is also known as the variational distance or the statistical distance between two probability distributions $P_X$ and $P_X'$, and is $$\label{eq:trace-distance}
  {\delta}(P_X,P_X') = \tfrac12\sum_{x\in{\mathcal{X}}}|P_X(x)-P_X'(x)|.$$

When we discuss security of a key in this paper, the following notion will be used.

\[def:key-security\] A key $k$ is called *perfect* if it is uniformly distributed from the adversary’s point of view; a key $k$ is called *${\varepsilon}$-perfect*, if its distribution has an ${\varepsilon}$ trace distance to the uniform.

The family of functions used to create the tags are defined as follows. Let ${\mathcal{M}}$ be the set of messages and ${\mathcal{T}}$ be the set of tags, both finite and ${\mathcal{T}}$ typically much smaller than ${\mathcal{M}}$. Also, let ${\mathcal{H}}$ be a set of functions from ${\mathcal{M}}$ to ${\mathcal{T}}$. The appropriate set of functions to use in ITS authentication is the following.

The set ${\mathcal{H}}$ is a *Strongly Universal$_2$ (SU$_2$) hash function family* if **(a)** for any $m_1\in{\mathcal{M}}$ and any $t_1\in{\mathcal{T}}$ there exist exactly $|{\mathcal{H}}|/|{\mathcal{T}}|$ hash functions $h\in{\mathcal{H}}$ such that $h(m_1)=t_1$, and **(b)** for any $m_2\in{\mathcal{M}}$ (distinct from $m_1$) and any $t_2\in{\mathcal{T}}$ (possibly equal to $t_1$), the fraction of those functions such that $h(m_2)=t_2$ is $1/|{\mathcal{T}}|$. If the fraction in (b) instead is at most ${\varepsilon}$, 