Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX? If yes, how do I go about using it?
My current understanding is:
- E = encrypt(plaintext)
- H = hash(E)
- output(H || E)
Is that correct?
Encrypt-then-MAC has been standardized in ISO/IEC 19772:2009 hence it is safe to assume all the properties that you mentioned.
To the best of my knowledge, the best way to perform EtM is:
Not quite. The reason you don't want to compute $H(E)$ is that anyone can compute that, given they know what function $H$ is and so your recipient will not be able to verify the response. What you're looking for is called HMAC (RFC 2104) which includes two other components: a key and padding.
Specifically, given some secret $s$, some message $m$, $p_o = 0x5c5c5c...$, $p_i = 0x363636...$, a suitable hash function $H$, $\oplus$ meaning the xor operation and $||$ meaning append then the HMAC scheme is:
$$HMAC(k, m, H) = H((k \oplus p_o) || H((k \oplus p_i) || m)).$$
To answer your other question, the EAX paper might be of interest. Specifically, EAX is built upon the OMAC construct which provides a message authentication code system based on a block cipher. As such, both systems essentially use MACs, but EAX's comes built in.