increases if she sees a valid message-tag pair $(m,t=f_K(m))$. Eve’s gain will now depend on $m$, and her gain is maximal if both $f_{k_+}(m)=t$ and $f_{k_-}(m)=t$ for all $k_-\in{\mathcal{K}}_-$, so that $$\Pr\big\{f_{K}(m) =t\big\}
  =\frac{|{\mathcal{K}}|}{|{\mathcal{T}}|}\frac1{|{\mathcal{K}}|}+{\varepsilon}'
  -|{\mathcal{K}}_-|{\varepsilon}'\frac1{|{\mathcal{K}}_-|}
  =\frac1{|{\mathcal{T}}|}.$$ If ${\varepsilon}'$ is small, there will exist such messages $m$. Since the hash function family is SU$_2$, $|\{k:f_k(m_{\text E})=t_{\text E}\wedge{}f_k(m)=t\}|=|{\mathcal{K}}|/|{\mathcal{T}}|^2$, and again this set contains $k_+$ but excludes ${\mathcal{K}}_-$. Therefore $$\begin{split}
    \Pr\big\{f_{K}(m_{\text E})=t_{\text E}\,\big|\, f_{K}(m)=t\big\}
      &=\frac{\Pr\big\{f_{K}(m_{\text E})=t_{\text E}\wedge f_{K}(m)=t\big\}}
      {\Pr\big\{f_{K}(m)=t\big\}}\\
      &=\frac{\frac{|{\mathcal{K}}|}{|{\mathcal{T}}|^2}\frac1{|{\mathcal{K}}|}+{\varepsilon}'}{\frac1{|{\mathcal{T}}|}}
      =\frac{\frac1{|{\mathcal{T}}|^2}+{\varepsilon}'}{\frac1{|{\mathcal{T}}|}}
      =\frac1{|{\mathcal{T}}|}+|{\mathcal{T}}|{\varepsilon}'.
  \end{split}
  \label{eq:1}$$ Note that this is an equation, not an inequality. Before seeing $(m,t)$ Eve’s probability of a successful message insertion attack equals $1/|{\mathcal{T}}|+{\varepsilon}'$. After seeing $(m,t)$, Eve’s probability of a successful substitution attack *equals* $1/|{\mathcal{T}}|+|{\mathcal{T}}|{\varepsilon}'$.

This might be taken as cause for alarm, but one should note that this is message-dependent: not all message-tag pairs $(m,t)$ will cause such an increase. It was pointed out already in [@CL] that the message and used key value may be such that Eve may have this unexpectedly high probability of success. On the other hand, in some situations (here, when $f_{k_+}(m)\neq t$), Eve will instead find out that her most likely key value was, in fact, not used, and that she must remove 