What are the three ways to combine encryption with a MAC, and which one should you use?
Encrypt-and-MAC, MAC-then-Encrypt and Encrypt-then-MAC. Use Encrypt-then-MAC: encrypt first, then MAC the ciphertext, so the receiver can verify before decrypting.
* Three ways to combine encryption and a MAC — Encrypt-then-MAC (verify before decrypting) is the safe one. *
1. Encrypt-and-MAC (E&M):
$$\begin{aligned} C &= E(K_E, M) \\ T &= \mathrm{MAC}(K_M, M) && \text{(MAC computed over plaintext)} \\ \text{send: } & (C, T) \end{aligned}$$
- Problem: MAC is computed on plaintext — may leak information about $M$
- Used by SSH (but with mitigations)
2. MAC-then-Encrypt (MtE):
$$\begin{aligned} T &= \mathrm{MAC}(K_M, M) \\ C &= E(K_E, M \mathbin\Vert T) && \text{(encrypt message + tag together)} \\ \text{send: } & C \end{aligned}$$
- Problem: must decrypt before you can verify integrity → vulnerable to padding oracle attacks
- Used by TLS up to 1.2 with CBC ciphers (and led to padding-oracle attacks like Lucky13 and POODLE)
3. Encrypt-then-MAC (EtM):
$$\begin{aligned} C &= E(K_E, M) \\ T &= \mathrm{MAC}(K_M, C) && \text{(MAC computed over ciphertext)} \\ \text{send: } & (C, T) \end{aligned}$$
- Recommended: verify MAC first, only decrypt if valid → prevents processing malicious ciphertext
- Used by IPsec ESP and the TLS 1.2
encrypt_then_macextension; TLS 1.3 uses AEAD ciphers (AES-GCM, ChaCha20-Poly1305) that build the same guarantee in
Tip: "Encrypt-then-MAC" = the gold standard. Check integrity BEFORE decrypting to avoid processing attacker-controlled data.
Go deeper:
Authenticated encryption (Wikipedia) — the composition orders and the attacks that killed the bad ones.