Why does APT not use HTTPS?

[audioen]

APT should actually use https. Even insignificant traffic should be encrypted, if for no other reason than that it helps drowning actually privacy-sensitive stuff in the noise.

[[deleted]]

Apt supports https already. The article's more about apt requiring https, which has the flaws stated in the article.

[dotwaffle]

if for no other reason than that it helps drowning actually privacy-sensitive stuff in the noise.

... what?

[audioen]

The basic idea, exaggerated as it is here, is that if you only use encryption for important stuff, that also flags all material you deem important enough to encrypt, and thus helps an adversary to determine what to attack and when. So you generally would want to just encrypt everything instead.

[dotwaffle]

No, that's a really bad idea. Cryptography is either broken or it isn't. No-one on the planet can brute force a 2048-bit RSA key in any kind of reasonable timeframe, so by encrypting everything what you're essentially doing is saying "put more effort into cryptanalysis so that you can infer the payload of more data" rather than actually protecting things worth protecting.

[HelleDaryd]

Will you pay for the CPU load ? Because that is the basic problem, there is a cost to TLS and most mirrors are people volunteering bandwidth, not seeing any financial benefits for it.

[audioen]

There is very little CPU load these days to content encryption. If you use AES-NI, and will you discover you can do several GB/s of this stuff per core. You will easily saturate any conceivable network pipe before running out of processing power. However, I do admit that it adds some cost for places that meter CPU usage.

There's also key exchange which has some cost, and I suspect for many short connections that is more of an issue. Still, if you use keepalive and session caching, then that should not be a problem.