Comment by nmadden

Like much of Peter Gutmann’s writing this is a mixture of good points and things that are downright incorrect or at least misleading. For example, he criticises GCM for losing confidentiality when a nonce is reused. True, but ChaPoly has exactly the same issue. And although CBC+HMAC is somewhat better in that regard, it doesn’t “drop back to ECB mode”, and it still loses CPA security. HMAC is far more robust than any polynomial MAC, but the persistent idea that there is any meaningful difference in robustness between any of the traditional cipher modes under nonce/IV misuse is nonsense. If you need misuse resistance then use a mode that actually provides it, like SIV.