On: The XAES-256-GCM extended-nonce AEAD

[dchest]

Encryption with the same key and repeated nonce/counter produce the same cipher stream. Ciphertext in GCM (or CTR) mode is cipherstream XOR plaintext, thus given two ciphertexts with the same key/nonce:

ciphertext1 XOR ciphertext2 = (cipherstream XOR plaintext1) XOR (cipherstream XOR plaintext2) = plaintext1 XOR plaintext2

In GCM it can also break authentication.