GCM is well known to have sudden death on nonce reuse, which is why we used GCM-SIV for the ZeroTier v1 protocol. (Our new protocol that stiiiil is not in produ

GCM is well known to have sudden death on nonce reuse, which is why we used GCM-SIV for the ZeroTier v1 protocol. (Our new protocol that stiiiil is not in product is Noise based.) Nonce reuse in SIV is much less catastrophic. Reuse of a nonce can reveal if two packets are identical but doesn’t let you do anything else. Of course there are categorically better modes than GCM but they are not widely supported. ChaChaPoly is better cryptographically but no hardware acceleration, which matters on small devices.