Subject: [Sip] Some remarks about "Computational Puzzles for SPAM Reduction in SIP"

From: [email-masked]
Date: Fri, 30 Sep 2005 16:38:05 +0200 (MEST)

Hello,

I have some remarks about the draft
"Computational Puzzles for SPAM Reduction in SIP",
and I'd like to have your advices:

1. Wouldn't it be interesting to be more "generic" concerning the hash algorithm,
to avoid to be forced to use SHA1 forever?
If the algorithm becomes easier to break, it would be
interesting to adapt easily the draft to new hash algorithms.
It would be also interesting to discuss about the consequences of this idea.
For example, we usually fix the value of "value" to 160, because
it is the fixed output lenght of a SHA1 hash. We would need
to fix another value of "value", depending of the hashing algorithm that is used.
My idea is not to replace immediatly SHA1!
It is just to keep this draft valid, even if new hash algorithm would
need to be used...

2. It is said that the (non normative) way to generate a random string
should be to use the current time, "rounded to the nearest minute".
I don't understand why. It means that we risk to generate the same
"random" string if we receive two or more requests during the same
minute. Wouldn't it be interesting to use something like
"System.currentTimeMillis" in Java, to avoid generating the same
string during a certain time period?

3. Sorry, I think there is a typing error... page 5: "low v low order bits"...

4. If an UAS sends a puzzle to an UAC, and that the UAC chooses
to solve the puzzle, and finds a WRONG solution, he sends
an incorrect answer to the UAS. In this case, which would be
the correct answer from the UAS? I've thought to
"403 Forbidden" or "406 Not Acceptable".
Would it be good to add this feature in the draft?

5. I know that is question is maybe "out of the scope of this draft",
but my problem is about determining the nature of the recipient
of my puzzle's UA. I need to know what is his power,
to determine a good value of "work". Is there a way
to determine which UA he is using? I've heard about "Terminal capabilities",
but I'm not sure that recipients cannot lie about their UA.
We could imagine a spammer pretending that he has a poor smartphone,
to receive puzzle with very low values of "work", and
to find solutions very easily thanks to a very powerful machine,
or even a Grid! What would be the protection against
this type of "atack"?

Thank you very much and best regards,

Geoffrey Dawirs

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip