What is the most preferred and secure way of combining both Encryption and MAC. There was a lecture on different combining strategies adopted by different protocols on a cryptography course by coursera.

 - Authenticate then encrypt SSL 
   (MSG -> compute Tag(MSG)-> MSG + Tag -> Encrypt(MSG+Tag)
 - Encrypt then authenticate IPSEC
   (MSG -> encrypt(MSG) -> compute Tag(encrypted MSG) -> encrypted MSG + tag)
 - Encrypt and authenticate SSH 
   (MSG -> encrypt(MSG) -> compute Tag(MSG) -> encrypted MSG + tag

The lecture concluded with IPSEC approach being the correct implement but i still lacks mathematical background and why SSL approach is not preferred.

  • 1
    Another option would be to use a authenticated mode like GCM.
    – user10211
    Dec 27, 2012 at 14:27

1 Answer 1


The preferred way is to use an encryption mode which does the hard work for you; these are authenticated encryption. Usual recommendations are EAX and GCM.

If you are stuck with "classical" encryption, and an additional MAC (and you are designing your own protocol, which is a daunting task), then the theoretically "good" way is to apply the MAC on the encrypted data. This is called "encrypt-then-MAC". See this question on crypto.SE. As a summary, when you apply the MAC on the encrypted data, then whatever the MAC does cannot reveal anything on the plaintext data, and, similarly, since you verify the MAC before decrypting, then this will protect you against many chosen ciphertext attacks (when the attackers feeds you with cunningly crafted so-called "ciphertext" and observes your reactions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.