upstream: Defend against user enumeration timing attacks. This

establishes a minimum time for each failed authentication attempt (5ms) and
adds a per-user constant derived from a host secret (0-4ms).  Based on work
by joona.kannisto at tut.fi, ok markus@ djm@.

OpenBSD-Commit-ID: b7845b355bb7381703339c8fb0e57e81a20ae5ca

1 files changed, 2 insertions, 1 deletions

diff --git a/servconf.h b/servconf.h
index 37a0fb1a3..6d2553c38 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.130 2017/10/25 00:19:47 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.131 2018/04/13 03:57:26 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -209,6 +209,7 @@ typedef struct {
 
         int     fingerprint_hash;
         int     expose_userauth_info;
+        u_int64_t timing_secret;
 }       ServerOptions;
 
 /* Information about the incoming connection as used by Match */