I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client to run that would be somewhat CPU heavy and verify it's result (via a light-weight operation), prior to running my password hash?

I was thinking something along the lines of brute-forcing a weak security (where I generate say a 128 bit RSA key or similar) and giving the client the public key and asking it to find the private key.

Has anything like this been done? would this be a reasonable implementation? are there better alternatives?

up vote 1 down vote accepted

Your idea in your question sounds feasible. Another alternative is to ask for a string to be generated that hashes via some algorithm (e.g. SHA1) to a value with properties you specify. E.g. find s such that s ends with a specified string and SHA1(s) % 5000 == 0; this will require the client on average to run 5000 SHA1 operations, while the server can verify the result with just 1.

  • I don't suppose anyone would care to explain why I was downvoted on this answer? – Periata Breatta Oct 23 '14 at 4:45
  • Next thought: is there some way I could get something useful done with many short bursts of CPU? mine bitcoin or similar? – user2813274 Oct 27 '14 at 19:37
  • That's plausible, although quite a bit harder. Take a look at how bitcoin pool mining works: the pool sets the individual members tasks that are simpler than actually mining a bitcoin block (because they don't need as many leading zeros in the hash result) but for which the valid answers can also be valid answers to the question required for mining the full block (albeit with a low probability). The server checks each answer submitted by a client against the full problem, and submits it to the network if it is a match. You could plausibly use the same system as a gateway to a login form. – Periata Breatta Oct 28 '14 at 2:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.