[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ipsec
Subject:    [IPsec] Puzzles and weak clients
From:       Yaron Sheffer <yaronf.ietf () gmail ! com>
Date:       2014-07-25 17:16:59
Message-ID: 53D2910B.4040501 () gmail ! com
[Download RAW message or body]

I missed some of the discussion (Meetecho played up again), so maybe 
there's an easier answer. But I think that mere computational 
(CPU-hogging) puzzles are not very useful when the attacker (a desktop 
machine on a botnet) is much more powerful than the legitimate client (a 
last-year iPhone). And as Mike said, the attacker's resources are 
cheaper, because he steals them.

One way to mitigate this problem is by limiting the competition to "new" 
clients, those who haven't used the VPN for the last (say) 24 hours. The 
gateway could hand out time limited, easy to validate, IP-bound cookies 
to VPN clients. And a VPN client who presents this cookie to the gateway 
is exempted from the puzzle game (but not from the IKE cookie, because 
it proves a legitimate source address which is bound to the cookie).

And even if we add such a mechanism, we still have the problem of 
attackers being favored by this proposal, compared to weak legit 
clients. So maybe puzzles are not a very good idea after all.

Thanks,
     Yaron

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec
[prev in list] [next in list] [prev in thread] [next in thread]