Re: [TLS] SSL Renegotiation DOS

[Peter Gutmann <[e-mail]>]

Martin Rex <[e-mail]> writes:

>A DoS-client could simply open new connections to the SSL server and blindly
>fire away precompiled static SSL handshake messages, forcing the server to do
>crypto work.  You should be able to make most servers perform RSA decrypts on
>arbitrary data, and a significant number to perform DHE computations.

Exactly.  You can do this with virtually no effort using netcat, I continue to
be surprised that we've never seen this deployed in the wild (not wanting to
give any hints to Anonymous, but LOIC is 1990s script-kiddie technology
compared to the DoSes you could use if you gave it a few minutes thought).
What makes it even worse is the Bleichenbacher-attack defense that says you
have to complete the handshake, at full crypto cost, even if it's obvious that
you're just processing garbage.

(Every time this comes up I'm tempted to release some quick tool to exploit
the problem, on the basis that if the good guys don't point it out now, the
bad guys will take advantage of it later.  So far I've resisted the
temptation...).

Peter.