# Tag Info

0

Indeed $H=E_k(0)$ is used to choose from the family. This is not a problem, and here is some intuition on why. The output of the hash function is not leaked in clear, it is "hidden" by xoring with $E_k(iv,ctr=0)$ which is different per each encrypted message (in contrast to $H=E_k(0)$). Otherwise it would be indeed trivial to recover H as the UHF ...

0

I've used Algorithm 3 of the paper for this purpose. $M[128] ← e1||0^{120}$ instead of H $P ← 04||0^{120}$ which is 2 with reverse bits

0

The polynomial f would be 0xe1, no? it is $e1 \mathbin \|0^{120}$ i.e. 0xe1000000000000000000000000000000 What would be the value of the element P, if it corresponds to the polynomial α? it is 2 reversed i.e. 0x40000000000000000000000000000000

Top 50 recent answers are included