Ah, quick update to the above (can't edit anymore): the final construction I posted in the above message is not good for arbitrary messages, because if msg sta

Ah, quick update to the above (can't edit anymore): the final construction I posted in the above message is not good for arbitrary messages, because if msg starts with an all-zeros block then the inner and outer hash invocations won't have different IVs (which is bad). If msg is structured in a way that guarantees that it doesn't have an all-zeros block as a prefix, then this construction is fine, but that does seem quite fragile... Goes to show how easy it is to mess this up. :\