I'd use HKDF's "expand" step to generate multiple keys from one masterkey.
Use PBKDF2 to derive that masterkey from the password and salt. i.e. replace the "extract" step of HKDF with PBKDF2.
//Extract
MasterKey = PBKDF2(salt, password, iterations)
//Expand
AES-Key = HMAC(MasterKey, "AES-Key" | 0x01)
MAC-Key = HMAC(MasterKey, "MAC-Key" | 0x01)
(where |
denotes concatenation)
Having PBKDF2 output more than its native size is a bad idea IMO. It increases the cost for the defender considerably (multiple key derivations with thousands of iterations) but doesn't increase the cost for the attacker(he can verify correctness of his password guess after one key was derived, he doesn't need both).
If you use a 512 bit hash, such as SHA-512 in PBKDF2 (PBKDF2-HMAC-SHA-512) you can also get away with simply splitting those 512 bits into two parts, using one for encryption and the other for MAC. But IMO the HKDF approach is cleaner.