Envoy, as an L7 proxy, uses BoringSSL as its default TLS library. As an edge proxy, Envoy handles numerous TLS connections, which can reduce queries per second per core. However, by utilizing the asynchronous private key provider framework with DPDK user-space crypto drivers, TLS processing can be fully offloaded to user space, leading to significant performance improvements. This approach eliminates context switches and buffer copies between kernel and user space.
In our implementation, DPDK's rte crypto APIs are used to handle sign and decrypt operations, ensuring a vendor-neutral solution. Initial observations indicate performance gains of up to 44% overall, and up to 80% on handshakes, by leveraging hardware crypto acceleration with the OCTEON SoC (RSA 2k certificates). By processing cryptographic operations in user space and offloading them to the accelerator device, Envoy can process more requests concurrently, significantly reducing handshake cycles and improving throughput.