Proof of concept nickreg flooding prevention for Trent
mids <[email protected]> Mon, 9 Jun 2003 13:56:19 +0200
| Newsgroups | gmane.comp.security.invisiblenet.iip.devel |
|---|---|
| Message-ID | <[email protected]> |
As discussed in IIP meeting 43 and 44, Trent has been flooded by registration attacks. This leads to the database beeing filled up. To prevent this from happening 3 kind of defenses are discussed: - HashCash - ThinkCash - RealCash I have made a proof of concept bot to show how this would work, HashCash and RealCash are implemented. Usage: /msg cashbot help This gives you 2 commands, "nickreg" and "price". Those two could be embedded into Trent. (I am not totally happy with the name 'price', maybe some other commandname is better, suggestions please). For now the registration costs are the following: HashCash: minimal 27 bits, use your nickname as resource. See also http://www.cypherspace.org/hashcash/ RealCash: minimal 0.50 DRAN Yodel certificate or its equivalent in USD, EURO or E-GOLD. See also http://yodelbank.com/ The costs are ricked quite randomly, 27 bits of hashcash takes about 5-10 minutes on an average PC, depending on your CPU speed. Adding a bit would approximately double the required time. Java applet code on a sun JDK is about 5 times slower as compiled C code. Unix is generally faster as the windows GUI implementation. 27 bits takes 7 minutes on my P550-III, 22 minutes on my P233-II, 5 minutes on FillaMents 1.6Ghz; your milage may vary. 0.50 DRAN is about 0.53 USD, 0.45 EURO and 0.0455 E-GOLD. If you make a spend on 'cashbot', I'll pay you back for now, since this is just testing. If someone wants to implement ThinkCash, be my guest. mids -- PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF19326A9 Key fingerprint = 730D 9B3A F406 F28A 957D 6397 31E8 6D4C F193 26A9
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+5HXiMehtTPGTJqkRAvjTAJ0bPDdTB9Y7jG3OduVjmUk76pZ17QCfWgGM O0fz6sNBZSGLFcgVZDFQOzo= =VoSG -----END PGP SIGNATURE-----