Why Encrypt-Then-MAC Beats MAC-Then-Encrypt

When combining encryption and a MAC, three orderings exist: Encrypt-then-MAC (EtM), MAC-then-Encrypt (MtE), and Encrypt-and-MAC (E&M). Each has fundamentally different security properties, and only one is provably secure in all settings.

In Encrypt-then-MAC, the plaintext is first encrypted to produce ciphertext, and then the MAC is computed over that ciphertext. The receiver can verify the MAC before ever attempting decryption, which means a tampered message is rejected immediately without revealing information.

In MAC-then-Encrypt, the MAC is computed over the plaintext, then both the plaintext and MAC are encrypted together. The receiver must decrypt the message before it can verify the MAC, which opens the door to padding oracle and decryption oracle attacks.

SSL 3.0 and TLS 1.0 used the MAC-then-Encrypt order for block ciphers in CBC mode. This design flaw was exploited by the BEAST attack in 2011 and the POODLE attack in 2014, both of which leveraged the oracle that exists when decryption happens before MAC verification.

In 2000, Bellare and Namprempre formally proved that among the three composition orders, only Encrypt-then-MAC achieves IND-CCA2 security (chosen-ciphertext security) for all combinations of secure encryption and MAC primitives. MtE and E&M can fail in certain compositions.

SSH uses Encrypt-and-MAC: the MAC is computed over the plaintext and sent alongside the ciphertext in plaintext form. While SSH has not suffered the same exploits as SSL/TLS MtE, this composition is also theoretically flawed as it can leak plaintext information through the unencrypted MAC.

Authenticated Encryption with Associated Data (AEAD) is the modern abstraction that solves the composition problem by design. AEAD integrates encryption and authentication into a single primitive, ensuring they are always combined correctly without requiring the developer to choose a composition order.

AES-GCM (Galois/Counter Mode) is the most widely deployed AEAD cipher suite. It provides authenticated encryption through a combination of CTR-mode encryption and GHASH authentication, and is hardware-accelerated via AES-NI and CLMUL instructions on modern CPUs.

TLS 1.3 made a decisive break with the past by removing all non-AEAD cipher suites. Every TLS 1.3 cipher suite uses AEAD, eliminating entire classes of vulnerabilities caused by improper manual composition of encryption and MAC primitives that plagued earlier TLS versions.

The key lesson from decades of cryptographic attacks is that manually composing encryption and MAC primitives is error-prone even for experts. Modern cryptographic libraries expose AEAD interfaces specifically to prevent developers from making composition mistakes that lead to real-world vulnerabilities.

When building systems today, always reach for an AEAD primitive such as AES-GCM or ChaCha20-Poly1305. If you must interoperate with legacy systems using separate MAC and encryption, ensure you are using Encrypt-then-MAC order and never MtE or E&M.

Which statement correctly describes the security difference between Encrypt-then-MAC and MAC-then-Encrypt?

EtM is the only provably secure composition order for separate encryption and MAC primitives. TLS 1.3 eliminates the problem entirely by mandating AEAD-only cipher suites. When in doubt, use an AEAD primitive such as AES-GCM or ChaCha20-Poly1305 and let the library handle composition correctly.