Crypto NICs & TLS Offload in Practice
Offload TLS, IPsec and crypto to hardware: kTLS, OpenSSL engines, Nginx/HAProxy/Envoy setups and national crypto (SM).
Advanced30 lessons
written lessons≈ 15 h
High-Performance Networking & Cloud-Native · 30 illustrated lessons (text/HTML)
Outcomes
- Configure TLS offload for Nginx, HAProxy and Envoy
- Explain kTLS, IPsec offload and the Linux crypto framework
- Size and cost-justify crypto acceleration
Where we teach this
- SEC-320 · Platform Integrity: Secure Boot, IMA/EVM & dm-verity live cohort
- OFL-310 · Crypto NIC and TLS Offload guided, self-paced
The lessons
Every lesson in this curriculum, in the order we teach it.
- 1Introduction: Crypto NICs and TLS offload
- 2Modern cryptography basics
- 3TLS/SSL protocol in depth
- 4NIC architecture basics
- 5Crypto NIC hardware architecture explained
- 6Core principles of TLS offload
- 7Mainstream Crypto NIC products and platforms
- 8The Linux crypto framework and Crypto NIC integration
- 9DPDK crypto acceleration: from cryptodev to user-space TLS offload
- 10OpenSSL engines and hardware integration
- 11Kernel TLS (kTLS) explained
- 12TLS offload configuration in practice: Nginx
- 13TLS offload configuration in practice: HAProxy and Envoy
- 14Key management and security
- 15Performance benchmarking methodology
- 16Performance analysis and tuning: hardware-accelerated encryption and TLS offload
- 17Virtualised and cloud deployment of Crypto NICs in practice
- 18Observability and monitoring
- 19High availability and failover: Crypto NICs in practice
- 20Security considerations and threat models
- 21Hardware acceleration for QUIC and HTTP/3
- 22Chinese national cryptography (SM algorithms) and hardware acceleration: principles to practice
- 23IPsec VPN offload: from principles to practice
- 24Storage encryption offload: from dm-crypt to end-to-end encryption
- 25Custom protocol and algorithm offload: programmable engines in practice
- 26Fault diagnosis and debugging: a Crypto NIC practice guide
- 27Cost-benefit analysis and ROI: hardware investment, power and space savings, and total cost of ownership (TCO)
- 28The impact of PCIe Gen5/6 on Crypto NICs
- 29Lab 1: building a complete TLS-offload web server cluster
- 30Lab 2: designing and building a high-performance, secure API gateway with hardware acceleration
All-access library
Every curriculum on this page, with the labs and lab sequences, for a year.