RFC 5116

An Interface and Algorithms for Authenticated Encryption
Standards Track
January 2008
RFC Library > Crypto Primitives > RFC 5116
Abstract: Defines a uniform interface for Authenticated Encryption with Associated Data (AEAD) algorithms. AEAD combines encryption and integrity protection in a single operation. AES-GCM and AES-CCM (used throughout 3GPP and TLS) implement this interface.
Canonical source: https://www.rfc-editor.org/rfc/rfc5116  |  IETF Datatracker

1. Introduction

▶

AEAD algorithms provide both confidentiality (encryption) and data integrity (authentication) in a single primitive. This is superior to the traditional 'encrypt-then-MAC' approach because it eliminates the risk of combining encryption and MAC incorrectly.

The AEAD interface takes a key, nonce, plaintext, and associated data (authenticated but not encrypted). It outputs ciphertext with an appended authentication tag. This interface is used by TLS 1.3, IPsec ESP, and 3GPP NAS security.

2. AEAD Interface

▶

Decryption takes the same inputs plus the received ciphertext/tag. If the tag verification fails, the decryption MUST return FAIL and no plaintext.

  AEAD Encrypt:
Inputs:  Key, Nonce, Plaintext, Associated Data (AAD)
Output:  Ciphertext || Authentication Tag
+-------+    +-------+    +----------+    +-----+
|  Key  |    | Nonce |    | Plaintext|    | AAD |
+---+---+    +---+---+    +----+-----+    +--+--+
|            |             |              |
+-----+------+------+------+------+-------+
|             |             |
v             v             v
+-----------------------------------------+
|         AEAD Algorithm                  |
|     (e.g., AES-128-GCM)                 |
+-----------------------------------------+
|                         |
v                         v
Ciphertext              Auth Tag (T)
|                         |
+----------+--------------+
|
v
C || T (transmitted)

3. Common AEAD Algorithms

▶
Algorithm Key Size Nonce Tag Usage
AEAD_AES_128_GCM 128 bits 96 bits 128 bits TLS 1.3, IPsec, 5G NAS
AEAD_AES_256_GCM 256 bits 96 bits 128 bits TLS 1.3, IPsec
AEAD_AES_128_CCM 128 bits 96 bits 128 bits CoAP, constrained IoT
AEAD_CHACHA20_POLY1305 256 bits 96 bits 128 bits TLS 1.3 (software-optimized)

4. Security Considerations

▶
  • Nonce reuse is catastrophic for GCM — completely breaks confidentiality and authentication
  • The authentication tag MUST be verified before any plaintext is released
  • AAD authentication is free — always include protocol headers as associated data
  • Tag truncation reduces security — use full-length tags unless constrained
Nonce Reuse Warning: AES-GCM with a repeated nonce for the same key reveals the XOR of two plaintexts and allows authentication key recovery. Implementations MUST ensure nonces are never reused — use a counter or random nonces with sufficient entropy.