# Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme.

$k_1$: encryption key
$k_2$: authentication key $m_1$: plaintext message
$c_1$: encrypted message (AES-CBC with random iv)
$IV$: from PRNG

where $k_1$ and $k_2$ are independent.

$$MAC = SHA256(m_1 || IV || k_2)$$ $$c1 = AES(k_1, IV, m_1)$$ $$SEND(c1 || MAC)$$

MAC is completely insecure because it is not a proper HMAC as defined by $H((k_1 \oplus opad) || H((k_1 \oplus ipad) || m_1))$. MAC can be easily compromised by an extension attack since the MAC is in the clear.

However, I am trying to determine if the above MAC becomes secure if it is included in the $c_1$ encryption of an Authenticate-then-Encrypt (AtE) scheme.

$$SEND(AES(k_1, IV, m_1 || MAC))$$

MAC is no longer in the clear and should not be vulnerable to the extension attack. I am aware of other general attacks on AtE schemes but my specific question is whether including a $MAC=SHA256(m_1 || IV || k_2)$ in the encrypted ciphertext is cryptographically secure for message authentication.

ie: Decrypt $c_1$ using $k_1$, then immediately verify decrypted MAC with $k_2$.

This is an academic question since in practice I would use AES-GCM for authenticated encryption.

• Note that authenticate-then-encrypt and encrypt-then-authenticate are commonly referred to as MAC-then-encrypt and encrypt-then-MAC, respectively. – Artjom B. Apr 19 '15 at 17:27
• The problem with the MAC isn't length-extension; $H(m||k)$ is immune to length-extension attacks. The problem is that it's vulnerable to collision attacks on the underlying hash (unlike HMAC, which isn't). – cpast Apr 19 '15 at 19:14