Is authentication length always a subset of encryption length? Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a packet, do I always know that the cipher offset will be greater than authentication offset i.e that authentication length will always be greater or equal to cipher length. For example in IPSEC, we add an esp header and trailer, we need to start encrypting after ESP but need to authenticate starting from ESP.
When we have regions of the packet that we only authenticate but not encrypt, that happens because we have data that we want to bind to the encrypted region, but we don't need to include within the encrypted region.  Examples of this are:


For IPsec, we include the sequence number (as a part of the ESP header).  We include that within the authentication (otherwise someone in the middle could change that arbitrarily), however we don't want that to be encrypted (otherwise, the decryptor would have to decrypt the packet before processing the sequence number).
For TLS, we include the sequence number.  We include that to prevent someone from replaying a TLS record; however this is different from the IPsec case, as we don't actually include the sequence number in the packet; both sides are expected to include that implicitly.


Now, the question is: does the opposite make sense?  Do we ever have a case where we care about the privacy of a field (so we need to encrypt it), but we don't care about its integrity (so if someone changes it, we don't really care)?

Personally, I'm having problems thinking of a scenario where this makes sense; if we have an encrypted region, one would expect that we do authentication over that entire region, and not pick and choose.

I also can't think of a protocol which attempts to take advantage of that (other than protocols which don't do integrity checking on anything - we try to discourage that, but they do exist).