International Association
for Cryptologic Research

MAC striping has been suggested as a technique to authenticate encrypted payloads using short tags. For an idealized MAC scheme, the probability of a selective forgery has been estimated as $\\binom{\\ell+m}{m}^{-1}\\cdot 2^{-m}$, when utilizing MAC striping with $\\ell$-bit payloads and $m$-bit tags. We show that this estimate is too optimistic. For $m\\le\\ell$ and any payload, we achieve a selective forgery with probability $\\ge \\binom{\\ell+m}{m}^{-1}$, and usually many orders of magnitude more than that.