hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages. This issue has been patched in version 1.7.5.

Affected: npm: @hpke/core

### Summary

The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can lead to complete loss of Confidentiality and Integrity of the produced messages.

### Details

The SenderContext Seal() [implementation](https://github.com/dajiaji/hpke-js/blob/b7fd3592c7c08660c98289d67c6bb7f891af75c4/packages/core/src/senderContext.ts#L22-L34) allows for concurrent executions to trigger `computeNonce()` with the same sequence number. This results in the same nonce being used in the suite's AEAD.

### PoC

This code reproduces the issue (and also checks for more things that could be wrong with the implementation).

```js import { CipherSuite, KdfId, AeadId, KemId } from "hpke-js";

const suite = new CipherSuite({ kem: KemId.DhkemP256HkdfSha256, kdf: KdfId.HkdfSha256, aead: AeadId.Aes128Gcm, });

const keypair = await suite.kem.generateKeyPair(); const skR = keypair.privateKey; const pkR = keypair.publicKey;

const sender = await suite.createSenderContext({ recipientPublicKey: pkR, });

const [message0, message1] = await Promise.all([ sender.seal( new TextEncoder().encode("Secret message 1: Attack at dawn").buffer ), sender.seal( new TextEncoder().encode("Secret message 2: Withdraw troops").buffer ), ]);

const recipient = await suite.createRecipientContext({ recipientKey: skR, enc: sender.enc, });

const plaintext0 = await recipient.open(message0); console.log("✓ Decrypted mes…