One Decade of Rustls: Evolution, Benchmarks, and Future Roadmap
Rustls, a Rust TLS library, marks its decade-long progression from a grassroots project to a funded open-source initiative. Key contributions from organisations boosted development, resulting in features like post-quantum cryptography and robust performance. The upcoming 0.24 release aims to enhance architecture and flexibility, including new input buffering and improved session handling By…
Over the course of a decade, Rustls has evolved from a grassroots effort into a sustainably funded open-source project. Initiated in 2016, the Rust-based Transport Layer Security (TLS) library gained broad site interoperability and released its first version (0.1.0) later that year. The project's growth and development were propelled by external contributions and financial backing from organizations such as the Internet Security Research Group (ISRG), Amazon Web Services (AWS), and the Cloud Native Computing Foundation (CNCF).
These entities provided funding for security audits, modern features, and compliance features, enabling Rustls to incorporate post-quantum cryptography, FIPS certification, and Encrypted ClientHello.
The recent trajectory of Rustls has been marked by the successful 0.23 release line, which maintained stability with numerous non-breaking updates. This consistency has been acknowledged by developer communities on platforms like Reddit and Hacker News, with users praising the reliability of the 0.23 cycle and its disciplined API management.
Rustls has found practical benefits in integration into broader toolchains and web infrastructure. Its performance benchmarks have shown it outperforming OpenSSL and BoringSSL in various aspects. For instance, in full handshakes per second per core, Rustls delivers 2,357 compared to OpenSSL's 1,713 and BoringSSL's 1,302, indicating a 1.38x and 1.82x improvement, respectively.
In resumed handshakes, Rustls leads with 7,249 per second per core, surpassing BoringSSL's 5,687 (1.28x slower) and OpenSSL's 3,780 (1.92x slower). In terms of data throughput, Rustls surpasses both OpenSSL (6,238 vs. 6,218) and BoringSSL (6,218 vs. 6,218) by achieving 7,333 megabytes received per second per core.
Looking ahead, Rustls plans to introduce significant architectural changes in the upcoming 0.24 release. The project aims to improve performance, flexibility, and ecosystem integration through external buffering via the new TlsInputBuffer trait. By routing input through this mechanism, Rustls can achieve in-place decryption and eliminate redundant memory copies.
Additionally, the 0.24 release introduces asynchronous programming support via session types that model handshake states sequentially, enabling handshakes to run in blocking, async, or completion-based styles. To maximize performance under full-duplex workloads, the 0.24 release introduces a unique "split mode" feature, decoupling post-handshake traffic into separate SendTraffic and ReceiveTraffic objects that can operate independently on different threads.
Lastly, the 0.24 release decouples cryptography providers into separate crates, allowing for flexible configuration of global providers.
Written by urgent.news from InfoQ's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
