Subject: comment on issue 15 (client puzzle)

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 23 May 2003 10:29:10 -0400

This is my rough comparison between the cookie mechanism and the
puzzle mechanism.

Cookie:

Pros - PAA does not hold any per-session state in the initial
exchange.

Cons - On-link attacker can sniff the initial exchange and generate a
cookie reply to be accepted by PAA, without performing cryptographic
computation.

Puzzle:

Pros - Attacker needs not only to sniff the initial exchange and but also 
to do cryptographic computation to generate a reply to be accepted by PAA.

Cons - PAA holds per-session state I, K, and Challenge in the initial
exchange.  So memory consumption attack is still possible.

Cons - If the length of the puzzle is too short (i.e., the puzzle is
easy to solve), the vulnerability might be as same as the cookie
mechanism.  On the other hand, if the length of the puzzle is too long
(i.e., the puzzle is difficult to solve), legitimate PaCs will also
experience signaling delay.

Yoshihiro Ohba