0

I'm having trouble understanding why my Android server is so much slower in HTTPS than in HTTP. As you can see from the curl below, I do not think it's due to the handshake as that happens relatively quickly

thomas-mba:thomas$ curl -v --trace-time --insecure https://192.168.1.19:8101/tasks
16:59:10.719547 * About to connect() to 192.168.1.19 port 8101 (#0)
16:59:10.720632 *   Trying 192.168.1.19...
16:59:10.750861 * connected
16:59:10.750952 * Connected to 192.168.1.19 (192.168.1.19) port 8101 (#0)
16:59:10.751810 * SSLv3, TLS handshake, Client hello (1):
16:59:11.666648 * SSLv3, TLS handshake, Server hello (2):
16:59:11.666737 * SSLv3, TLS handshake, CERT (11):
16:59:11.714497 * SSLv3, TLS handshake, Server finished (14):
16:59:11.714822 * SSLv3, TLS handshake, Client key exchange (16):
16:59:11.714887 * SSLv3, TLS change cipher, Client hello (1):
16:59:11.715034 * SSLv3, TLS handshake, Finished (20):
16:59:11.725787 * SSLv3, TLS change cipher, Client hello (1):
16:59:11.725959 * SSLv3, TLS handshake, Finished (20):
16:59:11.726056 * SSL connection using AES128-SHA
16:59:11.726114 * Server certificate:
16:59:11.726184 *    subject: CN=192.168.1.19
16:59:11.726247 *    start date: 2013-10-03 14:58:20 GMT
16:59:11.726302 *    expire date: 2014-10-03 14:59:10 GMT
16:59:11.726362 *    common name: 192.168.1.19 (matched)
16:59:11.726423 *    issuer: CN=My CA name
16:59:11.726472 *    SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
16:59:11.726609 > GET /tasks HTTP/1.1
16:59:11.726609 > User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8x zlib/1.2.5
16:59:11.726609 > Host: 192.168.1.19:8101
16:59:11.726609 > Accept: */*
16:59:11.726609 > 
16:59:22.310511 < HTTP/1.1 200 OK
16:59:22.310610 < Date: Thu, 03 Oct 2013 14:59:21 GMT+00:00
16:59:22.310645 < Server: My HTTP Server
16:59:22.310680 < Content-Length: 4248
16:59:22.310714 < Content-Type: text/html
16:59:22.310749 <

What takes the longest is to bind the socket:

// Set up HTTP connection
Socket socket = this.mServerSocket.accept();
socket.setKeepAlive(true);

DefaultHttpServerConnection conn = new DefaultHttpServerConnection();
Log.d(TAG,String.format("%s || Incoming connection from %s",
    new Date().toString(),
    socket.getInetAddress()));
conn.bind(socket, mParams);
Log.d(TAG,String.format("%s || Bind finished",
    new Date().toString()));
// Start worker thread
Thread t = new WorkerThread(this.mHttpService, conn, socket);
t.setDaemon(true);
t.start();
Log.d(TAG,String.format("%s || Worker thread started",
    new Date().toString()));

Output of above:

Thu Oct 03 17:10:05 CEST 2013 || Incoming connection from /192.168.1.29
GC_FOR_ALLOC freed 334K, 7% free 8987K/9568K, paused 55ms, total 58ms
Thu Oct 03 17:10:29 CEST 2013 || Bind finished
Thu Oct 03 17:10:29 CEST 2013 || Worker thread started

What do you think are the causes?

EDIT:

Here is the same in HTTP:

Thu Oct 03 17:23:25 CEST 2013 || Incoming connection from /192.168.1.29
Thu Oct 03 17:23:25 CEST 2013 || Bind finished
Thu Oct 03 17:23:25 CEST 2013 || Worker thread started

I cannot believe that it takes 25s vs less than a second to encrypt a 4KB html page, especially when it says everywhere that HTTPS is not that slow compared to HTTP anymore.

  1. How much overhead does SSL impose?
  2. https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
Community
  • 1
  • 1
chopchop
  • 1,905
  • 2
  • 21
  • 36
  • 4
    cryptography is expensive – KevinDTimm Oct 03 '13 at 15:13
  • 2
    all I'm sending back is a 3kb html page and it takes 25 seconds to encrypt on a old Nexus 7, is it that expensive? – chopchop Oct 03 '13 at 15:16
  • You're going to have to test against a non ssl connection to figure that out. But we recently made [all our web traffic encrypted](http://www.codinghorror.com/blog/2012/02/should-all-web-traffic-be-encrypted.html). – hooknc Oct 03 '13 at 15:19
  • Can you test it with a different server? Maybe your local server is to blame for that? – tiguchi Oct 03 '13 at 15:27
  • 1
    In your case it's "Bind" that is slow. What does bind() do in your particular case (in opposite to generic bind() function in berkley sockets)? Does it serve anything? – Eugene Mayevski 'Callback Oct 03 '13 at 16:35
  • HTTPS isn't more than 3 times as slow as HTTP, contrary to what is being suggested above, and you are quite right to be concerned. There is also no evidence that any encryption is taking place during the bind() call. – user207421 Oct 03 '13 at 17:07
  • I'm just using the default bind function in DefaultHttpServerConnection https://hc.apache.org/httpcomponents-core-4.2.x/httpcore/apidocs/org/apache/http/impl/DefaultHttpServerConnection.html#bind(java.net.Socket,org.apache.http.params.HttpParams) – chopchop Oct 04 '13 at 07:38

0 Answers0