Re: [ftpext] New Version Notification for draft-bryan-ftp-hash-05

[Paul Ford-Hutchinson <[e-mail]>]

 > Iljitsch van Beijnum  wrote on 12/07/2010 10:59:32:
> 
> A more efficient and less DoS-prone way to implement this would be 
> for the client to tell the server the hash, and for the server to 
> tell the client whether the file matches the hash.

Not sure how this reduces DoS - if a client can STOR/RETR a file then they 
know the length and 'mini-hash' and thence force the server to repeatedly 
calculate the full hash.  (And if the server is caching the hash, then 
this isn't a DoS issue in the first place).

> 
> To optimize this, the hash wouldn't be a straigh hash over the 
> entire file, but consist of three parts: the file length, a hash 
> over a small part of the file (say, the first and last kilobyte) and
> finally a hash over the entire file. So if the length doesn't match,
> the file doesn't match the hash and there is no need to access the 
> file. If the hash over the small part doesn't match, there is no 
> match and hashing the entire file is avoided.

my 2c - this is an unnecessary  complication to address a possible threat 
that can be managed by other mechanisms (throttling HASH requests from a 
given client, caching the hash, ...)

Paul