LOWER BOUNDS FOR AUTHENTICATION CODES WITH SPLITTING

The role of non-deterministic authentication coding (coding with splitting) is discussed; a new substitution attack is put forward which is argued to be more relevant than usual substitution for codes with splitting. A reduction theorem is proved which allows to extend "abstract" bounds for impersonation (including the new JS-bound, which is shown to hold on the large class of "abstract" authentication codes) to the new substitution attack.