Good stuff! One minor nit suggested by someone far smarter than myself is that "it is incorrect to describe the polynomial evaluation MACs like Poly1305 and GHA

Good stuff! One minor nit suggested by someone far smarter than myself is that "it is incorrect to describe the polynomial evaluation MACs like Poly1305 and GHASH as ‘cryptographic CRC’. There _are_ cryptographic CRC-like MACs, but nobody uses them because they're more of a pain than polynomial evaluation." with https://crypto.stackexchange.com/questions/56448/can-keyed-crc-be-used-as-a-mac/56450#56450 https://crypto.stackexchange.com/questions/56448/can-keyed-c... as a reference :)