What is Deterministic Authenticated Encryption? I came across something known as deterministic authenticated encryption in my studies, and a lot of people were associating it with Synthetic IV mode.
I am having trouble understanding what exactly DAE is because I thought that if something was deterministic, it didn't have a sense of authenticated encryption. It violates the confidentiality of the message -- deterministic encryption modes are prone to CPA attacks.
Can someone explain in layman's terms what exactly DAE is? How does DAE differ from just normal deterministic encryption modes like ECB mode?
Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ciphertext.

Authentication however doesn't really have to do with CPA security. It is about ensuring that the ciphertext was created by a specific party holding the secret key. In other words it provides authenticity of the ciphertext (and therefore plaintext). Furthermore it ensures that the integrity of the plaintext after decryption (and possibly the ciphertext before decryption) is maintained; i.e. that the ciphertext wasn't altered by an attacker or damaged somehow. If not the verification of the authentication tag will fail.

DAE differs with ECB in the sense that ECB doesn't provide authenticity or integrity of the ciphertext (if multiple blocks of plaintext are encrypted anyway). Furthermore ECB mode leaks information if identical plaintext blocks are encrypted. SIV mode on the other hand calculates an IV using the entire input. Even if just a single bit of plaintext is different the entire ciphertext will be indistinguishable from ciphertexts created from previous plaintexts.

This matters if you for instance wrap a large set of keys that do not encode to fully randomized blocks of data. Take for instance an RSA private CRT key, which consists of many numbers. Usually these are encoded, including the public modulus. It could well be that the same block contains only one byte of a private value. If you have many of those blocks then you will find duplicates, leaking information about the RSA private key. Horrible practices such as wrapping RSA keys using only ECB or CBC (using a zero-valued IV) are pretty wide spread.