AES-CTR authentication salt+HMAC(ciphertext) OR HMAC(salt+ciphertext)

Question

Which one of these functions are preferred for authenticating AES-CTR?

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    hmac = generateHMAC(ciphertext, hmacKey)
    salt = encryptionSalt + hmacSalt
    return hmac + salt + ciphertext
}

VS

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    salt = encryptionSalt + hmacSalt
    hmac = generateHMAC(salt + ciphertext, hmacKey)
    return hmac + salt + ciphertext
}

Answer 1

None of them. PBKDF2 should not be used multiple times or for large output. I would recommend to use an additional KBKDF such as HKDF.

function encrypt(msg, passphrase, iterationCount) {
    sessionKey, salt = newPBKDF2(passphrase, iterationCount)
    encryptionKey = HKDF(sessionKey, 'ENC')
    encryptionIV = HKDF(sessionKey, 'IV')
    hmacKey = HKDF(sessionKey, 'MAC')
    ciphertext = aesCTR(msg, encryptionKey, encryptionIV)
    authTag = generateHMAC(ciphertext, hmacKey)
    return salt + ciphertext + authTag
}

Iteration count should be set to high for passphrases. A good passphrase is still required.

As encryption already should be randomised to achieve CPA security there is no need for a salt input to HMAC. Note that replay attacks may still work if you reuse the passphrase, of course. You need to take care of that in the protocol definition.