tree 207f618329c9df13a2278c71c95b1dc66450bb86
parent d97874cbd909eb706886cd0cdd418f812c119ef9
author dtucker@openbsd.org <dtucker@openbsd.org> 1523591846 +0000
committer Darren Tucker <dtucker@dtucker.net> 1523597171 +1000

upstream: Defend against user enumeration timing attacks. This

establishes a minimum time for each failed authentication attempt (5ms) and
adds a per-user constant derived from a host secret (0-4ms).  Based on work
by joona.kannisto at tut.fi, ok markus@ djm@.

OpenBSD-Commit-ID: b7845b355bb7381703339c8fb0e57e81a20ae5ca