Is AES + MAC more secure than encrypting plaintext along with its hash

Question

Suppose I want to encrypt some plaintext and I can only use an unauthenticated AES mode like CBC.

One way of adding authentication is encrypt-then-MAC, where the two different keys for AES and MAC are derived from the same passphrase using a key derivation function.

Is the above more secure than encrypting the plaintext along with its hash? When decrypting, the hash is then separated from the plaintext and verified. So if the ciphertext is tampered with, the hash verification has to fail (as long as a proper cryptographic hash is used).

Answer 1

There are many small catches when it comes to the order in which to encrypt and MAC.

Encrypt-then-MAC in addition to being most secure has additional advantages. For example, when you receive a message, you first confirm the MAC. If it does not match, you don't even start the decryption. This makes it faster (less resource intense).

While it may be possible to devise a fully secure MAC-then-encrypt scheme, if you have to ask this question, you don't have the skill and knowledge to do so (Neither do I, very few people do). It is recommended to use Encrypt-then-MAC, because it is much easier to use securely.