waipu-oss GitHub avatar

go-ktls

waipu-oss

go-ktls offloads TLS record encryption from userspace to the Linux kernel for Go HTTPS listeners, transparently falling back to userspace TLS when offload is unavailable.

Stars

9

7-day growth

No data

Forks

0

Open issues

1

License

MIT

Last updated

2026-07-28

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It delivers substantial reductions in memory traffic and CPU overhead by avoiding ciphertext write-back to DRAM, and is production-proven at 130 Gbit/s on live video edge workloads.

Who it is for

  • Go developers building high-throughput HTTPS services
  • System administrators deploying TLS-terminating proxies or CDN nodes
  • Performance engineers optimizing memory bandwidth and CPU usage
  • Engineers working with kernel kTLS and NIC inline TLS offload

Use cases

  • Live video streaming (DASH, HLS) over HTTPS
  • High-performance TLS termination for web servers
  • Reducing CPU and DRAM load in data center TLS gateways
  • sendfile(2) based file serving through TLS sockets

Strengths

  • Transparent fallback to userspace TLS for unsupported scenarios (no connection breakage)
  • Production-tested on 130 Gbit/s with 19k concurrent streams, reducing DRAM bytes per egress byte from 5.4x to 2.2x
  • Supports TLS 1.3 and TLS 1.2 AES-GCM, with TLS 1.3 software kTLS for sendfile/copy savings
  • Minimal setup overhead (handshake and per-connection key capture) with no per-byte userspace overhead

Considerations

  • Linux-only and requires kernel 6.14+; hardware inline offload needs specific NICs (ConnectX-6 Dx/7) and firmware
  • Some scenarios fall back to userspace TLS: HTTP/2, client certificates, TLS 1.1 and below, TLS 1.2 CBC/ChaCha20
  • Does not reduce per-connection kernel state, so the connection count ceiling set by L3 cache is unchanged

README quick start

Usage

Description

Kernel TLS offload for a Go HTTPS listener.

Related repositories

Similar projects matched by category, topics, and programming language.

programmersd21
Featured
programmersd21 GitHub avatar

flow

flow is a minimalist terminal dashboard that displays real-time network throughput with smooth animations, multiple responsive modes, and zero configuration.

Developer ToolsCLI & Terminal
277
0xNikoDev
0xNikoDev GitHub avatar

robinhood-ai-dev-sniper

A commercial Go trading panel for Robinhood Chain that snipes token launches at the L1-flip boundary using pre-signed relay volleys, plus auto-sniper, trailing exit, and Uniswap V3 trading.

Go
133
nethical6
Featured
nethical6 GitHub avatar

conversation-steganography

A tool that hides encrypted secret messages inside innocent-looking AI-generated chat text for private communication over any messaging platform.

Go
1,149