AES-GCM-SIV
http://www.imperialviolet.org/2017/05/14/aesgcmsiv.html [www.imperialviolet.org]
2017-05-25 06:19
AES-GCM with some forgiveness. It uses the same primitives as AES-GCM, and thus enjoys the same hardware support, but it doesn’t fail catastrophically if you repeat a nonce. Thus you can use random, 96-bit nonces with a far larger number of messages, or withstand a glitch in your nonce distribution scheme.
So it’s important to emphasise that AES-GCM-SIV (and nonce-misuse resistant modes in general) are not a magic invulnerability shield.