Encrypt-then-MAC, MAC-then-encrypt and encrypt-and-MAC are three ways to combine a cipher with a MAC. Say which is correct, then describe the concrete attack that unauthenticated or badly ordered…

Question

Encrypt-then-MAC, MAC-then-encrypt and encrypt-and-MAC are three ways to combine a cipher with a MAC. Say which is correct, then describe the concrete attack that unauthenticated or badly ordered encryption allowed against a real protocol.

Accepted Answer

Encrypt-then-MAC is the correct order, because the receiver verifies the tag over the ciphertext and discards a forgery before decrypting anything. MAC-then-encrypt forces the receiver to decrypt attacker-supplied ciphertext and strip padding before it can check the tag, which is what enables a padding oracle attack: the attacker submits modified ciphertext and distinguishes a padding error from a MAC error, whether by a different response or by the timing difference between failing early and failing late, and each answer reveals one byte of plaintext. Roughly 256 queries per byte recovers a whole message, so an attacker who can replay a session cookie recovers it in minutes. Encrypt-and-MAC computes the tag over the plaintext and sends both, so the tag itself can leak plaintext equality because a deterministic MAC of the same plaintext is the same tag. Encrypt-then-MAC gives ciphertext integrity, which is the property that an attacker cannot produce any new ciphertext the receiver will accept, and that in turn means the decryption routine is never exposed to chosen ciphertext. The practical instruction is to use a single authenticated encryption primitive such as AES-GCM or ChaCha20-Poly1305 rather than composing two primitives, and to compare tags in constant time so the comparison itself is not an oracle.