On the security margin of MAC striping

MAC striping has been suggested as a technique to authenticate encrypted payloads using short tags. For an idealized MAC scheme, the probability of a selective forgery has been estimated as ( `+m m )−1 ·2−m, when utilizing MAC striping with `-bit payloads and m-bit tags. We show that this estimate is too optimistic. For m ≤ ` and any payload, we achieve a selective forgery with probability ≥ ( `+m m )−1 , and usually many orders of magnitude more than that.