Encrypt-then-HMAC implementation - am I doing it right?
PBKDF2 alone would be bad for step 4, since the blocks of its output can

trivially be computed independently. ​ If the PBKDF you use can't directly

produce enough output, then you should compose with a fast key-based KDF.

Make sure that

the IV is part of step 9's ciphertext
and
step 5 of decryption is constant-time

.