Encrypt-then-HMAC implementation - am I doing it right? I want to implement authenticated encryption using C#.  There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on windows 7.  In other words, there is no built-in dot net library to do AES in GMC mode that works on windows 7 or earlier. So it looks like I have to use separate calls to the C# aes and hmac routines.  Here is the pseudocode in my head.  Am I planning this correctly?

Encryption:


User supplies plaintext.
User supplies password.
CSPRNG generates 256-bit salt.
Slow key derivation function on password and salt produces 640-bit output.
First 256 bits of output becomes AES key.
Next 128 bits of output becomes AES IV.
Last 256 bits of output becomes HMAC-256 key.
AES encrypt CBC mode using (plaintext, AES key, AES IV) to produce ciphertext.
HMAC-SHA256 on IV||ciphertext (using HMAC-256 key) to produce MAC.
Publicly store salt, ciphertext, and MAC.


Decryption:


User retrieves salt, ciphertext, and MAC.
Step 2 from above.
Steps 4-7 from above.
Step 9 from above.
Compare calculated MAC to retrieved MAC.
If different, abort and tell user decryption failed.
If valid, AES decrypt CBC mode using (ciphertext, AES key, AES IV) to produce plaintext.
Display plaintext to user.
PBKDF2 alone would be bad for step 4, since the blocks of its output can

trivially be computed independently. ​ If the PBKDF you use can't directly

produce enough output, then you should compose with a fast key-based KDF.

Make sure that

the IV is part of step 9's ciphertext
and
step 5 of decryption is constant-time

.