Additional key derivation every 2 36 bytes of plaintext: two additional blocks of AES encryption, one additional key schedule bytes of plaintext: two additional blocks of AES encryption, one additional key schedule Authentication: one additional block of AES encryption bytes of plaintext: one additional block of AES encryption, one additional key schedule Authentication: one additional block of AES encryption