3 ms·

I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thi

by andreyf 11y ago

I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thinking of, and how does it provide authentication? Not everything needs encryption and there is a real cost to maintaining encryption infrastructure. As those costs decrease, we get more encryption, and perhaps we'll get to a place where everything is encrypted, but I don't think it's especially outrageous that we're not there now.

CyberDildonics 11y ago
Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.
- andreyf 11y ago
  Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.
  - dragonwriter 11y ago
    > https actually uses symmetric encryption for content and public/private for authentication, iirc. It uses public key crypto to exchange the keys for symmetric encryption; symmetric encryption relies on having a secure channel for exchanging a shared secret.

by andreyf 11y ago

CyberDildonics 11y ago

Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.

andreyf 11y ago
Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.
- dragonwriter 11y ago
  > https actually uses symmetric encryption for content and public/private for authentication, iirc. It uses public key crypto to exchange the keys for symmetric encryption; symmetric encryption relies on having a secure channel for exchanging a shared secret.