Say that I define a scheme where the salt is public and is MAC-ed with the message:
$k = KDF(password, salt)$
$tag = MAC_k(salt || message)$
Is it safe to salt the MAC this way? Assume that the salt is public and can be modified by an attacker.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
As Trevis says, it's at least as safe: there's a simple reduction from the salted to the non-salted MAC, assuming the latter is secure in the standard "existential unforgeability under chosen message attacks".
Assuming the adversary has full control of the salt, it also won't buy you anything security wise. In a slightly different setting, where the salt for the MAC is chosen at random and fresh for every message (but is public), salting can slightly improve security for some particular MACs, cf. "Improving the Security of MACs via Randomized Message Preprocessing" http://www.cs.nyu.edu/~dodis/ps/exact-macs.pdf
Safe, yes, but it doesn't really give you anything. The only use for a salt is to mitigate precomputation attacks against a password. Since it is public, it gives you no extra MAC security. By the property of the MAC, no adversary can forge one without knowing the key, and by the security of your KDF (which includes the salt) no one should be able to get the key. So, it is pretty much pointless.