Problem - Kevin Tafuro

compute the future time at which the next authentication attempt will be accepted,
and ignore any input until that time arrives.
When authenticating a user interactively on a terminal on Unix, the best solution is
likely to be to use the sleep( ) function. On Windows, there is no strict equivalent.
The Win32 API functions Sleep( ) and SleepEx( ) will both return immediately—
regardless of the specified wait time—if there are no other threads of equal priority
waiting to run.
Some of these techniques can increase the risk of denial-of-service
attacks.
In a GUI environment, any authentication dialog presented to the user will have a
button labeled “OK” or some equivalent. When a delay must be made, disable the
button for the duration of the delay, then enable it. On Windows, this is easily
accomplished using timers.
The following function, spc_throttle( ), computes the number of seconds to delay
based on the three variables we’ve described and the number of failed authentication
attempts. It has four arguments:
attempts
Pointer to an integer used to count the number of failed attempts. Initially, the
value of the integer to which it points should be zero, and each call to spc_
throttle( ) will increment it by one.
max_attempts
Maximum number of attempts to allow. When this number of attempts has
been made, the return from spc_throttle( ) will be –1 to indicate a complete
failure to authenticate.
allowed_fails
Number of attempts allowed before enabling throttling.
delay
Base delay in seconds.
If the maximum number of attempts has been reached, the return value from spc_
throttle( ) will be –1. If there is to be no delay, the return value will be 0; otherwise,
the return value will be the number of seconds to delay before allowing another
authentication attempt.
int spc_throttle(int *attempts, int max_attempts, int allowed_fails, int delay) {
int exp;
(*attempts)++;
if (*attempts > max_attempts) return -1;
if (*attempts