  We study the security of a specific authentication procedure of interest in
the context of Quantum Key Distribution (QKD). It works as follows: use a
secret but fixed Strongly Universal$_2$ (SU$_2$) hash function and encrypt the
output tag with a one-time pad (OTP). If the OTP is completely secret, the
expected time for an adversary to create a tag for a chosen message is
exponential in the tag length. If, however, the OTP is partially known in each
authentication round, as is the case in practical QKD protocols, then the
picture is different; the adversary's partial knowledge of the OTP in each
authentication round gives partial information on the secret hash function, and
this weakens the authentication in later rounds. The effect of this is that the
lifetime of the system is linear in the length of the fixed key. This is
supported by the composability theorem for QKD, that in this setting provides
an upper bound to the security loss on the secret hash function, which is
exponential in the number of authentication rounds. This needs to be taken into
account when using the protocol, since the authentication gets weakened at each
subsequent round and thus the QKD generated is key is not as strong as when the
authentication is strong. Some countermeasures are discussed at the end of this
paper.
