Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2? The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, it's deemed secure.

What if the iteration-count is read from the file, Is it still secure? I assume that it's secure in the sense that its encryption is fine. But what about its authentication?

I'm having a hard time finding a specific vulnerability, but the fact that the key derivation "algorithm" is not completely fixed (and can be changed by an attacker) seems insecure.
No, variable message iteration count (or more generally workfactor parameters) passed in the ciphertext (including in clear and unauthenticated) is not by itself a vulnerability, to either encryption or authentication, under the following reasonable assumptions:


The adversary can only get and manipulate the ciphertexts, and get plaintexts  (with the exception of those s/he is trying to decrypt); not alter the programs used, nor spy their execution.
PBKDF2 (or more generally a sound entropy-stretching function) is well-implemented, and used to convert password and salt to wide symmetric key(s) then used for symmetric encryption and message authentication. Here, "well-implemented" and "sound" includes:


The password-streching function does not exhibit much more collisions for different passwords than a random function for any iteration count (or more generally workfactor parameters) that can be parsed from the ciphertext (and leads to bearable execution time). For PBKDF2, an iteration count of 0 (or negative, if the encoding has provisions for that) should be rejected, as specified in RFC2898 / PKCS#5 v2.0 by
&nbsp; &nbsp; c       iteration count, a positive integer .
An hypothetical implementation accepting an iteration count of 0 and in that case giving constant output (or one depending only on salt) would be vulnerable.
The code used for decryption and authentication is not sensitive to side-channel attacks made worse by some choice of the iteration count/workfactor parameters.

There is no other implementation goof (or backdoor, perhaps disguised as goof) that the introduction of the variable workfactor can trigger.
The symmetric encryption and authentication primitives are secure, assuming their wide key has enough entropy.


Argument (not a formal proof): With the password unknown, the entropy in the symmetric keys actually used by the verifier remains high (nearly that of the password or as limited by key width, whichever is lower), including under an attack where the workfactor has been altered. The best attack for the adversary remains to find the password, and the cost of that increases with the workfactor used for a ciphertext that the adversary can intercept and is encrypted or authenticated with the right password; other ciphertexts (including any that the adversary could build without knowledge of the password) do not help towards finding the password.

The main practical danger lies in the consequences of the increased complexity introduced by variable iteration count: the code is more complex, thus more likely to contain an undetected weakness.