AES-GCM-SIV

AES-GCM-SIV is an authenticated encryption mode built on the Advanced Encryption Standard and defined in RFC 8452. It combines counter mode encryption with Galois field authentication, as Galois/Counter Mode does, but it first computes a synthetic initialization vector from the nonce, the plaintext and any additional associated data using a function called POLYVAL. Because the vector depends on the whole message, a repeated nonce reveals nothing beyond the fact that the same message was encrypted twice with that nonce, which makes the scheme misuse resistant. The price is that the whole message and its associated data must be held in memory before encryption or decryption can begin, so the mode cannot act as a streaming cipher. Performance is close to, though slightly worse than, Galois/Counter Mode, which makes it a fit for servers or devices that encrypt under one key without coordinating nonces.