Can poly1305 be used as an error-correction code? Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) by someone who knows the corrupt message, the mac code, and the key?
what is the minimum amount of bitflips on the message that can be corrected


Zero bits, Poly1305 doesn't provide error correction (at least Bernstein doesn't claim that property in the original paper).


  (or at least detected) by someone who knows the corrupt message, the mac code, and the key?


One bitflip is already detectable, it will change all bits of the resulting hash with a 0.5 chance.

Of course, there is always a negligible chance that the data does result in the correct hash (a chance of 1 in $2^{128}$ for the full MAC output). However, that's not dependent on how many bits are flipped.

Generally, it is recommended to keep the full output of the MAC calculation as an authentication tag.



If you also want error correction against changes, you could include a block of error-correcting code over the message + authentication tag. That way both are protected against non-malicious changes. Or you could use a specialized MAC algorithm as indicated within your own comment.



Personally I don't see a direct way to add error correction capabilities to the Poly1305 calculations, but I'm not the best person to indicate if that's possible.