Re: [TLS] TLS Client Puzzles

[Watson Ladd <[e-mail]>]

On Jul 9, 2015 9:38 AM, "Brian Sniffen" <[e-mail]> wrote:
>
> Watson Ladd <[e-mail]> writes:
>
> > On Jul 7, 2015 8:17 AM, "Brian Sniffen" <[e-mail]> wrote:
> >>
> >>
> >> > At these rates you saturate gigabit ethernet connections, which
> >> > puzzles will not help with. In fact, they will make the problem
worse.
> >>
> >> It's now normal to deploy one 10GbE NIC per CPU.  CPU load is
definitely
> >> still the bottleneck.
> >
> > There is still going to be a bottleneck somewhere. The only question is
can
> > you serve more clients than an attacker can muster: plenty of zombies
can
> > solve puzzles.
>
> Not quite!  Under a sufficiently big attack, we'll have to take *some*
> damage.  But we can use puzzles---in particular in combination with
> resumption/PSK modes---to make some choices about where we take
> that damage.  For example, mobile clients probably can't keep up with
> puzzles---but desktop browsers ought to be able to succeed at puzzles
> enough to justify asymmetric crypto once, then continue on.

Let's assume you can handle X connections before dropping some. An attacker
who can muster the resources to take up X connections wins. It doesn't
matter which resource is limiting.

>
> >> > What about improving performance? That avoids any protocol changes,
> >> > and brings about the benefits you seem to want.
> >>
> >> By all means!  But it'll take 10-20 years to get those performance
> >> benefits out to the ends of the Earth.  I hope we can have some
> >> conversations using that technology in 2-5 years, but we should expect
> >> to be supporting RSA-2048 at least through 2025 (or a few years after
> >> it's discovered to be broken), and NIST curves through 2030.
> >
> > Why is deploying puzzles more likely to happen then faster crypto?
>
> We get the benefit of puzzles when they hit the computationally powerful
> systems; those are mostly desktop browsers with a tight deployment loop.
> I don't think we get the benefit of faster crypto when they hit ~all the
> clients, and we can reasonably turn off slow crypto.

So now when puzzles turn on you start dropping mobile clients instead of
randomly selected ones. Where is the win here?

>
> I'd like both.
>
> -Brian