1. A Comparison of HTTP and HTTPS Performance Arthur Goldberg, Robert Buff, Andrew Schmitt [artg, buff, schm7136]@cs.nyu.edu Computer Science Department Courant Institute of Mathematical Science New York University Computer Measurement Group, December 8, 1998

2. 2 Outline Review of secure Web communications Experimental design HTTP and HTTPS performance Conclusions

3. 3 HTTP Transaction Client BrowserWeb Server TCP Connect HTTP GET transaction

4. 4 Measured Calls Socket = TCP-connect( URL ); start-timer; TCP-write( HTTP-Request ); while ( data-available ) { TCP-read( HTTP-Response ); } end-timer;

5. 5 HTTPS SSL TCP

6. 6 Client BrowserWeb Server HTTPS Transaction TCP Connect SSL Connect HTTPS GET transaction

7. 7 Measured Calls Socket = TCP-connect( URL ); SSL-connect( Socket ); start-timer; SSL-write( HTTP-Request ); while ( data-available ) { SSL-read( HTTP-Response ); } end-timer;

8. 8 Secure Performance Issues Comparison of HTTP and HTTPS GETs SSL connect delay

9. 9 WebPerf System Robot browser –HTTP 1.0 –Proxies –SSL Oracle 7.3 SQL 92 Database –Experiments –Results

10. 10 Robot Browser Implementation Visual C++ 5.0, optimized Single-threaded Winsock 1.1 SSLeay 0.8.1 (by Eric A. Young ) RogueWave and Oracle OCI

11. 11 Experimental Setup Intranet: Robot PC and Server PC Measured downloads in –HTTP –HTTPS export grade encryption (40 bit keys) –HTTPS domestic grade encryption (128 bit keys)

12. 12 Robot PC Windows NT Workstation 4.0 100 MHz Pentium, 32 MB, NE 2000 NIC 10 Mbps Ethernet Connected to server via unswitched hub

13. 13 Server PC Netscape Enterprise Server 3.5.1 Microsoft Internet Information Server (IIS) 4.0 Windows NT Server 4.0 200 MHz Pentium, 256 MB, 100baseT Ethernet NIC

14. 14 Downloaded documents Prefix of HTTP Specification in HTML Sizes in KB: 1, 2, 3, …, 18, 19, 20 40, 60, 80, 100

15. 15 200 100 50 150 200 100 50 150 ms Duration (100K) Netscape Microsoft Non-secureSecure (40)Secure (128) 20 60 100 75%95%

16. 16 Non-secureSecure (40)Secure (128) 20 60 100 60 100 Duration (20K) ms Microsoft Netscape 0 5 10 15 20 75%95%

17. 17 Conclusion HTTPS only slightly slower than HTTP