some related work on tagging attacks

[Roger Dingledine <arma@mit.edu>]

Was just looking over Ian's thesis
(http://www.isaac.cs.berkeley.edu/~iang/thesis.html), and page
133 describes basic forward tagging attacks. He proposes that
they be fixed via Integrity-aware CBC mode, as described in
http://alternic.net/drafts/drafts-j-k/draft-jutla-ietf-ipsec-esp-iapm-00.html

We'll probably want to mention this mode when describing how it doesn't
help us. :}

--Roger