Return to Answer

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nuance) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get:

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said for Authentication-then-Encryption.

Update on 2016-09-27:

*I agree with some of the top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nonce) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get:

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said for Authentication-then-Encryption.

Update on 2016-09-27:

*I agree with some of the top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nounce) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said to Authentication-then-Encryption.

Update on 2016-09-27:

*I agree with some of the top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nuance) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get:

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said for Authentication-then-Encryption.

Update on 2016-09-27:

*I agree with some of the top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nounce) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said to Authentication-then-Encryption.

What if the encryption is broken, i.e., when you wake up tomorrow, the rock solid AES becomes another DES? In that case, both schemes loses confidentiality, so it's a draw in that case.

Update on 2016-09-27:

*I agree with some of top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*

In many applications, only part of the data (m) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nounce) a is only authenticated but not encrypted.

Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.

When AAD a is used, if we use Encryption-then-Authentication, we will get

E(m) + A(a + E(m))

for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.

And if we use Authentication-then-Encryption, we will get

E(m + A(a+m))

which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.

Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said to Authentication-then-Encryption.

Update on 2016-09-27:

*I agree with some of the top comments that applying a cipher multiple times doesn't always lead to better security so I retracted that statement. But it actually is not relevant to my main point of AtE provides additional layer of security since we are not applying the same cipher to the same data twice in these A/E schemes.*