TTKServer 0.22.3

RA-TLS HTTP/3 (QUIC) server and client for TEEs (AWS Nitro, AMD SEV-SNP, Intel TDX) with RFC 9711 EAT evidence
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

//! Criterion benchmarks for the `ttk_server::client` library.
//!
//! Covers the offline helpers (hex encoding, extracting the RA-TLS evidence from
//! the server certificate) and the online paths against an in-process server with mock
//! attestation: a full QUIC + RA-TLS handshake (including evidence appraisal) and an HTTP/3
//! (RFC 9114) GET over an established connection.

use criterion::{criterion_group, criterion_main, Criterion};
use std::hint::black_box;
use std::net::SocketAddr;
use tokio::runtime::Runtime;
use ttk_server::client::{extract_attestation_doc, hex_encode, EnclaveCertVerifier, TtkClient};
use ttk_server::server::Server;

/// Starts a mock-attestation server on a free local port inside `rt` and returns its address.
fn start_server(rt: &Runtime) -> SocketAddr {
    rt.block_on(async {
        let server = Server::bind("127.0.0.1:0".parse().unwrap()).expect("server should start");
        let addr = server.local_addr().unwrap();
        tokio::spawn(server.serve());
        addr
    })
}

/// Connects to `addr`, accepting mock attestation.
async fn connect(addr: SocketAddr) -> TtkClient {
    TtkClient::connect_with_verifier(addr, "localhost", EnclaveCertVerifier::new().allow_mock())
        .await
        .expect("mock evidence should verify with mock allowed")
}

fn bench_offline(c: &mut Criterion) {
    let digest = [0xabu8; 32];
    c.bench_function("hex_encode/32B", |b| {
        b.iter(|| hex_encode(black_box(&digest)))
    });
}

fn bench_online(c: &mut Criterion) {
    let rt = Runtime::new().expect("tokio runtime");
    let addr = start_server(&rt);

    // Grab the server's RA-TLS certificate once for the extraction benchmark.
    let cert = rt.block_on(async {
        let client = connect(addr).await;
        let cert = client.peer_cert().expect("peer cert").to_vec();
        client.close().await.unwrap();
        cert
    });
    c.bench_function("extract_attestation_doc", |b| {
        b.iter(|| extract_attestation_doc(black_box(&cert)).unwrap())
    });

    let mut group = c.benchmark_group("h3");
    group.sample_size(20);

    group.bench_function("connect_and_verify", |b| {
        b.iter(|| {
            rt.block_on(async {
                let client = connect(addr).await;
                client.close().await.unwrap();
            })
        })
    });

    let mut client = rt.block_on(connect(addr));
    group.bench_function("get_root", |b| {
        b.iter(|| rt.block_on(client.get(black_box("/"))).unwrap())
    });
    group.finish();
    rt.block_on(client.close()).unwrap();
}

criterion_group!(benches, bench_offline, bench_online);
criterion_main!(benches);