There is no value in a high work order here. An HMAC-SHA256 is used in a single run in most other protocols. If there is a need for a work order, it should be used on the key.

Completion of previous commit
Break key into encryption key and HMAC key using pbkdf
Typo in comment
Added additional test case - incorrect key.
Regression - define keysize in decrypt.
Correct use of PHPUnit

Catch exception correctly.