bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Linux 4.13: kernel handles TLS encryption itself

Summary

In 2017 Linux 4.13 was able to take over the encryption and decryption of a TLS connection itself for the first time. This was meant to improve performance and open up new uses. The complex connection setup, however, is still handled by libraries such as OpenSSL in user space.

Ideas

  • The kernel only takes over symmetric encryption after the handshake.
  • The error-prone handshake remains in proven libraries.
  • Encryption in the kernel allows efficient data transfer without a detour through user space.

Insights

  • Dividing the work between kernel and library combines performance with maintainability.
  • Encryption moves to where the data flows anyway.

Facts

  • Kernel TLS arrived with Linux 4.13 in September 2017.
  • Libraries such as OpenSSL remain responsible for setting up the connection.

References

Critique

  • The report gives no measurements for the promised performance gain.

Remarks

  • Kernel TLS (kTLS) is used today by OpenSSL 3 and nginx and allows TLS offload to suitable network cards.

Recommendations

  • On high-throughput web servers, check whether kTLS can be used together with sendfile.
  • Only use kTLS if kernel, library and server support it together.

Read the original article

Search the Web Archive

hß · 2026

iX workshop: hardening Linux servers with encryption and access control

In 2026 heise again advertised the five-day iX workshop “Hardening Linux servers” with Florian Winkler of B1 Systems, this time with dates in September and November. Topics range from physical security through encryption, two-factor authentication and SELinux/AppArmor to logging, monitoring and intrusion detection. The target group is Linux administrators and security officers who want to secure their servers systematically.

hß · 2018

Linux: kernel and distributions protect against the Foreshadow/L1TF processor flaw

In August 2018 the processor flaw Foreshadow, also known as L1 Terminal Fault (L1TF), became known in many Intel CPUs; the Linux main branch and major distributions immediately provided protection. Anyone running third-party virtual machines also had to switch off hyper-threading, which could cost VMs up to 50 percent of their performance. The stable and longterm kernels appeared after less than 24 hours of review.

hß · 2010

Root privileges through Linux kernel bug [Update]

In 2010 Rafal Wojtczuk described a problem in Linux memory management in which the stack and shared memory segments could grow into each other. Using the X server as an example, Wojtczuk showed how an attacker could overwrite return addresses on the stack by writing to the shared memory and gain root privileges. The fix, a guard page between the stack and other areas, came in 2.6.32.19, 2.6.34.4 and 2.6.35.2, although SUSE had offered a fix as early as 2004.