Proof of concept nickreg flooding prevention for Trent

mids <[email protected]> Mon, 9 Jun 2003 13:56:19 +0200
Newsgroups gmane.comp.security.invisiblenet.iip.devel
Message-ID <[email protected]>
As discussed in IIP meeting 43 and 44, Trent has been flooded by
registration attacks. This leads to the database beeing filled up.
To prevent this from happening 3 kind of defenses are discussed:
- HashCash
- ThinkCash
- RealCash

I have made a proof of concept bot to show how this would work, HashCash
and RealCash are implemented.

Usage:
/msg cashbot help

This gives you 2 commands, "nickreg" and "price". Those two could be
embedded into Trent. (I am not totally happy with the name 'price',
maybe some other commandname is better, suggestions please).

For now the registration costs are the following:
HashCash: minimal 27 bits, use your nickname as resource. See also
http://www.cypherspace.org/hashcash/
RealCash: minimal 0.50 DRAN Yodel certificate or its equivalent in USD,
EURO or E-GOLD. See also http://yodelbank.com/

The costs are ricked quite randomly, 27 bits of hashcash takes about
5-10 minutes on an average PC, depending on your CPU speed. Adding a bit
would approximately double the required time. Java applet code on a sun
JDK is about 5 times slower as compiled C code. Unix is generally faster
as the windows GUI implementation.

27 bits takes 7 minutes on my P550-III, 22 minutes on my P233-II, 5
minutes on FillaMents 1.6Ghz; your milage may vary.

0.50 DRAN is about 0.53 USD, 0.45 EURO and 0.0455 E-GOLD. If you make a
spend on 'cashbot', I'll pay you back for now, since this is just
testing.

If someone wants to implement ThinkCash, be my guest.

mids
-- 
PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF19326A9
Key fingerprint = 730D 9B3A F406 F28A 957D 6397 31E8 6D4C F193 26A9
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+5HXiMehtTPGTJqkRAvjTAJ0bPDdTB9Y7jG3OduVjmUk76pZ17QCfWgGM
O0fz6sNBZSGLFcgVZDFQOzo=
=VoSG
-----END PGP SIGNATURE-----