Protecting Chrome Traffic with Hybrid Kyber KEM

blog.chromium.org

14 pointspabs33 comments

The 1 kilobyte of extra data to send to start a session sounds like it could have quite a performance impact, especially on slow connections, or occasions where it causes an extra RTT.

Is there really no way to reduce the size of the data needed? After all, even the fastest supercomputers available won't be counting to even a 64 bit (8 byte) number anytime soon, so you would imagine that if the crypto algorithm was perfect then 128 bits should be plenty for key sizes, and 256 bits gives a decent safety margin.

While I understand and admire the efforts to optimize performance, I think if 1kb spent wisely could be worth it.

Based on the pingdom stats from 2018, the average page size was above 2Mb. See https://www.pingdom.com/blog/webpages-are-getting-larger-eve...

So in the grand scheme of things, it could be a sub percentage price for better security. I do see how even small numbers compound for large populations, but this one is fine IMO

Not only for web pages - there are plenty of API requests where the connection overhead is far larger than the data payload.

Reply on news.ycombinator.com