与 HTTP 相比，使用 HTTPS 的开销是多少? [英] What is the overhead of using HTTPS compared to HTTP?

问题描述

我正在阅读此博客(http://googlepublicpolicy.blogspot.com/2009/06/https-security-for-web-applications.html) 由 google 发布，关于默认情况下不为 gmail 启用 HTTPS.其中一段内容如下.

I was reading this blog(http://googlepublicpolicy.blogspot.com/2009/06/https-security-for-web-applications.html) posted by google on not enabling HTTPS for gmail by default. One of the paragraph says as below.

除非对用户体验有负面影响或不切实际，否则我们打算更广泛地默认启用 HTTPS，希望所有 Gmail 用户都能使用.我们还在考虑如何使这项功能最适合其他应用，包括 Google 文档和 Google 日历(我们也为这些应用提供免费 HTTPS).

Unless there are negative effects on the user experience or it's otherwise impractical, we intend to turn on HTTPS by default more broadly, hopefully for all Gmail users. We're also considering how to make this work best for other apps including Google Docs and Google Calendar (we offer free HTTPS for those apps as well).

我不明白改用 HTTPS 会产生什么负面影响.是否对 HTTP 和 HTTPS 的性能进行了基准测试.

I didn't understand what negative effects can there be, by shifting over to HTTPS. Is there a benchmarking done on the peformance of HTTP and HTTPS.

我觉得https实际上最初涉及一些额外的协议消息，然后是数据加密.难道不能通过默认加载​​ SSL 浏览器代码等来解决这些问题.

I feel that https actually involves some additional protocol messages initially and data encryption later on. Can't these issues be taken care by having SSL browser code to be loaded by default etc..

谢谢巴拉

推荐答案

https 的主要开销通常是会话开始时的密钥交换，这是 CPU 密集型的.硬加速可用于处理此问题.如果它是 EV 证书，那么它还需要吊销检查.流的实际加密相对便宜.Sun Niagara II 具有零开销"加密，它使用空闲的 FPU 周期来进行处理.

The major cost of https is generally the key exchange at the start of the session, which is CPU intensive. Hardward acceleration is available to handle this. If it is an EV cert then it will also need revocation checking. Actual encryption of the stream is relatively cheap. Sun Niagara II has "zero overhead" encryption which uses spare FPU cycles to do the processing.

这篇关于与 HTTP 相比，使用 HTTPS 的开销是多少?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！