3 ms·
If every application provided their own encryption, most of them would get it wrong, and it still wouldn't protect important metadata. I don't think that's much
by tveita 13y ago
If every application provided their own encryption, most of them would get it wrong, and it still wouldn't protect important metadata. I don't think that's much of an ideal.
I don't have an issue with adding application specific encryption, as long as you also keep doing it at a suitable "lowest-common-denominator" layer.
A more achievable ideal would be for every layer to do strong integrity checking.
- tptacek 13y agoI agree that one of the costs for doing everything at the highest possible layer is the potential for mistakes. I don't think every application should invent their own cryptosystem; I think most applications would be well-served with Nacl, and I think things like GPGMail show another good path forward. I agree that it would be good if the lowest common denominator provided integrity checking, but as we can see with XTS, sector-level encryption makes that hard. Hence the article. :)