server/tripe.8.in: Fix formatting mistake.

[tripe] / server / tripe.8.in

diff --git a/server/tripe.8.in b/server/tripe.8.in
index ebbfc7904ce0c009704a198fd068d168d704db33..439cc206184716b60a9000b611ec0998696bbf89 100644 (file)
--- a/server/tripe.8.in
+++ b/server/tripe.8.in
@@ -27,7 +27,7 @@
 .so ../common/defs.man \" @@@PRE@@@
 .
 .\"--------------------------------------------------------------------------
-.TH tripe 8 "10 February 2001" "Straylight/Edgeware" "TrIPE: Trivial IP Encryption"
+.TH tripe 8tripe "10 February 2001" "Straylight/Edgeware" "TrIPE: Trivial IP Encryption"
 .
 .\"--------------------------------------------------------------------------
 .SH "NAME"
@@ -315,7 +315,7 @@ or
 .BR ec .
 If this attribute isn't present, then the key's type is examined: if
 it's of the form
-.BR tripe\- group
+.BI tripe\- group
 then the
 .I group
 is used.  If no group is specified,
@@ -361,8 +361,14 @@ mode, designed by Bellare, Canetti and Krawczyk).  These can all be
 overridden by setting attributes on your private key, as follows.
 .TP
 .B bulk
-Names the bulk-crypto transform to use.  Currently the only choice is
-.BR v0 .
+Names the bulk-crypto transform to use.  See below.
+.TP
+.B blkc
+Names a block cipher, used by some bulk-crypto transforms (e.g.,
+.BR iiv ).
+The default is to use the block cipher underlying the chosen
+.BR cipher ,
+if any.
 .TP
 .B cipher
 Names the symmetric encryption scheme to use.  The default is
@@ -384,6 +390,26 @@ at half the underlying hash function's output length.
 A `mask-generation function', used in the key-exchange.  The default is
 .IB hash \-mgf
 and there's no good reason to change it.
+.PP
+The available bulk-crypto transforms are as follows.
+.TP
+.B v0
+Originally this was the only transform available.  It's a standard
+generic composition of a CPA-secure symmetric encryption scheme with a
+MAC; initialization vectors for symmetric encryption are chosen at
+random and included explicitly in the cryptogram.
+.TP
+.B iiv
+A newer `implicit-IV' transform.  Rather than having an explicit random
+IV, the IV is computed from the sequence number using a block cipher.
+This has two advantages over the
+.B v0
+transform.  Firstly, it adds less overhead to encrypted messages
+(because the IV no longer needs to be sent explicitly).  Secondly, and
+more significantly, the transform is entirely deterministic, so (a) it
+doesn't need the (possibly slow) random number generator, and (b) it
+closes a kleptographic channel, over which a compromised implementation
+could leak secret information to a third party.
 .SS "Using SLIP interfaces"
 Though not for the faint of heart, it is possible to get
 .B tripe