I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. During encryption, I update HMAC continuously, using as input chunks of encrypted data (encrypt then MAC). There are no checksums on each chunk, so the only possibility to check whether encrypted file was compromised is read whole encrypted file, calculate HMAC of the whole file and compare it with the value stored in the header of the encrypted file.
My question: on decryption, is it better to authenticate encrypted data first and then attempt to decrypt, or proceed with decryption and at the end compare HMAC from the file header with actual HMAC of the encrypted data?
Here are my considerations:
1. Calculating HMAC before decryption attempt seems to me, at first glance, more "secure". On the other hand, I have to read whole file first, calculate and compare HMAC, and then read whole file ONCE AGAIN - this time to decrypt plaintext. This decreases performance - especially if input file is big, but we do not store possibly compromised decrypted plaintext on disk (or anywhere else), so if plaintext is compromised, general user can't access it AT ALL.
2. The other option is to decrypt file straight away, write decrypted output on disk, after whole file is processed calculate HMAC - if it is not equal to the HMAC value from file header, return "file corrupted" error and delete decrypted output from disk (since we consider it invalid). This mechanism increases overall speed of decryption process, since we read input file only once. On the other hand, if input file is compromised, we have written decrypted data on disk unnecessary - because, since HMAC comparison failed, they should be (and will be) deleted after HMAC check.
Does writing decrypted data from potentially tampered encrypted file compromises the security? How would it help to an attacker? As we suppose that the attacker know everything except password, he/she would be able to decrypt compromised file as described in option 2. But I am unable to tell whether this would help him somehow.
Otherwise, we suppose that secure, very long randomly generated passwords are used for encryption, the cipher used is also secure, the password authentication is done via KDF (PBKDF2, scrypt, whatever), so, as decribed above, my only concern is how to perform authentication properly.
EDIT: Please, do NOT answer like "you must first encrypt, then HMAC". The question is NOT about this. I always encrypt, then HMAC. The question is - should I HMAC, then decrypt or vice versa?
Thank you for your attention.