5 ms·
Encryption bundles orthogonal concerns, authenticity and confidentiality. Since there are situations confidentiality is not desired (see OP), I think we should
by sanxiyn 12y ago
Encryption bundles orthogonal concerns, authenticity and confidentiality. Since there are situations confidentiality is not desired (see OP), I think we should work on making cleartext+signature easier.
- Nursie 12y agoSet your ciphersuite to RSA_NONE_SHA256...
- ryan-c 12y agoNo common browsers support cipher suites without encryption.
- Nursie 12y agoTrue, and this is largely a good thing - if you actually want a secure connection you do not want your browser accepting a NULL cipher suite and saying "Hey! I'm using TLS!" There's no reason why browser-makers couldn't put in a capability to fetch some resources this way, without telling the user that what thy are doing is 'secure'. However by the time you've done your RSA verification and a per-packet SHA256 HMAC or similar, the overhead of AES encrypting the data might not actually be all that much more...
- sqeaky 12y agoThis stance implies that the complexity of having some systems or parts of systems encrypted, but not others is without cost. I would not be able to teach my grandmother the UI of this system, she has a hard time with chrome's SSL lock icon as it is. Encrypting everything is a great situation for her so she can shop online safely.
- Lawtonfogle 12y agoWhat does that solve? They can MITM to modify the clear text and the signature.