# Tag Info

1

Your proposal is malleable, so in particular, confidentiality does not hold against a chosen-W' attack, which is the key-wrap analogue of a chosen-ciphertext attack. $\:$ Also, the fact that your proposal concatenates s with p suggests that H can probably be evaluated too quickly. Although that may be typical, it shouldn't be, since the time needed to try ...

Only top voted, non community-wiki answers of a minimum length are eligible