[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgrXD_BLwxyu3Jah-GztmeSlG5yO6Wj-3yDt-yr4qNSI":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"3f4e1679-a505-44eb-a807-453a165747c9","article","kTLS：TLS 加密为什么有一部分可以交给 Linux 内核？","linux-ktls-kernel-tls-record-layer","kTLS 把 TLS 记录层的数据加解密工作交给 Linux 内核处理，而握手和密钥协商通常仍由用户态 TLS 库负责。本文沿着一次 HTTPS 传输拆解职责边界，并解释它与网卡硬件卸载并不是一回事。","HTTPS 数据传输要经过 TLS 加密。许多系统里，TLS 握手、证书验证、密钥协商和记录层数据处理都由用户态库完成。Linux Kernel TLS（kTLS）提供另一种分工：在连接已经建立后，可以把 TLS 记录层的加解密交给内核，让数据传输更直接地接入内核 I\u002FO 路径。\n\n## 握手和数据传输是两件事\n\nTLS 握手需要验证对端身份、协商算法并生成会话密钥；这部分通常仍由用户空间的 TLS 库负责。握手完成后，应用可以把连接状态和密钥等必要信息交给内核，内核据此封装或解封装 TLS 记录。发送文件时，kTLS 也能与某些高效 I\u002FO 路径配合，减少数据在用户态与内核态之间来回复制的机会。\n\n可把它类比为机场：用户态 TLS 库负责核验旅客证件、决定航线和签发通行凭证；kTLS 则让机场内部的货运流水线接手已经批准的货物。职责交接之后，数据仍受 TLS 记录保护，但不必每一步都回到应用进程中处理。\n\n## 它不是“内核替代 TLS 库”\n\nkTLS 不会自动承担证书验证、主机名检查、握手安全和应用身份判断。若用户态正确完成握手后把错误密钥交给内核，传输仍可能失败或不安全。支持的密码套件、连接方向、内核版本、应用框架和网卡卸载能力也会影响可用功能。\n\n还要区分 kTLS 与 TLS 硬件卸载。kTLS 表示记录层处理可以在内核中进行；若网卡进一步支持加密卸载，才可能由设备硬件承担部分计算。前者是软件架构分工，后者是硬件能力，二者可以组合但并非同义词。\n\n它适合大型文件服务、代理和高吞吐网络程序等场景，但收益要通过实际负载测量。kTLS 的关键是“把数据面的一部分交给内核”，而不是把整个安全协议栈一键搬家。只要握手、密钥和记录层职责被清楚区分，才容易判断它是否值得启用。\n\n来源：[Linux 内核文档：Kernel TLS](https:\u002F\u002Fwww.kernel.org\u002Fdoc\u002Fhtml\u002Flatest\u002Fnetworking\u002Ftls.html)","\u002Fuploads\u002F2026-10-17\u002Fdee8be1a-a200-46e1-8262-2cea34fe5521.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","Linux Kernel Documentation","https:\u002F\u002Fwww.kernel.org\u002Fdoc\u002Fhtml\u002Flatest\u002Fnetworking\u002Ftls.html","published",null,false,54,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:41.092Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T03:08:37.641Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":69,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z"]