Is XCBC where k2 and k3 might be the identical, secure? XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding.

Lets say we derive all three keys so that key 2 and key 3 might be the identical (randomly). Is it secure?
If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair.

Here's how it works, if the message is not a multiple of 16, then XCBC pads the message out to the next multiple of 16; if it already is, the message remains the same.

Then, XCBC logically does a CBC mode encryption (using key 1); except that when it gets to the last block, it xor's in either K2 (if no padding was added) or K3 (if padding was added) before the final encryption.

Note that this padding operation is public; anyone can compute it.

What the attacker would do is request the MAC of a message M (which is not a multiple of 16); he gets a valid T.

Then, the pair (Pad(M), T) has a nonnegligible chance of being also valid; if K2==K3, then the message will be a multiple of 16, and so no padding is added; XCBC will xor in K2, but since K2==K3, that'll give the same result as the corresponding step during the query, and the final encryption will also be the same.