title: Confused how to use AES and HMAC
body: <p>I'm a little bit confused how to use AES and HMAC (based on SHA-256) in a proper way when transmitting the encrypted message from server to client or vice versa</p>
  
  <p>Correct me please if the following method is wrong:</p>
  
  <ol>
  <li>Take the secure key from the key file (for example we suggest to use the AES-256 and we already have a valid 256 bit length key)</li>
  <li>Generate random IV for AES-256 to be sure that the same plain text will have different encryption output.</li>
  <li>Calculate HMAC-SHA-256 using the plain text and secure key. (The first question: should I use IV for HMAC calculation? For example append to secure key?)</li>
  <li>Encrypt the plain text using AES-256.</li>
  <li>Compose message for client as following: HMAC + IV+ ENCRYPTED_MESSAGE</li>
  </ol>
  
  <p>The biggest question is: is it possible somehow not to send IV to client but instead generate it the same way and still be crypto safe? Or is it ok to send the IV too?</p>
  
  <p>I've end up with random IV generation, because it is needed that the same plain text will end up in different encryption results.</p>