Suppose I use the following encrypt-and-MAC construction:
$E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where:
$k_1$ and $k_2$ are 256-bit keys
$n$ is a nonce
$m$ is an arbitrary-length message.
What security losses occur if I use the MAC as the nonce? (i.e. $n = \text{HMAC-SHA256}(k_2, m)$, but truncated to the appropriate length) Are there any other disadvantages to this scheme compared with typical authenticated encryption, e.g. AES-GCM?
Clearly, this scheme is distinguishable under chosen plaintext attack, since the same plaintexts always encrypt to the same ciphertexts. This is acceptable in my application, but I'm interested to know if there are other problems.