Attacks on a MAC that do not require the discovery of the key are possible. Consider the following MAC algorithm. Let M=(X1||||Xm) be a message that is treated as a concatenation of 64-bit blocks X1 ... Xm

Then define:

D(M)=X1 xor || || xor Xm

C(k,M)=Ek[D(M)]

Where the encryption algorithm is DES in ECB mode. Thus the key length is 56 and the MAC length is 64 bits. How would an attacker breach the system without knowing the encryption key?