Allan Jude 85c15ab853 improve PBKDF2 performance ... The PBKDF2 in sys/geom/eli/pkcs5v2.c is around half the speed it could be GELI's PBKDF2 uses a simple benchmark to determine a number of iterations that will takes approximately 2 seconds. The security provided is actually half what is expected, because an attacker could use the optimized algorithm to brute force the key in half the expected time. With this change, all newly generated GELI keys will be approximately 2x as strong. Previously generated keys will talk half as long to calculate, resulting in faster mounting of encrypted volumes. Users may choose to rekey, to generate a new key with the larger default number of iterations using the geli(8) setkey command. Security of existing data is not compromised, as ~1 second per brute force attempt is still a very high threshold. PR: 202365 Original Research: https://jbp.io/2015/08/11/pbkdf2-performance-matters/ Submitted by: Joe Pixton <jpixton@gmail.com> (Original Version), jmg (Later Version) Reviewed by: ed, pjd, delphij Approved by: secteam, pjd (maintainer) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D8236		2017-02-19 19:30:31 +00:00
..
geliboot_crypto.c	Add missing libc includes to fix -Wimplicit-function-declaration warnings	2016-05-31 06:24:09 +00:00
geliboot.c	GELIBoot may attempt to read past the end of the disk	2016-10-04 16:33:03 +00:00
geliboot.h	Add geliboot_crypt(..) definition to geliboot.h to mute a -Wimplicit-function-declaration	2016-05-13 11:24:55 +00:00
Makefile	improve PBKDF2 performance	2017-02-19 19:30:31 +00:00
Makefile.depend
pwgets.c