Offloading QUIC Encryption to Enabled NICs
summary
Proposal describes kernel module that exposes a netlink control plane to register QUIC flows, a driver ndo that returns an xid connection ID, and per-packet signalling via a SKB extension / CMSG so NICs can encrypt/decrypt in hardware. Implementation targets one-RTT short headers for bulk, long-lived flows to avoid short-lived churn. Control and data paths are split, transmit and receive offload are selectable, kTLS offload informs the design, expected CPU crypto savings are in the low-double-digit percent range. Mobility and multi-tenant isolation need extra handling.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 4:57Why QUIC offload matters
- 11:48Kernel module design
- 15:42User space challenges
- 21:26Existing kernel frameworks
- 24:12Connection lifecycle handling
- 27:18Multi-environment isolation
- 28:42Current implementation status
