Re: [TLS] SSL Renegotiation DOS

[Martin Rex <[e-mail]>]

Peter Gutmann wrote:
> 
> Martin Rex <[e-mail]> writes:
> 
> >A DoS-client could simply open new connections to the SSL server and blindly
> >fire away precompiled static SSL handshake messages, forcing the server to do
> >crypto work.  You should be able to make most servers perform RSA decrypts on
> >arbitrary data, and a significant number to perform DHE computations.
> 
> Exactly.  You can do this with virtually no effort using netcat, I continue to
> be surprised that we've never seen this deployed in the wild (not wanting to
> give any hints to Anonymous, but LOIC is 1990s script-kiddie technology
> compared to the DoSes you could use if you gave it a few minutes thought).
> What makes it even worse is the Bleichenbacher-attack defense that says you
> have to complete the handshake, at full crypto cost, even if it's obvious that
> you're just processing garbage.


If a hostile client is targetting specific servers, it could create
a valid PKCS#1 encrypted premaster secret once and then reuse it in
all further handshakes -- saving the client the asymmetric crypto work
on all additional connections, while still allowing the client to
complete the TLS handshake successfully.

-Martin