The Authenticated Encryption with Associated Data (AEAD) primitive is the most
common primitive for data encryption and is suitable for most needs.

AEAD has the following properties:

- **Secrecy**: Nothing about the plaintext is known, except its length.
- **Authenticity**: It is impossible to change the encrypted plaintext underlying the ciphertext without being detected.
- **Symmetric**: Encrypting the plaintext and decrypting the ciphertext is done with the same key.
- **Randomization** : Encryption is randomized. Two messages with the same plaintext yield different ciphertexts. Attackers cannot know which ciphertext corresponds to a given plaintext. If you want to avoid this, use [Deterministic AEAD](https://developers.google.com/tink/deterministic-aead) instead.

### Associated data

> [!CAUTION]
> **Caution:** **Associated data is authenticated but *NOT* encrypted.**

AEAD can be used to [tie ciphertext to specific associated
data](https://developers.google.com/tink/bind-ciphertext). Suppose you have a database with the fields `user-id`
and `encrypted-medical-history`. In this scenario, `user-id` can be used as
associated data when encrypting `encrypted-medical-history`. This prevents an
attacker from moving medical history from one user to another.

Associated data is optional. If specified, decryption only succeeds if the same
associated data is passed to both encrypt and decrypt calls.

### Choose a key type

While we recommend **AES128_GCM** for most uses, there are various key types for
different needs. AES128 offers 128-bit security, and AES256 offers 256-bit
security.

The two notable security constraints when choosing a mode are:

1. QPS: How many messages are encrypted with the same key?
2. Message size: How large are the messages?

Supported key types:

- AES-CTR-HMAC (AES128_CTR_HMAC_SHA256, AES256_CTR_HMAC_SHA256) with a 16-byte Initialization Vector (IV) is the most conservative mode with good bounds.
  - Key-committing.
- AES-EAX (AES128_EAX, AES256_EAX) is slightly less conservative and slightly faster than AES128_CTR_HMAC_SHA256.
  - Not key-committing [MLGR](https://eprint.iacr.org/2023/526.pdf).
- AES-GCM (AES128_GCM, AES256_GCM) is usually the fastest mode with the strictest limits on the number of messages (2^32^) and message size (\~64GB per message). When these limits are exceeded, AES-GCM fails catastrophically by leaking plaintext and the authentication portion of the AES-GCM internal key.
  - AES-GCM is not robust \[[ABN](https://eprint.iacr.org/2008/440.pdf)\] nor key-committing \[[GLR](https://eprint.iacr.org/2017/664.pdf)\]. It is possible to generate a ciphertext that is decryptable with two different keys. This can lead to practical attacks \[[DGRW](https://eprint.iacr.org/2019/016.pdf)\]. Carefully review your threat model if the key is chosen by the adversary.
- AES-GCM-SIV (AES128_GCM_SIV, AES256_GCM_SIV) \[[RFC8452](https://tools.ietf.org/html/rfc8452)\] is resistant to accidental nonce misuse and is nearly as performant as AES-GCM. The limits on the number of messages and message size for AES-GCM-SIV with random IVs are much higher than AES-GCM's limits. When these limits are exceeded, AES-GCM-SIV fails less catastrophically: it only leaks that [two messages are equal](https://datatracker.ietf.org/doc/html/rfc8452#section-9). AES-GCM-SIV is safer to use, but is less widely used in practice.
  - [Bounds for random nonces](https://datatracker.ietf.org/doc/html/rfc8452#section-9):
    - 2^32^ messages, where each plaintext is at most 8 GiB
    - 2^48^ messages, where each plaintext is at most 32 MiB
    - 2^64^ messages, where each plaintext is at most 128 KiB
  - To use in Java, install [Conscrypt](https://conscrypt.org).
  - Not key-committing [ADGKLS](https://eprint.iacr.org/2020/1456.pdf).
- XChaCha20-Poly1305 (XCHACHA20_POLY1305) has a much greater limit on the number of messages and message size than AES-GCM, but when it does fail (very unlikely), it also leaks key material. It isn't hardware accelerated, so it can be slower than AES modes in situations where hardware acceleration is available.
  - Not key-committing [LGR](https://eprint.iacr.org/2020/1491.pdf).

> [!NOTE]
> **Note:** All listed algorithms support a minimum length of 2^32^ bytes for the plaintext and associated data.

Learn more about the [wire format](https://developers.google.com/tink/wire-format#aead) of the AEAD ciphertext.

### Security guarantees

AEAD implementations offer:

- CCA2 security.
- At least 80-bit authentication strength.
- The ability to encrypt at least 2^32^ messages with a total of 2^50^ bytes. No attack with up to 2^32^ chosen plaintexts or chosen ciphertexts has success probability larger than 2^-32^.

> [!CAUTION]
> **Caution:** **AEAD offers no secrecy guarantees for associated data.**

### Example use cases

See I want to [encrypt data](https://developers.google.com/tink/encrypt-data) and I want to [bind ciphertext to
its context](https://developers.google.com/tink/bind-ciphertext).