If we agree applying a cypher multiple times is more secure than once (like 3DES is more secure than DES), then there is a security argument that can be made for using Authentication-then-Encryption in practical applications.
In many network applications, only part of the data is encrypted (m
), and some data, a
(aka. additional authenticated data
, usually some header data including nounce) is authenticated but not encrypted.
In such a scenario, if we apply encryption first, then we will get A(a + C(m))
for EtA
scheme, and C(A(a+m))
for AtE
scheme. Now notice how both a
and m
are better protected by two layers in the AtE
, while a
is only protected by one layer of cryptographic operation for EtA
.
In other words, suppose both C and A use AES-128, and somebody is able to crack one pass of AES-128, but not two passes of AES-128. Then EtA
will be not secure but AtE
still is.