The cryptographic answer is: yep, that sounds about right (with low confidence because the model violation is subtle). The cryptographic engineering answer is:

The cryptographic answer is: yep, that sounds about right (with low confidence because the model violation is subtle). The cryptographic engineering answer is: use OCB3 instead which doesn't have this problem :)