Performance Comparison of HTTP and HTTPS: A Study by Goldberg, Buff, and Schmitt
This paper presents a comprehensive comparison of the performance of HTTP and HTTPS protocols. It reviews secure web communications, elaborates on experimental design, and analyzes performance metrics. The experimental setup included HTTP and HTTPS transactions measured through TCP connections, revealing that while HTTPS involves added SSL encryption, the performance difference is marginal. The findings indicate that HTTPS is only slightly slower than HTTP, thereby making it a viable option for secure communications without significantly impacting user experience.
Performance Comparison of HTTP and HTTPS: A Study by Goldberg, Buff, and Schmitt
E N D
Presentation Transcript
A Comparison of HTTP and HTTPS Performance Arthur Goldberg, Robert Buff, Andrew Schmitt [artg, buff, schm7136]@cs.nyu.edu Computer Science Department Courant Institute of Mathematical Science New York University Computer Measurement Group, December 8, 1998
Outline • Review of secure Web communications • Experimental design • HTTP and HTTPS performance • Conclusions
HTTP Transaction Client Browser Web Server TCP Connect HTTP GET transaction
Measured Calls Socket = TCP-connect( URL ); start-timer; TCP-write( HTTP-Request ); while ( data-available ) { TCP-read( HTTP-Response ); } end-timer;
HTTPS HTTPS SSL TCP
HTTPS Transaction Client Browser Web Server TCP Connect SSL Connect HTTPS GET transaction
Measured Calls Socket = TCP-connect( URL ); SSL-connect( Socket ); start-timer; SSL-write( HTTP-Request ); while ( data-available ) { SSL-read( HTTP-Response ); } end-timer;
Secure Performance Issues • Comparison of HTTP and HTTPS GETs • SSL connect delay
WebPerf System • Robot browser • HTTP 1.0 • Proxies • SSL • Oracle 7.3 SQL 92 Database • Experiments • Results
Robot Browser Implementation • Visual C++ 5.0, optimized • Single-threaded • Winsock 1.1 • SSLeay 0.8.1 (by Eric A. Young) • RogueWave and Oracle OCI
Experimental Setup • Intranet: Robot PC and Server PC • Measured downloads in • HTTP • HTTPS export grade encryption (40 bit keys) • HTTPS domestic grade encryption (128 bit keys)
Robot PC • Windows NT Workstation 4.0 • 100 MHz Pentium, 32 MB,NE 2000 NIC • 10 Mbps Ethernet • Connected to server viaunswitched hub
Server PC • Netscape Enterprise Server 3.5.1 • Microsoft Internet Information Server (IIS) 4.0 • Windows NT Server 4.0 • 200 MHz Pentium, 256 MB, 100baseT Ethernet NIC
Downloaded documents • Prefix of HTTP Specificationin HTML • Sizes in KB: 1, 2, 3, …, 18, 19, 20 40, 60, 80, 100
95% 75% Duration (100K) Non-secure Secure (40) Secure (128) ms Netscape 200 150 100 50 Microsoft 200 150 100 50 20 60 100 20 60 100 20 60 100
95% 75% Duration (20K) Non-secure Secure (40) Secure (128) ms Netscape 100 60 20 Microsoft 100 60 20 0510 1520 0510 1520 0510 1520
Conclusion • HTTPS only slightly slower than HTTP
