Are authentication tags validated?

[nishils]

Hi there,

I can't get authentication tags to validate when using chacha20-poly1305. Decryption works just fine but when I purposefully mangle the authentication tag or the additional authenticated data (aad), it decrypts just fine.

Is there a specific order to run setAAD, update, and setAuthTag or some way to detect this failure mode?

This could be a bug or just user error. Unsure at this point!

Thanks!

[MahmoudNafiseh]

Did you get an answer for this?

[nishils]

@MahmoudNafiseh nope. As far as I can tell, they are not validated and can't find a way to get them validated.