Take the 2-minute tour ×  What are cryptographic reasons to
choose an authenticated-encryption mode of operation (such as
GCM) over a traditional encryption mode plus an independent MAC,
or vice versa?  Assume there is no implementation reason to pick
one or the other (crypto library supports both, no backward
compatibility constraints, etc).  share|improve this question
add comment  1 Answer  up vote 12 down vote accepted  If you
look closely at the definition of authenticated encryption
modes, you will see they all are, actually, the combination of
symmetric encryption and a MAC.  Using traditional encryption
and an independent MAC has a few tricky points, none of them
being unsolvable:    • The encryption mode will use a key, and
the MAC will also use a key; using the same key may trigger
unwanted weaknesses (e.g. if the encryption uses CBC mode and
the MAC is CBC-MAC). Solution: derive both the encryption key
and the MAC key from a "master key" through a Key Derivation
Function.    • The encryption uses a