You're welcome! From my understanding, IV plus hash of the plaintext is sort of what's going on in SIV (note that SIV is subtly different from GCM-SIV which is

You're welcome! From my understanding, IV plus hash of the plaintext is sort of what's going on in SIV (note that SIV is subtly different from GCM-SIV which is subtly different from AES-GCM-SIV), plus an added step to also mutate that hash using a single block of AES. The last bit is important not just to protect against weaknesses in the hash function, but also to prevent leaking information about the plaintext. Because the IV is required for decryption, it must be transmitted in the clear, so this could be trivially vulnerable to attack -- using the same True/False example I gave above, you could simply hash both values and see which one compares, and now you've exposed the plaintext. Obviously real-world scenarios are typically more complex than this, but the attack vector is nonetheless available. It takes me a while (read: I don't have time right now) to properly absorb specs like this (my formal background is in, of all things, mechanical engineering), so I can't speak completely confidently about whether or not there's a nonce mixed into AES-GCM-SIV specifically. That disclaimer aside, I believe there is; the key lengths are longer, and the AES-GCM-SIV construct does still involve a nonce. If I had to speculate, I would say that the nonce and key are distributed together, as if they were a single unit, and this is responsible for the longer key. But that's really as far as I'm willing to speculate, and should be taken with a huge grain of salt!