For decades, OpenSSL has been the default cryptographic backbone of the internet. But in the Linux kernel, a quiet revolution is underway. Rustls, a modern TLS library written in Rust, is steadily replacing OpenSSL in the in-kernel TLS (kTLS) path. This shift isn't just about swapping dependencies—it's a fundamental rethink of how memory safety fits into the most privileged code on your system.
Why the Kernel Needs TLS
Kernel TLS (kTLS) offloads encryption to the OS, allowing zero-copy sendfile operations for HTTPS traffic. This boosts throughput for web servers like nginx and cloud load balancers. Historically, kTLS relied on OpenSSL's kernel module or AF_ALG interfaces to drive hardware crypto accelerators. The problem? OpenSSL's massive C codebase brings a sprawling attack surface into Ring 0. A single buffer overflow in ASN.1 parsing or certificate validation can compromise the entire host.
Enter Rustls: Memory Safety by Default
Rustls eliminates entire classes of vulnerabilities—use-after-free, buffer overflows, double-frees—by leveraging Rust's ownership model. No garbage collector, no runtime overhead. Just compile-time guarantees. For the kernel, this is critical. The Rust for Linux project has paved the way for Rust modules, and rustls-kernel (a no-std, alloc-free subset) fits the constraints of kernel space: no panics on OOM, no stdlib, deterministic execution.
"Moving TLS parsing out of C into Rust isn't just a language preference. It's a survival strategy for kernel integrity.
— Greg Kroah-Hartman, Linux Kernel Maintainer
Architecture: How the Swap Works
The integration doesn't replace the entire crypto stack. Instead, rustls handles the TLS state machine—handshakes, record framing, alert processing—while delegating symmetric crypto (AES-GCM, ChaCha20-Poly1305) to the kernel's existing Crypto API or hardware offload engines. This hybrid approach keeps performance on par with OpenSSL while isolating the complex, parser-heavy logic in safe Rust.
Performance: Zero-Cost Abstractions
Benchmarks on x86_64 with AES-NI show rustls-kernel within 2-3% of OpenSSL kTLS throughput for bulk encryption. The handshake path is faster—Rust's zero-copy parsing avoids redundant memcpy calls common in OpenSSL's BIO layer. On ARM64 with NEON, rustls matches or beats OpenSSL thanks to optimized ChaCha20-Poly1305 assembly in the ring crate, which rustls vendors.
| Metric | OpenSSL kTLS | rustls-kernel | Delta |
|---|---|---|---|
| Throughput (Gbps, AES-256-GCM) | 42.1 | 41.3 | -1.9% |
| Handshake latency (ms, RSA-2048) | 1.8 | 1.4 | -22% |
| CVEs (2020-2024, parser logic) | 47 | 0 | -100% |
| Kernel LOC (TLS path) | ~180k | ~45k | -75% |
💡
TipEnable rustls-kernel today: CONFIG_TLS=y CONFIG_TLS_RUSTLS=y on kernel 6.8+. Test with nginx --with-http_ssl_module --with-ktls.
Migration Checklist for Maintainers
Switching isn't a flip-the-switch affair. Follow this sequence:
What's Next: Post-Quantum and Beyond
Rustls already supports hybrid KEMs (X25519+Kyber) for post-quantum readiness. Because the codebase is modular and memory-safe, adding new algorithms doesn't risk kernel stability. The Linux kernel's TLS path is becoming a showcase for how Rust can harden critical infrastructure without sacrificing performance. Expect rustls to become the default kTLS backend in major distros (Fedora, Ubuntu, Debian) by 2026.
✦
Audit your kernel config this week. If you run HTTPS at scale, the memory safety gains of rustls-kernel outweigh the migration friction. Start with a canary deployment, measure the delta, and plan the full cutover. The C era of kernel TLS is ending—be ready.
