Indeed, further down the thread Werner Koch suggests the solution is deploying AEAD modes, but the bottleneck is other implementations picking it up.<p>As an aside, I&#x27;m surprised this got posted to cryptography@metzdowd, the S&#x2F;N on that list is so low I&#x27;m surprised anyone still bothers to read it.