Exercise 3: Which Scheme Defeats the Padding Oracle Attack — Possible Solution
====================================================================

Encrypt-then-MAC is the safest of the three against a padding oracle
attack, per the chapter's own comparison table.

What happens differently at the moment a tampered ciphertext arrives:

WITH ENCRYPT-THEN-MAC:
The MAC was computed over the CIPHERTEXT itself. When a tampered
ciphertext arrives, the receiver's very first step is to recompute the
MAC over the received ciphertext and compare it to the received MAC
value. Since the attacker doesn't hold the MAC key (per this chapter's
own MAC section), any tampering changes the ciphertext in a way the
MAC check catches immediately. The message is REJECTED at the MAC
verification step -- decryption, and therefore any padding-check logic
at all, is NEVER REACHED. A padding oracle attack specifically depends
on the receiver attempting decryption on attacker-tampered ciphertext
and revealing (through error behavior, timing, or a response
difference) whether the PADDING happened to be valid -- and that
padding-check code path simply never executes here.

WITH MAC-THEN-ENCRYPT OR ENCRYPT-AND-MAC:
Both of these compute the MAC over the PLAINTEXT, not the ciphertext.
This means the receiver typically has to DECRYPT the ciphertext first
(which requires checking the padding, per Chapter 6's CBC discussion)
before there is even a plaintext available to check the MAC against.
An attacker's tampered ciphertext still reaches the padding-check code
during decryption, and whatever observable difference exists between
"padding was valid" and "padding was invalid" is still exposed BEFORE
the MAC ever gets a chance to reject the message -- which is exactly
the oracle a padding oracle attack exploits.

WHY THIS WORKS AS AN ANSWER
------------------------------
This applies the chapter's own stated reasoning directly: "because the
MAC covers the ciphertext, the receiver can verify it and reject a
tampered message before ever decrypting attacker-controlled data."
The exercise asks specifically what happens differently at the moment
of arrival, and the answer is the ORDER of operations -- verify-then-
maybe-decrypt (encrypt-then-MAC) versus decrypt-then-verify (the other
two) -- which is precisely the distinction that determines whether the
vulnerable padding-check code path is ever reached with attacker-
controlled ciphertext at all.