Document where the design for `s2v` comes from

[cipriancraciun]

Looking at the implementation of s2v it resembles the S2V construct from RFC 5297.

The only difference I see, besides the choice of hash function and sizes, is that if the message is less than the MAC size, you apply an extra d[mlen] ^= 0x80;.

Am I correct?

[jedisct1]

S2V is defined in Rogaway's paper -- See fig.2

It's a generic construction, so any PRF can be used. Setting the bit after the data is required to make the distinction between padding bits and zero bits from actual data.

[jedisct1]

The construction here is an instantiation of the SIV mode described in that paper. Pretty boring, but in a good way.

S2V is used in the SIV mode, but also in AES-OCB.

It can be used in any other context, to provide domain separation between members of a tuple.