I am using OpenSSL 1.1.1 to implement a TLS 1.3 communication module so I tried to learn how data integrity and authentication is ensured. I read a lot about AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M to the point that I know what they are, but I do not know how they are related to each other. My Questions are

  1. I know that TLS 1.3 uses AEAD. Does that mean that it is EtM, MtE or E&M?
  2. Is GCM an EtM algorithm for block ciphers?
  3. What does OpenSSL use by default? EtM, MtE or E&M? Which are supported?

1 Answer 1


I do not know how they are related to each other.

  • EtM, MtE and E&M are generic constructions that take pairs of schemes that satisfy weaker security notions (chosen-plaintext security and unforgeability) and turn them into AEAD-secure schemes.
  • GCM is a construction that takes a 128-bit block cipher and turns it into - an AEAD-secure scheme and internally uses something like EtM for that.
  • CBC is one construction that takes a block cipher and turns it into something that is suitable for the encryption part of the EtM, MtE and E&M schemes (though it is admittedly not easy to do this right in face of padding / timing attacks).
  • Poly1305 is a one-time MAC (that is a MAC that is only secure when used at most once for a given key) which can be paired up with e.g. a block cipher (to generate one-time keys from nonces) to become a regular MAC suitable for the MAC part in EtM, MtE and E&M schemes.

What does OpenSSL use by default?

Apparently OpenSSL will default to using either AES-GCM or ChaCha20-Poly1305 for symmetric encryption

Which are supported?

TLS 1.3 abandoned the concept of these generic compositions so you will only find complete AEAD schemes to be specified as ciphersuite.

  • $\begingroup$ It appears that the OpenSSL wiki is down (due to some configuration error), so I couldn't look into the TLS 1.3 page there to see the current supported list. $\endgroup$
    – SEJPM
    Commented Sep 27, 2019 at 11:03
  • $\begingroup$ 'use' is ambiguous. Yes, OpenSSL 1.1.1 by default offers or accepts AES-128/256-GCM and ChaCha-Poly, but what is negotiated on a particular connection also depends on the peer, and whether the server uses client or server preference. $\endgroup$ Commented Sep 28, 2019 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.