Recently, another question here made me start thinking about authenticated encryption.
In my understanding AE allows to check whether a key is valid for decryption without even decrypting the complete ciphertext. Instead, only the MAC will be checked, which should be considerably faster.
My questions are:
- Does this feature of AE make it more vulnerable to bruteforce attacks?
- Why is this not significant? (It can't be, since TLS 1.3 allows only AEAD modes.)
- Does the defense of AE schemes against key bruteforcing boil down to the strength of the hash function, which combines the secret key and plain- or ciphertext (depending on EtM/E&M/MtE)?