 Authenticated encryption

Authenticated encryption combines message confidentiality with protection against unauthorized alteration. Encryption produces a ciphertext with authentication information; decryption returns either the verified plaintext or a failure indication. Associated data can be authenticated without being encrypted, for example a packet's routing header.^[ref]

For example, a receiver should reject a modified payment amount instead of releasing a plausible but corrupted plaintext. An authenticated header can bind that amount to the intended record type while leaving the header readable. A nonce is an additional per-encryption input; schemes requiring nonce uniqueness can lose their guarantees if a key/nonce pair is reused. The exact rule belongs to the selected construction. Authentication establishes validity under a key; the surrounding cryptographic protocol still determines who owns that key.^[ref]

Authenticated encryption (AE) is a type of cryptographic scheme that combines both encryption and authentication to ensure the confidentiality, integrity, and authenticity of data. In other words, it not only encrypts the data to protect it from unauthorized access but also verifies that the data has not been tampered with and confirms the identity of the sender.