Hi!

The nonce that peers use to communicate in secret sessions is 64 bit (rather than 96 bit) and looks like it might wrap?

func incrNonce(nonce *[aeadNonceSize]byte) {
	counter := binary.LittleEndian.Uint64(nonce[4:])
	counter++
	binary.LittleEndian.PutUint64(nonce[4:], counter)
}

Seems like the session should terminate before re-using a nonce.

Doesn't look like there's a terribly practical attack available but may as well belt-and-braces since it's crypto that's important.

Thanks