Perfect Message Authentication Codes

• Perfect MACs are information-theoretic authentication schemes that achieve exact forging probability bounds even against unbounded adversaries.
• They employ precise combinatorial designs and non-deterministic encodings to guarantee both optimal spoofing resistance and perfect secrecy.
• Extensions to quantum, channel-based, and keyless models illustrate diverse practical implementations and theoretical advances.

Searching arXiv for recent and foundational work on perfect message authentication codes and closely related information-theoretic authentication. A perfect message authentication code is an information-theoretic authentication mechanism whose security is specified against even unbounded adversaries, but the exact meaning of “perfect” depends on the model. In the one-time MAC literature, it refers to the strong single-query authentication setting with explicit bounds on forgery probability under uniform or non-uniform keys (Ryabko, 13 Aug 2025). In the splitting-model literature, perfect secrecy and optimal spoofing resistance are studied simultaneously through non-deterministic encodings and combinatorial designs (Huber, 2011). Closely related work shows that group-generated splitting authentication codes have perfect secrecy, that algebraic manipulation detection codes arise as a special case, and that quantum or channel-based models can realize different notions of perfect authentication under additional resources or assumptions (Paterson et al., 2021, Nikolopoulos et al., 2020, Ostrev, 2018).

1. Formal models and security criteria

In the one-time MAC setting, a scheme is a pair of algorithms

$$S:\;K\times M\to T,\qquad V:\;K\times M\times T\to\{\mathit{accept},\mathit{reject}\},$$

with correctness

$V(k,m,S(k,m))=\mathit{accept}$

with probability $1$ for every $k\in K$ and $m\in M$. The forgery game samples $k$ from a key distribution, gives the adversary a tag $t_0=S(k,a)$ on a chosen message $a$, and asks for a forgery $(b,t_1)$ with $b\ne a$; the adversary’s advantage is

$V(k,m,S(k,m))=\mathit{accept}$0

The same source defines a perfect MAC as an information-theoretically strong one-time MAC and derives the standard single-query forging bound under uniform keys (Ryabko, 13 Aug 2025).

In splitting authentication codes, the source set is $V(k,m,S(k,m))=\mathit{accept}$1, the message set is $V(k,m,S(k,m))=\mathit{accept}$2, and the encoding-rule set is $V(k,m,S(k,m))=\mathit{accept}$3. Encoding is non-deterministic: $V(k,m,S(k,m))=\mathit{accept}$4 and for each $V(k,m,S(k,m))=\mathit{accept}$5 and $V(k,m,S(k,m))=\mathit{accept}$6,

$V(k,m,S(k,m))=\mathit{accept}$7

The code is $V(k,m,S(k,m))=\mathit{accept}$8-splitting if $V(k,m,S(k,m))=\mathit{accept}$9 for every $1$0 and every $1$1. Perfect secrecy in the Shannon sense is

$1$2

for every $1$3 and every $1$4. Spoofing attacks of order $1$5 observe $1$6 distinct authentic messages under the same key and then insert a new message; the deception probability is $1$7 (Huber, 2011).

The splitting-model notion of perfect authentication is parameterized by spoofing order. For $1$8,

$1$9

and the code is called $k\in K$0-fold secure against spoofing if equality holds for all $k\in K$1. A $k\in K$2-fold secure $k\in K$3-splitting code must satisfy

$k\in K$4

with equality defining optimality (Huber, 2011).

2. One-time perfect MACs under uniform keys

For uniform keys $k\in K$5, the 2025 robustness analysis considers the event

$k\in K$6

for a fixed forgery attempt $k\in K$7. Under the requirement that the scheme be perfectly secure, there are exactly $k\in K$8 keys mapping a fixed message $k\in K$9 to any single tag value, so

$m\in M$0

It follows that

$m\in M$1

This is the explicit one-time forging bound stated for the uniform-key case (Ryabko, 13 Aug 2025).

That formulation is narrower than the splitting-model literature, because it concerns a single chosen-message query and a single forgery on a different message. It is also narrower than later quantum constructions that claim zero forgery probability under a different resource model. A plausible implication is that “perfect” is not a single invariant definition across authentication theory, but a label attached to model-specific information-theoretic guarantees.

The same source emphasizes that this one-time analysis allows possibly randomized tag generation and unbounded adversaries. The structure is therefore information-theoretic at the level of the authentication game itself, rather than computational or asymptotic (Ryabko, 13 Aug 2025).

3. Robustness to non-uniform key distributions

A central refinement is the effect of biased keys. Let $m\in M$2 be the real key distribution and $m\in M$3 the uniform distribution on $m\in M$4, with statistical distance

$m\in M$5

For a forgery $m\in M$6, define

$m\in M$7

Using a subset-sum bound, the success probability under $m\in M$8 satisfies

$m\in M$9

Because $k$0 in the uniform ideal case, one obtains the general bound

$k$1

The paper states that the worst-case increase in forgery probability is exactly $k$2, and summarizes the conclusion as robustness of perfect MACs to small deviations from a uniform key distribution (Ryabko, 13 Aug 2025).

The same source gives two numerical examples. If $k$3 and $k$4, then

$k$5

if instead $k$6, then

$k$7

These examples make the dependence on key quality explicit: once $k$8, the key-distribution defect dominates the ideal forging term (Ryabko, 13 Aug 2025).

The practical recommendations in the same work are correspondingly direct: ensure $k$9, apply extractors or “whitening” to reduce bias, periodically test key material for statistical bias, and choose tag length $t_0=S(k,a)$0 so that plausible $t_0=S(k,a)$1 remains tiny relative to $t_0=S(k,a)$2 (Ryabko, 13 Aug 2025).

4. Splitting authentication codes, perfect secrecy, and design theory

In the splitting model, authentication and secrecy are treated jointly. A $t_0=S(k,a)$3-$t_0=S(k,a)$4 splitting design is a pair $t_0=S(k,a)$5 with $t_0=S(k,a)$6 points and $t_0=S(k,a)$7 blocks, where each block is partitioned into $t_0=S(k,a)$8 disjoint subblocks of size $t_0=S(k,a)$9, and every $a$0-subset of points lies in exactly $a$1 blocks with the points occupying distinct subblocks. The basic counting relations include

$a$2

together with divisibility conditions

$a$3

for each $a$4, and a Fisher-type bound $a$5 for $a$6 (Huber, 2011).

The key equivalence is that there exists an optimal $a$7-splitting authentication code for $a$8 equiprobable source states, $a$9 messages, and

$(b,t_1)$0

encoding rules, $(b,t_1)$1-fold secure, if and only if there exists a $(b,t_1)$2-$(b,t_1)$3 splitting design. This result turns optimal information-theoretic authentication into a design-existence problem (Huber, 2011).

For perfect secrecy, the 2011 construction uses cyclic $(b,t_1)$4-$(b,t_1)$5 splitting designs with no short orbit. In that setting, the induced $(b,t_1)$6 encoding matrix is balanced in each column, and each message occurs equally often in each column. If each of the $(b,t_1)$7 keys is used with probability $(b,t_1)$8, then Shannon’s condition

$(b,t_1)$9

follows immediately. The construction therefore yields optimal $b\ne a$0-splitting authentication codes with perfect secrecy in the general case where the number of keys may differ from the number of messages, extending earlier work that covered only the special case $b\ne a$1 via external difference families (Huber, 2011).

The same paper gives concrete examples, including a $b\ne a$2-$b\ne a$3 cyclic splitting design generated by the base blocks $b\ne a$4 and $b\ne a$5, which yields an optimal one-fold secure $b\ne a$6-splitting authentication code with $b\ne a$7 messages and $b\ne a$8 keys. More generally, for $b\ne a$9 and $V(k,m,S(k,m))=\mathit{accept}$00, it constructs a cyclic $V(k,m,S(k,m))=\mathit{accept}$01-$V(k,m,S(k,m))=\mathit{accept}$02 splitting design, hence $V(k,m,S(k,m))=\mathit{accept}$03 keys (Huber, 2011).

5. Group-generated constructions, equitable ordering, and AMD codes

A broader design-theoretic framework is given by group-generated splitting authentication codes. A splitting set system $V(k,m,S(k,m))=\mathit{accept}$04 is group-generated if there is an abelian subgroup $V(k,m,S(k,m))=\mathit{accept}$05 whose action on $V(k,m,S(k,m))=\mathit{accept}$06 is regular. For such systems, the corresponding splitting A-code has perfect secrecy and optimal impersonation probability. If it is $V(k,m,S(k,m))=\mathit{accept}$07-splitting, it also meets the standard lower bound on substitution success; if it is generated from an AMD code, then its substitution probability equals the AMD parameter (Paterson et al., 2021).

This perfect-secrecy result is explained by regularity: each $V(k,m,S(k,m))=\mathit{accept}$08 occurs equally often in each part $V(k,m,S(k,m))=\mathit{accept}$09, hence

$V(k,m,S(k,m))=\mathit{accept}$10

for all $V(k,m,S(k,m))=\mathit{accept}$11. The same paper introduces equitably ordered splitting BIBDs. A $V(k,m,S(k,m))=\mathit{accept}$12-splitting BIBD is equitably ordered if every point occurs exactly $V(k,m,S(k,m))=\mathit{accept}$13 times in each part, where

$V(k,m,S(k,m))=\mathit{accept}$14

Such equitable ordering immediately yields perfect secrecy, because for each message-tag pair the number of keys mapping the source to the tag is independent of the source index (Paterson et al., 2021).

The existence theory is unusually explicit. For example, an equitably ordered $V(k,m,S(k,m))=\mathit{accept}$15-splitting BIBD exists if and only if

$V(k,m,S(k,m))=\mathit{accept}$16

and the solvable pairs listed in the paper include $V(k,m,S(k,m))=\mathit{accept}$17 as well as all cases with $V(k,m,S(k,m))=\mathit{accept}$18. Additional conditions are

$V(k,m,S(k,m))=\mathit{accept}$19

$V(k,m,S(k,m))=\mathit{accept}$20

$V(k,m,S(k,m))=\mathit{accept}$21

and

$V(k,m,S(k,m))=\mathit{accept}$22

with the stated possible exceptions at $V(k,m,S(k,m))=\mathit{accept}$23 and $V(k,m,S(k,m))=\mathit{accept}$24 in the relevant cases (Paterson et al., 2021).

The same work establishes a precise correspondence with algebraic manipulation detection codes. The development of a weak $V(k,m,S(k,m))=\mathit{accept}$25-AMD code yields a group-generated $V(k,m,S(k,m))=\mathit{accept}$26 splitting set system whose corresponding A-code has perfect secrecy and substitution success $V(k,m,S(k,m))=\mathit{accept}$27 for uniformly distributed sources; the strong AMD case gives substitution success $V(k,m,S(k,m))=\mathit{accept}$28 for any source distribution. Conversely, any group-generated symmetric $V(k,m,S(k,m))=\mathit{accept}$29 splitting code with perfect secrecy and substitution success $V(k,m,S(k,m))=\mathit{accept}$30 gives rise to a strong $V(k,m,S(k,m))=\mathit{accept}$31-AMD code by restricting to the block containing a fixed point (Paterson et al., 2021).

6. Alternative realizations and adjacent notions of perfection

One adjacent direction is the artificial-noise-aided MAC. Here a standard deterministic MAC $V(k,m,S(k,m))=\mathit{accept}$32 is converted to bipolar form, perturbed by i.i.d. Gaussian noise $V(k,m,S(k,m))=\mathit{accept}$33, and quantized: $V(k,m,S(k,m))=\mathit{accept}$34 The adversary sees a memoryless channel with transition law

$V(k,m,S(k,m))=\mathit{accept}$35

The paper analyzes three performance metrics—completeness error, false acceptance probability, and conditional equivocation about the key—and shows how to balance them. Its information-theoretic bounds include

$V(k,m,S(k,m))=\mathit{accept}$36

and when $V(k,m,S(k,m))=\mathit{accept}$37, any ML decoder has $V(k,m,S(k,m))=\mathit{accept}$38 exponentially in $V(k,m,S(k,m))=\mathit{accept}$39. The paper states that “perfect” authentication is approached when $V(k,m,S(k,m))=\mathit{accept}$40, $V(k,m,S(k,m))=\mathit{accept}$41, and $V(k,m,S(k,m))=\mathit{accept}$42, rather than achieved as an exact finite-model equality (Wu et al., 2015).

A second adjacent direction is quantum authentication. The 2020 quantum paper first states that passive prepare-and-measure quantum message-authentication schemes cannot do better than their classical counterparts, and then gives an interactive entanglement-assisted scheme which ideally authenticates an $V(k,m,S(k,m))=\mathit{accept}$43-bit classical message with an $V(k,m,S(k,m))=\mathit{accept}$44-bit classical key. Alice and Bob share $V(k,m,S(k,m))=\mathit{accept}$45 EPR pairs and an $V(k,m,S(k,m))=\mathit{accept}$46-bit uniformly random classical key, Alice sends a $V(k,m,S(k,m))=\mathit{accept}$47-qubit register, and Bob performs Bell-basis checks. The claimed security objective is exact: for any adversary operation on the transmitted register, the probability that Bob both accepts and outputs $V(k,m,S(k,m))=\mathit{accept}$48 is exactly $V(k,m,S(k,m))=\mathit{accept}$49. The comparison table in the same source states key length $V(k,m,S(k,m))=\mathit{accept}$50 for a classical Wegman–Carter MAC with $V(k,m,S(k,m))=\mathit{accept}$51, versus key length $V(k,m,S(k,m))=\mathit{accept}$52 for the quantum construction, at the cost of $V(k,m,S(k,m))=\mathit{accept}$53 ebits and one round of quantum communication (Nikolopoulos et al., 2020).

A third direction removes the shared key entirely. Under a channel model in which Alice’s channel to Bob is strictly less noisy than Eve’s channel to Bob, one can construct a statistically secure authenticated channel of rate

$V(k,m,S(k,m))=\mathit{accept}$54

The encoder uses random coding, the decoder uses unique jointly $V(k,m,S(k,m))=\mathit{accept}$55-typical decoding, and both decoding error and forgery-acceptance probability vanish exponentially in block length. The same work formulates the result in the Abstract-Cryptography framework, proving composable security by constructing an authenticated channel resource from the noisy real resource without any shared secret key (Ostrev, 2018).

Taken together, these variants show that perfect message authentication code is best understood as a family of information-theoretic authentication notions. In some papers it denotes optimal one-time forging resistance under uniform keys; in others it is coupled to perfect secrecy in a splitting code; in still others it denotes zero forgery in a quantum interactive protocol or asymptotically vanishing forgery in a noisy-channel construction. The technical commonality is that authentication guarantees are derived from exact combinatorial balance, channel asymmetry, or quantum correlations, rather than from computational hardness assumptions.