15.4 Authenticated ciphers
Authenticated ciphers are an alternative to the block cipher and MAC combinations. An authenticated cipher algorithm is functionally equivalent to a cipher and MAC combination, but it is simpler, faster, and oftentimes more secure [11].
In addition to the ciphertext, an authenticated cipher also produces a so-called authentication tag. Formally, Authenticated Encryption (AE) is defined as:
where K is the secret key, P is the plaintext, C is the ciphertext, and T is the authentication tag.
The inverse operation, Authenticated Decryption (AD), is defined as:
Analogous to verifying a MAC, if the authentication tag T is invalid, ADK will return an error to prevent the receiving party from processing the decrypted plaintext since the ciphertext C was manipulated.
Authenticated encryption, among other things, prevents chosen-ciphertext attacks where an adversary creates ciphertexts and asks the legitimate party (an oracle in cryptographic parlance) for...
