Simplify AES cryptor and file header by using an authenticated encryption mode (GCM) instead of CFB+HMAC.
When using derived keys, derive only once each time the program starts.