> "This isn't just theoretical, it actually happened to Colin Percival, a very experienced crypto developer, in his backup program tarsnap." Colin was using AE

> "This isn't just theoretical, it actually happened to Colin Percival, a very experienced crypto developer, in his backup program tarsnap." Colin was using AESCTR+HMAC rather than GCM, but there was a nonce reuse bug six years ago: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-...