Processing unauthenticated AEAD data

[nwalfield]

As defined by 4880bis, AEAD can have very large (exabyte-sized) chunks. This leaves implementations with two choices: fail to buffer large chunks and thereby fail to parse the message, or process unauthenticated data. Many people argue and it has been codified in RFC 5116 (Section 2.2) that unauthenticated data should not be processed:

[The authenticated decryption operation]
has only a single output, either a plaintext value P or a special
symbol FAIL that indicates that the inputs are not authentic.

Unfortunately, RNP does this as does gpg.

[hannob]

Ultimately this is somewhat "variations of efail", but probably deserves to be mentioned explicitly.