Tweak Review: BMGL

In [HNa] the submitters generalize the BMGL generator in order to allow keystream synchronization with random access properties. This synchronization is done by an initialization vector. Furthermore they present a sketch for a security proof based on the assumption that the iterated Rijndael mapping is hard to invert even if an attacker has a number of extra plaintext-ciphertext pairs. In [HNb] the submitters give a stronger analysis of the BMGL generator and improve some theoretical results on which the construction is based. In addition the submitters present an alternative construction, called BMGL2/GGM. In [HNc] the submitters summarize the two amendments presented in [HNa,HNb] and make the following new proposal: The BMGL construction has two parameters n and m, where n is the key/blocksize of Rijndael and m denotes the number of output bits per iteration. The submitters suggest that these two parameters should be selected by an implementation rather than being fixed as previously recommended. (n = 256 and m = 40)