Hacker News Reader

Comment by vbezhenar | Hacker News Reader

I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.

View on HN

Typically very little. Most current CPUs integrate some variation of the Advanced Encryption Standard instruction set (AES, AES-NI, etc), so just like H.264 or H.265 decoding, it can be very, very efficient with custom instructions (magnitudes of order faster / less power consuming than without).

This is why most devices are equally capable of rendering http or https (you never have to 'revert' to http because a website is too slow in https... it's just not a thing). A stupid background app may consume 10x or 100x your encryption budget.

I wonder how much metal is spent making door locks. Eh, probably better leaving all doors unlocked.

I wonder how much steel is in a banks safe. Eh, better leave the safe open.

I wonder how much time people spend typing in their passwords. Eh, better remove passwords from all sites.

On a modern CPU with encryption instructions in the ISA, a vanishingly small amount of power compare to the databases and JavaScript involved in the requests.

I bet if you stress test a server via http and via https, the CPU time won't be as different as you might think.

The main efficiency lost is that you can no longer have big shared cache networks for everybody, but those were a security risk anyway.

The somewhat surprising main problem is not CPU load but the additional back-and-forth TLS requires to establish the handshakes. One of the main goals/draws of HTTPS/3 is eliminating these extra steps.

By encrypting all traffic, you protect sensitive traffic better because an adversary can't tell sensitive from non-sensitive communications.

Not much since all major processor vendors do this in hardware.

Many entities have published their numbers and overhead is in the low single digit percentage.

Efficiency is overrated. Encryption stops injection or modification of data in flight in its tracks, that alone makes it worth it. Otherwise, how would you know you receive what the sender sent you?

Not much with modern processors. And it's worth it, you can't put a price on privacy and rights to it.

Everything has its price.

Reply on news.ycombinator.com