Douglas Stebila

TurboTLS: TLS connection establishment with 1 less round trip

Message flow of TurboTLS

Abstract

We show how to establish TLS connections using one less round trip. In our approach, which we call TurboTLS, the initial client-to-server and server-to-client flows of the TLS handshake are sent over UDP rather than TCP. At the same time, in the same flights, the three-way TCP handshake is carried out. Once the TCP connection is established, the client and server can complete the final flight of the TLS handshake over the TCP connection and continue using it for application data. No changes are made to the contents of the TLS handshake protocol, only its delivery mechanism. We avoid problems with UDP fragmentation by using request-based fragmentation, in which the client sends in advance enough UDP requests to provide sufficient room for the server to fit its response with one response packet per request packet. Clients can detect which servers support this without an additional round trip, if the server advertises its support in a DNS HTTPS resource record. Experiments using our software implementation show substantial latency improvements. On reliable connections, we effectively eliminate a round trip without any noticeable cost. To ensure adequate performance on unreliable connections, we use lightweight packet ordering and buffering; we can have a client wait a very small time to receive a potentially lost packet (e.g., a fraction of the RTT observed for the first fragment) before falling back to TCP without any further delay, since the TCP connection was already in the process of being established. This approach offers substantial performance improvements with low complexity, even in heterogeneous network environments with poorly configured middleboxes.

Keywords: TLS, UDP

Reference

Carlos Aguilar-Melchor, Thomas Bailleux, Jason Goertzen, Adrien Guinet, David Joseph, Douglas Stebila. TurboTLS: TLS connection establishment with 1 less round trip. In Joaquin Garcia-Alfaro, Rafał Kozik, Michał Choraś, Sokratis Katsikas, editors, Proc. 29th European Symposium on Research in Computer Security (ESORICS) 2024, LNCS, vol. 14983, pp. 24–44. Springer, September 2024. © Springer.

Download

BibTeX

@inproceedings{ESORICS:ABGGJS24,
 	Author = {Carlos Aguilar-Melchor and Thomas Bailleux and Jason Goertzen and Adrien Guinet and David Joseph and Douglas Stebila},
 	Booktitle = {Proc. 29th European Symposium on Research in Computer Security (ESORICS) 2024},
 	Doi = {10.1007/978-3-031-70890-9_2},
 	Editor = {Garcia-Alfaro, Joaquin and Kozik, Rafa{\l} and Chora{\'{s}}, Micha{\l} and Katsikas, Sokratis},
 	Month = sep,
 	Note = {\url{https://arxiv.org/abs/2302.05311v2}},
 	Publisher = {Springer},
 	Series = {LNCS},
 	Title = {{T}urbo{TLS}: {TLS} connection establishment with 1 less round trip},
 	Volume = {14983},
 	Year = {2024}
 }

Funding

• Natural Sciences and Engineering Research Council of Canada (NSERC) Discovery grant RGPIN-2022-03187