# Tag Info

You are quite correct. A PRP in counter mode is, in fact, distinguishable from a random sequence if you approach the "birthday bound". We get around this by never generating that much output at once. With a 128 bit block cipher, an output of $2^{40}$ bytes (which is a lot of output) gives us a distinguishing advantage of about $2^{-56}$ (the probability ...
Usually. $\:$ A variable-length input keyed-PRF is a [PRF's output length]-bit MAC. In particular, a variable-length input keyed-PRF with long output is automatically a MAC.