15.2 Authenticated encryption – generic composition
An authenticated encryption (AE) scheme is a symmetric-key encryption scheme that provides both confidentiality as well as message integrity and authenticity.
Roughly speaking, sender Alice encrypts her plaintext and, in addition, computes a message authentication code (MAC, see Chapter 11, Hash Functions and Message Authentication Codes) over the ciphertext. The MAC serves as a tag to ensure the integrity and authenticity of the ciphertext. Receiver Bob validates the message’s integrity and authenticity by recomputing the MAC and checking that it is equal to the MAC attached to Alice’s message.
If Bob’s verification is successful, he can be sure that the received ciphertext is untampered and was indeed sent by Alice. So, Bob decrypts the ciphertext and processes the obtained plaintext.
The traditional way of implementing AE, called generic composition, is a combination of encryption (to achieve confidentiality...
