Alice sends Bob a message using AES-GCM. Bob is a software developer with just enough cryptography knowledge to be dangerous. He wants to start processing data as soon as he receives it. He observes that he can ignore the tag and just decrypt the CTR-mode ciphertext.
In every mode I can think of it is possible to decrypt a message without performing the authentication part. Does there exist a standard or named mode of operation that makes it impractical to try to skip or defer authentication?
It seems like such a scheme would necessarily be two-pass. It's fine if the first pass is always authentication and the second pass is decryption.
I had two (incomplete) ideas for how such an encryption scheme might work. I include their descriptions because it might aid to better explain the question asked above.
My initial idea involved first encrypting plaintext using an unauthenticated algorithm and random IV. Then the ciphertext would be fed to some kind of HMAC. The first 128 bits of HMAC output would become the message tag. The remaining bits would not be published and instead be used as a tweak for encrypting the IV.
(This prevents the recipient from decrypting the message without first performing the MAC algorithm because otherwise the IV remains unknown to the recipient. One issue is that the IV isn't authenticated.)
My second idea was to try adapting an all-or-nothing-transform, "an unkeyed, invertible, randomized transformation, with the property that it is hard to invert unless all of the output is known."