EncryptionthenMAC

EncryptionthenMAC is a security construction in cryptography that combines encryption and message authentication. It involves first encrypting a message using a symmetric encryption algorithm and then calculating a Message Authentication Code (MAC) over the resulting ciphertext. This approach aims to provide both confidentiality (ensuring the message content is secret) and integrity (ensuring the message has not been tampered with).

The process typically involves an encryption key and a MAC key, which can be the same or different depending on the specific implementation. The plaintext message is encrypted to produce ciphertext. Then, a MAC is generated using the MAC key and the ciphertext as input. The final output consists of the ciphertext and the MAC tag.

When a recipient receives the encrypted message and MAC tag, they first verify the MAC tag using the MAC key and the received ciphertext. If the MAC verification fails, it indicates that the ciphertext has been altered, and the message should be rejected. If the MAC verification succeeds, the recipient proceeds to decrypt the ciphertext using the encryption key to recover the original plaintext.

While EncryptionthenMAC is a common and intuitive approach, it is important to note that it is not always the most secure composition. In certain scenarios, and with specific cryptographic primitives, it can be vulnerable to attacks. A more robust and generally recommended composition is authenticated encryption with associated data (AEAD), which integrates encryption and authentication more tightly, often providing stronger security guarantees. However, EncryptionthenMAC remains a foundational concept in understanding message security.