已认证 Encryption Modes (AEAD)

AEAD Concept

Authenticated Encryption with Associated Data (AEAD) encrypts plaintext and produces a tag that authenticates both the ciphertext and optional non-secret associated data. The associated data, such as protocol headers, is integrity-protected but not encrypted. Verification of the tag before releasing plaintext prevents padding oracle and malleability attacks. AEAD is the recommended approach for all new symmetric encryption designs.

GCM

AES-CTR plus GMAC, NIST standard, hardware accelerated

TLS 1.2/1.3

ChaCha20-Poly1305

Stream cipher plus MAC, software friendly

TLS 1.3, SSH

CCM

CBC-MAC plus CTR, used in 802.11i

Bluetooth

EAX

Two-pass generic composition, provably secure

academic

Nonce Management

All AEAD modes require a nonce that must never be reused with the same key. GCM is especially sensitive: nonce reuse reveals the authentication key and enables forgery. A counter-based nonce is safe if the counter never wraps or resets. Random nonces are acceptable for GCM with 96 bits, but the birthday bound limits the number of encryptions per key. Misuse-resistant nonce schemes are an active research area.

Tag Verification

The authentication tag must be verified in constant time before any plaintext is released to the application. Releasing plaintext before verification creates a decryption oracle even with AEAD. A failed verification must not distinguish between tag mismatch and other errors. Libraries that return plaintext eagerly are vulnerable to timing side channels that defeat the authentication guarantee.