# Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions

I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-Then-Encrypt vs. Encrypt-Then-Hash, but in this case I am seeking insights on the security aspects of a specific authentication protocol employing a keyed hash function:

$$Alice \xrightarrow{m||h_k(m)} Bob$$

In this setup, where $$m$$ denotes the transmitted message from Alice to Bob and $$k$$ represents the shared secret key, the message travels over a public channel susceptible to modification and message insertion by attackers.

Assume we utilize the encryption function $$E_k$$ of a one-key cipher and a hash function $$h$$. The cipher is deemed secure, and $$h$$ possesses the weak collision resistance property and is one-way.

Given that $$m$$ is public and the hash function $$h$$ satisfies weak collision resistance, which of the following keyed hash functions provides greater security?

1. $$h_k(m) = h(E_k(m))$$
2. $$h_k(m) = E_k(h(m))$$

My understanding is that Hash-Then-Encrypt might offer similar security to Encrypt-Then-Hash due to the computational infeasibility of an attacker finding another $$m'$$ such that $$h(m) = h(m')$$. Can someone confirm or provide additional insights on this?

• A keyed Hash function is a MAC! Commented Oct 31, 2023 at 11:03
• Oh yeah, it acts as a MAC in this case, yes. Would MAC-Then-Encrypt be less secure in this case for the exact reason that it is mathematically possible to find a collision? Even if it's computationally infeasible and basically the same as winning in the lottery?
– Hero
Commented Oct 31, 2023 at 11:05
• See HMAC proof or KMAC constructions. This recovers a proof-based guarantee since no known attacks compromise the pseudorandomness of the compression function, and it also helps explain the resistance to attack that HMAC has shown even when implemented with hash functions whose (weak) collision resistance is compromised Commented Oct 31, 2023 at 11:09
• So, from the HMAC proof, both could be said to be resistant to attacks, even if collisions exist?
– Hero
Commented Oct 31, 2023 at 11:17
• Do I understand correctly that the keyed hash (i.e. MAC) function consists of encrypting the message and then hashing it using a normal, unkeyed hash, or encrypting an unkeyed hash over the message? Commented Oct 31, 2023 at 17:44

Now, while the 2nd pre-image resistance / weak collision resistance property is usually defined as "computationally infeasible" to compute another $$m'$$ such that $$h(m') = h(m)$$, it is still (although very unlikely) mathematically possible to find such a $$m'$$. It's like winning the lottery - not very likely, but still technically possible.