# Tag Info

In the first part of this answer, I restrict to reading requirement 2 as "if one pair $(m,r)$ is known…", and assume that $k$ is chosen at random. I entirely disregard security when an adversary knows two distinct pairs $(m,r)$, or when related keys $k$ are used. The following construction uses the Galois Field $(\mathbb F_{2^{64}},\oplus,\otimes)$,...