was modified on the channel, the symbol $\bot$ is delivered, see Fig. \[fig:functionality\]. In other words, messages received from ${\mathcal{F}}$ are either authentic or blocked, and so *cannot* be successfully modified or substituted. Note that there is no confidentiality requirement, so the message can be read by anyone. The real implementation of authentication in the WCA scheme has three components, as depicted in Fig. \[fig:functionality\]: a tag generation algorithm TAG, a verification algorithm VRFY, and a key source. Both TAG and VRFY use the same key. From an input message $m$, Alice uses TAG to compute a message-tag pair $(m,t)$ where $t=f_k(m)$ and $f_k$ is a hash function from an ${\varepsilon}$-ASU$_2$ family identified by $k$. Bob uses VRFY to verify a received message-tag pair $(m',t')$, and VRFY outputs $m'$ if $f_k(m')=t'$ (for example if $m'=m$ and $t'=t$), otherwise $\bot$.

The distinguisher (in UC terminology, the *environment*) ${\mathcal{Z}}$ should not be able to distinguish the two systems, except with low probability. It can attempt to distinguish the two by controlling the input to the system (the message $m$), and the output from the channel $(m',t')$. The systems should be indistinguishable even under the presence of an *adversary* ${\mathcal{A}}$, and it is 