Live data from Hacker News

How HTTPS Stops Attackers: What Every Web Dev Should Know

blog.hartleybrody.com

41–45 of 45 posts

Re: How HTTPS Stops Attackers: What Every Web Dev Should Know

#41
post #15

Symmetric-key ciphers aren't used because they "save a round trip". They're used because they're much faster. One could use a public key encryption system to encrypt the entire session between two parties (e.g. RSA) but AES is much faster than RSA.

Speed is one concern but far from the main reason. You couldn't use a typical-length RSA key to encrypt a large chunk of data because there's a max input size for any given RSA key size. Standard block/stream cipher modes of operation are defined only for symmetric key ciphers.

The max input size is for one message. It's effectively the "block size" for RSA. You can send multiple messages using a single RSA key (and in fact pretty much everyone does that, otherwise you'd need a new public key for every message). RSA is a complete crypto system, you don't need any additional ciphers. You do need randomiziation (e.g. random padding).

Re: How HTTPS Stops Attackers: What Every Web Dev Should Know

#42
post #11

I had quite low expectations for what I would learn from this article but it was actually very good. I really liked the paint analogy and the simplified understandable maths. Does someone want to try it here? :P Lets use root 2 and a small private number. We can do mod 10 (so the last digit of 2^(your secret) is your public number). My public number would be 4. (My secret number is secret). I know this is kind of goo…

10 is not prime.

Drat. I failed that quite badly. Yes, a prime number would be needed. If someone knows why a prime must be used or knows of something which explains why then I would be very interested to find out why this is.

Re: How HTTPS Stops Attackers: What Every Web Dev Should Know

#43
This article leads me to wonder. Has the US Government ever requested the master private keys for the main certificate authorities, such as Verisign?

It actually makes sense in a criminal investigation to spoof a real site in order to phish for passwords or the personal information of criminals. A similar method was used before to get cable thieves to call a phone number on the screen thinking they were giving their information to win a free item.

However, having the capability to impersonate any company, group, or individual has an enormous potential for abuse.

Re: How HTTPS Stops Attackers: What Every Web Dev Should Know

#44
post #41

Earlier quoted context omitted.

Speed is one concern but far from the main reason. You couldn't use a typical-length RSA key to encrypt a large chunk of data because there's a max input size for any given RSA key size. Standard block/stream cipher modes of operation are defined only for symmetric key ciphers.

The max input size is for one message. It's effectively the "block size" for RSA. You can send multiple messages using a single RSA key (and in fact pretty much everyone does that, otherwise you'd need a new public key for every message). RSA is a complete crypto system, you don't need any additional ciphers. You do need randomiziation (e.g. random padding).

For the sake of completeness, one such construction where RSA is used as a cipher is OAEP (Optimal Asymmetric Encryption Padding). Beyond being slow it has some other inefficiencies but that's another story.
Post reply on HN