Say there's a cryptosystem where encryption and authentication of data is done using a key derived from a user-given password using something like PBKDF2. Is it a good or bad idea to include the PBKDF2 salt in the MAC?
In other words, which of these two systems is better?
$$Packet = Salt + IV + Enc(Data)$$ $$Output = Packet + MAC(Packet)$$
Or
$$Packet = IV + Enc(Data)$$ $$Output = Salt + Packet + MAC(Packet)$$
Assuming $Output$ is the value being transmitted.
A real system like this would obviously be more complicated. This is just to give a rough idea of what I mean.
One argument for this is that it prevents the salt from being modified without notice. But you already get this from the salt deriving the MAC key.
One argument against this is that it allows for a piece of the MAC'd data to have influence on the derived key to calculate said MAC. But this shouldn't be feasible to attack given good KDF and MAC functions.
Which is better? Is there a difference?