[onlydnaq]

To be honest, nonce reuse with Bernsteins authenticated encryption algorithms will lead to the same problem as those the author points out with GCM (i.e. plaintext recovery). However, the biggest issue with GCM isn't that the plaintext leaks when reusing nonces, it's the fact that reusing nonces leads to an attacker being able to forge arbitrary ciphertexts.

[loup-vaillant]

But… Poly1305 has the same "problem"…

[tptacek]

Guttman's wording here is imprecise. GCM and Poly1305 are not comparably brittle. Both have nonce misuse issues, but GCM has additional problems. See:

https://news.ycombinator.com/item?id=13384762