Is it a good or bad idea to include a password's salt in the calculation of a MAC?

Question

Say there's a cryptosystem where encryption and authentication of data is done using a key derived from a user-given password using something like PBKDF2. Is it a good or bad idea to include the PBKDF2 salt in the MAC?

In other words, which of these two systems is better?

$$Packet = Salt + IV + Enc(Data)$$ $$Output = Packet + MAC(Packet)$$

Or

$$Packet = IV + Enc(Data)$$ $$Output = Salt + Packet + MAC(Packet)$$

Assuming $Output$ is the value being transmitted.

A real system like this would obviously be more complicated. This is just to give a rough idea of what I mean.

One argument for this is that it prevents the salt from being modified without notice. But you already get this from the salt deriving the MAC key.

One argument against this is that it allows for a piece of the MAC'd data to have influence on the derived key to calculate said MAC. But this shouldn't be feasible to attack given good KDF and MAC functions.

Which is better? Is there a difference?

Answer 1

It seems unwise to give an attacker enough information to run an off-line attack against a password even if you're using a good PBKDF. PAKE would probably be better.

Assuming you have a strong key your question still holds. I interpret it as:

Given a key $k_1$ and a salt $r$ you derive $k_2 = KDF(k_1|r)$. You then send $m, r$ and $MAC_{k_2}(m|r)$. Is it safe to do this given that a change to $r$ will change both $k_2$ and $m|r$ or is there a chance that $MAC_{k_2'}(m|r') = MAC_{k_2}(m|r)$?

And my answer is, there is no chance of that happening because it would constitute a forgery. Given a good KDF $k_2'$ will be indistinguishable from random so a valid MAC for anything under that key including $MAC_{k_2'}(m|r')$ would be a forgery.