freebsd-dev/etc/mtree
Allan Jude 85c15ab853 improve PBKDF2 performance
The PBKDF2 in sys/geom/eli/pkcs5v2.c is around half the speed it could be

GELI's PBKDF2 uses a simple benchmark to determine a number of iterations
that will takes approximately 2 seconds. The security provided is actually
half what is expected, because an attacker could use the optimized
algorithm to brute force the key in half the expected time.

With this change, all newly generated GELI keys will be approximately 2x
as strong. Previously generated keys will talk half as long to calculate,
resulting in faster mounting of encrypted volumes. Users may choose to
rekey, to generate a new key with the larger default number of iterations
using the geli(8) setkey command.

Security of existing data is not compromised, as ~1 second per brute force
attempt is still a very high threshold.

PR:		202365
Original Research:	https://jbp.io/2015/08/11/pbkdf2-performance-matters/
Submitted by:	Joe Pixton <jpixton@gmail.com> (Original Version), jmg (Later Version)
Reviewed by:	ed, pjd, delphij
Approved by:	secteam, pjd (maintainer)
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D8236
2017-02-19 19:30:31 +00:00
..
BSD.debug.dist Remove obsolete /usr/lib/debug/usr/lib/private dir 2017-01-20 03:14:18 +00:00
BSD.groff.dist Flesh out WITHOUT_GROFF support to DTRT. 2011-02-22 08:13:49 +00:00
BSD.include.dist hyperv/vss: Add driver and tools for VSS 2016-11-15 02:36:12 +00:00
BSD.lib32.dist Handle lib32 files during delete-old* when MK_LIB32=no. 2015-10-20 20:35:34 +00:00
BSD.libsoft.dist Add libsoft to the tree, just like lib32. 2016-01-03 04:32:05 +00:00
BSD.release.dist
BSD.root.dist syslogd(8): add an 'include' keyword 2016-11-01 01:41:24 +00:00
BSD.sendmail.dist
BSD.tests.dist improve PBKDF2 performance 2017-02-19 19:30:31 +00:00
BSD.usr.dist Update build glue for llvm/clang 3.9.1. 2016-11-26 01:13:53 +00:00
BSD.var.dist tabs -> spaces in etc/mtree 2017-01-05 02:47:56 +00:00
Makefile Add libsoft to the tree, just like lib32. 2016-01-03 04:32:05 +00:00
README Fix a small typo nit 2011-01-19 20:16:47 +00:00

$FreeBSD$

Note: If you modify these files, please keep hier(7) updated!

These files are used to create empty file hierarchies for building the
system into.  Some notes about working with them are placed here to try
and keep them in good working order.

    a)  The files use 4 space indentation, and other than in the header
        comments, should not contain any tabs.  An indentation of 4 is
        preferable to the standard indentation of 8 because the indentation
        of levels in these files can become quite deep causing the line to
        overflow 80 characters.

        This also matches with the files generated when using the
        mtree -c option, which was implemented that way for the same reason.

    b)  Only directories should be listed here.

    c)  The listing should be kept in filename sorted order.

    d)  Sanity checking changes to these files can be done by following
        this procedure (the sed -e is ugly, but fixing mtree -c to
        not emit the trailing white space would be even uglier):

            mkdir /tmp/MTREE
            mtree -deU -f BSD.X.dist -p /tmp/MTREE
            mtree -cdin -k uname,gname,mode -p /tmp/MTREE | \
		sed -e 's/ *$//' >BSD.X.new
            diff -u BSD.X.dist BSD.X.new
            rm -r /tmp/MTREE

        Note that you will get some differences about /set lines,
        and uname= gname= on certain directory areas, mainly man page
        sections.  This is caused by mtree not having a look ahead
        mechanism for making better selections for these as it
        traverses the hierarchy.

        The BSD.X.new file should NOT be committed, as it will be missing
        the correct header, and important keywords like ``nochange''.
        Simply use the diff for a sanity check to make sure things are in
        the correct order and correctly indented.

    e)  Further sanity checking of the system builds with DESTDIR=/someplace
        are more complicated, but can often catch missing entries in these
        files.  I tend to run this more complete sanity check shortly after
        the target date for a new release is announced.

        If you want details on it bug me about it via email to
        rgrimes@FreeBSD.org.