# Tag Info

3

$Tag = MAC_k(\Sigma_i m_i)$. Too many attacks to enumerate. As long as the sum over the blocks remains the same, the tag remains valid. If the sum is reduced modulo $2^{\mathrm{blocksize}}$ at the end, the attacker can choose the whole message, apart from a single block used to balance the sum. $t_i = MAC_k(m_i)$ and $Tag = (t_1, ..., t_l)$. ...

1

One particularly interesting aspect of Poly1305 is that its security is guaranteed, assuming the underlying cipher is secure. In other words, Poly1305-AES is guaranteed to be secure, as long as AES has not been broken. In the event that AES is broken, AES could be replaced with another cipher, and get a similar security guarantee. DJB talks about his ...

1

It is clear that if $r_i$ is picked randomly the above Mac [defined in the second paragraph] would be secure. Actually, that's not at all clear. I would claim that if I were given that values of $Mac_i(a)$ and $Mac_i(b)$, I could compute the value of $Mac_i(x)$ for any $x$, as long as $a-b$ is relatively prime to $p-1$. To do this, I need the value of ...

Only top voted, non community-wiki answers of a minimum length are eligible