On: AEADs: getting better at symmetric cryptography

[tptacek]

I can do you one better:

http://cryptopals.com/sets/1/challenges/6/

http://cryptopals.com/sets/3/challenges/20/

In the literature, nonce reuse on things like GCM can fail even more spectacularly, with respect to to the authenticator's key.