Falling through the KRACKs
This will provide further impetus for not using CCM/GCM and similar AEAD cipher modes in any context other than octet stream protocols (e.g., TLS, but _not_ <i>D</i>TLS).<p>There is ongoing work to produce AEAD cipher modes that do not fall apart when {key, nonce} pairs are reused (for different message plaintexts, naturally).<p>Crypto is tricky...<p>It's easy enough to construct AEAD cipher modes by generic composition that don't have this problem.  For example, the Kerberos enctypes don't.<p>The key is to construct AEAD cipher modes that are <i>efficient</i> (Kerberos' add a block's worth (16 bytes) of "confounder" to each message, bloating it, and also adds a block's worth of cipher operation, slowing it down) and don't require additional random numbers if at all possible (those confounders in Kerberos are random numbers prepended to the plaintext).  Also, Kerberos' enctypes use HMAC for the integrity protection part, which is not a very fast MAC.