On Thu, Mar 31, 2016 at 09:14:46AM +0000, Harlan Stenn wrote: > Miroslav Lichvar writes: > > On Thu, Mar 31, 2016 at 07:50:08AM +0000, Harlan Stenn wrote: > > > Miroslav Lichvar writes: > > > > Any state that the protocol would require on the server is a potential > > > > vector for a DoS attack. How easy is for an attacker to make new > > > > "connections" and allocate memory on the server? > > > > > > While great hunks of this are implementation-dependent, I suspect no > > > additional memory will be required to answer "now" as opposed to > > > "later". The difference is "duration" and it's easy enough to deal with > > > that. There are other steps that can be taken, too. > > > > If you want to respond later, you need to save that response > > somewhere. And when you have too many reponses saved, you need to drop > > some of them. > > How is that significantly different from having lots of NTS connections > starting up at the same time?
I think the difference is that new NTS associations can't break existing associations if the server doesn't keep any NTS state per client. It's easy to control the number of requests that are processed at the same time, but it's difficult to tell which associations are still alive. -- Miroslav Lichvar _______________________________________________ TICTOC mailing list [email protected] https://www.ietf.org/mailman/listinfo/tictoc
