Given the need to transmit relatively short messages (a few dozens of bytes max), how unsecure would the following bundling of a hash in the initialization vector be?
- (A) = 64 bits of cryptographic random
- (B) = cryptographic hash of A concatenated with original Message
Then concatenate (A) with 64 bits of (B), and use that as IV for an AES CTR mode encryption.
This weakens the IV randomness to allow bundling the hash in it, and attempts to hide information the unencrypted hash in the IV could leak.
The key used for AES is itself changed every time, it is a HMAC of (secret + message counter).