I am setting up a Python program to encipher messages on the following basis:
-from my password, generate 32-byte key from SHA256(password)
-generate a 16-byte IV from a PRNG
-measure the length of the plaintext and express as 2 bytes (my plaintext will be shorter than 2^16 characters)
-pad the plaintext to be a multiple of 16 bytes
-make an instance of the encryptor = AES.new(key, CBC, IV)
-generate ciphertext = encryptor.encrypt(plaintext)
-make string of concatenated length pt before padding||IV||ciphertext and send to recipient
-also send to recipient the tag from HMAC(key,concatenated string)
My question is whether for security I should use a different key for the AES encryption and for the HMAC tagging?
This seems to me unnecessary, in the sense that with a strong password the chance of finding the key by reverse engineering either the ciphertext or the tag is negligible. Or is it?