[yuhong]

As a side note, I wonder how bad MAC-then-encrypt is on a stream cipher compared to a block cipher. TKIP used CRC plus Michael MIC for example.