Question

I was considering what would it take (technologically) to move all the web traffic to HTTPS. I thought that computers are getting faster, and faster, so some time from now it will be possible to run all traffic via HTTPS without any noticeable cost.

But then again, I thought, encryption strength will have to evolve to counter the loss of security. If computers get 10x faster, encryption will have to be 10x stronger, or it will be 10x easier to break.

So, will we ever be able to encrypt all web traffic “for free”?

Edit: I’m asking only about the logic of performance increases in computing vs encryption. If we can use the same crypto algorhytms and keys in 20 years, they will consume a far lower percentage of the overall computing capacity of a server (or client), and in effect, that will make it “free” to encrypt and sign everything that we transmit over networks.

Answer 1

One of the big issues with using HTTPS is that its considered secure and so most web browsers don’t do any caching, or at least do very limited caching.

Without the cache, you’ll notice that HTTPS pages load significantly slower and a non-encrypted page would.

HTTPS should be used to protect sensitive information.

I have no idea about the CPU impact of running everything through SSL. I would say that on the client side, the CPU isn’t an issue since most workstations are running idle most of the time anyway. The big program would be on the web server side due to the sheer number of concurrent requests that are being handled.

In order to get to the point that SSL is basically ‘free’, you’d have to have dedicated hardware for encryption (which already exists today).

EDIT: Based on the comments, the question’s author suggests this is the answer he was looking for :

Using crypto is already pretty fast,
particularly considering that we’re
using CPU cycles vs. data
transmission. Crypto keys do not need
to get longer. I don’t think there’s
any technical reason why this is
impractical.
–David Thornley

UPDATE: I just read that Google’s SPDY protocol (designed to replace HTTP) looks like it will use SSL on every connection. So, it looks like Google thinks that it’s possible!

To make SSL the underlying transport
protocol, for better security and
compatibility with existing network
infrastructure. Although SSL does
introduce a latency penalty, we
believe that the long-term future of
the web depends on a secure network
connection. In addition, the use of
SSL is necessary to ensure that
communication across existing proxies
is not broken.