gsadmin/noq
1
0
Fork 0
mirror of https://github.com/n0-computer/noq.git synced 2026-09-24 20:25:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prefer AES cipher suites

Browse Source 
Testing showed that there is a huge performance boost using AES ciphers
due to hardware acceleration. Therefore those should be preferred.

As an example, a benchmark run using CHACHA20 reached a throughput
of 350MB/s, whereas the same configuration using AES128 reached 520MB/s.

While CHACHA20 might have higher performance on devices without
hardware acceleration for AES, this set of devices might now be tiny.
This commit is contained in:
Matthias Einwag
2021-02-14 00:07:06 -08:00
committed by Dirkjan Ochtman
parent b9eb42ee75
commit e9a799676f
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
quinn-proto/Cargo.toml
+3
View File
@@ -30,6 +30,9 @@ bytes = "1"
ct-logs = { version = "0.8", optional = true }
rand = "0.8"
ring = { version = "0.16.7", optional = true }
# If rustls gets updated to a new version which contains
# https://github.com/ctz/rustls/commit/7117a805e0104705da50259357d8effa7d599e37
# the custom cipher list in `quinn-proto/src/crypto/rustls.rs` can be removed.
rustls = { version = "0.19", features = ["quic"], optional = true }
rustls-native-certs = { version = "0.5", optional = true }
slab = "0.4"
quinn-proto/src/crypto/rustls.rs
+19 -2
View File
@@ -276,7 +276,7 @@ pub struct HandshakeData {
impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
fn new() -> Self {
let mut cfg = rustls::ClientConfig::new();
let mut cfg = rustls::ClientConfig::with_ciphersuites(&QUIC_CIPHER_SUITES);
cfg.versions = vec![rustls::ProtocolVersion::TLSv1_3];
cfg.enable_early_data = true;
#[cfg(feature = "native-certs")]
@@ -320,7 +320,10 @@ impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
impl crypto::ServerConfig<TlsSession> for Arc<rustls::ServerConfig> {
fn new() -> Self {
let mut cfg = rustls::ServerConfig::new(rustls::NoClientAuth::new());
let mut cfg = rustls::ServerConfig::with_ciphersuites(
rustls::NoClientAuth::new(),
&QUIC_CIPHER_SUITES,
);
cfg.versions = vec![rustls::ProtocolVersion::TLSv1_3];
cfg.max_early_data_size = u32::max_value();
Arc::new(cfg)
@@ -399,3 +402,17 @@ impl crypto::PacketKey for PacketKey {
}
}
}
/// Cipher suites suitable for QUIC
///
/// The list is equivalent to TLS1.3 ciphers.
/// It matches the rustls prefernce list that was introduced with
/// https://github.com/ctz/rustls/commit/7117a805e0104705da50259357d8effa7d599e37.
/// This list prefers AES ciphers, which are hardware accelerated on most platforms.
/// This list can be removed if the rustls dependency is updated to a new version
/// which contains the linked change.
static QUIC_CIPHER_SUITES: [&rustls::SupportedCipherSuite; 3] = [
&rustls::ciphersuite::TLS13_AES_256_GCM_SHA384,
&rustls::ciphersuite::TLS13_AES_128_GCM_SHA256,
&rustls::ciphersuite::TLS13_CHACHA20_POLY1305_SHA256,
];