Encrypting the message isn't fool-proof, because the same folks between me and the BBC server can get the keys used to encrypt our messages. But they have to be watching the requests from the very beginning, which isn't easy to do.
is this true? I was under the impression that things like TLS have both parties use their own private/public key pairs, something like diffie hellman to get a shared secret, then a KDF to derive a key that's never transmitted over the wire.
Serial podcast creator and .NET Core maniac.
Can often be found talking about everything and nothing on one of the many podcasts that he produces (only one of them is about .NET Core, honest)
Location
Leeds, UK
Education
Computer Science with Games Development - BSc
Work
.NET Development Contractor; Podcast host, producer and editor
You're absolutely right. I'll need to think of how to change this slightly.
I wanted to somehow point out that, given enough compute time, the encryption can be brute forced after the fact. I think I'll just leave that bit out.
But I will edit this post/notes to strike through that bit.
Yeah, encryption keys are only valid for n numbers of operations, that number changes depending on the bit size of the key, but it's a pretty large number. But yeah, getting into that's kinda the nitty gritty.
Even still, brute forcing even the smaller of AES keys (128 bits) takes a long time - not sure how accurate this is to today's compute, but from: eetimes.com/document.asp?doc_id=12.... in the uh, scientific notation of years!
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
is this true? I was under the impression that things like TLS have both parties use their own private/public key pairs, something like diffie hellman to get a shared secret, then a KDF to derive a key that's never transmitted over the wire.
You're absolutely right. I'll need to think of how to change this slightly.
I wanted to somehow point out that, given enough compute time, the encryption can be brute forced after the fact. I think I'll just leave that bit out.
But I will edit this post/notes to strike through that bit.
Yeah, encryption keys are only valid for
nnumbers of operations, that number changes depending on the bit size of the key, but it's a pretty large number. But yeah, getting into that's kinda the nitty gritty.Even still, brute forcing even the smaller of AES keys (128 bits) takes a long time - not sure how accurate this is to today's compute, but from: eetimes.com/document.asp?doc_id=12.... in the uh, scientific notation of years!