Bug 1562671 - Add environment variables to control Master Password KDF iteration count. Disable iteration count for legacy DBM storage by default. r=rrelyea

1 files changed, 8 insertions, 5 deletions

diff --git a/lib/softoken/lgglue.c b/lib/softoken/lgglue.c
index 67f17943b..8cfb4ec56 100644
--- a/lib/softoken/lgglue.c
+++ b/lib/softoken/lgglue.c
@@ -194,12 +194,15 @@ sftkdb_encrypt_stub(PLArenaPool *arena, SDB *sdb, SECItem *plainText,
         /* PORT_SetError */
         return SECFailure;
     }
-    if (handle->newKey) {
-        key = handle->newKey;
-        iterationCount = handle->newDefaultIterationCount;
+    key = handle->newKey ? handle->newKey : &handle->passwordKey;
+    if (sftk_isLegacyIterationCountAllowed()) {
+        if (handle->newKey) {
+            iterationCount = handle->newDefaultIterationCount;
+        } else {
+            iterationCount = handle->defaultIterationCount;
+        }
     } else {
-        key = &handle->passwordKey;
-        iterationCount = handle->defaultIterationCount;
+        iterationCount = 1;
     }
 
     rv = sftkdb_EncryptAttribute(arena, key, iterationCount,