Re: [PATCH] Delete cryptoloop

[daw@taverner.cs.berkeley.edu (David Wagner)]

James Morris  wrote:
>It would be good if we could get some further review on the issue by an 
>independent, well known cryptographer.

I'd be glad to review it if someone can point me to a clear, concise
description of the scheme (trying to extract the spec from the code
is too much work for me).

M.J. Saarinen's attack seems to be real, if that's what you're asking
about.  IV generation is important; if you choose IVs poorly, then you
can end up with some weaknesses even if the underlying block cipher is
perfectly fine.  (I noticed that some posts from, e.g., Clemens were
confused about this point.  If you use a great cipher in a bad mode of
operation, you can easily end up with an insecure system.  The existence
of an attack against such a system is not in contradiction to the security
of the underlying block cipher against chosen plaintext attacks.)