> Aren't authentication functions symmetric, almost by definition? > > Joe well, RSA signatures aren't (expense depends on the length of the exponent and the public exponent is usually made short so signature verification is fast at the expense of making signing expensive) but those are clearly too expensive to use in per-packet transforms. - Bill