# What Is AEAD? Definition and Examples

> AEAD (Authenticated Encryption with Associated Data) is a class of ciphers that encrypt data and authenticate it, plus unencrypted metadata, in one operation.

Source: https://ssl.sh/glossary/aead/
Last updated: 2026-11-10

AEAD is a cipher interface, standardized in RFC 5116, that takes a key, a nonce, plaintext and optional associated data, and returns ciphertext plus an authentication tag. Decryption fails outright if a single bit of the ciphertext or the associated data has changed. Common AEAD algorithms are [AES-GCM](https://ssl.sh/glossary/aes-gcm/), [ChaCha20-Poly1305](https://ssl.sh/glossary/chacha20-poly1305/) and AES-CCM.

## Why it matters
Before AEAD, TLS protected records with a separate MAC followed by CBC encryption ("MAC-then-encrypt"). That construction produced a long line of padding-oracle and IV attacks, including [BEAST](https://ssl.sh/glossary/beast/), Lucky Thirteen and [POODLE](https://ssl.sh/glossary/poodle/). AEAD removes the separate padding and MAC steps entirely. TLS 1.2 added AEAD suites as an option; [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) allows nothing else and uses the record header as the associated data, so it is authenticated even though it is sent in clear.

## Example
Two real TLS 1.2 suites that look similar but behave differently:

```text
ECDHE-RSA-AES128-GCM-SHA256   AEAD (AES-GCM); SHA-256 is only used for key derivation
ECDHE-RSA-AES128-SHA256       AES-CBC with HMAC-SHA256, not AEAD
```

`openssl ciphers -v` marks AEAD suites with `Mac=AEAD`.

## Common misconceptions
- **"The SHA256 in a GCM suite name is the MAC."** In AEAD suites the hash drives the PRF or HKDF; integrity comes from the AEAD tag.
- **"AEAD makes nonce handling irrelevant."** Reusing a nonce with the same key can break both confidentiality and authenticity of AES-GCM and ChaCha20-Poly1305. TLS derives each record's nonce from its sequence number to prevent reuse.
- **"Any encryption also guarantees integrity."** Unauthenticated modes such as CBC or CTR can be modified without detection; the authentication tag is what AEAD adds.

## Related terms

- [AES-GCM](https://ssl.sh/zh/glossary/aes-gcm/): AES-GCM 是以伽罗瓦/计数器模式运行的 AES 分组密码，属于 AEAD 算法，用计数器模式加密、用 GHASH 认证标签保证完整性。
- [ChaCha20-Poly1305](https://ssl.sh/zh/glossary/chacha20-poly1305/): ChaCha20-Poly1305 是把 ChaCha20 流密码与 Poly1305 认证算法组合而成的 AEAD 算法，专为纯软件实现时的高速和恒定时间而设计。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [BEAST](https://ssl.sh/zh/glossary/beast/): BEAST 是 2011 年公布的攻击（CVE-2011-3389），利用 SSL 3.0 和 TLS 1.0 中 CBC 模式可预测的 IV，逐字节解密 Cookie 等秘密。
- [POODLE](https://ssl.sh/zh/glossary/poodle/): POODLE 是 2014 年公布的攻击（CVE-2014-3566），利用 SSL 3.0 不校验 CBC 填充的缺陷，从加密连接中逐字节还原 Cookie 等秘密。