Google Proposes Way To Speed Up SSL Handshake

Outsmart Malicious Hackers


I’m always interesting when it comes to cryptography and cryptographic trickery. We all know, the main problem with SSL is speed – it can really slow your surfing experience down and for most people it annoys them enough to just not use it.

Google researchers claim they’ve devised a way to reduce that painful wait when visiting an SSL encrypted site. Now, it may be faster but is it any less secure? You’d have to run through the paper to ascertain that.

And well it can only work in a few very specific sets of circumstances, it’s not like it’s really going to change anything on a large scale.

Google researchers say they’ve devised a way to significantly reduce the time it takes websites to establish encrypted connections with end-user browsers, a breakthrough that could make it less painful for many services to offer the security feature.

What’s more, the technique known as False Start requires that only simple changes be made to a user’s browser and appears to work with 99 percent of active sites that offer SSL, or secure sockets layer, protection.

“We implemented SSL False Start in Chrome 9, and the results are stunning, yielding a significant decrease in overall SSL connection setup times,” Google software engineer Mike Belshe wrote in a blog post published Wednesday. “SSL False Start reduces the latency of a SSL handshake by 30%. That is a big number.”

The finding should come as welcome news to those concerned about online privacy. With the notable exceptions of Twitter, Facebook, and a handful of Google services, many websites send the vast majority of traffic over unencrypted channels, making it easy for governments, administrators, and Wi-Fi hotspot providers to snoop or even modify potentially sensitive communications while in transit. Companies such as eBay have said it’s too costly to offer always-on encryption.

The Firesheep extension introduced last year for the Firefox browser drove home just how menacing the risk of unencrypted websites can be.

There’s a blog post about the speed improvements here:

SSL FalseStart Performance Results

It shows an approximate 30% reduction in the overall SSL connection setup time. They say they have implemented it in Chrome 9 (the current public release of Chrome is version 11) – so that makes me wonder has it been running in Chrome since February this year when 9 was released?

If you did want to disable it you can do so with the following command line option:


False Start works by reducing the amount of data that must be exchanged when a webserver and browser are negotiating an SSL session. Under official SSL specifications, two round-trip passes of data must be exchanged before an encrypted tunnel is established. The requirement adds latency that can slow down the time it takes pages to load and increase the packets websites must process.

Latency “makes a difference in does it feel snappy or does it feel sluggish,” said Marsh Ray, a researcher and software developer at two-factor authentication service PhoneFactor. False Start “certainly eliminates an objection that some people have for SSL, which is that it increases the load time.”

False Start, as described in a proposal Google engineers submitted last year to the Internet Engineering Task Force, makes it possible to reduce the latency penalty of offering SSL to just a single round-trip pass. The technology does this by using an abbreviated handshake when negotiating the key and other variables used in the encrypted session.

Belshe said engineers tested False Start on a list of all known websites that offer SSL and got a 94.6 percent success rate. Almost all of the unsuccessful connections came from sites that were no longer available, leaving a true failure rate of just 0.4 percent. Those sites have now been compiled into a manageable list used to turn off False Start when they are accessed in Chrome.

With all the media coverage from FireSheep – SSL is indeed a big issue now so this might come as a pleasant surprise for heavy SSL users.

You can read the entire paper here:

Transport Layer Security (TLS) False Start

Let me know your thoughts? Yah SSL is already a big mess, but does this make it worse?

Source: The Register

Posted in: Cryptography, Networking Hacking


Latest Posts:


StaCoAn - Mobile App Static Analysis Tool StaCoAn – Mobile App Static Analysis Tool
StaCoAn is a cross-platform tool which aids developers, bug bounty hunters and ethical hackers performing mobile app static analysis on the code of the application for both native Android and iOS applications.
snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.


2 Responses to Google Proposes Way To Speed Up SSL Handshake

  1. BlueRaja June 25, 2011 at 10:28 am #

    ALL known websites that offer SSL!?

    Only google…

  2. Bogwitch June 29, 2011 at 8:45 am #

    @BlueRaja – I’m not quite sure what you mean…

    I’ve performed some packet sniffs with Chrome on SSL sites (not owned by Google) and the sequence that they describe is taking place, both under Windows and Linux (I don’t have a Mac to test with)