Comment by catoc

"Never use random IVs with GCM; this breaks the authentication"

Why could one not use Encrypt-then-HMAC and HMAC-then-Decrypt with a random IV ?

(Serious question. It definitely sounds like you know what you are talking about, I just can't see what I am missing here)