English
Menu

What is Authenticated encryption (AEAD)?

A form of encryption that provides confidentiality and tamper detection in a single operation. AEAD stands for authenticated encryption with associated data: associated data such as headers, which are not encrypted but must be protected against tampering, can also be included in the authentication. A tag is computed during encryption and verified during decryption; if it does not match, an error is returned and no plaintext is released. AES-GCM and ChaCha20-Poly1305 are typical examples, and TLS 1.3 uses only AEAD. Reusing a nonce with the same key undermines both confidentiality and tamper detection.

Japanese name: 認証付き暗号(AEAD)

Authenticated encryption (AEAD) appears in 8 practice questions across 1 topic, including Applied Cryptography.

Field: Applied Cryptography

Try it: questions about Authenticated encryption (AEAD)

Which of the following does authenticated encryption (AEAD) such as AES-GCM provide in a single operation?

  1. AOnly the confidentiality of the data; detecting tampering requires a separate digital signature
  2. BThe confidentiality of the data and verification that the ciphertext and associated data have not been tampered with
  3. CNon-repudiation towards third parties, in addition to confidentiality and tamper detection
Show answer and explanation

Answer: B. The confidentiality of the data and verification that the ciphertext and associated data have not been tampered with

Authenticated encryption (AEAD: authenticated encryption with associated data) computes an authentication tag while encrypting and verifies the tag when decrypting; if the ciphertext has been tampered with, it returns an error without releasing any plaintext. Headers and other data that are not encrypted but must be protected against tampering can also be included in the tag computation as "associated data". GCM is a mode that combines encryption in CTR mode with authentication by GHASH, which uses multiplication in a Galois field, and TLS 1.3 uses only AEAD. Because the tag is made with a shared key, like a message authentication code it cannot provide non-repudiation.

Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?

  1. AIt need not be secret and may be generated by a counter, but the same value must never be used twice with the same key
  2. BIf an attacker learns it, the plaintext leaks, so it must be kept secret and stored securely just like the key
  3. CIt must be chosen at random every time, and generating it with a counter incremented by 1 destroys security
Show answer and explanation

Answer: A. It need not be secret and may be generated by a counter, but the same value must never be used twice with the same key

What is required of a GCM nonce is that its values never repeat (are unique) under the same key. It need not be secret, and a counter that counts transmissions satisfies the requirement. Using the same nonce twice with the same key leaks the XOR of the plaintexts, as in CTR mode, and also allows the value used for authentication to be recovered, so tags may be forged. When nonces are chosen at random, a limit is placed on the number of encryptions under one key to avoid accidental repeats (2^32 in NIST SP 800-38D).

Authenticated encryption (AEAD) in the explanations

Questions that mention Authenticated encryption (AEAD) (8)

  1. Which of the following does authenticated encryption (AEAD) such as AES-GCM provide in a single operation?
  2. Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?
  3. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?
  4. Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?
  5. AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?
  6. A server receiving data encrypted in CBC mode returned different errors when the padding after decryption was incorrect and when the padding was correct but the check of the contents failed. Which of the following correctly describes this situation?
  7. In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?
  8. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Block cipher mode of operation TLS AES (Advanced Encryption Standard) Nonce Diffie–Hellman key exchange RSA cryptosystem Message authentication code Hash function HMAC Forward secrecy

Back to the glossary