Rustls 0.24 Release: Architectural Shifts and Performance Gains

Rustls, the memory-safe Transport Layer Security (TLS) library written in Rust, is gearing up for the release of version 0.24. This is a significant step forward in terms of both architecture and performance. The update promises to boost flexibility and throughput, a welcome change for engineers working with TLS in Rust-based systems.

Key Changes in the 0.24 Release

Building on the solid base of the 0.23 release line known for its stability, Rustls 0.24 maintains that reliability while bringing some big architectural updates.

Introduction of the TlsInputBuffer Trait

A highlight of Rustls 0.24 is the TlsInputBuffer trait. This new way of handling input data veers away from the standard I/O traits. Now, data comes through this mechanism, and output goes into vectors provided by users. It allows in-place decryption, cutting down on redundant memory copies. This isn't just about elegance; it optimizes memory use and can speed things up. This shift is all about better managing data flow and reducing the overhead from copying data between buffers.

Enhanced Asynchronous Programming

Rustls 0.24 also makes strides in asynchronous programming by introducing session types that sequentially model handshake states. This means handshakes can now run in blocking, async, or completion-based styles, letting Rustls fit better into the asynchronous ecosystems developers might be using. This change is especially handy for those working with async frameworks like Tokio, as it makes integrating with existing async code more natural and less error-prone.

Split Mode for Full-Duplex Workloads

The introduction of split mode makes handling full-duplex traffic more efficient. Previously, a single connection object had to juggle both sending and receiving. Now, with separate SendTraffic and ReceiveTraffic objects—each implementing the Send trait—you can handle these independently on different threads. It effectively doubles throughput for apps dealing with full-duplex traffic. Users requested this feature back in 2019, showing Rustls listens to the community. Internal back-channel communication minimizes contention between threads, boosting performance for concurrent operations.

Decoupling Cryptography Providers

Another shift is the decoupling of cryptography providers into separate crates like rustls-aws-lc-rs and rustls-ring. This gives more room to configure and avoids build-feature unification panics. Developers can now pick and configure the cryptographic providers they need without getting tangled in a monolithic system.

Why These Changes Matter

For those maintaining production codebases, the changes in Rustls 0.24 bring several real-world perks. By introducing external buffering and split mode, there's a noticeable boost in performance, especially for high-concurrency applications. Separating cryptographic providers adds flexibility, making dependency management a bit easier.

These advances are particularly crucial for developers zeroed in on optimizing TLS performance in cloud environments or heavy-load systems. The improvements in memory handling, along with efficient full-duplex traffic management, can lead to tangible performance gains. These architectural updates push Rustls closer to modern software development practices, where modularity and performance are key.

Implementing Rustls 0.24 in Your Codebase

If you're ready to bring version 0.24 into your systems, here are some steps to consider:

• Review the Migration Guide: Given the architectural changes, the migration guide from the Rustls team will be your best friend. It should highlight any breaking changes and guide you through a smooth transition.
• Test in a Staging Environment: Before going full-scale, run tests in a staging environment to check performance improvements and catch any issues early. It’s crucial to see the new features in action under realistic conditions.
• Adjust Asynchronous Logic: If you’re relying on asynchronous programming, refactor your TLS handshake logic to take full advantage of the new session types. This might mean updating async functions to work seamlessly with existing workflows.
• Utilize Split Mode: If your application can gain from higher throughput, put split mode to use with the decoupled SendTraffic and ReceiveTraffic objects. Think about threading strategies to maximize efficiency.
• Manage Cryptographic Dependencies: Reassess and tweak your cryptographic dependencies using the new crate separation to fit your application’s security needs. This might require tweaks in your build scripts and dependency management files.

Performance Benchmarks

In performance benchmarks comparing Rustls (version 0.23.37) against OpenSSL (version 3.6.1) and BoringSSL on x86_64 architectures, Rustls delivers 2,357 full handshakes per second per core, outperforming OpenSSL at 1,713 (1.38x slower) and BoringSSL at 1,302 (1.82x slower). For resumed handshakes, Rustls leads with 7,249 per second per core, compared to BoringSSL's 5,687 (1.28x slower) and OpenSSL's 3,780 (1.92x slower). In terms of throughput, Rustls achieves 7,333 megabytes received per second per core—surpassing OpenSSL at 6,238 and BoringSSL at 6,218 (both 1.18x slower). For data sent, BoringSSL marginally leads at 7,565 megabytes per second per core (1.02x faster than Rustls), while Rustls processes 7,421 megabytes per second per core, beating OpenSSL's 5,844 (1.27x slower).

These benchmarks underscore Rustls's efficiency and make it a top choice for high-performance applications. Rustls’s performance, especially in high-throughput situations, stands up well against the competition.

Limitations and Considerations

Even with all these advantages, keep a few potential hurdles in mind:

• Compatibility: Check your existing infrastructure and third-party libraries for compatibility. Older systems might need some extra work to fit the new Rustls setup.
• Learning Curve: Newcomers to Rust or Rustls might find the learning curve steep, especially with the new features. Spending time on training and reading documentation can help ease this transition.
• Community Support: Remember that community support can vary. Engaging on platforms like Reddit or Hacker News can provide valuable insights and troubleshooting advice.

Despite these considerations, the improvements in Rustls 0.24, especially in performance and security, might just tip the scales in favor of upgrading. It's a solid step forward for applications demanding high reliability and efficiency.

Moving Forward with Rustls

After the 0.24 release stabilizes, the plan is to shift towards a stable 1.0 API aimed at long-term maintenance. This indicates a strong commitment to delivering a reliable and performant TLS library for Rust developers.

In my view, these forward-thinking efforts, backed by community feedback and support, create a solid base for any software project. Rustls seems set to remain a crucial tool for developers focused on security and performance in their applications.

For more details about Rustls's progress and what lies ahead, check out the full source article.