Authenticated Encryption with Associated Data (AEAD)

AEAD provides confidentiality by encrypting plaintext into ciphertext, and integrity/authenticity by generating an authentication tag. This dual guarantee ensures the ciphertext cannot be read and has not been altered in transit. Unlike generic composition (Encrypt-then-MAC), AEAD is a single, provably secure algorithm that avoids subtle implementation errors. The verification step will fail if even a single bit of the ciphertext or associated data is modified.

A core feature is the ability to authenticate Associated Data (AD)—plaintext metadata that must be integrity-protected but does not need to be encrypted. This is crucial for securing packet headers, database IDs, or protocol version numbers. The AD is processed to create the authentication tag but is transmitted in the clear. Examples include:

• An IP packet header for network security.
• A database record ID linked to encrypted field data.
• A protocol version string to prevent downgrade attacks.

AEAD algorithms are nonce-based. A nonce (Number Used Once) is a unique value for each encryption operation under the same key. Its critical property is uniqueness, not necessarily secrecy. Reusing a nonce with the same key can catastrophically compromise security. Standardized AEADs like AES-GCM and ChaCha20-Poly1305 explicitly define nonce sizes (e.g., 96 bits) and construction methods to ensure safe usage. Proper nonce management is a primary implementation responsibility.

AEAD is constructed by combining a symmetric cipher with a Message Authentication Code (MAC). Common modes of operation include:

• AES-GCM: Uses AES in Galois/Counter Mode for encryption and a Galois MAC for authentication. It is fast with hardware acceleration.
• ChaCha20-Poly1305: A stream cipher (ChaCha20) combined with a polynomial MAC (Poly1305). Often faster in software without AES-NI.
• AES-CCM: Combines AES in CBC-MAC mode for authentication and Counter mode for encryption. Each mode offers a standardized, analyzed construction, eliminating the need for custom, error-prone Encrypt-and-MAC schemes.

The encryption operation produces a single, composite output consisting of the ciphertext and an authentication tag. The decryption operation is all-or-nothing: it first verifies the tag against the ciphertext and associated data. Only if verification succeeds is the ciphertext decrypted and the plaintext returned. This prevents oracle attacks where an attacker might probe a system by manipulating ciphertext and observing error responses (e.g., padding oracles). A failed verification yields a generic error with no information leak.

AEAD is the standard for securing modern communication and data storage protocols due to its robust security guarantees. Key applications include:

• TLS 1.3: Mandates AEAD ciphersuites (e.g., AES-256-GCM) for all symmetric encryption.
• WireGuard VPN: Uses ChaCha20-Poly1305 exclusively for its packet security.
• Disk Encryption: Formats like LUKS2 use AEAD modes (e.g., AES-GCM) to protect data at rest.
• Messaging Protocols: Signal and MLS use AEAD to secure message contents and metadata.
• API Payload Security: Encrypting and authenticating sensitive payloads between services and AI agents.

A cryptographic system where the same secret key is used for both encryption and decryption. AEAD modes are built upon symmetric ciphers like AES (Advanced Encryption Standard).

• Core Function: Provides confidentiality by transforming plaintext into ciphertext.
• AEAD Relationship: AEAD combines symmetric encryption with a Message Authentication Code (MAC) to add integrity and authenticity.
• Common Algorithms: AES, ChaCha20.

A short piece of information used to authenticate a message and confirm its integrity and authenticity. It is generated using a secret key and the message content.

• Core Function: Verifies that a message has not been altered and originated from the holder of the secret key.
• AEAD Relationship: In AEAD, the MAC is computed over both the ciphertext and the associated data, binding them together.
• Common Types: HMAC (Hash-based MAC), CMAC.

A unique, often random, value used with a secret key to initialize a cryptographic operation. It ensures the same plaintext encrypts to different ciphertexts.

• Critical Property: Must be non-repeating (for a given key) to maintain security. In AEAD, this is typically called a nonce.
• AEAD Role: The nonce is an essential input to AEAD encryption and decryption. It does not need to be secret but must be unpredictable or unique.
• Security Impact: Reusing a nonce with the same key in most AEAD schemes can catastrophically compromise security.

The unencrypted plaintext in an AEAD scheme that must be authenticated for integrity but does not require confidentiality.

• Purpose: Protects metadata (e.g., packet headers, protocol version, database record ID) from tampering without the overhead of encryption.
• Mechanism: The AD is included in the MAC calculation but is not encrypted. The decryption operation will fail if the AD is modified.
• Real-World Example: In TLS, the sequence number and protocol header are authenticated as associated data alongside the encrypted application payload.