3 ms·

You don't need to replace your entire anything, and it's not "just for fun". No, the question is really "EC has these benefits (lower CPU and memory usage) - w

You don't need to replace your entire anything, and it's not "just for fun". No, the question is really "EC has these benefits (lower CPU and memory usage) - why aren't these benefits attractive enough for someone to start experimenting with it?" - with those someones probably being companies like Google, Facebook, Dropbox etc that have very substantial amounts of SSL traffic and could surely benefit from saving on memory and CPU.

VLM 13y ago
"could surely benefit from saving on memory and CPU." ... at a certain labor cost. And memory and CPU prices are forever decreasing and labor cost is sorta increasing. So if it doesn't make sense as a system to do it today it probably never will, for an established organization anyway. Also its not "why aren't they experimenting" but "why aren't they publicly experimenting". And it would nearly be a first in the security field to discuss algo changes this long in advance of rollout, if its ever discussed in public at all... Finally its highly unclear why anyone uses SSL for these apps. That solely protects the relatively highly secure comm channel between two wide open insecure endpoints, so there's no point other than security theater/marketing. For email auth, yeah maybe. For finance its theater but necessary theater. But for G+, FB, DB as listed its just a waste of time. The MS windows enduser is probably owned 100x over with worms and keyloggers, and the server side will roll over and play dead to anyone remotely in .gov.
- mseebach 13y ago
  > Finally its highly unclear why anyone uses SSL for these apps Huh? The reason you use SSL for Google and Facebook is so 15 random strangers don't get access to your accounts just because you go online for five minutes in Starbucks. PRISM is awful and all but that doesn't mean non-state adversaries stopped being a thing overnight.

VLM 13y ago

"could surely benefit from saving on memory and CPU." ... at a certain labor cost. And memory and CPU prices are forever decreasing and labor cost is sorta increasing. So if it doesn't make sense as a system to do it today it probably never will, for an established organization anyway. Also its not "why aren't they experimenting" but "why aren't they publicly experimenting". And it would nearly be a first in the security field to discuss algo changes this long in advance of rollout, if its ever discussed in public at all... Finally its highly unclear why anyone uses SSL for these apps. That solely protects the relatively highly secure comm channel between two wide open insecure endpoints, so there's no point other than security theater/marketing. For email auth, yeah maybe. For finance its theater but necessary theater. But for G+, FB, DB as listed its just a waste of time. The MS windows enduser is probably owned 100x over with worms and keyloggers, and the server side will roll over and play dead to anyone remotely in .gov.

mseebach 13y ago
> Finally its highly unclear why anyone uses SSL for these apps Huh? The reason you use SSL for Google and Facebook is so 15 random strangers don't get access to your accounts just because you go online for five minutes in Starbucks. PRISM is awful and all but that doesn't mean non-state adversaries stopped being a thing overnight.