When encrypted data crosses an untrusted network, secrecy alone is not enough: an attacker might alter the ciphertext. Authenticated encryption with associated data (AEAD) encrypts plaintext, detects ciphertext changes, and authenticates optional metadata that remains visible. section 4.5.1 section 4.7
An AEAD exchange follows a small, practical contract:
- The sender and receiver share the same symmetric key. section 4.5.1 section 4.7
- The sender supplies plaintext and may supply associated data, such as a sender identity or protocol metadata. section 4.5.1
- The construction returns ciphertext with an authentication tag; the associated data stays unencrypted. section 4.5.1
- The receiver must provide the same associated data during decryption; altered ciphertext or incorrect associated data produces an error instead of plaintext. section 4.5.1
AES-GCM in JavaScript
A Web Crypto API operation generates an AES-GCM key, creates a random initialization value, encodes associated data and plaintext, encrypts them, and decrypts using the same parameters. The API is low-level, so safe nonce handling remains the developer’s responsibility. section 4.5.1
AES-GCM is the most widely used AEAD, while ChaCha20-Poly1305 is another widely adopted choice. AES-GCM combines AES-CTR encryption with GMAC authentication. Nonces must not be reused: reuse breaks AES-GCM and ChaCha20-Poly1305 authentication. Prefer all-in-one AEAD constructions over assembling encryption and MACs casually; AES-CBC-HMAC remains usable but is easy to misimplement. section 4.5.2 section 4.7 section 4.4
