[Sipping] Feedback on draft-jennings-sip-hashcash-01.txt

Hi,

I just read the following draft:

http://www.ietf.org/internet-drafts/draft-jennings-sip-hashcash-01.txt

some other protocols also use this type of puzzle to be solved by 
clients to avoid DoS attacks. I have some comments on the actual 
algorithm proposed in this draft.

To create a puzzle, the UAS needs to create a pre-image, calculate its 
hash, and set to zero the low bits of the pre-image. Given that the 
pre-image contains fields from the request (e.g., Call-ID and From tag), 
the UAS needs to create the puzzle when such a request arrives.

If my UAS is under a DoS attack, I do not want it to start consuming all 
these cycles generating puzzles (this would only make the attack worse). 
I want a puzzle that is easier to create for a UAS... of course, the UAS 
should still be able to modify the difficulty of the puzzle, as in the 
current proposal.

An alternative algorithm would consist of creating the pre-image as 
described in the draft and asking the UAC to find a string so that the 
hash of the concatenation of the string and the pre-image has n number 
of zeros as its low order bits.

hash (string pre-image) = 00000xxxxxxxxx

The higher the number of zeros, the more difficult it is for the UAC to 
solve the puzzle.

Gonzalo

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sip@ietf.org for new developments of core SIP