Re: [TLS] About encrypting SNI

> On May 15, 2014, at 8:05, Brian Sniffen <bsniffen@akamai.com> wrote:
> 
> Marsh Ray <maray@microsoft.com> writes:
> 
>> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Brian Sniffen
>>> 
>>> Bitcoin's also hard to check: if the client says it found no bitcoin in a
>>> particular region, how do you know?  And a whole bitcoin's too
>>> much to ask.
>>> 
>>> An identity scheme tied to giving away bitcoin---much like a credit
>>> rating ties to many transactions profitable for the counterparty---
>>> has a lot in its favor.  It would make a great (research) extension
>>> on top of TLS 1.3, and I hope that any puzzle mechanism will be
>>> flexible enough to support that.
>> 
>> Years back, Microsoft was looking into a proof-of-work scheme for antispam sender-pays email.
>> http://research.microsoft.com/en-us/projects/pennyblack/
> 
> Thanks!  I hadn't remembered the name, but that work was surely on my
> mind as I wrote.
> 
>> One challenge is that botnets (that are conduits for most of the spam) also have plenty of spare CPU capacity.
> 
> Yes, but each bad node's CPU capacity only outstrips many good node's
> capacities by a little bit---compared to network bandwidth, where very
> often botnets outstrip good nodes' capacity by orders of magnitude.  Of
> course the bad nodes will beat out cell phone CPUs; a client puzzle
> scheme has to be about, in some part, "acceptable losses."  If we can
> drop new mobile nodes and the botnet, but keep service up for (say)
> established connections and "real" computers, that may be okay.

I don't have hard data at hand, but my guess is that these days TLS connections from mobile devices far outnumber TLS connections from "real" computers. So that may not be okay. 

> 
> -Brian
> 
> -- 
> Brian Sniffen
> Information Security
> Akamai Technologies
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls