One Ciphertext, Two Valid Plaintexts: Why AEAD Needs Key Commitment

Modern encryption is almost always AEAD: authenticated encryption with associated data. AES-GCM and...