= Authenticated encryption
<Authenticated encryption> combines message confidentiality with protection against unauthorized alteration. Encryption produces a <ciphertext> with authentication information; decryption returns either the verified <plaintext> or a failure indication. Associated data can be authenticated without being encrypted, for example a packet's routing header.<An Interface and Algorithms for Authenticated Encryption by D. McGrew>[RFC 5116, §2, authenticated encryption with associated data]{ref}
For example, a receiver should reject a modified payment amount instead of releasing a plausible but corrupted <plaintext>. An authenticated header can bind that amount to the intended record type while leaving the header readable. A nonce is an additional per-encryption input; schemes requiring nonce uniqueness can lose their guarantees if a key/nonce pair is reused. The exact rule belongs to the selected construction. Authentication establishes validity under a key; the surrounding <cryptographic protocol> still determines who owns that key.<An Interface and Algorithms for Authenticated Encryption by D. McGrew>[§§2.1–2.3 and §3.1, nonce requirements]{ref}
Back to article page
