Back in October Google announced that they would be enabling SSL search by default… at least for Google account owners. What this means is every ounce of information is (at least theoretically *see below) encrypted while it goes over the tubes between Google’s servers and your computer or mobile devices.
Traditionally SSL was only used for high-security sites, such as bank logins, government and corporate portals, and email systems. However, thanks to the yearly increases in server performance, large-scale SSL rollouts is becoming a reality. First it was facebook, then it was twitter, and now Google is joining the party.
While many services such as Banks have used SSL for years, there is huge difference between encrypting something with a few million requests per month vs a few million requests per hour. That extra percent or two of CPU usage for one request really adds up at that scale.
Now with the increased publicity about constant security threats it would not surprise me to start seeing more readily available servers include encryption coprocessors – sort of like what a GPU is for gaming. Many manufacturers have plans to start fabbing such chips, and there are some systems that already include them – but they haven’t really taken off yet. When that starts happening I think the adoption rate of SSL for general-purpose sites (such as Google search) will really skyrocket. One of the big problems now is SSL runs strictly on the CPU… and sure CPUs these days are incredibly fast, but in servers they are usually busy with other tasks – such as running code or fetching a database row or saving something to memcache, etc.
The only other option I could see would be to start putting GPUs into servers. GPUs are actually amazingly fast at encrypting and decrypting data – unfortunately they are also amazingly hot and are nowhere near as efficient as a dedicated encryption processor could be. Personally, I would not want to see what would happen to a server if you could somehow shoehorn a couple of GTX 570s into it… sure it could crunch the hell out of some numbers, but the poor thing would melt. Heck, you could probably fry eggs on it.
I’ll go out on a limb and say in the next 5 years pretty much every server-grade system being produced will include encryption coprocessors (probably coupled with the main CPU), and at least 30% of all traffic will be encrypted, whether it is with SSL or something else.
(*Note: SSL is secure, however, it can be broken. Like every end-to-end solution, it is very possible (albeit difficult) to do a man in the middle attack)