Symmetric encryption and authenticated encryption

A nonce-based scheme for authenticated encryption with associated data (AEAD) encrypts a message $M$ under a key $K$, a nonce $N$, and associated data $A$, producing a ciphertext that includes an authentication tag. Decryption with the same $(K,N,A)$ returns $M$ or rejects. The associated data, such as a packet header, is authenticated but not encrypted. Security combines privacy (ciphertexts look like random strings) and authenticity (no adversary produces a new ciphertext that decrypts), against adversaries that never repeat a nonce when encrypting under one key ([Rogaway02]). AEAD schemes are built from block ciphers, from stream ciphers, or from public permutations.

• Block cipher: a keyed permutation on fixed-size blocks, required to be a pseudorandom permutation ([NIST01]; historically [NBS77]).
• Confidentiality-only modes: CBC with an unpredictable IV and CTR with unique counter blocks ([Dworkin01]) give IND-CPA security but no integrity; their ciphertexts are malleable.
• Authenticated encryption (AE): privacy together with integrity of ciphertexts. The two together imply security against chosen-ciphertext attacks.
• Nonce: a value that must not repeat under one key; it need not be secret or random. In counter-based modes a repeated nonce reveals the XOR of plaintexts and can enable forgeries.
• Misuse-resistant AE: if a nonce repeats, the only leakage is whether the same $(N,A,M)$ was encrypted twice. Synthetic-IV (SIV) designs derive the IV from a MAC of all inputs, at the cost of a second pass ([Harkins08], [GLL19]).
• Key commitment: a ciphertext should decrypt correctly under at most one key. It is not implied by AE security: AES-GCM, ChaCha20-Poly1305, AES-GCM-SIV, and OCB3 admit ciphertexts valid under two keys ([ADG+22]). Stronger variants also commit to the nonce and associated data, and context-discovery attacks break permissive commitment for CCM, EAX, and SIV ([MLGR23]).
• Online, parallelizable, one-pass: structural properties that determine streaming and hardware cost.
• Lightweight AEAD: designs for constrained devices, here a duplex mode over a small public permutation ([DEMS14]).

• Block cipher with CTR and a MAC: CCM pairs CTR with CBC-MAC ([Dworkin04]), EAX with OMAC ([BRW04]), and GCM with a polynomial hash over $\mathrm{GF}(2^{128})$ ([Dworkin07]).
• Stream cipher with a one-time authenticator: ChaCha ([Bernstein08]) combined with Poly1305 ([NL18]).
• Synthetic IV: AES-SIV ([Harkins08]) and AES-GCM-SIV, which also derives per-nonce keys ([GLL19]).
• Permutation-based: Ascon ([DEMS14]), standardized as Ascon-AEAD128 ([TMKKC25]).
• Committing transforms: generic ways to add key or context commitment with limited ciphertext expansion ([BH24]).