AEAD Encryption

TLS 1.3 uses AEAD (Authenticated Encryption with Associated Data) ciphers exclusively. Examples:

• AES-128-GCM
• AES-256-GCM
• ChaCha20-Poly1305

AEAD combines:

• Encryption: makes data unreadable without the key.
• Authentication: detects any tampering.

Both in one operation. Avoid the historical disasters of MAC-then-encrypt, encrypt-then-MAC, etc. — many TLS 1.0/1.1 attacks (BEAST, Lucky 13, POODLE) exploited the boundary between encryption and MAC.

Interface:

encrypt(key, nonce, aad, plaintext) -> ciphertext + tag
decrypt(key, nonce, aad, ciphertext, tag) -> plaintext  OR  failure

• key: 16 or 32 bytes (depends on cipher).
• nonce: 12 bytes (96 bits). MUST be unique per (key, message) pair.
• aad: associated data, authenticated but not encrypted. Used for headers.
• tag: 16 bytes appended to ciphertext.

Reusing a (key, nonce) pair leaks plaintext. Catastrophic. TLS 1.3 derives nonces from sequence numbers, ensuring uniqueness.

ChaCha20-Poly1305 vs AES-GCM:

• AES-GCM: hardware accelerated (AES-NI). Fastest on x86/ARM with crypto extensions.
• ChaCha20-Poly1305: software-only friendly, faster on devices without AES-NI (low-end mobile).

TLS 1.3 negotiates whichever both sides prefer.