[TLS] TLS Client Puzzles

[Erik Nygren <[e-mail]>]

Following a discussion last year in Denver, I've written up a proposal
for a TLS Client Puzzles extension.  It is specific to TLS 1.3 in that
it is constructed using the HelloRetryRequest request flow (although
it could be adapted to HelloVerifyRequest with prior versions of DTLS).

The puzzles here are placeholders meant as a starting-point for discussion
(and also take in some feedback from discussions on this list last year)
and will likely evolve.

        Erik


---------- Forwarded message ----------
From: <[e-mail]>
Date: Thu, Jul 2, 2015 at 5:30 PM
Subject: New Version Notification for draft-nygren-tls-client-puzzles-00.txt
To: Erik Nygren <[e-mail]>



A new version of I-D, draft-nygren-tls-client-puzzles-00.txt
has been successfully submitted by Erik Nygren and posted to the
IETF repository.

Name:           draft-nygren-tls-client-puzzles
Revision:       00
Title:          TLS Client Puzzles Extension
Document date:  2015-07-02
Group:          Individual Submission
Pages:          12
URL:
https://www.ietf.org/internet-drafts/draft-nygren-tls-client-puzzles-00.txt
Status:
https://datatracker.ietf.org/doc/draft-nygren-tls-client-puzzles/
Htmlized:
https://tools.ietf.org/html/draft-nygren-tls-client-puzzles-00


Abstract:
   Client puzzles allow a TLS server to defend itself against asymmetric
   DDoS attacks.  In particular, it allows a server to request clients
   perform a selected amount of computation prior to the server
   performing expensive cryptographic operations.  This allows servers
   to employ a layered defense that represents an improvement over pure
   rate-limiting strategies.

   Client puzzles are implemented as an extension to TLS 1.3
   [I-D.ietf-tls-tls13] wherein a server can issue a HelloRetryRequest
   containing the puzzle as an extension.  The client must then resend
   its ClientHello with the puzzle results in the extension.




Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat