Not a crypto guy. So would the high-level summary be something like this? Standard AES-GCM AEAD will catastrophically fail if you use the same nonce twice[1] f

Not a crypto guy. So would the high-level summary be something like this? Standard AES-GCM AEAD will catastrophically fail if you use the same nonce twice[1] for different messages, and the size of the size of the nonce is small enough that one cannot safely use a random nonce in many cases. This work provides an easy to use way to avoid that. It does so by changing not just the nonce but also the key used per message for the AES-GCM call. And it uses only "plain" AES which is readily available if you have AES-GCM, and no fancy new constructions which may have unknown weaknesses. The overhead per message is just two small buffers that needs to be encrypted/decrypted with "plain" AES and a longer 192 bit nonce. [1]: https://frereit.de/aes_gcm/ https://frereit.de/aes_gcm/