TEE vs No TEE

Source Material

• Repository: livylabs/tlsn
• Branch: benchmark
• Commit used for this run: de32cca
• Metric: NOTARIZATION_MS, TDX_VERIFY_MS
• Sample size: 25 runs per mode
• Run: benchmark-results/20260508T150207Z-fixture-release-25-complete/results.csv
• Benchmark source links: tee_ws env and mode flags, tee_ws target connection and Host header, tee_ws notarization and timing metrics, test-server.io fixture certificate domain

These measurements were collected from the benchmark branch. The implementation docs elsewhere use tee_dev as the source of truth.

Test Matrix

• TEE no verify: notarization with TDX attestation requested, excluding local quote verification time.
• TEE verify: notarization with TDX attestation requested, followed by local TDX quote verification.
• No TEE: normal TLSN notarization without the extra TDX attestation message.

Methodology

Each row below is one notarization run. The benchmark uses release binaries, the public TDX Notary at tlsn.livylabs.xyz, and a local TLS fixture as the target server. The values are elapsed milliseconds for the notarization phase only unless the column explicitly includes local verification.

The benchmark does not resolve test-server.io in DNS. The TCP connection goes to TARGET_HOST=127.0.0.1 and TARGET_PORT=4000; TARGET_SERVER_NAME=test-server.io is used for TLS SNI, certificate validation, and the HTTP Host header. The fixture package includes a certificate for test-server.io, and USE_FIXTURE_CA=true configures the example to trust that fixture CA.

Run the current benchmark from the infra repository root:

./benchmark-tee-impact.sh

The script uses these defaults:

• TLSN_BRANCH=benchmark
• ITERATIONS=25
• BENCHMARK_MODES="no_tee tee_no_verify tee_verify"
• START_FIXTURE=1
• FIXTURE_ADDR=127.0.0.1
• FIXTURE_PORT=4000
• NOTARY_SCHEME=https
• NOTARY_HOST=tlsn.livylabs.xyz
• NOTARY_PORT=443
• TARGET_HOST=127.0.0.1
• TARGET_PORT=4000
• TARGET_SERVER_NAME=test-server.io
• TARGET_URI=/formats/json?size=4
• USE_FIXTURE_CA=true
• MAX_SENT_DATA=4096
• MAX_RECV_DATA=16384
• RUN_TIMEOUT_SECONDS=300

It writes benchmark-results/<timestamp>/results.csv, summary.txt, and per-run stdout and stderr logs. The CSV includes both tdx_verify_ms and notarization_plus_verify_ms so verification cost is reported separately from the notarization phase.

Per-Run Results

Summary Statistics

Overhead

Notes

This run removes public target-server variance by using the local TLS fixture. The public Notary path can still produce network or service outliers. The initial 25-run pass had three timeout rows; those rows were retried with a 300-second timeout and folded into the complete result set.

With 25 samples, the TEE no-verify group median and paired average agree closely, so the earlier 10-run +6.06% paired average was an outlier artifact. TEE verify includes several high notarization runs, so its average is higher than its median. For this run, use these headline figures:

• TEE no verify median overhead over No TEE: +278.0 ms, or about +25.48%.
• TEE verify median notarization + verification overhead over No TEE: +573.0 ms, or about +52.52%.
• TDX verification median: 326.0 ms.