13 reputation
3
bio website
location
age
visits member for 1 year, 11 months
seen Nov 30 '12 at 9:45

Nov
30
awarded  Supporter
Nov
30
awarded  Scholar
Nov
29
accepted Message authentication codes construction
Nov
29
comment Message authentication codes construction
let us continue this discussion in chat
Nov
29
awarded  Student
Nov
29
comment Message authentication codes construction
Thanks, but I don't think it's arbitrary. They purposely make the data only 63 bits so that they can prepend the bit. My intuition is that a forgery is possible if r can look like one of the message blocks and they therefore differentiate r from the message blocks with the first bit. The issue is, I don't see how a polynomial time adversary would forge even without this bit.
Nov
29
comment Message authentication codes construction
Thank you!! :-)
Nov
29
comment Message authentication codes construction
I wasn't referring to the padding. In the scheme itself, they have z=F_a(0.r) XOR F_a(1. <1>.M[1]) XOR F_a(1.<2>.M[2])...
Nov
29
comment Message authentication codes construction
Thank you for editing!
Nov
29
asked Message authentication codes construction