The interface is Seal(key, nonce, plaintext, aad) → ciphertext ‖ tag and Open(key, nonce, ciphertext ‖ tag, aad) → plaintext or failure; decryption returns nothing at all when the tag does not verify. Standard AEADs: AES-GCM, ChaCha20-Poly1305, AES-CCM, AES-GCM-SIV (RFC 8452) and AES-OCB (RFC 7253), all with 128-bit tags in common use.
The nonce rule decides security: most AEADs require a nonce that never repeats under the same key, and a repeat in AES-GCM or ChaCha20-Poly1305 reveals the XOR of plaintexts and allows forgeries. Use counters or long random nonces (XChaCha20-Poly1305 has 192 bits), respect per-key usage limits, or choose a misuse-resistant mode such as AES-GCM-SIV.
TLS 1.3 uses only AEAD cipher suites; JWE content encryption (A128GCM, A256GCM, A128CBC-HS256), HPKE, age, PASETO local tokens, QUIC and SSH (chacha20-poly1305@openssh.com, aes256-gcm@openssh.com) all build on AEADs.