15.7 Summary
In this chapter, we covered authenticated encryption and authenticated encryption with additional data. To understand the security implications of different authenticated encryption schemes, we first introduced the security notions IND-CPA, IND-CCA, NM-CPA, INT-PTX, and INT-CTX.
We then studied the encrypt-and-MAC, MAC-then-encrypt, and encrypt-then-MAC variants of generic composition that can be used to construct an authenticated encryption scheme from simpler cryptographic primitives (namely, a block cipher and a message authentication code).
Finally, we had a closer look at the counter with cipher block chaining message authentication code as a concrete example of an AEAD algorithm. Moreover, we looked into how AEAD algorithms are used in TLS 1.3.
In the next chapter, we will take a detailed look at the Galois/Counter Mode (GCM), the mandatory-to-implement AEAD algorithm used in TLS 1.3.
