Here is the pseudocode for a routine I am designing:
encrypt(password, string): nonce1 := generate_random_nonce() nonce2 := generate_random_nonce() key := derive_key(nonce1, password) encrypted := cipher(nonce2, key, string) return (nonce1 || nonce2 || encrypted || mac(key, encrypted))
I realized that an attacker with the encrypted text might be able to brute force the key, since a mac is not slow to compute (like key derivation).
I thought about using a third nonce for the mac key instead of the ciphertext key, but the mac key should be secret so this isn't an option.
How should I correctly use a MAC to authenticate the ciphertext (and thus plaintext) in this situation?