Does there exist a mode of operation that forces mac-then-decrypt? Alice sends Bob a message using AES-GCM. Bob is a software developer with just enough cryptography knowledge to be dangerous. He wants to start processing data as soon as he receives it. He observes that he can ignore the tag and just decrypt the CTR-mode ciphertext.

In every mode I can think of it is possible to decrypt a message without performing the authentication part. Does there exist a standard or named mode of operation that makes it impractical to try to skip or defer authentication?

It seems like such a scheme would necessarily be two-pass. It's fine if the first pass is always authentication and the second pass is decryption. 



I had two (incomplete) ideas for how such an encryption scheme might work. I include their descriptions because it might aid to better explain the question asked above.

My initial idea involved first encrypting plaintext using an unauthenticated algorithm and random IV. Then the ciphertext would be fed to some kind of HMAC. The first 128 bits of HMAC output would become the message tag. The remaining bits would not be published and instead be used as a tweak for encrypting the IV. 

(This prevents the recipient from decrypting the message without first performing the MAC algorithm because otherwise the IV remains unknown to the recipient. One issue is that the IV isn't authenticated.)

My second idea was to try adapting an all-or-nothing-transform, "an unkeyed, invertible, randomized transformation, with the property that it is hard to invert unless all of the output is known."
There is a type of AEAD construction, exemplified for example by the CAESAR candidate AEZ, which splits up into two components:


An enciphering scheme: "an object that is like a conventional blockcipher except that the plaintext’s length is arbitrary and variable, and, additionally, there’s a tweak" (p. 1).
An encode-then-encipher mode that enciphers the concatenation of a plaintext with a fixed number of zeroes (or some other alternatives).  On decryption, the authenticity check verifies that these final bits deciphered to zero.


The key thing is that in the enciphering scheme, a change to any bit of the ciphertext (or plaintext respectively) has a 50% chance of affecting every bit of the plaintext (or ciphertext respectively).  So attempts to modify a ciphertext will yield garbled plaintexts, and those garbled plaintexts will be safe to reveal.