Mass encryption use, and DPI

[Peter Fairbrother]

Ian Batten wrote:
> 
> On 21 Jun 2009, at 04:50, Peter Fairbrother wrote:
> 
>> The HO seem to be (maybe... ) continuing with their attempt to log all 
>> comms between everyone, eg those messages passed via facebook or 
>> whatever, using DPI - but just how hard would it be for facebook etc 
>> to use SSL encryption?
>>
>> That would be transparent to the user, but just how much would it cost 
>> facebook to implement? 0.001%?  1%?
> 
> At risk of returning this list to discussing crypto, isn't one of the 
> problems going to be, for a seriously high-traffic site like Facebook, 
> laying hands on enough entropy to make the server end of the key 
> negotiation secure?
> 
> ian

Leaving aside hardware RNG's, I think, for client-side security, the 
server hardly needs any entropy at all.

The RSA bit needs none, and server could reuse the DH entropy as often 
as needed, relying on the client to provide secure entropy.

Which just leaves the cost of the hardware...


-- Peter Fairbrother