distinguisher ${\mathcal{Z}}$ can distinguish between the two cases

*(a)* it is interacting with ${\mathcal{A}}$ and participants running the WCA scheme based on ${\varepsilon}$-ASU$_2$ hashing using ${\varepsilon}'$-perfect authentication key, or

*(b)* it is interacting with ${\mathcal{S}}$ and participants running ${\mathcal{F}}$

except with probability ${\varepsilon}+{\varepsilon}'$.

In the proof, the message given to Alice is denoted $X$ and its distribution is in control of the environment ${\mathcal{Z}}$. The authentication key $K$ is used to select $f_K$ that in turn is used to generate the tag. The key distribution is not in control of ${\mathcal{Z}}$, and has ${\varepsilon}'$ trace distance to the uniform. The corresponding output message-tag pair is denoted $Y$. The channel output is denoted $Y'$ and is again in control of ${\mathcal{Z}}$. The output of the real and ideal functionality is denoted ${\widetilde{X}}$ and ${\widehat{X}}$, respectively and take values in ${\mathcal{M}}\cup\{\bot\}$. Thus, the environment ${\mathcal{Z}}$ has access to the joint random variables $XYY'{\widetilde{X}}$ in the real case and $XYY'{\widehat{X}}$ in the ideal case. In both cases, ${\mathcal{Z}}$ is in control of $X$ and $Y'$. The random variable $Y$ has an identical distribution (conditioned on the value of $X$) in both cases, so distinguishing the two systems can only be done from the 