framework (to be discussed below), the relevant figure of merit is the trace distance to the uniform distribution, and not the guessing probability as given above. And also the trace distance increases by the same amount, in the beneficial case for Eve. The key is still random to Eve, but the distribution conditioned on her new knowledge that $h_K(m)=t$ has a larger trace distance to the uniform. A uniform distribution conditioned on $h_K(m)=t$ would be constant at $|{\mathcal{T}}|/|{\mathcal{K}}|$ (the set of still possible keys has the size $|{\mathcal{K}}|/|{\mathcal{T}}|$), but in our example, if both $f_{k_+}(m)=t$ and $f_{k_-}(m)=t$ for all $k_-\in{\mathcal{K}}_-$, $$\label{eq:3}
  \begin{split}
    P_K(k_+\,|\,h_K(m)=t)&=\frac{\Pr\{K=k_+\wedge
      h_K(m)=t\}}{P\{h_K(m)=t\}}
    =\frac{P_K(k_+)}{\Pr\{h_K(m)=t\}}\\
   &=\frac{\frac1{|{\mathcal{K}}|}+{\varepsilon}'}{\frac1{|{\mathcal{T}}|}}
    =\frac{|{\mathcal{T}}|}{|{\mathcal{K}}|}+|{\mathcal{T}}|{\varepsilon}'.
  \end{split}$$ This forces the conditional distribution of the key to have a high trace distance to the uniform. As before, the example gives the worst-case scenario, and an upper bound for this trace distance is given by the following theorem.

\[thm-WCA-cor\] *(Bound for trace distance with partially known key.)* Consider the WCA scheme based on ${\varepsilon}$-ASU$_2$ hashing. If the authentication key is ${\varepsilon}'$-perfect (as random variable $K$ to the adversary), and the adversary has access to a valid message-tag pair $(m,t)$, then the trace distance from the conditional probability to the uniform is 