 Wegman–Carter authentication

Combine a secret randomly selected almost strongly universal hash family member with a fresh secret output mask. An observed message authentication code tag leaves the hash-selection key hidden, and the conditional hash bound controls substitution forgery probability. The message itself need not be encrypted. Mask reuse can reveal hash differences; repeated-use guarantees require fresh masks and an appropriate analysis of verification information. A one-use polynomial construction needs only two secret field elements, even for a much longer message.