Here's a slide deck by Bellare talking about some of the differences between encrypt-and-MAC, MAC-then-encrypt, and encrypt-then-MAC: http://cseweb.ucsd.edu/~m

Here's a slide deck by Bellare talking about some of the differences between encrypt-and-MAC, MAC-then-encrypt, and encrypt-then-MAC: http://cseweb.ucsd.edu/~mihir/cse207/s-ae.pdf http://cseweb.ucsd.edu/~mihir/cse207/s-ae.pdf