Assuming I am using different secrets/keys for each MAC pass, does running both MtE and EtM creates any vulnerability?
This is what I mean about doing MtEtM:
K0 ≠ K1 ≠ K2 addMAC(msg, K) = msg || MAC(msg, K) ciphertext = addMAC(encrypt(addMAC(msg, K1), K0), K2)
If I understood correctly, EtM has the advantage of ensuring that the recipient doesn't even use the decryption key when a message is tampered. But MtE is harder to forge.
Intuitively it sounds that combining both would make the system at least a bit more secure, but I am worried about some sort of timing attack.
Also, is the use of HMACs instead of generic MACs here a potential problem?