When using an authenticated-encryption scheme (a shared-key mechanism that provides both privacy and authenticity) it is sometimes useful, when encrypting a message, to also authenticate some additional information which is not privacy protected. We address this associateddata problem, wherein a Sender can bind to an authenticated ciphertext C a string AD, called its associated-data, and where ...