Re: [TLS] SSL Renegotiation DOS

[Eric Rescorla <[e-mail]>]

On Tue, Mar 15, 2011 at 9:07 AM, Martin Rex <[e-mail]> wrote:
> Jorge A. Orchilles wrote:
>>
>> Marsh Ray has invited me to present my research and report on SSL/TLS
>> Renegotiation Denial of Service on this mailing list. I have posted this on
>> my site and will paste here for your feedback:
>> http://orchilles.com/2011/03/ssl-renegotiation-dos.html
>>
>> *SSL/TLS Renegotiation Denial of Service*
>>
>> An SSL/TLS handshake requires at least 10 times more processing power on the
>> server than on the client.
>
> I'm sorry, I completely fail to see what renegotiation has to do
> with the DoS capability here.
>
> The TLS protocol is a cryptographic protocol, and servers that expect
> to talk to real clients performing the protocol as designed will attempt
> to perform the cryptographic operations as requested.
>
> A DoS-client could simply open new connections to the SSL server and
> blindly fire away precompiled static SSL handshake messages, forcing the
> server to do crypto work.  You should be able to make most servers
> perform RSA decrypts on arbitrary data, and a significant number
> to perform DHE computations.

I tend to agree with Martin here: I don't see how this is
significantly worse than separate
connections. Arguably, it's better from the victim's perspective,
since common implementations
run each SSL/TLS connection in its own control thread (or process) and
so the scheduler
will try to fairly share between connections to some extent meaning
that the single offending
connection is bounded in terms of how much it can affect other users.

-Ekr