I used to figure that message authentication codes function like digital signatures: a hash of a message is calculated and then encrypted with a secret key. To verify the authenticity of a message, the recipient calculates the hash of the message, decrypts the MAC with the secret key, and compares the two. I have not seen a single MAC that works like this. Is this insecure?
Actually, there are Carter-Wegman MACs that work like this; of course, there the "hash" function is not a cryptographical hash function, but instead it is an almost-universal hash (with a key).
If we replace this almost-universal hash, well, we run into some potential problems.
The first one is the malleability of some encryption methods. If we were to use, say, counter mode, then it would be easy to modify the message arbitrarily. All one would need to do is compute the hashes of both the original message, and the modified one, and xor in both to the encrypted MAC; this modified MAC would decrypt to the hash of the modified message. Carter-Wegman MACs don't run into this problem, because we assume that an attacker cannot compute the almost-universal hash function (because they don't have the key).
One way to attempt to get around this problem is simply use ECB mode, and encrypt only one block -- that is certainly not malleable. This runs into the second potential problem -- hash collisions. If we use only 128 bits of the hash, someone can find two plaintexts that share those 128 bits, obtain the MAC for one, and then he has found a valid MAC for the other message. While clearly this isn't as severe as the first problem (where the attacker can generate a valid MAC for any message), it's still enough for us to be wary of this. Again, Carter-Wegman MACs don't run into this problem.
So, it can potentially work; however we need to choose our encryption method carefully.