Whoops; you're right of course, but same idea with fewer primitives -- either way, obscure the output of the polynomial MAC with the output of a cipher, so you

Whoops; you're right of course, but same idea with fewer primitives -- either way, obscure the output of the polynomial MAC with the output of a cipher, so you get the fast MAC that you can reuse multiple times.