This matches the security level of AES-256 according to NSA Suite B. To
better comply with Suite B we should replace the combination of CTR mode
and HMAC with GCM, which would reduce the MAC size from 48 to 16 bytes.