 |
 |
also just a very off topic topic: what if a trusted CA issued a *.* cert? for those of you who don't know, that would be valid everywhere (even if the session was hjacked) but again, very off topic, back to the topic at hand :D *Riley Childs* *Library Technology Manager at Charlotte United Christian Academy <http://cucawarriors.com/>* *Head Programmer/Manager at Open Library Management Projec <http://openlibman.sf.net/>t <http://openlibman.sourceforge.net/>* *Cisco Certified Entry Level Technician * _________________________ *Phone: +1 (704) 497-2086* *email: [log in to unmask] <[log in to unmask]>* *email: [log in to unmask] <[log in to unmask]>* *Twitter: @RowdyChildren <http://twitter.com/rowdychildren>* On Tue, Nov 12, 2013 at 7:56 PM, Riley Childs <[log in to unmask]> wrote: > Is there a donate button somewhere? the only hurdle I see now is finding > some to maintain the cert, and coming up with the money, maybe we could put > a check box on the conference sign up form, like chip in $10 for a SSL > Cert? > Also, once again I ask how do you normally take this sort of poll deal? I > would assume it would just be a roll call (like I vote yes in a series of > emails) > Once again my recommendation for a cert provider is DigiCert, they will > cover both the wiki and site (plus *.code4lib.org) for about $475 a year > (or they have a single cert for $159) > > *Riley Childs* > *Library Technology Manager at Charlotte United Christian Academy > <http://cucawarriors.com/>* > *Head Programmer/Manager at Open Library Management Projec > <http://openlibman.sf.net/>t <http://openlibman.sourceforge.net/>* > *Cisco Certified Entry Level Technician * > _________________________ > > *Phone: +1 (704) 497-2086 <%2B1%20%28704%29%20497-2086>* > *email: [log in to unmask] <[log in to unmask]>* > *email: [log in to unmask] <[log in to unmask]>* > *Twitter: @RowdyChildren <http://twitter.com/rowdychildren>* > > > > > On Tue, Nov 12, 2013 at 7:28 PM, Simon Spero <[log in to unmask]> wrote: > >> On Mon, Nov 4, 2013 at 1:45 PM, Ethan Gruber <[log in to unmask]> wrote: >> >> > NSA broke it already >> >> >> SSL was born into lossage. After Netscape decided to go it alone, the >> first version they came back with used RC4... with the same symmetric key >> in both directions... At EIT I did a Proof of Concept attack using the >> initial lack of binding between DNS name and X.500 certificate (this was >> funded on the DARPA MADE project grant). >> >> All this was done at a time when the guestimate of a ~1 Public Key >> Operation per second. >> >> On a late 2011 macbook pro ( Intel(R) Core(TM) i7-2760QM CPU @ 2.40GHz ) >> >> openssl speed -multi 8 rsa2048 gives a throughput of 3124.2 >> signatures.second, and 97561.0 verifications. >> >> For Symmetric AES, the same hardware gives the throughput listed below. >> >> The 'numbers' are in 1000s of bytes per second processed. >> >> type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 >> bytes >> >> aes-128 cbc 427093.88k 451648.30k 460755.99k 462780.42k >> 459068.76k >> >> aes-192 cbc 352143.17k 368399.83k 370499.48k 371674.11k >> 371816.40k >> >> aes-256 cbc 299224.85k 309780.08k 301863.34k 286403.36k >> 286261.25k >> In other words: the cpu cost ain't not thang. >> >> There is an recurrent cost for a server certificate, but I'm sure that >> this >> could be obtained from the usual suspects (Mellon, OCLC, Kilgour, or >> Stanford). Somebody has to responsible for renewing certificates before >> they expire (same sort of work as making sure the DNS domains don't >> expire). >> >> Simon >> > >