An authentication question

[Jack Lloyd]

In the second version, any random user (or script) could upload very large
files, wasting your bandwidth, and also CPU time when you check the sig. Or
lots and lots of really small files, which would swamp your CPU(s) trying
to check 500 sigs a second (makes for a good DDOS).

I don't see a difference from the standpoint of what ends up being stored
in the server, though. The second version is (mostly) safe from password
guessing, which is good. The first is easier for most users to figure out,
which is also good.
  -Jack

On Mon, 5 Aug 2002, Adam Fields wrote:

> If you were going to open up an interface to allow known parties to
> upload files to you via web form submission, would you want to 1)
> distribute passwords to them and let them sign in to a page where they
> could upload the files over SSL, or 2) allow anyone to upload files
> and require that authorized parties sign (and/or encrypt) the files
> before uploading them, rejecting any that weren't signed with a valid
> key?
>
> Are these two scenarios equivalent from a security standpoint?
>


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com