<story><title>Internet architects propose encrypting all the world&apos;s web traffic</title><url>http://www.wired.co.uk/news/archive/2013-11/15/encrypting-all-web-traffic</url></story><parent_chain></parent_chain><comment><author>bostik</author><text>I know this may be a bit off-topic, but since we&amp;#x27;re discussing HTTP&amp;#x2F;2 already, I can&amp;#x27;t help but wonder. The recent attacks (BEAST, CRIME, etc.) have all relied on being able to build an oracle from (sent) body content and uncover header elements. The attacks only get better in time, so I expect to see even more attacks like this.&lt;p&gt;If we&amp;#x27;re going to overhaul the HTTP spec in any case and go for framed messaging - why not go for separate header&amp;#x2F;body compression AND separate encryption keys? As far as I understand, that would block the whole family of attacks. Separate compression contexts would prevent the attacker from building an oracle from body to attack the header. Separate keys and encryption contexts should prevent padding and mode oracles against the header.&lt;p&gt;I know crypto is hard, and I &lt;i&gt;know&lt;/i&gt; there would be devilishly tricky details to figure out. So I have to assume someone has already thought of this, has had it vetted out for flaws and then discarded the idea.&lt;p&gt;But if so, why? Apart from requiring at least twice the key size in negotiation (compute oversized shared key, split for header&amp;#x2F;body and likely HMAC keys), are there any other obvious or non-obvious technical reasons not to do this?</text></comment>
<story><title>Internet architects propose encrypting all the world&apos;s web traffic</title><url>http://www.wired.co.uk/news/archive/2013-11/15/encrypting-all-web-traffic</url></story><parent_chain></parent_chain><comment><author>XorNot</author><text>One thing I&amp;#x27;ve really thought is consistently screwed up with security proposals is &lt;i&gt;what do you do when it might be compromised&lt;/i&gt;?&lt;p&gt;Users invariably click through the big red web page because they still need to use their email at the end of the day, and that page provides no information as to what&amp;#x27;s going on.&lt;p&gt;If the certificate doesn&amp;#x27;t verify, don&amp;#x27;t give up - try a different route to it (sadly we&amp;#x27;ve taken away source-routing for other security reasons). If that fails then start a Tor session and try connecting through that.&lt;p&gt;Then show me a little diagram that shows where we think the problem is so I can think about what might be the problem.</text></comment>