Re: [TLS] add challenge in TLS v1.3 to prevent DDOS attack?

[Ilari Liusvaara <[e-mail]>]

On Mon, Jun 08, 2015 at 04:46:18PM +0800, Bingzheng Wu wrote:
> Hi all,
> 
> TLS is susceptible to DDOS attack.
> In TLS v1.3, attackers can generate ClientHello and
> ClientKeyshare messages easily, while the server has to
> consume large amounts of CPU doing asymmetric crypto operations
> to generate ServerKeyshare and ServerCertificateVerify messages.

Note that this type of attack already works in TLS 1.2.

> So, could we add a challenge-response mode in TLS v1.3 to
> increase the attacker's cost ?

There is already an issue about this (but given nature of that
issue, it should be discussed on this ML, especially as it
still seems to be open).

> The mode is disable in usual.
> If the server think it's under attack (e.g. >1000 qps), it
> could enable this mode by responding a HelloRetryRequest (or
> a new type) message to the client with a challenge.
> The client receiving the challenge must solve the challenge
> which is expensive in CPU, and continue the handshake by
> carrying the challenge's answer.

One has to be careful that this kind of thing doesn't introduce
security issues. E.g. Proper implementations can not restart
handshake, and repeating yourself is legendary source of bugs.

> For example, server could make the challenge by encrypting an
> random number by a RSA public key (which is short), and send
> the private key (which is long) and cipher text to client.

The usual way things like this are done is via hashes.

TLS13 github issue #9 has link to a ML post describing one scheme:
https://www.ietf.org/mail-archive/web/tls/current/msg11763.html


-Ilari