Allan Jude 85c15ab853 improve PBKDF2 performance ... The PBKDF2 in sys/geom/eli/pkcs5v2.c is around half the speed it could be GELI's PBKDF2 uses a simple benchmark to determine a number of iterations that will takes approximately 2 seconds. The security provided is actually half what is expected, because an attacker could use the optimized algorithm to brute force the key in half the expected time. With this change, all newly generated GELI keys will be approximately 2x as strong. Previously generated keys will talk half as long to calculate, resulting in faster mounting of encrypted volumes. Users may choose to rekey, to generate a new key with the larger default number of iterations using the geli(8) setkey command. Security of existing data is not compromised, as ~1 second per brute force attempt is still a very high threshold. PR: 202365 Original Research: https://jbp.io/2015/08/11/pbkdf2-performance-matters/ Submitted by: Joe Pixton <jpixton@gmail.com> (Original Version), jmg (Later Version) Reviewed by: ed, pjd, delphij Approved by: secteam, pjd (maintainer) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D8236		2017-02-19 19:30:31 +00:00
..
autofs	Fix -media to not mount ufs with "async"; it doesn't make sense when	2016-09-20 04:54:00 +00:00
bluetooth
casper	Please welcome casperd daemon. It (and its services) will be responsible for	2013-12-02 08:21:28 +00:00
defaults	Add support for encrypted kernel crash dumps.	2016-12-10 16:20:39 +00:00
devd	Sort REALTEK section and remove duplicate entry for RTL8192CU.	2017-01-24 03:00:22 +00:00
etc.aarch64	Update the arm64 ttys file to enable the correct uart based on which device	2015-10-01 09:36:18 +00:00
etc.amd64	Enable all callin ttys if the tty is an available console.	2015-10-20 16:10:46 +00:00
etc.arm	Enable ttyu1, ttyu2, ttyu3 for arm installations.	2015-06-21 19:50:02 +00:00
etc.i386	Enable all callin ttys if the tty is an available console.	2015-10-20 16:10:46 +00:00
etc.mips	Enable all callin ttys if the tty is an available console.	2015-10-20 16:10:46 +00:00
etc.powerpc	Enable all callin ttys if the tty is an available console.	2015-10-20 16:10:46 +00:00
etc.riscv	Start support for the RISC-V 64-bit architecture developed by UC Berkeley.	2015-12-11 22:55:23 +00:00
etc.sparc64	Enable all callin ttys if the tty is an available console.	2015-10-20 16:10:46 +00:00
gss
mail	Add a ${CP} alias for copying files in the build.	2015-01-16 21:39:08 +00:00
mtree	improve PBKDF2 performance	2017-02-19 19:30:31 +00:00
newsyslog.conf.d	META MODE: Update dependencies with 'the-lot' and add missing directories.	2015-12-01 05:23:19 +00:00
ntp	Revert r298887 (spelling fix) and remove $FreeBSD$ because text changes	2016-08-25 02:40:14 +00:00
pam.d	Create a rcmds package.	2016-01-21 17:33:31 +00:00
periodic	Allow 999.local to run scripts in any language	2017-02-01 23:22:54 +00:00
pkg	Give hint on how to disable the default repository.	2014-03-30 15:24:17 +00:00
rc.d	Remove pc98 support completely.	2017-01-28 02:22:15 +00:00
root	Step 1 of eliminating the "games" distribution: Move binaries to /usr/bin;	2015-02-12 05:35:00 +00:00
sendmail	If world is built with a custom sendmail.cf, use it for the distribution	2015-10-12 21:02:36 +00:00
amd.map
apmd.conf
auto_master	Stop appending "noatime" in the autofs -media map, and instead add it	2016-09-20 04:52:01 +00:00
blacklistd.conf	Add basic blacklist build support	2016-06-02 19:06:04 +00:00
crontab
csh.cshrc
csh.login
csh.logout
ddb.conf
devd.conf	Use kldload -n when loading if_deqna	2017-02-05 08:24:37 +00:00
devfs.conf
dhclient.conf
disktab	10 years too late add support for "2.88MB 3.5in Extra High Density"	2012-11-02 00:17:30 +00:00
fbtab
freebsd-update.conf	Remove remnants of BIND from /etc, since there is no BIND in base now.	2013-11-05 09:30:06 +00:00
ftpusers	Remove most of the ATF tools and the _atf user.	2013-10-12 06:06:53 +00:00
gettytab	Add 3wire and std as terminal types/classes. These are similar to	2014-03-09 20:51:14 +00:00
group	Fix regression introduced on r293801.	2016-01-27 06:28:56 +00:00
hosts
hosts.allow	Allow info to display correctly in for varying tabstop settings	2014-12-24 01:50:44 +00:00
hosts.equiv
hosts.lpd
inetd.conf	Add an example inetd(8) entry for the Prometheus sysctl exporter.	2016-12-21 08:32:20 +00:00
libalias.conf
libmap.conf	Include /usr/local/etc/libmap.d/ by default.	2013-08-01 05:50:42 +00:00
login.access
login.conf	Fix handling of umtxp resource limit in sh(1)/ulimit(1), limits(1), add	2016-03-12 14:54:34 +00:00
mac.conf
Makefile	Fix packaging /usr/share/examples/etc.	2016-10-31 21:11:46 +00:00
Makefile.depend	META MODE: Update dependencies with 'the-lot' and add missing directories.	2015-12-01 05:23:19 +00:00
man.alias
master.passwd	Capitalize "LDAP" in the description field of the _ypldap entry.	2016-05-10 12:47:36 +00:00
minfree
motd	Add the less-ambiguous freebsd-version command.	2014-11-02 19:25:31 +00:00
netconfig
netstart	Remove reference to mroute6d in /etc/netstart.	2016-06-25 12:54:27 +00:00
network.subr	network.subr: avoid unnecessary reinitialization	2016-02-29 20:21:54 +00:00
networks
newsyslog.conf	Increase the default rotation threshold of log files from 100kb to 1000kb	2016-08-24 23:02:20 +00:00
nls.alias
nscd.conf
nsmb.conf	Remove IPX support.	2014-03-14 02:58:48 +00:00
nsswitch.conf	Implement an NSS backend for netgroups and add getnetgrent_r(3).	2016-06-09 01:28:44 +00:00
ntp.conf	Update ntp.conf to use the ntpd pool feature.	2017-01-02 15:19:22 +00:00
opieaccess
pccard_ether	Do not try to recreate wlan(4) interface if it already exists.	2016-12-04 15:58:34 +00:00
pf.os	Add DragonFly BSD fingerprints to pf.os	2013-12-03 04:32:02 +00:00
phones
portsnap.conf	Now that the portsnap buildbox is generating the raw bits for INDEX-12,	2016-08-14 05:18:38 +00:00
printcap
profile
protocols	etc: minor spelling fixes.	2016-05-01 16:43:22 +00:00
rc	Use checkyesno instead of rolling my own..	2016-10-23 18:00:09 +00:00
rc.bsdextended
rc.firewall	Slight tidy up of comments before MFC	2015-06-29 07:43:09 +00:00
rc.initdiskless	etc: minor spelling fixes.	2016-05-01 16:43:22 +00:00
rc.resume	wpa_supplicant should be able to reassociate when resuming, so remove a	2013-07-04 07:32:40 +00:00
rc.sendmail
rc.shutdown	Since r275359, there is no need to provide a bogus service name.	2015-10-26 15:16:27 +00:00
rc.subr	Fix bug preventing limits(1) from being applied	2016-12-03 19:03:40 +00:00
rc.suspend
regdomain.xml	Add a new 900MHz GSM regulatory SKU for the Xagyl Communications XC900M.	2012-12-07 06:34:46 +00:00
remote
rpc
services	Add an example inetd(8) entry for the Prometheus sysctl exporter.	2016-12-21 08:32:20 +00:00
shells
snmpd.config	Move the mibII module up so uncommenting the bridge module works	2017-01-07 09:03:40 +00:00
sysctl.conf
syslog.conf	syslogd(8): add an 'include' keyword	2016-11-01 01:41:24 +00:00
termcap.small