC for the concatenation of messages is the XOR of the tag/MAC of the originals; and we can insert two identical blocks in a message leaving the tag/MAC unchanged.