Algorithms with the -etm suffix calculate the MAC after encryption, which is generally considered safer.