# Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer?

1. Encrypt the plaintext and compare against the ciphertext, or
2. Decrypt the ciphertext and compare against the plaintext in $O(n)$

The former appears better to me since the contents of the ciphertext are never decrypted and loaded into memory. However, given that it's an authenticated mode of encryption, this bypasses the authentication checks that would normally occur during decryption.

So, which is hypothetically worse? Potentially allowing Eve to load decrypted ciphertexts into memory, or potentially allowing Eve to force my system into comparing plaintexts (either under Eve's control or unknown to her) to forged ciphertexts?

-
2 is considered better, because the probability of the comparison in 1 returning $\:\text{true}\:$ is always at most $$\frac1{2^{\operatorname{len}(\text{IV})}}$$
What would the probability of the comparison returning $true$ be on the second one? Would it be \$1 / 2^{len(ciphertext)}, since given a fixed IV, key, and plaintext, there should be one possible ciphertext? –  Stephen Touset Dec 4 '12 at 22:37