I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
I'm planning to use the crypto_box() functions of Nacl (or, alternatively, the crypto_box_easy() functions of libsodium) to ...
HS1-SIV is a good nonce-misuse-resistant, two-pass, AEAD scheme that is part of the CAESAR competition. However, it suffers from forgeries if the SIV collides. It seems to me that encrypting the SIV ...