The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, using GHASH or Wegman-Carter authentication is not sufficient. (Indeed, in GCM, the result of GHASH is masked and not directly output.)

The proof of the general composition appears in two papers: The order of encryption and authentication... by Hugo Krawczyk, and Authenticated encryption: relations among notions... By Mihir Bellare and Chanathip Namprempre. It is important to note that the paper by Krawczyk actually shows that in some important cases it is secure to MAC-then-encrypt. However, this is only true when the operations is atomic and it is impossible to know whether the MAC was incorrect or another error occurred. However, in practice this is almost impossible to do right and has been the cause of multiple attacks on SSL over the past years. Therefore, this part of the paper should not be seen as saying that it's OK to every MAC-then-encrypt.

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, using GHASH or Wegman-Carter authentication is not sufficient. (Indeed, in GCM, the result of GHASH is masked and not directly output.)

The proof of the general composition appears in two papers: The order of encryption and authentication... by Hugo Krawczyk, and Authenticated encryption: relations among notions... By Mihir Bellare and Chanathip Namprempre. 

It is important to note that the paper by Krawczyk actually shows that in some important cases it is secure to MAC-then-encrypt. However, this is only true when the operations is atomic and it is impossible to know whether the MAC was incorrect or another error occurred. 

However, in practice this is almost impossible to do right and has been the cause of multiple attacks on SSL over the past years. Therefore, this part of the paper should not be seen as saying that it's OK to every MAC-then-encrypt.

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, using GHASH or Wegman-Carter authentication is not sufficient. (Indeed, in GCM, the result of GHASH is masked and not directly output.)

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, using GHASH or Wegman-Carter authentication is not sufficient. (Indeed, in GCM, the result of GHASH is masked and not directly output.)

The proof of the general composition appears in two papers: The order of encryption and authentication... by Hugo Krawczyk, and Authenticated encryption: relations among notions... By Mihir Bellare and Chanathip Namprempre. It is important to note that the paper by Krawczyk actually shows that in some important cases it is secure to MAC-then-encrypt. However, this is only true when the operations is atomic and it is impossible to know whether the MAC was incorrect or another error occurred. However, in practice this is almost impossible to do right and has been the cause of multiple attacks on SSL over the past years. Therefore, this part of the paper should not be seen as saying that it's OK to every MAC-then-encrypt.