think about using a derived key from the master, one for encryption one for hmac. It is harder to attack.