{
  "slug": "authenticated-encryption",
  "term": "Authenticated encryption",
  "aliases": [],
  "definition": "Authenticated encryption combines confidentiality with cryptographic integrity protection for the protected message.",
  "note": "AEAD additionally authenticates associated data without encrypting it; another layer may protect its confidentiality. RFC 5116 defines decryption as returning plaintext or failure and requires compliance with the chosen algorithm's nonce rules. It leaves anti-replay services and access decisions outside the interface. [rfc5116] A storage design therefore needs a separate trusted freshness mechanism if it must reject older valid data. [broz2018]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Authentication does not repair damaged bytes or prove that a write was durable; those are separate storage contracts.",
      "citationIds": [
        "hesela-encryption"
      ]
    }
  ],
  "related": [
    "xts-aes",
    "cryptographic-nonce",
    "dm-crypt",
    "luks",
    "dm-integrity",
    "cryptographic-hash",
    "lost-write",
    "replay-attack",
    "rollback-protection"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "rfc5116",
      "title": "RFC 5116: AEAD scope, interface and nonce requirements, sections 1.2, 2 and 3.1",
      "url": "https://www.rfc-editor.org/rfc/rfc5116.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "broz2018",
      "title": "Broz, Patocka and Matyas: Practical cryptographic data integrity protection with full disk encryption (extended version), 2018, section 2.4",
      "url": "https://arxiv.org/pdf/1807.00309v1",
      "accessed": "2026-10-15"
    },
    {
      "id": "hesela-encryption",
      "title": "Hesela: Encryption is not authentication",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#encryption-boundaries",
      "accessed": "2026-10-15"
    }
  ],
  "updated": "2026-10-15"
}