The Cost of the "S" in HTTPS

Abstract

Increased user concern over security and privacy on the Internet has led to widespread adoption of HTTPS, the secure version of HTTP. HTTPS authenticates the communicating end points and provides confidentiality for the ensuing communication. However, as with any security solution, it does not come for free. HTTPS may introduce overhead in terms of infrastructure costs, communication latency, data usage, and energy consumption. Moreover, given the opaqueness of the encrypted communication, any in-network value added services requiring visibility into application layer content, such as caches and virus scanners, become ineffective.This paper attempts to shed some light on these costs. First, taking advantage of datasets collected from large ISPs, we examine the accelerating adoption of HTTPS over the last three years. Second, we quantify the direct and indirect costs of this evolution. Our results show that, indeed, security does not come for free. This work thus aims to stimulate discussion on technologies that can mitigate the costs of HTTPS while still protecting the user's privacy.

Elliptic-Curves Cryptography on High-Dimensional Surfaces

“…However, introducing such security layers comes at the price of overheads in terms of infrastructure costs, communication latency, data usage, and energy consumption [15]. Therefore, the first motivation of HDECC is to reduce the cost of security in many of the today's state-of-the-art communication technologies.…”

Agricultural Traceable and Marketing System Based on iOS-Platform and Wireless Sensor Network

“…HTTPS, the secure version of HTTP, runs HTTP on top of SSL/TLS, which is the standard protocol for providing authenticity and confidentiality on top of TCP connections [11]. Compared to HTTP, HTTPS provides authentication of the client and server, and additionally, bidirectional encryption of communications.…”

GroupSec: A new security model for the web

“…HTTPS refers to HTTP layered on top of Transport Layer Security (TLS); TLS is a session-oriented protocol that ensures data confidentiality, integrity, and authentication by encrypting all communication between the client and the server. HTTPS is used today for slightly over half of all traffic flows [1] and adoption is rapidly increasing, led by movements such as the Electronic Frontier Foundation (EFF)'s call for "HTTPS Everywhere" [2].…”

“…This results in significant consequences for end-users, publishers, and network operators alike, including increased latency, bandwidth consumption, CPU usage, and significant financial impact: Netflix alone estimates that switching from HTTP to HTTPS will cost upwards of $100M per year [3]! Though middleboxes provide a wide range of services, [1] identifies that the primary cost of TLS stems from preventing transparent content caching. Transparent caching is a technique used to reduce network bandwidth consumption, and is incredibly effective because it exists at a powerful intersection of motives and ability: First, transparent caches can be deployed by ISPs and network operators without requiring coordination with clients or publishers.…”