The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release:
No real solutions exists. The following steps can mitigate (but not solve) the problem:
1. Disable SSL-Renegotiation
2. Invest into SSL Accelerator
Either of these countermeasures can be circumventing by modifying THC-SSL-DOS. A better solution is desirable. Somebody should fix this.
Idea 1 simply doesn't work because the core of the problem is not based on SSL-Renegotiation. I am not sure about idea 2, SSL Accelerators. How many dedicated systems for SSL Acceleration would you need to prevent a big SSL-Exhaustion attack? Does this make sense for an average SSL-Server?
So what I am asking here is, what can we do to prevent such attacks until a solution to the core problem is available? How can we protect our servers that rely on encryption?