I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client to run that would be somewhat CPU heavy and verify it's result (via a light-weight operation), prior to running my password hash?

I was thinking something along the lines of brute-forcing a weak security (where I generate say a 128 bit RSA key or similar) and giving the client the public key and asking it to find the private key.

Has anything like this been done? would this be a reasonable implementation? are there better alternatives?


1 Answer 1


Your idea in your question sounds feasible. Another alternative is to ask for a string to be generated that hashes via some algorithm (e.g. SHA1) to a value with properties you specify. E.g. find s such that s ends with a specified string and SHA1(s) % 5000 == 0; this will require the client on average to run 5000 SHA1 operations, while the server can verify the result with just 1.

  • I don't suppose anyone would care to explain why I was downvoted on this answer? Oct 23, 2014 at 4:45
  • Next thought: is there some way I could get something useful done with many short bursts of CPU? mine bitcoin or similar? Oct 27, 2014 at 19:37
  • That's plausible, although quite a bit harder. Take a look at how bitcoin pool mining works: the pool sets the individual members tasks that are simpler than actually mining a bitcoin block (because they don't need as many leading zeros in the hash result) but for which the valid answers can also be valid answers to the question required for mining the full block (albeit with a low probability). The server checks each answer submitted by a client against the full problem, and submits it to the network if it is a match. You could plausibly use the same system as a gateway to a login form. Oct 28, 2014 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.