Consider a variant of CMAC that XORs the second key (K1) after encrypting the final block of the message. That is, VMACK(M) = CBCK(M) K1, assuming M requires no padding.

Lets say the adversary does a chosen plaintext attack to get the VMAC for three messages 0n , 1n , and 0n ; 1n. Break the security of VMAC by showing that the adversary can compute the VMAC of the message 0n ; VMAC(0n ) VMAC(1n ).