What is it about?
Secure web services rely on TLS to encrypt communication, but this security comes with a significant CPU cost. XTLS reduces that cost by moving TLS processing from the server’s main CPU to a SmartNIC, a programmable network card with its own processors and hardware accelerators. After the SmartNIC establishes a secure connection, XTLS hands the connection back to the normal Linux networking stack, so existing server applications can continue to work with only minor changes. It also automatically chooses the most efficient way to process each connection depending on how much data it transfers.
Featured Image
Photo by Lightsaber Collection on Unsplash
Why is it important?
Modern servers may handle enormous numbers of encrypted connections, and the CPU time spent on TLS is CPU time that cannot be used for applications. Previous acceleration techniques often speed up only selected cryptographic operations or sacrifice throughput and compatibility. XTLS demonstrates that a SmartNIC can take over almost the entire TLS workload while preserving the performance of the host networking stack. In the experiments, it delivered the same request rate with one host CPU core that competing approaches needed seven or eight cores to achieve, while maintaining high data-transfer rates and low tail latency. This could allow datacenter servers to devote substantially more CPU capacity to their actual workloads rather than to encryption overhead.
Perspectives
XTLS points to a broader way of thinking about hardware acceleration. Rather than simply adding faster cryptographic hardware, systems can achieve greater benefits by carefully dividing responsibilities between the server CPU and a programmable network card. In XTLS, the SmartNIC takes over the expensive security work, while the host keeps the well-established Linux networking stack and application interface. This approach may be useful beyond TLS. As servers face growing demands from networking, storage, and AI workloads, moving suitable tasks to SmartNICs could free CPU resources for application work while preserving the flexibility and compatibility of existing software. The paper therefore presents host–SmartNIC co-design as a broader systems design direction, not just a technique for accelerating encrypted traffic.
Seongjong Bae
Seoul National University
Read the Original
This page is a summary of: XTLS: Scalable TLS Offloading through Host-SmartNIC Stack Co-Design, September 2026, ACM (Association for Computing Machinery),
DOI: 10.1145/3838177.3841736.
You can read the full text:
Contributors
The following have contributed to this page
