The Multi-user Security of Authenticated Encryption: AES-GCM in TLS 1.3
Authenticated-encryption with associated-data