Re: [TLS] TLS Client Puzzles

[Tony Arcieri <[e-mail]>]

On Thu, Jul 2, 2015 at 2:40 PM, Erik Nygren <[e-mail]> wrote:

> Following a discussion last year in Denver, I've written up a proposal
> for a TLS Client Puzzles extension.
>

I'm sorry, but I think this is the wrong approach.

I assume you're trying to solve the asymmetrical computation requirements
of RSA, a.k.a. the "THC DoS attack"

If you're using RSA for key exchange, don't. It's very broken in more ways
than DoS.
If you're using RSA for signatures, it should be deprecated and phased out.

Trying to solve the latter problem by complecting TLS is likewise something
I oppose.

Moving to ECC-based signatures (ECDSA or EdDSA or
CFRG-yet-to-be-standardized-signatures) would obviate this problem without
complecting the TLS protocol. ECC punts the computational burden to the
client, elegantly solving this problem by using the algorithms we want to
move to anyway.

Complexity is the enemy of security.

I prefer simplicity. To solve this same problem, I would prefer RSA
diediedie. I know that's a stretch, but I would prefer TLS gravitate
towards simple solutions than adding complex band-aids.

-- 
Tony Arcieri