Ciphertext is the scrambled, encrypted form of readable data, called plaintext. Encryption uses a key to produce ciphertext; decryption uses the required key to recover the plaintext. Without that key, the ciphertext should be unintelligible. section 5.1
Treat ciphertext as more than hidden text:
- Choose an appropriate encryption mode. ECB encrypts each block independently, so repeated plaintext creates repeated ciphertext patterns and may let attackers manipulate meaning without learning the key. section 5.2
- Protect ciphertext from tampering as well as inspection. AEAD binds encrypted data to optional plaintext metadata called additional authenticated data (AAD). section 5.4
- Keep the key secret while treating the encryption algorithm as public; the key, not hidden algorithm details, controls decryption. section 5.1
AES-GCM message
A Java AES-GCM operation encrypts a body with a secret key and randomly generated IV, optionally authenticates a plaintext header as AAD, and stores the IV with the resulting ciphertext and authentication tag. Decryption requires the key and matching AAD; otherwise authentication fails. section 5.4
Figure 5.9 AES in GCM mode is a black box that takes four inputs: plaintext, a secret key, an IV, and optional AAD. The authentication tag is computed using the AAD and the ciphertext. The IV, ciphertext, and authentication tag are saved to the output. To decrypt, you must provide both the encryption key and the AAD; otherwise, an error is raised.
Trace how AES-GCM combines plaintext, a secret key, an IV, and optional AAD to produce ciphertext and an authentication tag. section 5.4
