Suggestion 5: Improve Handling of Excessively Large Messages During Encryption / Decryption

[mpguerra]

Location

src/comms/http.rs#L306
src/comms/http.rs#L460

Synopsis

In order to prevent denial of service (DoS) attacks, a message from the server must have a size of less than 65535 bytes in the functions encrypt and decrypt for the coordinator, participant, and DKG protocol. If the message exceeds this bound, the code of the coordinator (for example) would abort in L460 of the function recv when the coordinator receives a message from the participant. Hence, a malicious participant can end the coordinator process by sending a message that is too large to decrypt.

Mitigation

We recommend implementing a different approach for handling messages exceeding a certain size. Instead of throwing an error, the code should be modified to ignore large messages.