Consider the following message authentication code (MAC): The secret key is a uniformly at random chosen bitstring k {0,1}256 for a block cipher that operates on 256-bit blocks. We consider only messages m whose length is an integer multiple of 256. Let m=m1||||mr with mi{0,1}256. To generate an authentication tag, we proceed as follows, where Enck stands for encrypting with the block cipher and is the XOR-operation:

1. compute x1= Enck (m1)

2. compute x2 = Enck (m2 x1)

3. compute x3 = Enck (m3 x2)

r. compute xr = Enck (mr xr1)

r+1. output xr.

To verify a tag, the recipient reproduces the tag and checks for equality. Show that this MAC is insecure: It is possible to derive a valid authentication tag for a new message m from given (message,tag)-pairs?