# Are there any non Canonical Verifiable Cryptographic MACs

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs;

Canonical verification. For deterministic message authentication codes (that is, where $$\text{Mac}$$ is a deterministic algorithm), the canonical way to perform verification is to simply re-compute the tag and check for equality. In other words, $$\operatorname{Vrfy}_k(m, t)$$ first computes $$\tilde{t} := \text{Mac}_k (m)$$ and then outputs $$1$$ if and only if $$\tilde{t} = t$$.

Then, later

It is not hard to see that if a secure MAC uses canonical verification then it is also strongly secure. This is important since all real-world MACs use canonical verification.

All of the cryptographic MACs, that I know, use canonical verification.

• Is there any non Canonical Verifiable Cryptographic MACs?
• If not, then this definition is redundant, or is this definition is defined for future MAC schemes?

• in short, the problem starts when a Mac has randomized tags, as this is the only reason for having two different valid tags for a message $m$ – kelalaka Nov 14 '18 at 17:55