Catalog Details
CATEGORY
securityCREATED BY
UPDATED AT
January 02, 2025VERSION
0.0.1
Pattern Snapshot
Related Patterns
Accelerated mTLS handshake for Envoy data planes
MESHERY4421
What this pattern does:
Envoy uses BoringSSL as the default TLS library. BoringSSL supports setting private key methods for offloading asynchronous private key operations, and Envoy implements a private key provider framework to allow creation of Envoy extensions which handle TLS handshakes private key operations (signing and decryption) using the BoringSSL hooks.
CryptoMB private key provider is an Envoy extension which handles BoringSSL TLS RSA operations using Intel AVX-512 multi-buffer acceleration. When a new handshake happens, BoringSSL invokes the private key provider to request the cryptographic operation, and then the control returns to Envoy. The RSA requests are gathered in a buffer. When the buffer is full or the timer expires, the private key provider invokes Intel AVX-512 processing of the buffer. When processing is done, Envoy is notified that the cryptographic operation is done and that it may continue with the handshakes.
Envoy uses BoringSSL as the default TLS library. BoringSSL supports setting private key methods for offloading asynchronous private key operations, and Envoy implements a private key provider framework to allow creation of Envoy extensions which handle TLS handshakes private key operations (signing and decryption) using the BoringSSL hooks.
CryptoMB private key provider is an Envoy extension which handles BoringSSL TLS RSA operations using Intel AVX-512 multi-buffer acceleration. When a new handshake happens, BoringSSL invokes the private key provider to request the cryptographic operation, and then the control returns to Envoy. The RSA requests are gathered in a buffer. When the buffer is full or the timer expires, the private key provider invokes Intel AVX-512 processing of the buffer. When processing is done, Envoy is notified that the cryptographic operation is done and that it may continue with the handshakes.
Caveats and Consideration:
test
Compatibility:
Recent Discussions with "meshery" Tag
- Dec 31 | 404 page not found
- Dec 30 | Seeking Help with Playground Features for Complex Designs
- Dec 04 | Link Meshery Integrations and Github workflow or local code
- Nov 25 | Issue: Unable to Run make server-local in Meshery Cloud Setup Due to Soda CLI Dependency
- Nov 28 | Issue on Setting Up Meshery Using Docker
- Nov 22 | Meshery CI Maintainer: Sangram Rath
- Nov 25 | T.roles_names is undefined ( permission path is not provided )
- Nov 20 | Meshery Development Meeting | Nov 20th 2024
- Nov 10 | Error in "make server" and "make ui-server"
- Nov 11 | Difference in dev Environments on port 9081 and 3000