the single biggest, indeed killer failure
of the [GCM], the fact that if you for some
reason fail to increment the counter, you're
sending what's effectively plaintext (it's
recoverable with a simple XOR).
GCM is so bad that when Sean and Hanno gave their GCM talk at Black Hat last year, they were able to inject their slides directly into the TLS session of a GCHQ website and serve them from there.
One older and real-world example is DSA vs. RSA: if you use the same random number twice when making DSA signatures, an attacker can recover the private key. Or if you use different random numbers, but you don't keep them secret, an attacker can also recover the private key. This is a real problem if you happen to use, say, Debian when it had the the OpenSSL RNG bug. RSA has no such flaw; the attacker would need you to have made a series of much-more-unlikely mistakes to recover a private key out of RSA.
See also https://www.imperialviolet.org/2013/06/15/suddendeathentropy...
If you're wondering why GPG, OpenSSH, etc. started defaulting to RSA in the past few years, that's why. (If you're wondering why they originally picked DSA, patents.)
On top of that, DSA was limited to 1024 bit keys and 160 bit hashes until the standard was extended and the extension propagated to implementations again. RSA signatures gained a lot of use while this was happening.
Why does DSA suck? Patents. It was designed to work around patents in the much simpler and Schnorr signature scheme (which is immune to nonce reuse due to the way message content and nonce are hashed together).
1. attacker learns the key, and can encrypt and decrypt all messages
2. attacker can encrypt any message
3. attacker can decrypt any message
4. attacker can create a valid random encrypted message, but doesn't know what it says
5. attacker can decrypt only the messages that were wrongly encrypted
6. attacker can determine whether two encrypted messages are the same, but can't decrypt them
7. attacker can determine whether the two wrongly encrypted messages were the same, but can't decrypt them
Some of these situations are clearly less bad than others; I'm pretty sure at least #5 can be guaranteed.