Authenticated encryption (AEAD)

In short: AEAD methods such as AES-GCM or ChaCha20-Poly1305 encrypt data and at the same time ensure it has not been altered. Pure encryption without integrity checking is insecure.

In more detail: A block cipher in CTR/GCM mode generates a key stream combined with the plaintext. Additionally an authentication tag is computed. On decryption the tag is checked; if it does not match, nothing is output. Extra, unencrypted data (headers) can be protected too.

In Depth

• Nonce: One-time value per message. Reusing it with the same key in GCM destroys security completely.
• Tag: Usually 128 bit. Protects against tampering (bit flipping).
• Associated data: Authenticated but not encrypted (for example metadata).
• AES-GCM: Fast with hardware support (AES-NI).
• ChaCha20-Poly1305: Fast in software, good for phones.
• Padding oracle: Classic attack on CBC without integrity. AEAD avoids it.
• Never build it yourself: Use libraries such as libsodium or WebCrypto.

See also: TLS handshake in detail, Key derivation and password hashing (Argon2)