I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-Then-Encrypt vs. Encrypt-Then-Hash, but in this case I am seeking insights on the security aspects of a specific authentication protocol employing a keyed hash function:

$$Alice \xrightarrow{m||h_k(m)} Bob$$

In this setup, where $m$ denotes the transmitted message from Alice to Bob and $k$ represents the shared secret key, the message travels over a public channel susceptible to modification and message insertion by attackers.

Assume we utilize the encryption function $E_k$ of a one-key cipher and a hash function $h$. The cipher is deemed secure, and $h$ possesses the weak collision resistance property and is one-way.

Given that $m$ is public and the hash function $h$ satisfies weak collision resistance, which of the following keyed hash functions provides greater security?

  1. $$h_k(m) = h(E_k(m))$$
  2. $$h_k(m) = E_k(h(m))$$

My understanding is that Hash-Then-Encrypt might offer similar security to Encrypt-Then-Hash due to the computational infeasibility of an attacker finding another $m'$ such that $h(m) = h(m')$. Can someone confirm or provide additional insights on this?

  • $\begingroup$ A keyed Hash function is a MAC! $\endgroup$
    – kelalaka
    Commented Oct 31, 2023 at 11:03
  • $\begingroup$ Oh yeah, it acts as a MAC in this case, yes. Would MAC-Then-Encrypt be less secure in this case for the exact reason that it is mathematically possible to find a collision? Even if it's computationally infeasible and basically the same as winning in the lottery? $\endgroup$
    – Hero
    Commented Oct 31, 2023 at 11:05
  • $\begingroup$ See HMAC proof or KMAC constructions. This recovers a proof-based guarantee since no known attacks compromise the pseudorandomness of the compression function, and it also helps explain the resistance to attack that HMAC has shown even when implemented with hash functions whose (weak) collision resistance is compromised $\endgroup$
    – kelalaka
    Commented Oct 31, 2023 at 11:09
  • 1
    $\begingroup$ So, from the HMAC proof, both could be said to be resistant to attacks, even if collisions exist? $\endgroup$
    – Hero
    Commented Oct 31, 2023 at 11:17
  • $\begingroup$ Do I understand correctly that the keyed hash (i.e. MAC) function consists of encrypting the message and then hashing it using a normal, unkeyed hash, or encrypting an unkeyed hash over the message? $\endgroup$
    – Maarten Bodewes
    Commented Oct 31, 2023 at 17:44

1 Answer 1


After talking to some professors at my university, I have come to the following answer, which I'd like to share:

First of all, what is called "weak collision resistance" here is also what's often referred to as the 2nd pre-image resistance property.

Now, while the 2nd pre-image resistance / weak collision resistance property is usually defined as "computationally infeasible" to compute another $m'$ such that $h(m') = h(m)$, it is still (although very unlikely) mathematically possible to find such a $m'$. It's like winning the lottery - not very likely, but still technically possible.

And since this question simply asks "which is more secure", then Encrypt-Then-Hash (1) is the more secure implementation out of the two. But if this was in a practical setting, one could argue that they both provide the same level of security.

  • $\begingroup$ However, in the context of AEAD/AE, you want a collision-resistant MAC for the scheme to be committing. Therefore, weak collision resistance doesn't provide the same level of security as it enables vulnerabilities that full collision resistance does not. $\endgroup$ Commented Nov 9, 2023 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.