On the Impending Crypto Monoculture (2016)
<p><pre><code>  the single biggest, indeed killer failure 
  of the [GCM], the fact that if you for some
  reason fail to increment the counter, you're
  sending what's effectively plaintext (it's
  recoverable with a simple XOR).
</code></pre>
Is this property particularly unique to GCM? I'd have thought all encryption algorithms would fail if you didn't give them the right inputs?