> Can you help me identify the ciphersuites that provide Authenticate > Encryption with Associated Data (AEAD) from those that do not? All which explicitely name `gcm` or `chacha20_poly1305` are AEAD ciphersuites. The others use the TLS default which is MAC-then-encrypt with CBC. > Is it always the case that AE ciphersuites must be also Forward > Secrecy ciphersuites? There's no _technical_ reason that forces this to be the case. In fact [RFC 5487][1] defines `TLS_PSK_WITH_AES_128_GCM_SHA256` which uses AES-GCM (AEAD) but doesn't offer forward-secrecy. And if you don't accept a PSK suite as an answer here, [RFC 5288][2] defines `TLS_RSA_WITH_AES_128_GCM_SHA256`, which uses RSA key-transport (and thus offers no forward secrecy). **However**, AEAD is what some people call "modern crypto". And as such it is usually paired with other "modern crypto", which does usually mean that you prefer to use forward-secrecy with AEAD suites and only have the non-forward secrecy ones for fallback, after all, clients who implement AES-GCM will also have all the other modern crypto like ECDHE. > Is Authenticated Encryption (AE) is the same AEAD? or they are > different terms? Technically yes. An AE scheme only needs to deliver authenticated encryption of the plaintext, the AEAD scheme also needs to authenticate data as well, so every AEAD scheme is also an AE scheme but not the other way around. Practically however, I am not aware of any scheme that is practically used and is AE but not AEAD (and even then, conversion would be quite simple). [1]: https://www.rfc-editor.org/rfc/rfc5487#section-2 [2]: https://www.rfc-editor.org/rfc/rfc5288#section-3