Re: [TLS] Alert type for connection limit or server busy?

> Of course, the server would have to spend cycles generating and
> validating challenges.  Not as many as the clients, but still, cycles.

Of course, but considerably less (orders of magnitude less?).  Very similar
to the cycles used in syncookies.

> It'd have to remember full_value under overload conditions, though.
> Unless that's shared, that's memory (stored) or CPU (generated).

Not necessarily.  If structured right, the server could construct
full_value from something
like { HMAC-SHA256(key, nonce || client_ipaddr) || nonce }
that could be reconstructed when the client returns.  The server might then
went
to keep these around for a bit for *accepted* connections to avoid replay
attacks.

(Disclaimer:  I'm not a cryptographer, so the example given was more
a sample type of proof-of-work rather than a particular proposed
implementation.)

        Erik

On Tue, Apr 1, 2014 at 11:23 PM, Alyssa Rowan <akr@akr.io> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 02/04/2014 07:20, Alyssa Rowan wrote:
>
> > Otherwise known as "hashcash".
>
> [Ugh, shouldn't post before breakfast, mistake. It's not hashcash,
>  although it is kinda like it. Reverse hashcash, maybe.]
>
> It'd have to remember full_value under overload conditions, though.
> Unless that's shared, that's memory (stored) or CPU (generated).
>
> - --
> /akr
> -----BEGIN PGP SIGNATURE-----
>
> iQIcBAEBCgAGBQJTO6zdAAoJEOyEjtkWi2t6UiYP+wawQNs3Y1jWl/IPCngGKISe
> TjW4zbSI8zOjbk6gCrkI3tMnUHIchWMR972EaFNqDBGT9LIMir4ak1vpD/m+g7pG
> 1F4KgVH+b7iJ/Z/ZfISNNjXx6MoqDmWjLVoxbiHghjTEkf0ElinNNsOu7QE9znzd
> mRpfQofHf2V6xSZt4PmE/oLUtXjiEda2WG3AW8OhOLdjw+Ihgs4fN9SxsLjYq4/7
> vznGO8qXQYAfh95XZQ1VsT9lf2mMASW/lH10czb4djXYrp7wNKQ2aG16PmSozZdr
> qnCYb4IZ3YciG16mQ5sBiPf0wtEu9tpc/BeYpGVFkm2c/chjS7jzoP4gjehyWihm
> eB8e/dO7HwIk+iaF1M+0VA4KkmcEqKHTFMsqyD0d0RR5J5ejbAn3T8Kae3OyNpUA
> 9t/4SdI/Wrt9o5r1hCS1p8LjeksmENJMjQE6Z21lPX5RkGJ2+F1Zk5ieNMjcFEOA
> UYXK5DWcs+Wofw3+dcR++zQyDgYSr3L8UgUZltOQIrESmrGq4bSeRXuPa2lwyOus
> /n3aSeuBqOAqbKfVFkCC6l86BJH2/GybEIsP70RHZgcWXdCpIWhitxD/jM8w2LUr
> biMVUzbGviDyo1S3JSCu82tQBqqzixD7UmCCRSKtmtwJjCtp39igKMtdKHIy6URo
> u4FgGxztq8HWjV30W323
> =31sI
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>