* a small non-cryptographic error-correcting code between the peers
     as the most efficient way to reduce the random error rate to, say,
     one in a thousand packets;

   * a strong cryptographic authenticator as the most efficient way to
     eliminate forgeries by anyone on the network between the peers (and
     to clean up the remaining random errors); and

   * a signature from the original source of the data as the only way to
     catch forgeries by the middlemen.

I was commenting solely on the balance between the first two stages; I
didn't mean to suggest that they were the only stages.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago