Is encrypt-and-MAC secure for AES-CTR + UMAC? OpenSSH will (especially in older versions) use AES-CTR plus a MAC in encrypt-and-MAC.  This is not secure in general (meaning that there exist secure ciphers and secure MACs such that using them in encrypt-and-MAC is insecure).

However, as I understand it AES-CTR + MAC as used in SSH is secure, at least for the MAC choices actually in use, because:


The MACs used (HMAC and UMAC/VMAC + encrypt the MAC tag) are
privacy-preserving: the MAC tag does not leak any information about
the plaintext, at least for one who does not know the MAC key.  In the
case of HMAC, I believe that this follows from HMAC being a strong PRF;
in the case of UMAC/VMAC, the security of the MAC depends entirely on
encrypting the MAC before transmission, and the encryption of the MAC
also ensures that no information about the plaintext is leaked.
No encoding is done between encryption and authentication.  The data
that is encrypted and the data that is authenticated are one and the
same.
The cipher in question uses CTR mode – in other words, it is a stream
cipher.  Thus, any change to the ciphertext will cause a 1-to-1 change
in the plaintext – integrity of plaintext thus implies integrity of
ciphertexts.


My conclusion is that these cipher suites are actually secure, due to the specifics of the protocol.

Is my reasoning correct?  More importantly, is my conclusion correct?  I am not a cryptographer and have zero trust that I did not make a foolish error.
Encrypt-and-MAC does not preserve confidentiality because two encryptions of the same message will have the same mac tag, revealing the fact that the messages are equal.

Ssh includes a counter in the data the mac tag is computed over, so it never computes the mac tag for the same message twice (even if identical data is transmitted twice), so this particular weakness is not an issue.

This is not an endorsement of encrypt-and-MAC, however. Do not use it.

(If you have a strange MAC, encrypt-and-MAC can leak even more than equality, but few reasonable MACs are strange.)