Analysis of the client puzzles protocol

By: Andreas Gabrielsson & Simon Österman

Abstract

This paper covers a certain proof of work protocol known as the client puzzles. The client puzzles is placed upon the protocol it is supposed to protect and is specifically designed to protect against connection depletion attacks. Our study is to determine how well the client puz- zles protocol prevents connection depletion attacks and how it affects other parts of the system. To do this we choose to implement our own version of the client puzzles protocol and to see how it performs as well as read up on what other people has learned about its strengths and flaws. After implementing and trying with different sized puzzles we could determine that the client puzzles actually could provide some protection against connection depletion attacks though it also became clear that the protocol has some other issues. These flaws include in- creased vulnerability to distributed denial of service attacks by solving large amounts of puzzles on the clients, denial of service attacks by just requesting puzzles without solving them. Our conclusion of the client puzzles protocol is that while the pro- tocol could solve the security issue it is supposed to, it provides with even more new problems. That combined with the fact that it needs software on all clients makes it a quite bad solution.