this that is simple to implement.

A more recent paper [@Portmann] extends the security of the WCA scheme to the Universally Composable (UC) framework, proving that the scheme is UC-secure if the authentication key is perfectly secret. In the same paper, the Composability Theorem [@Canetti] is used to further extend the result to the case with partially known key, but due to the complexity of the UC framework and the composability theorem, the existence of the guessing attack mentioned above, and ultimately the differences between questions of Confidentiality and Integrity, there has been some discussion as to the meaning and appropriate statement of this result [@OH12; @RR12; @HY12].

In this paper, we aim to resolve the issue by providing upper bounds for failure probability, both for the problem discussed in [@CL] and for witness indistinguishability as used in the UC framework. This is done for the case of partially known key using a direct proof, without using the Composability Theorem. We first show that, if the authentication procedure has a failure probability ${\varepsilon}$; the authentication key has an ${\varepsilon}'$ trace distance to the uniform; and the adversary has seen a valid message-tag pair, then the adversary’s success probability of breaking 