What are the three ways to combine encryption with a MAC, and which one should you use?

Encrypt-and-MAC, MAC-then-Encrypt and Encrypt-then-MAC. Use Encrypt-then-MAC: encrypt first, then MAC the ciphertext, so the receiver can verify before decrypting.

* Three ways to combine encryption and a MAC — Encrypt-then-MAC (verify before decrypting) is the safe one. *

1. Encrypt-and-MAC (E&M):

C = E(K_E, M)
T = MAC(K_M, M)    ← MAC computed over plaintext
Send: (C, T)

• Problem: MAC is computed on plaintext — may leak information about M
• Used by SSH (but with mitigations)

2. MAC-then-Encrypt (MtE):

T = MAC(K_M, M)
C = E(K_E, M || T)    ← encrypt message + tag together
Send: C

• Problem: must decrypt before you can verify integrity → vulnerable to padding oracle attacks
• Used by TLS up to 1.2 with CBC ciphers (and led to padding-oracle attacks like Lucky13 and POODLE)

3. Encrypt-then-MAC (EtM):

C = E(K_E, M)
T = MAC(K_M, C)    ← MAC computed over ciphertext
Send: (C, T)

• Recommended: verify MAC first, only decrypt if valid → prevents processing malicious ciphertext
• Used by IPsec ESP and the TLS 1.2 encrypt_then_mac extension; TLS 1.3 uses AEAD ciphers (AES-GCM, ChaCha20-Poly1305) that build the same guarantee in

Tip: "Encrypt-then-MAC" = the gold standard. Check integrity BEFORE decrypting to avoid processing attacker-controlled data.

Go deeper:

• Authenticated encryption (Wikipedia) — the composition orders and the attacks that killed the bad ones.