[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Some comments on JFK

"Hallam-Baker, Phillip" <pbaker@verisign.com> writes:

> [1  <text/plain; iso-8859-1 (7bit)>]
> > Yes, but purpose of forcing the initiator to spend cycles before the
> > responder is for DoS prevention, not rate throttling of legitimate
> > initiators, no?
> 
> Carefull, you don't 'force' the initiator to spend cycles before the
> responder. What you actually do is to force the initiator to prove that
> it can recieve packets sent to the purported initiator address before 
> the responder spends cycles.
> 
> The initiator can send any old junk to the respinder and the responder
> will not know until the cycles are spent.
This was exactly my point. 

The draft says:

   The Initiator bears the initial computational burden
   and must establish round-trip communication with the Responder
   before the latter is required to perform expensive operations.

This text suggests that the fact that the initiator performs
the DH operation first protects against DoS. As far as I can
tell it does not.

-Ekr

-- 
[Eric Rescorla                                   ekr@rtfm.com]
                http://www.rtfm.com/
Follow-Ups: References: