Message Authentication Code (MAC)

Consider the following MAC construction that uses AES. Given a message M, it is padded to so that its length in bits is a multiple of 128, and divided into blocks of 128 bits each: M1, M2, ..., Me. The MAC value under a key k is defined as MACk(M) = AESk(M1) o AESk(M2) 0 AESk(Me). Show that this MAC construction is insecure by giving a concrete attack. Consider the following MAC construction that uses AES. Given a message M, it is padded to so that its length in bits is a multiple of 128, and divided into blocks of 128 bits each: M1, M2, ..., Me. The MAC value under a key k is defined as MACk(M) = AESk(M1) o AESk(M2) 0 AESk(Me). Show that this MAC construction is insecure by giving a concrete attack