What is the most preferred and secure way of combining both Encryption and MAC. There was a lecture on different combining strategies adopted by different protocols on a cryptography course by coursera.

 - Authenticate then encrypt SSL 
   (MSG -> compute Tag(MSG)-> MSG + Tag -> Encrypt(MSG+Tag)
 - Encrypt then authenticate IPSEC
   (MSG -> encrypt(MSG) -> compute Tag(encrypted MSG) -> encrypted MSG + tag)
 - Encrypt and authenticate SSH 
   (MSG -> encrypt(MSG) -> compute Tag(MSG) -> encrypted MSG + tag

The lecture concluded with IPSEC approach being the correct implement but i still lacks mathematical background and why SSL approach is not preferred.

  • 1
    Another option would be to use a authenticated mode like GCM. – Ayrx Dec 27 '12 at 14:27
up vote 5 down vote accepted

The preferred way is to use an encryption mode which does the hard work for you; these are authenticated encryption. Usual recommendations are EAX and GCM.

If you are stuck with "classical" encryption, and an additional MAC (and you are designing your own protocol, which is a daunting task), then the theoretically "good" way is to apply the MAC on the encrypted data. This is called "encrypt-then-MAC". See this question on crypto.SE. As a summary, when you apply the MAC on the encrypted data, then whatever the MAC does cannot reveal anything on the plaintext data, and, similarly, since you verify the MAC before decrypting, then this will protect you against many chosen ciphertext attacks (when the attackers feeds you with cunningly crafted so-called "ciphertext" and observes your reactions).

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.