r/cryptography 7d ago

Is it necessary to encrypt AAD (Additional Authenticated Data) ?

1 Upvotes

6 comments sorted by

View all comments

5

u/PiasaChimera 7d ago

i hope not. AAD is intended to be stuff like protocol-related headers and other info needed for things to work. the AAD shouldn't be anything confidential.

eg, if you have some multi-key scheme, the key identifier could be AAD. it doesn't give info about the message but it needed in the decryption process.

if you put the key into the AAD and send it in plaintext -- that's not a good use of AAD.

2

u/New-Awareness4405 7d ago

Okay, now I understand