On Tue, Oct 25, 2011 at 8:15 AM, BH <[email protected]> wrote: >... >> To make it more difficult to DOS servers using SSL, the protocol could >> somehow be modified to challenge the client with some useless** ... > > One problem I can foresee with this is a way to scale this in a secure > manner.
no syn cookies for TLS :( yet, they mention proper fix on page: disable renegotiation. use hw accel. speaking of GPUs: http://shader.kaist.edu/sslshader/ there are HSM+Accel cards that do 70k+ sessions/sec if you want the hardware protection for your secrets in addition to performance. what i really want to know! when does thc-ssl-dos get GPU support? "Taking on larger server farms who make use of SSL Load balancer required 20 average size laptops and about 120kbit/sec of traffic." - what kind of shitty LB was this? an old as dirt F5 BigIP? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
