Order of MACing and Encrypting in TLS I've been working through how TLS1.0 works, and think I've basically understood most of it. One thing I can't seem to find a explanation of though is the order in which MACing and encrypting should happen. Let's say we've got the client finished message. You generate the 12 bytes of verify_data from the master secret, the finished label, and the md5/sha1 hashes of the handshake messages. At that point, do you:

a-> use your MAC key to create a hash of the 12 bytes, tag it onto the end and then encrypt the whole thing with your Write Key, or

b-> use your MAC key to create a hash of the 12 bytes, then use your Write Key to encrypt the 12 bytes, and tag the hash onto the end of the encrypted bytes?
It depends on which cipher suites and extensions the client and the server implement, enable and negotiate.


The default operation in TLS 1.2 and earlier, is MAC then Encrypt. This corresponds to alternative a in the question.
In TLS 1.2 it is possible to use AEAD cipher suites. Such cipher suites (e.g. AES-CCM but not AES-GCM) might correspond to alternative b in the question.
In all versions of TLS, the client and server might negotiate use of Encrypt then MAC with all non-AEAD cipher suites, provided that they both implement RFC 7366.