Why CBC-MAC encrypts at each step Considering CBC-MAC as:

$\qquad H_0 = IV = 0$

$\qquad H_i = E_k(P_i \oplus H_{i-1})$

$\qquad MAC = H_n$

What are the properties that makes this "safer" (less exposed to failure) than just:

$\qquad H_0 = IV = 0$

$\qquad H_i = P_i \oplus H_{i-1}$

$\qquad MAC = E_k(H_n)$

Please use simple terms (a didactic explanation for non cryptographers is appreciated)
What are the properties that makes this "safer" (less exposed to failure) than just: [simple construction]


Well, there's an easy attack on the simple construction: Pick any message block $P$ and construct a message $M=P\|P$ (so $P$ twice). Now compute the MAC-tag of that message: $\text{MAC}=E_k(\text{IV}\oplus P\oplus P)$ which is just $E_k(\text{IV})$ because $x\oplus x=0$. Now pick any different message $P'$ and $M'=P'\|P'$ and compute the tag for that message: $\text{MAC}'=E_k(\text{IV}\oplus P'\oplus P')$ which again is $E_k(\text{IV})$. So both messages have the same tag. As soon as you see the tag for any of them, you can make somebody accept the other one as well. This is a property that we don't want from MACs.

If it helps your imagination: $P=0^n$ and $P'=1^n$, i.e. they are the message of all-zeroes and all-ones.