AES-GCM-SIV: AES-GCM with some forgiveness
Very roughly, this is using a hash of the data mixed into the IV (so IV+key re-use means same plaintext always gives same ciphertext, but not catastrophic fail like re-using IV &amp; key in GCM).<p>I wish the library support were better (e.g. common java libs), and that it would get added to approved cipher lists from various govt. bodies. I&#x27;m not across how this really happens so no idea if it will, but I really hope it does.<p>I like how hard to get wrong SIV mode is, and how, as a primitive, it lines up quite well with how developers <i>think</i> encryption works before they go do coursera or the matasano challenges or whatever.<p>In my experience developers don&#x27;t really get better (as an entire class of people) at security, most of the improvements in security I&#x27;ve seen, I attribute to better APIs and outsourcing of low level infrastructure to highly resourced entities.<p>Yeah so it&#x27;s a bit slower and your data has to fit in memory, but within these application caveats I see no reason not to universally prefer automatic IV modes.<p>You still have to care that its deterministic in a lot of applications but thats not too hard to communicate.