Mathematics and development of fast TLS handshakes
summary
Tempesta TLS implements kernel-space TLS handshakes by forking mbed TLS, grafting bits from WolfSSL, and rewriting crypto hot paths (assembly for big-int math) to get x40 faster point operations and overall tests showing 40–80% more handshakes per second and up to 4× lower latency versus OpenSSL/Nginx. It focuses on P‑256 elliptic math, constant‑time or randomized defenses against SCAs, notes CPU mitigation costs and kernel crypto API overheads, and plans TLS 1.3 server‑only upstream with userspace fallback.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:23Brief introduction
- 2:54Brief introduction of the product
- 4:01Performance
- 7:44Benchmark tools
- 8:41Demo
- 14:19Data comparison
- 15:11Why Tempest is faster
- 15:36Elliptic curves
- 16:55Multiplication inelliptic curve
- 18:13Coordinate systems
- 19:13Multiplication and squaring
- 21:44Montgomery reduction
- 23:38Example
- 25:14Security
- 27:48Memory usage
- 29:17Big integers
- 30:46Assembly implementation
- 32:05Performance enhancement
- 32:47Linux kernel
- 33:43Problems
- 35:04QA
related talks
30mMathematics and development of fast TLS handshakes
42mThe Linux network stack extension for DDoS mitigation and web security
46mLinux kernel TLS and HTTPS
53mHansel and Gretel do TLS
20mmmTLS: Scaling the Performance of Encrypted Network Traffic Inspection
19mWhat's happening in TLS (transport layer security)?
38mIoT TLS: Why It's Hard
30mAccelerate TLS with DPDK