I think Thomas Pornin's [reply](http://security.stackexchange.com/questions/20464/when-authenticating-ciphertexts-what-should-be-hmaced http://security.stackexc

I think Thomas Pornin's [reply](http://security.stackexchange.com/questions/20464/when-authenticating-ciphertexts-what-should-be-hmaced http://security.stackexchange.com/questions/20464/when-authe...) (and our subsequent back-and-forth) to a question of mine on the security StackExchange highlights exactly how hard it is to Encrypt-Then-MAC yourself properly. You should use a separate key for the encrypt phase and MAC phase. You must MAC the ciphertext, the IV, the authenticated data, and possibly a specifier for the encryption algorithm. You must also construct the MAC'd string in a way that prevents tampering with field boundaries.