Why is release of unverified plaintext so Bad? Lately I came across of release of unverified plaintext. I was told that this is a bad thing, but I don't really get why. Isn't unverified plaintext released just nonsense? How can this be attacked in the context of authenticated encryption?
If you don't care about the authenticity of the plaintext, why are you listening for it in the first place?  You could make up plaintext on the spot with your ears plugged up and it would be just as good!

Here's the traditional example:  You are a general.  You receive a message that says, Attack at dawn!.  Since it is late at night already, your cryptographer on staff decided to rush it to you before verifying the authenticator on it.  Alas, it was a forgery.  The secret message actually sent by your fellow general was Attack at dusk!.  That message, encrypted by a one-time pad, was intercepted in transit, and its ciphertext xored with the Attack at dawn! xor Attack at dusk!.

That is:


the original plaintext $P$ was Attack at dusk!;
the modified plaintext $P'$ is Attack at dawn!;
the original ciphertext was $C = P \oplus K$ where $K$ is the one-time pad;
the modified ciphertext is
\begin{align*}
    C' &amp;= P' \oplus K \\
       &amp;= 0 \oplus P' \oplus K \\
       &amp;= P \oplus P \oplus P' \oplus K \\
       &amp;= P \oplus P' \oplus P \oplus K \\
       &amp;= P \oplus P' \oplus C.
  \end{align*}


This may sound contrived and goofy, but mistakes like this still happen today—and much faster, because your cryptographer on staff is actually a computer making millions of decisions every second and leaking the content of your encrypted email to an attacker.

‘But, but,’ you say, ‘you contrived that example to make it really easy for the attacker to modify the message, by using xor.  Surely the well-known mode of operation like CBC thwart this?’  It does not.  In fact the additional unnecessary complexity of CBC enables other attacks.  A one-time pad with a one-time authenticator guarantees secrecy and negligible forgery probabilities; CBC guarantees nothing whatsoever about forgery—every string of blocks is a valid ciphertext in CBC, so the cryptography can do nothing to distinguish valid messages from invalid messages.

To make the one-time pad and authenticator practical, generating the one-time pad and the one-time authenticator key from a short secret by a pseudorandom function like ChaCha or AES-CTR is widely accepted to be a good method that nobody is likely to break.  Better yet, just use NaCl crypto_secretbox_xsalsa20poly1305 when you and your peer share a secret key and you want to exchange secret messages on a potentially compromised channel.  (In a sequential conversation, use message sequence numbers as the nonce; in a nonsequential conversation, pick the nonce uniformly at random and affix it to the message.)

Unauthenticated data is pure evil—don't touch it!