I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the security of AEAD if the authentication tag is embedded to the ciphertext(e.g. by performing XOR/modular addition to the last block of ciphertext)?

  • 5
    $\begingroup$ If you xor in the tag into the last block of ciphertext, how do you recover that last block to decrypt? $\endgroup$
    – poncho
    Commented Aug 1, 2019 at 2:46
  • $\begingroup$ @poncho So that's what I missed. You're right, it's impossible to decrypt the last block. $\endgroup$
    – comepradz
    Commented Aug 1, 2019 at 2:55
  • 1
    $\begingroup$ The SIV construct masquerades tag as IV. $\endgroup$
    – DannyNiu
    Commented Aug 1, 2019 at 7:03

1 Answer 1


As discussed in RFC 5116, AEAD is the tuple of encryption and decryption function:

  • An encryption function that takes a key, a nonce, a plaintext and a header (associated data), and produce a ciphertext and a tag.

  • A decryption function that takes a key, a nonce, a ciphertext, and a header, and produces either 1) the plaintext, or 2) decryption failure indication.

The tag part you're concerned with is used to verify the decrypted plaintext (roughly speaking).

However, there's a requirement that can sometimes be a pitfall in the real world: the nonce must be unique for most AEAD algorithms to be secure. So the clever people invented "deterministic authenticated encryption" (DAE in short, a.k.a. key-wrap in some contexts). These encryption algorithms advertise the property of "misuse-resistance". And AES-SIV is one such example.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.