On the security margin of MAC striping

MAC striping has been suggested as a technique to authenticate encrypted payloads using short tags. For an idealized MAC scheme, the probability of a selective forgery has been estimated as $\binom{\ell+m}{m}^{-1}\cdot 2^{-m}$, when utilizing MAC striping with $\ell$-bit payloads and $m$-bit tags. We show that this estimate is too optimistic. For $m\le\ell$ and any payload, we achieve a selective forgery with probability $\ge \binom{\ell+m}{m}^{-1}$, and usually many orders of magnitude more than that