How to build a secure AE scheme with generic composition? I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed CTR-Then-CMAC scheme (mainly in order to avoid apparent fragility of GHASH as to limit impacts of accidental IV reuse with gcm)

My questions are the following:


If for instance I plan to build a composed CTR-Then-CMAC scheme, I think to process as follows 
derive two Authentication / Encryption keys from unique
input key
encrypt plaintext P using CTR mode &amp; input
Initial counter block    (ICB)
lastly  authenticate the  sequence composed of IV, AD and
Ciphertext using CMAC.
Is is correct ?    where / how can we find rules to build   correctly a composed AE    scheme from input "secure"   Encryption &amp; MAC/Authentication modes ?
the only standard which addresses such    AE generic
composition seems to be ISO/IEC 19772:2009 which includes
"Encrypt-Then-Mac" mode beside other AE/AEAD modes; but as such ISO
standard has to be ordered I didn't still get info about content of
"Encrypt-Then-Mac" mode section
You might look at EAX mode, which combines a block cipher in CTR mode with a CMAC.  However, EAX does differ from generic Encrypt-than-MAC in that EAX uses a single master key, which would be an absolute no-no for Encrypt-then-MAC.  Normally using the same key for both purposes is quite dangerous, but EAX is explicit about the use of the master key for the cipher and MAC, and EAX comes with a formal proof of security for that usage (and the entire mode).

Given that EAX (and CCM to a less flexible degree) provide a proven method for encrypting and authenticating data, for practical purposes my advice would be to just use one of the well known and trusted AEAD modes.

For theoretical purposes, the answers to Why choose an authenticated encryption mode instead of a separate MAC? and Should we MAC-then-encrypt or encrypt-then-MAC? should give you a good idea of the steps required to define a your own general composition, and how tricky it is to get all of those right.

The EAX paper also describes and proves the security of an EAX2 mode, which is a generic composition approach to create a two key AEAD mode based on a cipher and a MAC.