3 ms·
SSL/TLS is bloated but that's not a reason not to use it. Rather it's a reason we need some TLSv2 that just removes the crap and focuses only on three encrypti
by tscs37 10y ago
SSL/TLS is bloated but that's not a reason not to use it.
Rather it's a reason we need some TLSv2 that just removes the crap and focuses only on three encryption/authentication modes:
* Desktop: High throughput, lots of CPU, minimal latency
* IoT: small throughput, very little CPU, latency acceptable
* Mobile: small to medium throughput, some CPU, minimize latency
A lot of bloated protocols are still good, they're bloated because backwards compatibility and everyone and their kitchensink needs to be able to decode it.
- phonon 10y agohttps://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html https://security.googleblog.com/2014/04/speeding-up-and-stre...
- fkooman 10y agoIt seems to make more sense to just have ONE that can accommodate all those scenarios in a secure way. One doesn't solve bloat by introducing more bloat. I'd say more can be won by removing e.g. ASN.1 and X.509 for certificate handling and encoding that are a very difficult (impossible?) to get right and switch to something simple that solves the 99% use case of current TLS.
- tscs37 10y agoI agree with ASN.1 and X.509. Those two are part of my plaintext-offenders list, like SMTP. They make life equally painful for both man and machine.