Frederic Lecaille 20686bf5fd OPTIM: quic: use native HKDF APIs where available ...

QUIC key and token derivation currently uses EVP_PKEY for all HKDF
operations, creating and configuring a context for each derivation.

Use HKDF_extract(), HKDF_expand() and HKDF() directly with AWS-LC and
BoringSSL. With OpenSSL 3, use EVP_KDF directly to bypass the EVP_PKEY
compatibility layer and pass the parameters in a single call. Keep the
EVP_PKEY approach for the other SSL libraries.

Centralize the three HKDF modes in a common helper and make the extract
and expand wrappers private to quic_tls.c.

Local HTTP/3 tests with an unchanged HALoad client, one full handshake
per request and empty responses showed these median request rates
and paired gains:

  SSL library          HATerm HEAD    HATerm patched    Paired gain
  OpenSSL 3.5.4            486              540             +11%
  AWS-LC 5.9.0             903              950              +4%
without session resumption.

Validated with RFC 5869 and RFC 9001 vectors and full QUIC handshakes.

2026-10-16 10:41:24 +02:00

..

haproxy

OPTIM: quic: use native HKDF APIs where available

2026-10-16 10:41:24 +02:00

import

BUILD: sym: Make sure __always_inline always is inline.

2026-10-15 17:31:28 +02:00

make

BUILD: makefile: add macros enable_opts and disable_opts

2026-07-03 16:33:27 +02:00