Re: [TLS] About encrypting SNI

David Holmes <d.holmes@f5.com> writes:

> ➢ so a server under load can, in the initial opportunistic encryption phase, push back to a client and ask for a puzzle to be solved?
>
> I was describing this idea to a colleague, and the first thing he said was "could you have the client mine some bitcoin for you? As a show of good faith?"

Bitcoin's also hard to check: if the client says it found no bitcoin in
a particular region, how do you know?  And a whole bitcoin's too much to
ask.

An identity scheme tied to giving away bitcoin---much like a credit
rating ties to many transactions profitable for the counterparty---has a
lot in its favor.  It would make a great (research) extension on top of
TLS 1.3, and I hope that any puzzle mechanism will be flexible enough to
support that.

-Brian

> Two problems sprung to mind with a bitcoin mining solution - unethical servers would be gaming clients to do computation for them. Second, this would also a cause a problem for mobile handsets where CPU = battery life.
>
> But I think the puzzle idea has merit, especially if it's not a required challenge = that is, only issued when server is under load.
>
>
> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla
> Sent: Thursday, April 17, 2014 2:20 PM
> To: Brian Sniffen
> Cc: tls@ietf.org; Andy Lutomirski
> Subject: Re: [TLS] About encrypting SNI
>
> On Thu, Apr 17, 2014 at 12:59 PM, Brian Sniffen <bsniffen@akamai.com> wrote:
> I hesitate to ask, but: is it plausible to re-open the proof-of-work
> conversation, so a server under load can, in the initial opportunistic
> encryption phase, push back to a client and ask for a puzzle to be
> solved?
>
> I don't think it's implausible (though I'm not completely sold yet).
>
> One concern I would have is whether we understand the problem well
> enough to actually specify this. I'm not an expert in this area, but weren't
> there a bunch of concerns about designing puzzles that were effective
> without being prohibitively expensive for mobile devices? How would
> we design a new kind of puzzle (As opposed to messing with the puzzle
> work factor) and then roll it out?
>
> -Ekr
>
>> I wonder if there's a way to test a large number of private keys at
>> once.  If so, then the cost drops to O(log N).  Off the top of my
>> head, I can't think of a cryptosystem with that property.
> I certainly don't expect to find any *pair* of cryptosystems with that
> property, and continue to maintain that in 3 years we won't find two big
> organizations willing to use exactly the same crypto.
>
> -Brian
>
> --
> Brian Sniffen
> Information Security
> Akamai Technologies
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
Brian Sniffen
Information Security
Akamai Technologies