In many applications, only part of the data (m
) is encrypted, and some so-called Additional Authenticated Data (AAD, usually some header data including nuance) a
is only authenticated but not encrypted.
Here is my argument: When AAD is used, Authentication-then-Encryption provides an additional layer of protection for AAD than Encryption-then-Authentication, thus one may argue it could be more secure in certain usages.
When AAD a
is used, if we use Encryption-then-Authentication, we will get:
E(m) + A(a + E(m))
for scheme, which means we encrypt `m` first, and then concatenate it with a, and then encrypt the result. Notice how `a` is only protected by one layer of cryptographic operation, the MAC operation `A`.And if we use Authentication-then-Encryption, we will get
E(m + A(a+m))
which means we first encrypt concatenated `a` and `m`, then concatenate the resulted MAC code with `m`, and then do the encryption. Notice `a` is effectively protected by two layers of cryptographic operations, both `A` and `E`.Now suppose the authentication method is somehow broken and the encryption is not, which is not that far-fetched since some MAC algorithms (like HMAC-MD5) is indeed found weak, then a
will be fully exposed to tampering when using Encryption-then-Authentication. The same cannot be said for Authentication-then-Encryption.