Re: http+aes from Julian Reschke on 2012-03-05 (uri@w3.org from March 2012)

From: Julian Reschke <julian.reschke@gmx.de>
Date: Mon, 05 Mar 2012 11:51:03 +0100
To: Poul-Henning Kamp <phk@phk.freebsd.dk>
CC: Willy Tarreau <w@1wt.eu>, Anne van Kesteren <annevk@opera.com>, URI <uri@w3.org>, HTTP Working Group <ietf-http-wg@w3.org>, Ian Hickson <ian@hixie.ch>
Message-ID: <4F549A97.8060101@gmx.de>

On 2012-03-05 11:43, Poul-Henning Kamp wrote:
> In message<20120305104004.GC30594@1wt.eu>, Willy Tarreau writes:
>
>> Being able to encrypt only the payload would be extremely useful in
>> server-to-server communications in datacenters.
>
> How usefull is it, when packet sniffing gets you both the key
> and the encrypted data ?
>
> I could understand it if the userinfo pointed to a PSK, but sending
> the actual AES key as part of the request defeats any attempt at
> privacy I can see ?

I think the confusion comes from embedding local information into the 
URI; it seems the userinfo is not supposed to be transmitted on the 
wire. (which of course raises the question about why it's in the URI then)

Best regards, Julian

Received on Monday, 5 March 2012 10:51:36 UTC