Authenticated encryption with associated data (AEAD) protects encrypted content from disclosure and tampering while authenticating related data that remains readable. A message header can stay plaintext, while the body is encrypted; changing either causes authentication to fail. This avoids separately combining AES encryption with HMAC and helps prevent message-swapping attacks. section 5.4
Use AEAD with these practical expectations:
- Prefer AES-GCM, which produces ciphertext and an authentication tag from a secret key, random IV, plaintext, and optional associated data. section 5.4 section 5.7
- Never reuse an IV with the same key; common guidance uses 256-bit keys, 96-bit IVs, and 128-bit authentication tags. section 5.7
