Why does bit padding work in practice in a message authentication code? I understand that bit padding (add a 1, then 0's as needed) is a secure way to pad a message, preventing an unpadded message producing the same tag as a message that has been padded.

What I don't understand is how this works in practice. Surely a message exists that has a '1' bit followed by several trailing 0's. How does the system for a MAC distinguish between a regular message that naturally has a 1 and trailing 0's, and a padded message?
Bit padding is a padding that is always applied. So every possible message still has a canonical representation.

It is even possible to remove the padding always by removing all trailing zeros and the rightmost bit with value one.

For MAC calculation the unpadding is of course not used, but it shows that every message is still unique, even after the padding has been applied.

So if you have one message and you pad to a multiple of 8 bits (to make the example readable):

0000      -&gt; pad -&gt; 0000 1000


and a message that is identical to that padded message:

0000 1000 -&gt; pad -&gt; 0000 1000 1000 0000


as you can see the messages are still distinct after padding.