On Thu, Nov 8, 2018 at 9:31 PM Ryan Carboni <rya...@gmail.com> wrote:
> On Thursday, November 8, 2018, Eric Rescorla <e...@rtfm.com> wrote: > >> It's also worth noting that in practice, many sites are served on >> multiple CDNs which do not share keying material. >> > > Encrypting common knowledge is cargo cult fetishism for cryptography. The > files could be sent unencrypted, and protected using subresource integrity. > If you are sharing the same data to multiple second parties to serve to a > single third party, the value of encryption is less than zero. > This misunderstands the utility and deployability of SRI. SRI is based on hashing data exactly, and so sites can only practically use it for files that do not change (e.g. jQuery x.y.z) and not services that do change (e.g. an analytics service, or really any live service). Encryption in transit for public files, between services operated by separate entities, is a practical necessity to preserve integrity.
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
