Hacker News Reader

Comment by discreditable | Hacker News Reader

Why would they not use asymmetric encryption?

Because the paragraph on key generation and management would be 3 times as long as the entire article in its current form ?

Asymmetric encryption solves the problem of transmitting the password safely ("solve" is a rather optimistic word, maybe "delegates" is more appropriate); if you can safely transfer passwords from point to point, then using symmetric encryption is far easier.

Asymmetric cryptography transforms key distribution problems into key management problems.

Which is just a different problem, not necessarily an easier one, like you say.

more importantly, they're more cpu intensive and slow to deal with large files

Asymmetric encryption adds constant overhead, independent of message size.

Unless you're doing it wrong.

while not an expert I disagree, encrypt a 1GB file must be different from 1MB file, no matter it is sym or asym encryption. normally Asym is for keys while symmetric encryption is for the real content.

> Asymmetric cryptography transforms key distribution problems into key management problems.

That's a very nice way to put it, I'm going to reuse that !

...and why encrypt stuff transferred with scp?

because encryption in transit != encryption at rest. Maybe you don't trust the server you are scp'ing the data to, with encryption at rest you dont' need to.

That's not what the documentation is about, though:

====

Use GPG with the cipher AES256, without the --armour option, and with compression to encrypt your files during inter-host transfers. GPG

Encryption helps protect your files during inter-host file transfers (for example, when using the scp, bbftp, or ftp commands). We recommend GPG (Gnu Privacy Guard), an Open Source OpenPGP-compatible encryption system.

===

scp shouldn't be in that list.

If your goal is to transfer securely from person to person, 'scp' generally means there's a common server you're accessing - not that you're 'scp'ing directly to the other user's machine. Keeping it secure when "at rest" on the remote server would ensure it's securely transferred between the two end points.

NASA has historically done at least some open transfers, such as HTTP, FTP, etc. Using GPG for these is good. And it keeps the file encrypted at rest too.

Symmetric is easier to teach to people, especially large groups of people doing tech training.

GPG, of course, allows you to use asymmetric crypto and currently supports RSA, RSA-E, RSA-S, ELG-E, and DSA algorithms for that purpose.

But for bulk data encrypting good symmetric (AES, CAST5, etc.) is both more secure and significantly faster.

You should be aware that even for asymmetric encryption, only a one-time document-specific key will be encrypted with the asymmetric algorithm. The document itself will always be encrypted using a symmetric cipher.

This is how the same document can be encrypted for multiple recipients efficiently, without duplication all the data. First the document is encrypted with a symmetric key, which is then encrypted with the public key of each recipient. This information will be prepended to the actual encrypted document.

For details see: https://tools.ietf.org/html/rfc4880#section-2.1

GPG 2.1 (via libgcrypt) also supports various elliptic curve algorithms for asymmetric crypto, depending on what version of libgcrypt you have.

Reply on news.ycombinator.com