Deamplification of DoS Attacks via Puzzles

Puzzles have been proposed as a mechanism to deamplify denial of service attacks against a server’s memory and processing resources. For example, HIP implements a cookie puzzle mechanism to protect the server from wasting resources performing Diffie-Hellman exponentiation in response to spurious requests. We examine cookie puzzle mechanisms of this type. We find that careful attention is needed in server implementation to ensure that an attacker does not retain opportunities to amplify the attack despite the puzzle mechanism, and present a design which addresses these issues. We compare vulnerability to bandwidth and processing attacks, determining when one dominates the other. Finally, we quantify the deamplification of DoS attacks provided by a cookie puzzle mechanism and determine the best setting for puzzle difficulty under a steady-state attack.