With appropriate padding to ensure each s is in its own separate input block, that is called "envelope" or "sandwich" MAC, and its security can be reduced to th

With appropriate padding to ensure each s is in its own separate input block, that is called "envelope" or "sandwich" MAC, and its security can be reduced to the compression function's security using mostly the same techniques as HMAC. [1] https://doi.org/10.1007/978-3-540-73458-1_26 https://doi.org/10.1007/978-3-540-73458-1_26 [2] https://eprint.iacr.org/2013/248 https://eprint.iacr.org/2013/248 [3] https://eprint.iacr.org/2021/097 https://eprint.iacr.org/2021/097