Encrypt-then-MAC when encrypting data in multiple blocks? Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ?

For example, the plaintext is 530 bytes long. We read the first 512 bytes into a buffer, process this chunk, but what happens then ?

Do we

1.


write the ciphertext of the incoming chunk
update and write the MAC of this ciphertext


or

2.


while (incoming chunk == 512B)


write the ciphertext of the incoming chunk
update the MAC with this ciphertext

write the ciphertext of the last chunk with length L (&lt;512)
update the mac with this ciphertext
write out the MAC


What about decryption ?

The goal of EtM is to be able to check the MAC before decrypting, so I think 2 is the right way of doing it, except if we just need one MAC tag at the end of the file (like with GCM).
You can do either. Though make sure you tighten up how you do the first scheme.

In the first case you are going to have multiple tags, 1 for each chunk. In the latter, you will have a single tag. If you are downloading files that are approximately 1MB, I think #2 makes sense. If you are downloading files that are 1GB or 1TB, maybe #1 makes the most sense, as you can stop the download if one of the chunks is bad.