There aren't many comments here, so I'll take the liberty of adding a thing or two. This is a CAESAR submission by Rogaway and friends. It is essentially a con

There aren't many comments here, so I'll take the liberty of adding a thing or two. This is a CAESAR submission by Rogaway and friends. It is essentially a construction that uses AES and transforms it into a block cipher of arbitrary size. The authentication comes for free by appending zeroes at the end of the message and checking that they remain zeroes after decryption. This is a nice scheme for users, since it provides strong misuse guarantees. Repeating nonces won't be catastrophic like in many of the other CAESAR ciphers, and the speed is quite nice (mostly owing to the hardware-accelerated AES-NI instructions). For implementers it's not so nice, as it seems rather complicated (especially if you do not have constant-time hardware AES instructions). Like the majority of AES-based schemes, security starts to break down once you encrypt around 2^64 blocks with the same key. This is not AES's or AEZ's fault, it's a consequence of AES's small 128-bit block size. As a result, the authors do not recommend encrypting over 4 petabytes of data under the same key. It would be nice if AEZ was defined in terms of a generic block cipher, but as far as I understand the scheme is quite tied to AES.