> I would accompany that design with very strong warnings that substituting AES-GCM for anything else is likely to destroy the security of the design. IMO, it'

> I would accompany that design with very strong warnings that substituting AES-GCM for anything else is likely to destroy the security of the design. IMO, it's exactly this kind of strong advice early on that would be of great benefit would-be crypto developers. They need it drilled in as early as possible that the canyon-like pitfalls lie in the compositional problems of building a working cryptosystem. This is really a domain where just-ship-it cowboy coding becomes a massive liability.