SIV Mode: Nonce-Misuse Resistant AEAD

CTR-mode based AEAD ciphers like AES-GCM require a unique nonce for every encryption. If the same nonce is reused with the same key, an attacker who observes two ciphertexts can XOR them together to recover the XOR of the two plaintexts, immediately breaking confidentiality.

Nonce reuse in AES-GCM is even more catastrophic than in plain CTR mode. When two messages are encrypted under the same nonce and key, an attacker can recover the GHASH authentication key H entirely. With H known, the attacker can forge arbitrary authenticated messages.