Update hash iterations in heimdal-history

Rebenchmark (admittedly not really on that newer of hardware) and
bump the hash iterations by about 10%.

diff --git a/NEWS b/NEWS
index 71924d02c9e330ac12eb92a9f6d0dcda0aecebb4..4c7408ea7036d0bf7ac9bedba4f0a253396d82b2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,13 @@ krb5-strength 3.3 (unreleased)
     heimdal-history now requires the Perl modules Const::Fast and
     JSON::MaybeXS instead of Readonly and JSON.
 
-    Explicitly erase the copy of the password made in the Heimdal plugin.
+    Increase hash iterations for heimdal-history by about 10% to maintain
+    the time required for a password hash at about 0.1 seconds on not
+    horribly modern hardware.  This will affect newly-stored history
+    entries but will not invalidate existing password history entries.
+
+    Explicitly erase the copy of the password made in the Heimdal plugin
+    before freeing memory.
 
     Add a spec file for building RPMs, contributed by Daria Phoebe
     Brashear.

diff --git a/tools/heimdal-history b/tools/heimdal-history
index 63cc3459580ec701350ba35755f90aface4e4eb4..dbf8fc5890d34a515ec46beaeebc52a570f30b84 100755 (executable)
--- a/tools/heimdal-history
+++ b/tools/heimdal-history
@@ -33,7 +33,7 @@ use Sys::Syslog qw(openlog syslog LOG_AUTH LOG_INFO LOG_WARNING);
 # The number of PBKDF2 iterations to use when hashing passwords.  This number
 # should be chosen so as to force the hash operation to take approximately 0.1
 # seconds on current hardware.
-const my $HASH_ITERATIONS => 40128;
+const my $HASH_ITERATIONS => 45144;
 
 # Path to the history database.  Currently, this must be a Berkeley DB file in
 # the old DB_HASH format.  Keys will be principal names, and values will be a