Tight Lower Bound on Linear Authenticated Encryption

We show that any scheme to encrypt m blocks of size n bits while assuring message integrity, that apart from using m + k invocations of random functions (from n bits to n bits) and vn bits of randomness, is linear in (GF 2) n , must have k + v at least (log m). This lower bound is proved in a very general model which rules out many promising linear modes of operations for encryption with message integrity. This lower bound is tight as 8] shows a linear scheme to encrypt m blocks while assuring message integrity by using only m + 2 + log m invocations of random permutations.