Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer?
- Encrypt the plaintext and compare against the ciphertext, or
- Decrypt the ciphertext and compare against the plaintext in $O(n)$
The former appears better to me since the contents of the ciphertext are never decrypted and loaded into memory. However, given that it's an authenticated mode of encryption, this bypasses the authentication checks that would normally occur during decryption.
So, which is hypothetically worse? Potentially allowing Eve to load decrypted ciphertexts into memory, or potentially allowing Eve to force my system into comparing plaintexts (either under Eve's control or unknown to her) to forged ciphertexts?