Re: [TLS] TLS client puzzles

[Bill Cox <[e-mail]>]

Equihash looks like a nice advance, so kudos to Dmitry's team.  So long as
we're on this topic, I'll mention an alternative that addresses some of
your concerns.  I do not recommend making it an official part of TLS, as I
feel that TLS is already vastly too complex.  However, this algorithm is
very cool:

Makwa <http://password-hashing.net/wiki/doku.php/makwa> is a "recommended"
algorithm from the password-hashing contest.  It is a proof-of-work
algorithm with fast verification, but is not memory-hard.  However, that
seems OK, since Makwa supports "delegation".  An IoT device can ask any
Makwa hashing provider on the Internet to do the proof of work for it, and
the result is as secure as if the IoT device had done it.  This solves the
concern about leaving under-powered devices behind, while aiding in DDoS
defense.

If widely adopted, with ASIC implementations, it would also defeat
botnets.  ASICs would many times more efficient than CPUs at Makwa, IIRC,
about 4000X in my last analysis.  Even botnets would have difficulty
competing with a legit ASIC Makwa provider.

My own dumb-idea related to Makwa is to use it as a PoW in a block-chain
based crypto-coin.  If miners are going to waste crazy amounts of
electricity mining anyway, at least they could help defeat DDoS attacks
while they are at it.  This might also create a method for IoT devices to
pay for the PoW service in nano transactions.

No way would I ever want such a beast bolted into TLS :>  Maybe as a DDoS
extension API in OpenSSL?

Bill