Chapter 2 of 6 · 4 practices · 5 min · 4-question quiz
Encrypting data with AEAD
Authenticated encryption keeps data secret and detects tampering in one step. Most of the risk sits in nonces, associated data and how you encrypt with public keys.
Start: Default to an AEAD: AES-GCM, ChaCha20-Poly1305 or XChaCha20-Poly13054 practices in this chapter
- 1Default to an AEAD: AES-GCM, ChaCha20-Poly1305 or XChaCha20-Poly1305An AEAD (authenticated encryption with associated data) encrypts the plaintext and produces a tag that fails verification if a single bit of the ciphertext, the nonce or the associated data changes…
- 2Never reuse a nonce with the same keyAEAD security depends on each (key, nonce) pair being used once. With AES-GCM and ChaCha20-Poly1305, reusing a nonce under the same key can reveal the XOR of two plaintexts and let an attacker forge…
- 3Bind ciphertext to its context with associated dataAn AEAD tag can also cover associated data: values that are not encrypted but must not change. Without it, an attacker who can write to your database can swap encrypted fields between rows. User A's…
- 4Encrypt to a public key with HPKE or a sealed box, not raw RSAWhen the sender should not hold a decryption key (a browser encrypting to your backend, one service sealing data for another), you need public-key encryption. OWASP's guidance: Use a maintained…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.