Symmetric Encryption and AEAD: AES-GCM, ChaCha20-Poly1305, Nonce Management and Envelope Encryption
Encrypting a field correctly today takes an AEAD mode such as AES-GCM, a fresh nonce for every encryption and associated data that binds the ciphertext to its context; key rotation adds a versioned format and envelope encryption. With real outputs we cover the problems of ECB and CBC, the nonce limit, wrapping DEKs with AES-KWP, encrypting Bookstore's Customer.Phone with an EF Core value converter and a blind index, and how Always Encrypted compares.
14 Nov 2026
·
16 min
·
1
