I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:
We show that generic compositions of confidentiality-secure encryption schemes with Manipulation Detection Code (MDC) functions for authenticated encryption are, in general, weaker than "encrypt-than-authenticate" compositions using strong Message Authentication Code [edit: (MAC)] schemes. Since the former compositions lead, in general, to authenticated encryption schemes that are faster, more power-efficient, and simpler implementations than the latter, we conclude that both types of composition are necessary in practice for different application environments.
Now despite this claim I cannot find any protocols that e.g. use the Infinite Garble Extension (IGE) or double IGE (biIGE) modes of encryption.
Furthermore I found the following rather alarming notes (that are more alarming since the aforementioned paper seems to be of a later date than the attack described in the last link):
So my two related questions are:
- Can there be any practical use of MDCs in general?
- Can there be any practical use of IGE or biIGE mode encryption?