encryptthenMAC

Encrypt-then-MAC is a cryptographic construction used to provide both confidentiality and integrity. In this design, a plaintext P is first encrypted under a symmetric algorithm to produce ciphertext C, typically using a random per-message IV. A separate MAC key is then used to compute a message authentication code tag T over the ciphertext (and, if desired, additional authenticated data such as the IV and any associated data). The transmitted payload consists of the ciphertext, the IV, and the tag.

On receipt, the tag is verified with the MAC key using the same data (C, IV, AD). If verification succeeds, the ciphertext is decrypted to obtain P; otherwise the data are rejected. Tag verification must occur before decryption to avoid exploiting decryption oracles.

Security: If the MAC is EUF-CMA secure and the encryption scheme is IND-CPA or stronger, and the tag verification is done prior to decryption, Encrypt-then-MAC provides authenticated encryption. It is a simple and well-studied construction and is widely recommended as a building block in cryptographic protocols.

Practical considerations: Use separate keys for encryption and MAC (or derive distinct keys from a master key), and fresh IVs/nonces for each message. Choose a robust MAC such as HMAC with a secure hash or a modern MAC like Poly1305; consider using an AEAD-supported scheme instead when possible. Ensure constant-time comparison of MAC tags to avoid timing side channels, and include relevant associated data in the MAC.