Charlie,
Yes, the paper has changed since the August version which did not include
a solution that scales up. The current paper does scale up for
multiple addressees by using a MIC that we call the "double DES MAC".
I see that the vulnerability that you had previously found with the
message type using DES-MAC with RSA keying is quite similar. As with
both vulnerabilities, the problem can be eliminated by using the
"double DES MAC" instead. However, as we all seem to agree, the current
direction of eliminating the DES MAC altogether is the simplest
choice.
I will re-send you a copy of the paper. If we have trouble this time,
I will make it available via FTP.
--Stuart