Combining MAC and Encryption

Question

What is the most preferred and secure way of combining both Encryption and MAC. There was a lecture on different combining strategies adopted by different protocols on a cryptography course by coursera.

 - Authenticate then encrypt SSL 
   (MSG -> compute Tag(MSG)-> MSG + Tag -> Encrypt(MSG+Tag)
 - Encrypt then authenticate IPSEC
   (MSG -> encrypt(MSG) -> compute Tag(encrypted MSG) -> encrypted MSG + tag)
 - Encrypt and authenticate SSH 
   (MSG -> encrypt(MSG) -> compute Tag(MSG) -> encrypted MSG + tag

The lecture concluded with IPSEC approach being the correct implement but i still lacks mathematical background and why SSL approach is not preferred.

Answer 1

The preferred way is to use an encryption mode which does the hard work for you; these are authenticated encryption. Usual recommendations are EAX and GCM.

If you are stuck with "classical" encryption, and an additional MAC (and you are designing your own protocol, which is a daunting task), then the theoretically "good" way is to apply the MAC on the encrypted data. This is called "encrypt-then-MAC". See this question on crypto.SE. As a summary, when you apply the MAC on the encrypted data, then whatever the MAC does cannot reveal anything on the plaintext data, and, similarly, since you verify the MAC before decrypting, then this will protect you against many chosen ciphertext attacks (when the attackers feeds you with cunningly crafted so-called "ciphertext" and observes your reactions).