I have recently been playing with Chacha20-Poly1305 in libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell the AD tag never actually gets put anywhere in the ciphertext. So if I were to simply transfer the ciphertext I would never actually be able to extract the AD portion (which is where I would like to store the nonce). And even if I were to just append the AD portion to the ciphertext afterward I am not certain the best way to retrieve it without doing something like OpenSSL with its Salted__ magic constant.

All of the examples say something like this:

#define MESSAGE (const unsigned char *) "test"
#define MESSAGE_LEN 4
#define ADDITIONAL_DATA (const unsigned char *) "123456"

unsigned long long ciphertext_len;

randombytes_buf(key, sizeof key);
randombytes_buf(nonce, sizeof nonce);

MESSAGE, MESSAGE_LEN,
NULL, nonce, key);

unsigned char decrypted[MESSAGE_LEN];
unsigned long long decrypted_len;
NULL,
ciphertext, ciphertext_len,
nonce, key) != 0) {
/* message forged! */
}


But in real life you obviously only retrieve the ciphertext and would not have ADDITIONAL_DATA without extracting it. So what is the "standard" way of handling additional data in a AEAD scheme?

EDIT: Got the OpenSSL magic constant wrong.

• Note that Additional Data is also known as Additional Authenticated Data (AAD) in other schemes, I think AAD is more common. Feb 8, 2015 at 5:54