Hacker News Reader

Comment by p4bl0 | Hacker News Reader

The discussion here is already quite long so maybe I missed it, but I don't see anyone asking (or answering) the first question that came to me while reading the linked email:

Why is the cost of end-to-end crypto never taken into account?

I just can't believe that we have reached a point where it is possible to cheaply mass mail the way spammers do if you need to encrypt each email for each recipient. That alone should be disuasive enough, at least that's always what I thought. If I'm right, all the discussion about the need for client to extract features from emails and send them to a necessarily trusted centralized third party is useless. But I may be missing something, where am I wrong?

View on HN

Even at a reduced rate, end to end crypto means spammers will have a much higher success rate since they don't have to fight a centralized spam system with global knowledge. This more than makes up for the extra time to encrypt a message.

Mh, okay.

But let's make the crazy assumptions that we are effectively in a world where end-to-end crypto is massively used, virtually by everyone.

I guess it would be stupid to assume that the message are encrypted but not signed.

This means that it would be easy to have a list of identities (i.e., keys) which are sending spams, for instance using a web of trust, without users having to disclose any other informations that "I trust these identities, not these ones" (which could be as easy to do as clicking "spam" or "not spam" for the users).

Now that means that the spammers not only have to encrypt every single email for every single recipient but also to generate new key-pairs for almost each encryption.

Of course it is also very easy to mark as spam any email signed with a key that is considered too small (i.e., too quick to generate).

Now if you tell be that still won't do it without a "centralized spam system with global knowledge", I have to seriously rethink a lot of my assumptions about the cost of some computations.

Some numbers:

- Public key encryption: 2048bit RSA can achieve up to about 200k encryptions per second on a high end cpu [1]. ElGamal-like encryption schemes using elliptic curve cryptography can get to about 100k encryptions [2].

- Public key signatures: RSA is hopelessly slow for good keys. There is no reason to use strong keys for this case, though. If you reuse primes you can use a 1000 primes to generate a million RSA modules (you need two primes per public key), effectively eliminating the costly prime search. Using elliptic key cryptography the key generation step is dirt cheap: With ed25519 you get 200k key generations per second [3]

[1] http://bench.cr.yp.to/results-encrypt.html [2] http://bench.cr.yp.to/results-dh.html [3] http://bench.cr.yp.to/results-sign.html

Formula used for each of the above numbers: 3500x10^6/[median for Intel Xeon E3]x4

Thanks for the number, it's very informative.

I guess there's still the solution to only accept message from trusted keys but that means that 1- we have to be able to detect signature-rings from spammers in the graph (that clearly should not be a big problem), and 2- that there is an easy and realistic way to have a legitimate key in the trusted network before it can be used to sends emails…

Anyway, all that is very interesting from a theoretical point of view, but we are far from being in a world where end-to-end crypto is massively used.

You could set up your MUA today so that anyone you've already emailed with gets put in a priority folder. No need to mess with end to end encryption just for that functionality.

Theoretically, any spammer could research you enough to send to mail purporting to be from your friends, but realistically no one would bother.

> trusted keys

The problem with Web-of-Trust is that once you try to roll it out mainstream, most people will just click "accept" or "I trust this key" without thinking about it. Instead of "signature-rings from spammers" you would have spammers duping less-aware real people into trusting their keys.

That said, it would seem to be a longer feedback loop to get a number of actual people to open emails and trust their keys.

> most people will just click "accept" or "I trust this key" without thinking about it

What if they don't have to do that because it's transparently done for them when they use the "flag as spam", "not spam", and "reply" buttons for instance?

Encryption is pretty darn cheap in cpu cost. And they have botnets to do it for them.

Of course using end-to-end crypto does not only mean "encryption", see my other response.

Reply on news.ycombinator.com