Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
VMAC seems to me much more secure than Poly1305 on long messages (the security of the latter decreases linearly with increasing message length). Is this of practical relevance?