cgdconfig(8): add some console feedback when calculating the number
of pkcs5_pbkdf2 iterations

replace openssl HMAC(3) with our hmac(3).

Remove trailing whitespace (patch provided by: Taylor R Campbell
<campbell+netbsd@mumble.net>)

Remove clause 3 and 4 from TNF licenses

PR/28627: Andreas Gustafsson: Try 5 times to calibrate before failing. Should
fix issues with CPU's that don't produce consistent timing output due to code
morphing or power-savings.

branches: 1.12.8; 1.12.10;
size_t != unsigned int - so don't pass the address of the former when a
pointer to the latter is expected.

3 month roland feedback timeout:
- Pass lint
- knf
- convert ints to size_t's

branches: 1.10.4;
Replaced int_encode() with be32enc().

Programs that use efun.

HMAC() wants unsigned int pointer for the final argument; make it so.

Centralize error checking for malloc,calloc,strdup.

s/milliseconds/microseconds/ in comments and a variable because it is
misleading to say one when we've been meaning the other.

Fix a longstanding algorithmic flaw in PKCS#5 key generation.

The existing pkcs5_pbdkf2 keygen method is retained functionally
as-is, for compatibility with existing params files. The corrected
algorithm, which is now the default for new params file generation, is
called pkcs5_pbkdf2/sha1.

NB. The backwards compatibility for the miscreant keygen method will
be removed at the same time as support for the previous parameters
file syntax. Sometime between now and then, users should update their
params files using -G, which will create a new params file including
an xor value so that the resulting generated key is the same; they
should also

Problem discovery and 2-char algorithm fix by Charles Blundell, messy
compat goop by me, long complicated names by Roland Dowdeswell.

Update manpage accordingly and bump date.

back out revision 1.3. this should not have been committed yet,
since it breaks backward compatibility.

noticed by recht@

add a new verification method that prompts for the pkcs#5 pbkdf2
passphrase again and checks the generated key against the original.

substantial rototill of the code.

o added new features:
o -G: generate a new paramsfile that produces the same
key as the old paramsfile,
o ffs verify_method,
o multiple keygen methods that are xor'ed together
(for n-factor authentication), and
o calibrating the iteration count of PKCS#5 PBKDF2 to
the current machine's speed.
o changed paramsfile format to allow for the new features.
o replaced open-coded parser with yacc grammar.
o lots of supporting changes.
o updated documentation to reflect new features and new
paramsfile format.

Initial checkin of cgdconfig(8), a program to configure a cgd.

replace openssl HMAC(3) with our hmac(3).

Remove trailing whitespace (patch provided by: Taylor R Campbell
<campbell+netbsd@mumble.net>)

Remove clause 3 and 4 from TNF licenses

PR/28627: Andreas Gustafsson: Try 5 times to calibrate before failing. Should
fix issues with CPU's that don't produce consistent timing output due to code
morphing or power-savings.

branches: 1.12.8; 1.12.10;
size_t != unsigned int - so don't pass the address of the former when a
pointer to the latter is expected.

3 month roland feedback timeout:
- Pass lint
- knf
- convert ints to size_t's

branches: 1.10.4;
Replaced int_encode() with be32enc().

Programs that use efun.

HMAC() wants unsigned int pointer for the final argument; make it so.

Centralize error checking for malloc,calloc,strdup.

s/milliseconds/microseconds/ in comments and a variable because it is
misleading to say one when we've been meaning the other.

Fix a longstanding algorithmic flaw in PKCS#5 key generation.

The existing pkcs5_pbdkf2 keygen method is retained functionally
as-is, for compatibility with existing params files. The corrected
algorithm, which is now the default for new params file generation, is
called pkcs5_pbkdf2/sha1.

NB. The backwards compatibility for the miscreant keygen method will
be removed at the same time as support for the previous parameters
file syntax. Sometime between now and then, users should update their
params files using -G, which will create a new params file including
an xor value so that the resulting generated key is the same; they
should also

Problem discovery and 2-char algorithm fix by Charles Blundell, messy
compat goop by me, long complicated names by Roland Dowdeswell.

Update manpage accordingly and bump date.

back out revision 1.3. this should not have been committed yet,
since it breaks backward compatibility.

noticed by recht@

add a new verification method that prompts for the pkcs#5 pbkdf2
passphrase again and checks the generated key against the original.

substantial rototill of the code.

o added new features:
o -G: generate a new paramsfile that produces the same
key as the old paramsfile,
o ffs verify_method,
o multiple keygen methods that are xor'ed together
(for n-factor authentication), and
o calibrating the iteration count of PKCS#5 PBKDF2 to
the current machine's speed.
o changed paramsfile format to allow for the new features.
o replaced open-coded parser with yacc grammar.
o lots of supporting changes.
o updated documentation to reflect new features and new
paramsfile format.

Initial checkin of cgdconfig(8), a program to configure a cgd.