Suppose message (a) is one block long. Suppose that an attacker has received the MAC (t) for a using CBC-MAC under some random key unknown to the attacker. Explain how to forge the MAC for a two-block message of your choice. What is the two-block message that you chose? What is the tag that you chose? Why is your chosen tag a valid tag for your two-block message?

Tips on how to solve this problem from Cryptography Engineering.