Thanks for taking the time to check it out, it is encouraging to see positive and constructive feedback. I'll be sure to change the hmac to use a separator for

Thanks for taking the time to check it out, it is encouraging to see positive and constructive feedback. I'll be sure to change the hmac to use a separator for the iv and ciphertext, that's a subtle vulnerability that you articulated well. I think you are also correct about encrypting the iv being worthless. Thinking back to when I wrote this, I believe that I originally added the encryption for that purpose exactly, to prevent modification during transmission. I later added the hmac to prevent modification of the ciphertex, but I ended up adding the iv in there too. Thanks!