At the time this article was written, AEAD modes were apparently still too new, and their implementations too untrustworthy: http://www.daemonology.net/blog/20

At the time this article was written, AEAD modes were apparently still too new, and their implementations too untrustworthy: http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.html http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.... At the moment, the best-supported AEAD mode seems to be AES-GCM, which has received a fair bit of attention since then. Alternately, {Salsa20,ChaCha20}-Poly1305 has some good implementations, e.g. http://nacl.cr.yp.to/ http://nacl.cr.yp.to/ and in TLS: https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto...