13 reputation
3
bio website
location
age
visits member for 1 year, 9 months
seen Nov 30 '12 at 9:45

Nov
29
comment Message authentication codes construction
let us continue this discussion in chat
Nov
29
comment Message authentication codes construction
Thanks, but I don't think it's arbitrary. They purposely make the data only 63 bits so that they can prepend the bit. My intuition is that a forgery is possible if r can look like one of the message blocks and they therefore differentiate r from the message blocks with the first bit. The issue is, I don't see how a polynomial time adversary would forge even without this bit.
Nov
29
comment Message authentication codes construction
Thank you!! :-)
Nov
29
comment Message authentication codes construction
I wasn't referring to the padding. In the scheme itself, they have z=F_a(0.r) XOR F_a(1. <1>.M[1]) XOR F_a(1.<2>.M[2])...
Nov
29
comment Message authentication codes construction
Thank you for editing!