mmTLS: Scaling the Performance of Encrypted Network Traffic Inspection
summary
mmTLS eliminates split-connection relaying by having clients share end-to-end session keys over an out-of-band “autoband” channel so the middlebox decrypts on the single TCP flow; implementation uses a smartNIC session-key folder to steer keys to cores and a client library to send keys. Performance: 179 Gbps relay and 2.7–41.2× better than nginx split-proxy (up to 41.2× or 58.8× on short-lived requests), plus 4.6× and 9.6× gains in persistent tests. Integrity protection uses a private tag derived from the 16-byte GCM tag to avoid costly re-hashing.
AI-written summary · about
chapters (11)
- 0:00mmTLS and encrypted traffic
- 2:10Split-connection TLS problems
- 6:23Avoiding split connections
- 8:49mmTLS operation
- 10:13Preventing content modification
- 12:21Scaling mmTLS with multi-core
- 14:08Event-driven API for middleboxes
- 15:59Implementation and evaluation
- 17:03Performance vs split TLS
- 18:28DPI impact on mmTLS
- 19:12Summary of mmTLS benefits
related talks
29mThe impact of ML-KEM and ML-DSA on mTLS connection Time-to-Last-Byte
43mMathematics and development of fast TLS handshakes
36mSecuring Every Bit
30mAccelerate TLS with DPDK
15mImplementing Hybrid TLS with ML-KEM-768 for Post-Quantum Security in Mobile IIoT Deployments
42mAccelerating Envoy with the Linux Kernel
29mSecuring Data in Motion and at Rest: Quantifying End-to-End Encryption Perfo...
30mMathematics and development of fast TLS handshakes