AF_KTLS is a kernel module that introduces parts of TLS and DTLS protocols to the Linux kernel. After a handshake is done in userspace all the key material is passed to the Linux kernel via appropriate socket system calls supported by AF_KTLS. After that, the user-space application can transparently use AF_KTLS type socket that transparently performs encryption and decryption of traffic. The main advantage of using AF_KTLS lies in applications that serve static content that can be sent using sendfile(2) system call or by applications that do not necessarily need decrypted content available in user-space. An example of such applications could be OpenConnect VPN where AF_KTLS could be used to optimize copies from user-space to kernel-space and vice versa just for encryption or decryption. A similar use-case can be found also in TCP/HTTP balancer HAProxy. This work will extend the AF_KTLS [1, 2] kernel module that introduces parts of TLS [3] and DTLS protocols to the Linux kernel.

The goal of this thesis is to analyse possible use-cases and scenarios where AF_KTLS could be beneficial and to propose changes in user-space applications or directly inside AF_KTLS module implementation that would lead to optimization.

The student will also implement the changes, evaluate benchmarks on implemented changes and suggest other optimization alternatives, based on bottlenecks found in benchmarks.

The student will also implement some changes as agreed with the supervisor and technical consultant, evaluate benchmarks on implemented changes and suggest other optimization alternatives, based on bottlenecks found in benchmarks.