Cryptography Consulting LLC This document defines random-access authenticated encryption (raAE), a primitive that partitions a message into an indexed sequence of segments that can be encrypted and decrypted independently and in any order. It also specifies SEAL (Segmented Encryption and Authentication Layer), a parameterized construction that defines a family of concrete raAE instantiations, one for each valid choice of an Authenticated Encryption with Associated Data (AEAD) algorithm, a key derivation function (KDF), and associated parameters. SEAL provides two profiles, immutable (write-once) and mutable (in- place ciphertext rewrite), each with per-segment authentication. A separately configured snapshot authenticator can additionally authenticate the complete, indexed segment set. The document also defines the security notions of raAE, specifies the requirements for conforming constructions, analyzes SEAL against those requirements, and provides example cipher suites and test vectors.