Re: possible DoS attack

I suggest to remove phrase "to identify such attacks" : 

Consequently, applications should be able to restrict arbitrary
recursion and the total amount of processing and networking
resources a request can consume.

Because a question about DoS attack identification is a very good and
not simple question. From my point of view, for XML Encryption
implementation it is enough to have the described restrictions for solving
this particular problem.

Aleksey Sanin


Joseph Reagle wrote:

>On Thursday 11 April 2002 13:08, Aleksey Sanin wrote:
>
>>I don't suggest
>>to change the XML Encryption design but I do think that a warning
>>about possible problem is a good idea.
>>
>
>
>http://www.w3.org/Encryption/2001/Drafts/xmlenc-core/#sec-Denial
>$Revision: 1.181 $ on $Date: 2002/04/12 20:42:15 $ GMT
>[[
>6.4 Denial of Service 
>
> This specification permits recursive processing. For example, the 
>following scenario is possible: EncryptedKey A requires EncryptedKey B to 
>be decrypted, which itself requires EncryptedKey A! Or, an attacker might 
>submit an EncryptedData for decryption that references network resources 
>that are very large or continually redirected. Consequently, applications 
>should be able to identify such attacks and restrict arbitrary recursion 
>and the total amount of processing and networking resources a request can 
>consume. 
>]]
>