Re: thinking about AES, VIA and the bad guys

[Damien Miller <djm@mindrot.org>]

rembrandt wrote:
> And what will happen if he rewrite 'john' a littlebit to play with oBSD
> and the AES-Engine?

1. If your attacker has master.passwd, then she has root and you are
already screwed.

2. If your user's can't choose sane passwords, then nothing will
help you.

3. You can make the password hashing more computationally expensive
(this was a design criteria). See "localcipher" in login.conf.
This control is logarithmic: each increment doubles the number of
rounds used (i.e "10" is four times more work than "8".)

-d