Why is ECBC-MAC with one key insecure? For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key is required, but that that appears to be the implication. I don't see why a different key is necessary for encrypting the last block. Double encryption with the block cipher $E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}}$ could be rewritten as $F_{1}(K, X) = E(K, X)$. Then, the entire MAC procedure can be reformulated as:


$m$ is the number of message blocks to be authenticated.
$M_{i} \in \{0, 1\}^{\ell_{X}}$ is the $i$th zero-based message block to be authenticated where $0 \leq i &lt; m$.
$t_{0} = F_{1}(K, M_{0})$.
For $0 &lt; i &lt; m - 1$, $t_{i} = F_{1}(K, t_{i - 1} \oplus M_{i})$.
The MAC, T, is calculated from $F_{2}(K, t_{m- 2} \oplus M_{m - 1})$.


With two calls to the block cipher, $F_{2}$ is a different function than $F_{1}$, the same way $E(K_{0}, X)$ is a different function of $X$ than $E(K_{1}, X)$.
Note that re-encrypting the output of CBC-MAC with the same key as it was calculated with is equivalent to appending a single all-zero cipher block to the message:
$$E_K(\text{CBC-MAC}_K(m)) = E_K(\text{CBC-MAC}_K(m) \oplus 0^b) = \text{CBC-MAC}_K(m \,\|\, 0^b),$$
where $0^b$ represents a $b$-bit block of all zero bits and $b$ is the block size of the cipher.

Thus, the classic attack on unmodified CBC-MAC with variable-length messages can be easily adapted to your scheme.  Specifically, let $$\begin{aligned} t\phantom{'} &amp;= E_K(\text{CBC-MAC}_K(m)), \\ t' &amp;= E_K(\text{CBC-MAC}_K(m')), \end{aligned}$$ and construct the message $m'' = m \,\|\, 0^b \,\|\, (t \oplus m')$, where $t \oplus m'$ represents $m'$ modified by XORing its first block with $t$.  Then $$E_K(\text{CBC-MAC}_K(m'')) = E_K(\text{CBC-MAC}_K(m')) = t'.$$