Re: [TLS] About encrypting SNI

On Mon, May 12, 2014 at 6:53 PM, Michael D'Errico <mike-list@pobox.com> wrote:
> David Holmes wrote:
>>
>> ➢ so a server under load can, in the initial opportunistic encryption
>> phase, push back to a client and ask for a puzzle to be solved?
>>
>> I was describing this idea to a colleague, and the first thing he said was
>> "could you have the client mine some bitcoin for you? As a show of good
>> faith?"
>
>
> Sure!  After we get rid of TLS compression, RSA key transport, non-AEAD
> ciphers,
> and all the other crud, let's plug in Bitcoin!  ;-)

We're not getting rid of these things because they are needless
complexity (although they are) but because they are horrifically
broken.

Plugging in a puzzle consisting of doing some SHA-256 evaluations
doesn't open up any holes. It seems to solve a real security issue,
but might not be that effective: botnets have CPU to burn. I'm mildly
for it. And if someone makes it into an altcoin somehow we might
accidentally fix web micropayments.

I think bigger issues are ensuring the security properties in TLS 1.3
are what we want them to be (sine qua non), making it clear what you
have to implement to implement TLS, possibly letting alternatives to
X509 be of equal standing, tightening up the language to make the
first goal and second easier. Puzzles are a nice way to ensure DOS is
hard.

Sincerely,
Watson Ladd

> Mike
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin