• Milan Broz's avatar
    Move PBKDF internal benchmark to one place. · 5fc79f56
    Milan Broz authored
    Also cache its value in active context, so we run benchmark
    only once.
    
    The patch also changes calculated value for LUKS1 key digest
    to 125 miliseconds (it means that for full 8 used slots
    the additional slow-down is circa 1 second).
    
    Note that there is no need to have too high iteration count
    for key digest; if it is too computationally expensive, attacker
    will better decrypt of one sector with candidate key anyway.
    (Check for a known signature.)
    
    The reason to have some delay for key digest check was
    to complicate brute-force search for volume key with LUKS header
    only (and if RNG used to generate volumekey was flawed
    allowing such a search i reasonable time).
    5fc79f56
keymanage.c 33.9 KB