I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on windows 7. In other words, there is no built-in dot net library to do AES in GMC mode that works on windows 7 or earlier. So it looks like I have to use separate calls to the C# aes and hmac routines. Here is the pseudocode in my head. Am I planning this correctly?
User supplies plaintext.
User supplies password.
CSPRNG generates 256-bit salt.
Slow key derivation function on password and salt produces 640-bit output.
First 256 bits of output becomes AES key.
Next 128 bits of output becomes AES IV.
Last 256 bits of output becomes HMAC-256 key.
AES encrypt CBC mode using (plaintext, AES key, AES IV) to produce ciphertext.
HMAC-SHA256 on IV||ciphertext (using HMAC-256 key) to produce MAC.
Publicly store salt, ciphertext, and MAC.
User retrieves salt, ciphertext, and MAC.
Step 2 from above.
Steps 4-7 from above.
Step 9 from above.
Compare calculated MAC to retrieved MAC.
If different, abort and tell user decryption failed.
If valid, AES decrypt CBC mode using (ciphertext, AES key, AES IV) to produce plaintext.
PBKDF2 alone would be bad for step 4, since the blocks of its output can
trivially be computed independently. If the PBKDF you use can't directly
produce enough output, then you should compose with a fast key-based KDF.
You might want to call out to libsodium instead. It provides password hashing and authenticated encryption built-in, with a very clean API that is easy to use correctly, as long as you remember to choose a fresh nonce every time you encrypt. It will also be faster than AES+HMAC, and uses Argon2 for password hashing, the winner of the Password Hashing Competition.
The API is C, but you can easily P/Invoke, or use the existing bindings. Be warned that the bindings do not throw on auth failure.