Re: Allegations regarding OpenBSD IPSEC

[Kjell Wooding]

> It *seems harder* (but I'm not an expert on this kind of thing!) to
> predict the first couple of rounds if <nanotime_noise> is hashed (which
> means that you have to re-do the complete calculation for each possible
> <nanotime_noise>, which may not necessarily be the case above), and if
> this hashing is used to distribute the noise over the entire initial
> state of the cipher (so that no known portion exists).
>
>
Hashing wasn't my objection. Hashing 3 times with data-dependent inputs and
XORing them together was.