Relatively short description of the design goal: The goal of an encryption scheme is to provide confidentiality. It is important to know that most traditional

Relatively short description of the design goal: The goal of an encryption scheme is to provide confidentiality. It is important to know that most traditional encryption schemes, like block ciphers in CBC, CTR, OFB modes, do not provide any authenticity, i.e. while you cannot recover the plaintext from a ciphertext, you might be able to feed the decryption algorithm a ciphertext that you crafted, without the decryption algorithm having a means for detecting its lack of authenticity (e.g. flipping a bit in ciphertext generated with CTR mode will result in a flipped bit in decrypted plaintext), and in effect, making the system do things that an adversary wants it to do. In practice, this can often be more dangerous than loss of confidentiality. In order to add authenticity to an encryption scheme, you would traditionally apply a separate message authentication algorithm to the ciphertext and the initialization vector to generate an authentication tag, which you can then use to verify if the ciphertext was tampered with. There are many ways this combination can go wrong (and has gone) due to design and implementation mistakes, like sharing the key for the MAC and encryption algorithms, not authenticating the IV, not verifying the tag correctly and exposing yourself to timing attacks, applying the MAC to plaintext, as opposed to the ciphertext, etc.. For this reason, and performance implications, it is desirable to have encryption schemes that also somehow provide authenticity almost "for free", as a natural byproduct of the ciphertext generation. Encryption schemes that achieve that, like OCB, CCM, CWC, and GCM modes, are called Authenticated Encryption. Most of the regular authenticated encryption schemes rely on passing a unique number when encrypting each message, called nonce or initialization vector. For instance, encrypting more than one message with AES in GCM mode with the same nonce will result in total loss of authenticity, among other things. Therefore, they are not very resistant to accidental misuse, and extreme care should be taken while using them. AEZ, on the other hand, strives to be a more robust authenticated encryption scheme in the face of nonce reuse (misuse), that is, it will not face a catastrophic loss of security if a nonce is accidentally reused.