Benchmarking rustls 0.23.31 vs OpenSSL 3.5.15 vs BoringSSL on x86_64
2025-07-31
System configuration
We ran the benchmarks on a bare-metal server with the following characteristics:
- OS: Debian 12 (Bookworm).
- C/C++ toolchains: GCC 12.2.0 and Clang 14.0.6.
- CPU: Xeon E-2386G (supporting AVX-512).
- Memory: 32GB.
- Extra configuration: hyper-threading disabled, dynamic frequency scaling disabled, cpu scaling governor set to performance for all cores.
Versions
The benchmarking tool used for both OpenSSL and BoringSSL was openssl-bench 82b86b22.
This was built from source with its makefile.
BoringSSL
The tested version of BoringSSL is 0.20250701.0, which was the most recent point on master when we started these measurements.
BoringSSL was built from source with CC=clang CXX=clang++ cmake -DCMAKE_BUILD_TYPE=Release.
OpenSSL
The tested version of OpenSSL is 3.5.1, which was the latest release at the time of writing.
OpenSSL was built from source with ./Configure ; make -j12.
Rustls
The tested version of rustls is 0.23.31, which was the latest release at the time of writing. This was used with aws-lc-rs 1.13.1 / aws-lc-sys 0.29.0.
Measurements
BoringSSL was tested with this command:
~/bench/openssl-bench
$ BENCH_MULTIPLIER=16 setarch -R make measure BORINGSSL=1
OpenSSL was tested with this command:
~/bench/openssl-bench
$ BENCH_MULTIPLIER=16 setarch -R make measure
rustls was tested with this command:
~/bench/rustls
$ BENCH_MULTIPLIER=16 setarch -R make -f admin/bench-measure.mk measure
Results
Transfer measurements are in megabytes per second. Handshake units are handshakes per second.
| BoringSSL 0.20250701.0 | OpenSSL 3.5.1 | rustls 0.23.31 | |
|---|---|---|---|
| transfer, 1.2, aes-128-gcm, sending | 8575.27 | 6565.22 | 8074.82 |
| transfer, 1.2, aes-128-gcm, receiving | 6986.81 | 7219.67 | 7952.68 |
| transfer, 1.3, aes-256-gcm, sending | 7739.61 | 6093.27 | 7628.68 |
| transfer, 1.3, aes-256-gcm, receiving | 6421.36 | 6472.3 | 7407.83 |
| BoringSSL 0.20250701.0 | OpenSSL 3.5.1 | rustls 0.23.31 | |
| full handshakes, 1.2, rsa, client | 5375.06 | 3251.54 | 8206.33 |
| full handshakes, 1.2, rsa, server | 1447.33 | 2169 | 2857.81 |
| full handshakes, 1.2, ecdsa, client | 3454.89 | 2195.55 | 4345.05 |
| full handshakes, 1.2, ecdsa, server | 9096.44 | 5178.02 | 13618.81 |
| full handshakes, 1.3, rsa, client | 3125.36 | 2222.21 | 4187.28 |
| full handshakes, 1.3, rsa, server | 1285.88 | 1714.24 | 2273.13 |
| full handshakes, 1.3, ecdsa, client | 2344.76 | 1650.56 | 2884.83 |
| full handshakes, 1.3, ecdsa, server | 5113.83 | 3183.26 | 6229.71 |
| BoringSSL 0.20250701.0 | OpenSSL 3.5.1 | rustls 0.23.31 | |
| resumed handshakes, 1.2, client | 47,509.5 | 19,936.5 | 65,617.35 |
| resumed handshakes, 1.2, server | 46,561.8 | 21,043.1 | 74,771.51 |
| resumed handshakes, 1.3, client | 4695.79 | 3574.86 | 5614.4 |
| resumed handshakes, 1.3, server | 5803.03 | 3771.28 | 6623.94 |
Notable changes since last time
Post-quantum key exchange
OpenSSL and rustls now use X25519MLKEM768 post-quantum key exchange by default. BoringSSL is configured to do the same. This applies to all TLS1.3 handshakes.
| old | new | ||
|---|---|---|---|
| BoringSSL 76968bb3 | ➡️ | BoringSSL 0.20250701.0 | |
| full handshakes, 1.3, rsa, client | 4813.91 hs/s | 1.54x slower | 3125.36 hs/s |
| OpenSSL 3.3.2 | ➡️ | OpenSSL 3.5.1 | |
| full handshakes, 1.3, rsa, client | 2788.76 hs/s | 1.25x slower | 2222.21 hs/s |
| rustls 0.23.15 | ➡️ | rustls 0.23.31 | |
| full handshakes, 1.3, rsa, client | 6803.93 hs/s | 1.62x slower | 4187.28 hs/s |
BoringSSL AVX-512 AES-GCM
BoringSSL now has AVX512-accelerated AES-GCM. Since last time, that looks like:
| old | new | ||
|---|---|---|---|
| BoringSSL 76968bb3 | ➡️ | BoringSSL 0.20250701.0 | |
| transfer, 1.2, aes-128-gcm, sending | 5043.04 MB/s | 1.7x faster | 8575.27 MB/s |
rustls extension optimizations
We spent some time improving our internal representation for TLS extensions. This applied to clients and servers, and all TLS versions. But it's most visible here in TLS1.2 performance because there aren't any cryptography changes masking it.
| old | new | ||
|---|---|---|---|
| rustls 0.23.15 | ➡️ | rustls 0.23.31 | |
| resumed handshakes, 1.2, client | 64,722.55 hs/s | 1.02x faster | 65,617.35 hs/s |
| resumed handshakes, 1.2, server | 71,149.91 hs/s | 1.05x faster | 74,771.51 hs/s |