阅读中文版本

Authenticated Encryption (AEAD)

Authenticated encryption produces ciphertext and a tag that proves integrity and authenticity, so tampering is detected before plaintext is used.

Definition

Authenticated encryption with associated data is a mode that encrypts a message and authenticates both the ciphertext and any additional public data, detecting any modification.

It is the correct default for symmetric encryption of data at rest, in transit within a service, and in tokens. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

Modes such as AES-GCM and ChaCha20-Poly1305 bind a nonce, the ciphertext, and optional associated data into a single authentication tag that decryption verifies.

Nonce management is critical: reusing a nonce with the same key under GCM destroys confidentiality and allows forgery, so nonces must be unique per key.

Trade-offs and alternatives

Never use a block cipher in a bare mode for new code; authenticated modes fail closed on tampering rather than silently returning corrupted plaintext. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that encryption alone protects integrity. Another is that the associated data is encrypted along with the message. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to using a raw block cipher mode without a separate integrity check and to encrypting and then verifying with an unauthenticated hash of the plaintext. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include Forward Secrecy, Key Derivation Functions, Public Key Infrastructure.