Skip to main content
1 of 12

If we agree applying a cypher multiple times is more secure than once (like 3DES is more secure than DES), then there is a security argument that can be made for using Authentication-then-Encryption in practical applications.

In many network applications, only part of the data is encrypted (m), and some data, a (aka. additional authenticated data, usually some header data including nounce) is authenticated but not encrypted.

In such a scenario, if we apply encryption first, then we will get A(a + C(m)) for EtA scheme, and C(A(a+m)) for AtE scheme. Now notice how both a and m are better protected by two layers in the AtE, while a is only protected by one layer of cryptographic operation for EtA.

In other words, suppose both C and A use AES-128, and somebody is able to crack one pass of AES-128, but not two passes of AES-128. Then EtA will be not secure but AtE still is.