keys are imperfect if partial information has leaked about them. One example of this is QKD-generated keys, where an eavesdropper can extract some information on the key, tightly restricted by security parameters of the system. In this paper, we study security of the WCA scheme in the scenario where the key is partially known to the adversary. We measure the adversary’s partial knowledge of the key as the trace distance between the distribution of the key and the uniform distribution, as is done in QKD. We should stress that our analysis is not just restricted to QKD. The same analysis applies *whenever* the authentication scheme under study is used with a key that has a small but non-zero trace distance to the uniform.

Related work, and contribution of this paper {#related-work-and-contribution-of-this-paper .unnumbered}
--------------------------------------------

The security of the WCA scheme as used in QKD was studied in [@CL] where the observation was made that, for the WCA scheme with partially known authentication key, an active attack is not always needed to weaken the system. The attacker can, in essence, wait for a beneficial moment and only launch an active (guessing) attack at that moment. The paper also proposes a countermeasure to 