able to prove directly that the authenticated channel is indistinguishable from an (ideal) authentic channel (the desired functionality), except with probability less than ${\varepsilon}+{\varepsilon}'$. This proves that the scheme is (${\varepsilon}+{\varepsilon}'$)-UC-secure, without using the composability theorem.

    , Strongly Universal hash functions, Partially known key, Trace distance, Universal Composability, Quantum Key Distribution.
author:
- 'Aysajan Abidin and Jan-[Å]{}ke Larsson'
bibliography:
- 'wca.bib'
title: |
    Direct Proof of Security of Wegman-Carter\
    Authentication with Partially Known Key
---

Introduction {#sec:introduction}
============

Information-theoretically secure (ITS) message authentication codes [@WC1; @WC2] provide two users, Alice and Bob, with means to guarantee authenticity and integrity of messages exchanged over an insecure public channel. To achieve ITS (sometimes called unconditional security) the schemes used need shared secret between Alice and Bob. This procedure is secure against any adversary, even with unlimited computing and storage capability, provided that the key is perfectly secret. Such schemes normally have high demand for fresh secret key material, but even so they are used in some cryptographic schemes; especially in ITS key agreement schemes such as Quantum Key Distribution (QKD) [@BB84; @Ekert91]. QKD needs ITS authentication in order to thwart man-in-the-middle attacks [@BB84; @AL09; @Abidin; @PAL12].

This paper addresses security of an 