Symmetric encryption
Use authenticated encryption
Choose a high-level AEAD construction so ciphertext confidentiality and integrity are verified together before plaintext is accepted.
8 minute lesson
Encryption without authentication can allow controlled ciphertext changes. Use authenticated encryption by default.
A high-level library may provide AES-GCM or ChaCha20-Poly1305 through a safe API. Decryption must fail closed when authentication fails and must not release partial plaintext. Do not select raw cipher modes yourself.
An application encrypts an account role but does not authenticate the ciphertext. A controlled bit change can alter decrypted data or produce distinguishable errors before the application notices.
AEAD checks integrity before plaintext is accepted. The application must treat every authentication failure the same and avoid fallback decryption with a weaker mode.
Encrypt a short account record with a maintained AEAD API and save the complete versioned output fields. Decrypt it successfully, then flip one byte in the ciphertext and tag. Prove both failures return no plaintext and follow the same public error path.
Lesson completed