it from the set of possible key values. In this case, the information she had becomes unusable; she will have lost information. But, importantly, Eve can find out if there was a gain or not, before performing an active (guessing) attack, by using her distribution of $K$ and the received message-tag pair from Alice. Eve then only performs an active attack if her success probability has increased (sufficiently, see [@CL]). From Alice’s point of view, the probability of having her message-tag pair *and* a successful attack from Eve is $1/|{\mathcal{T}}|+{\varepsilon}'$, but this probability is *per round*, not per guess (by Eve). Eve does not need to reveal herself by guessing frequently; she can wait for the beneficial case where her success probability is high [@CL].

Therefore, there is a clear need for an upper bound for the success probability in this situation. For general ${\varepsilon}$-ASU$_2$-based authentication, the following theorem holds.

\[thm-WCA\] *(Bound for guessing probability with partially known key.)* Consider the WCA scheme based on ${\varepsilon}$-ASU$_2$ hashing. If the authentication key is ${\varepsilon}'$-perfect (as random variable $K$ to the adversary), the probability of a successful message insertion is bounded by $$\Pr\big\{f_K(m_{\text E})=t_{\text E}\big\}\le\frac1{|{\mathcal{T}}|}+{\varepsilon}'.$$ If in addition the adversary has access 