MACthenencrypt

MACthenencrypt, often short for MAC-then-encrypt, is a cryptographic construction in which a Message Authentication Code (MAC) is first computed on a plaintext message and then the concatenation of the message and its MAC tag is encrypted with a symmetric cipher. The recipient decrypts the ciphertext and then verifies the MAC to ensure both confidentiality and integrity.

In a typical implementation, separate keys are used for the MAC and for encryption. The sender computes t = MAC(K1, M), forms P = M || t, and computes C = ENC(K2, P). The transmission is C. On receiving C, the recipient decrypts to P' = DEC(K2, C), splits M' and t', and accepts the message only if t' equals MAC(K1, M').

Security considerations for MACthenencrypt depend on the properties of the underlying primitives and correct usage. If the encryption scheme is secure (e.g., IND-CPA or stronger) and the MAC is strongly unforgeable, the construction can provide confidentiality and integrity. However, it has known drawbacks and is generally considered less robust than encrypt-then-MAC or authenticated encryption (AE) schemes. Vulnerabilities can arise from improper parameter choices, misuse of a single key for multiple roles, or weaknesses in the MAC or encryption mode, potentially enabling forgery or leakage of information.

Today, MACthenencrypt is largely superseded by authenticated encryption with associated data (AEAD) schemes, such as AES-GCM or ChaCha20-Poly1305, and by the encrypt-then-MAC paradigm, which offer clearer security proofs and easier safe usage.

See also: Encrypt-then-MAC, MAC-on-Ciphertext, AEAD, AES-GCM.