dualeai/hpke-http - CodSpeed

hpke-http

Blog Docs Changelog

Performance History

No performance history available yetOnce you have some commits, you will be able to see the performance history of your primary branch.

Latest Results

perf(streaming): wire format v2 with zero-copy AEAD encrypt_into/decrypt_into Move encoding_id from plaintext-prefix to AEAD AAD; eliminates one full chunk-sized copy on encrypt path. Combined-buffer + reusable scratch (msgspec/picows pattern) cuts per-chunk peak memory ~33% (193KB → 129KB at 64KB chunks). Drop ChunkEncryptor threading.Lock (single-thread async usage). _ChunkStreamParser yields read-only memoryview. Per-chunk decryptor return widened to bytes | bytearray. Wire layout v2: length(4) || counter(4) || encoding_id(1) || ct+tag. encoding_id authenticated via AAD; tampering raises DecryptionError (downgrade-attack resistance preserved). Adds ChunkEncryptor.encrypt_into(plaintext, dest, offset=-1) public API (msgspec.Encoder.encode_into pattern) and RawFormat.encrypt_chunk_into backing it. Removes dead aead_seal/aead_open from primitives. Bumps version 0.1.0 -> 0.2.0 (wire format break, pre-1.0 hard cutover). Measured perf (Python 3.14, cryptography 48.0): CPU encrypt vs raw cipher.encrypt_into baseline: - 1 KB: 3.25 us / 1.93 us = +68.8% framing overhead (315 MB/s) - 8 KB: 8.53 us / 7.04 us = +21.2% (960 MB/s) - 64 KB: 50.79 us / 48.10 us = +5.6% (1290 MB/s) - 256 KB: 197.50 us / 189.28 us = +4.3% (1327 MB/s) Decrypt CPU symmetric: ~52 us @ 64 KB, 1.27 GB/s throughput. Memory peak per chunk (tracemalloc): - encrypt 4 KB: 9 KB peak (-25% vs pre-refactor 12 KB) - encrypt 64 KB: 129 KB (-33% vs 192 KB) — matches plan target - encrypt 256 KB: 513 KB (-33% vs 768 KB) - decrypt 4 KB: 5 KB (-38% vs plan target 8 KB) - decrypt 64 KB: 64.9 KB (-49% vs plan target 128 KB) - decrypt 256 KB: 256.9 KB (-49% vs plan target 512 KB) Allocation count steady-state (reusable scratch verified): - 4 KB: 100 encrypts -> 14 alloc blocks (~0.14/call) - 64 KB: 100 encrypts -> 13 alloc blocks (~0.13/call) - pre-refactor: ~3-4 allocs/call (~30x reduction in malloc churn) Parser memoryview yield (replaces bytes() copy): - 64 KB: 4.35 us/chunk (was ~5.16 us pre-refactor) — 16% faster encrypt_into public API (msgspec pattern, skip internal scratch): - 4 KB: 5.11 us vs 5.52 us encrypt() — +7.4% saving - 64 KB: 49.23 us vs 51.23 us encrypt() — +3.9% saving Compression path (zstd) on highly-compressible 64 KB: 3.74 us total (payload compresses to ~30 B; AEAD cost dominated by tag). No-lock counter increment: 3.22 us/op @ 1 KB (saves ~38 ns/chunk vs threading.Lock; single-threaded async usage documented in docstring). Memory regression gates (tests/benchmarks/test_bench_memory.py): 6/6 pass. Functional suite: 2213 passed, 19 skipped, 0 failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

develop

2 months ago

perf(streaming): wire format v2 with zero-copy AEAD encrypt_into/decrypt_into Move encoding_id from plaintext-prefix to AEAD AAD; eliminates one full chunk-sized copy on encrypt path. Combined-buffer + reusable scratch (msgspec/picows pattern) cuts per-chunk peak memory ~33% (193KB → 129KB at 64KB chunks). Drop ChunkEncryptor threading.Lock (single-thread async usage). _ChunkStreamParser yields read-only memoryview. Per-chunk decryptor return widened to bytes | bytearray. Wire layout v2: length(4) || counter(4) || encoding_id(1) || ct+tag. encoding_id authenticated via AAD; tampering raises DecryptionError (downgrade-attack resistance preserved). Adds ChunkEncryptor.encrypt_into(plaintext, dest, offset=-1) public API (msgspec.Encoder.encode_into pattern) and RawFormat.encrypt_chunk_into backing it. Removes dead aead_seal/aead_open from primitives. Bumps version 0.1.0 -> 0.2.0 (wire format break, pre-1.0 hard cutover). Measured perf (Python 3.14, cryptography 48.0): CPU encrypt vs raw cipher.encrypt_into baseline: - 1 KB: 3.25 us / 1.93 us = +68.8% framing overhead (315 MB/s) - 8 KB: 8.53 us / 7.04 us = +21.2% (960 MB/s) - 64 KB: 50.79 us / 48.10 us = +5.6% (1290 MB/s) - 256 KB: 197.50 us / 189.28 us = +4.3% (1327 MB/s) Decrypt CPU symmetric: ~52 us @ 64 KB, 1.27 GB/s throughput. Memory peak per chunk (tracemalloc): - encrypt 4 KB: 9 KB peak (-25% vs pre-refactor 12 KB) - encrypt 64 KB: 129 KB (-33% vs 192 KB) — matches plan target - encrypt 256 KB: 513 KB (-33% vs 768 KB) - decrypt 4 KB: 5 KB (-38% vs plan target 8 KB) - decrypt 64 KB: 64.9 KB (-49% vs plan target 128 KB) - decrypt 256 KB: 256.9 KB (-49% vs plan target 512 KB) Allocation count steady-state (reusable scratch verified): - 4 KB: 100 encrypts -> 14 alloc blocks (~0.14/call) - 64 KB: 100 encrypts -> 13 alloc blocks (~0.13/call) - pre-refactor: ~3-4 allocs/call (~30x reduction in malloc churn) Parser memoryview yield (replaces bytes() copy): - 64 KB: 4.35 us/chunk (was ~5.16 us pre-refactor) — 16% faster encrypt_into public API (msgspec pattern, skip internal scratch): - 4 KB: 5.11 us vs 5.52 us encrypt() — +7.4% saving - 64 KB: 49.23 us vs 51.23 us encrypt() — +3.9% saving Compression path (zstd) on highly-compressible 64 KB: 3.74 us total (payload compresses to ~30 B; AEAD cost dominated by tag). No-lock counter increment: 3.22 us/op @ 1 KB (saves ~38 ns/chunk vs threading.Lock; single-threaded async usage documented in docstring). Memory regression gates (tests/benchmarks/test_bench_memory.py): 6/6 pass. Functional suite: 2213 passed, 19 skipped, 0 failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

develop

2 months ago

perf(streaming): wire format v2 with zero-copy AEAD encrypt_into/decrypt_into Move encoding_id from plaintext-prefix to AEAD AAD; eliminates one full chunk-sized copy on encrypt path. Combined-buffer + reusable scratch (msgspec/picows pattern) cuts per-chunk peak memory ~33% (193KB → 129KB at 64KB chunks). Drop ChunkEncryptor threading.Lock (single-thread async usage). _ChunkStreamParser yields read-only memoryview. Per-chunk decryptor return widened to bytes | bytearray. Wire layout v2: length(4) || counter(4) || encoding_id(1) || ct+tag. encoding_id authenticated via AAD; tampering raises DecryptionError (downgrade-attack resistance preserved). Adds ChunkEncryptor.encrypt_into(plaintext, dest, offset=-1) public API (msgspec.Encoder.encode_into pattern) and RawFormat.encrypt_chunk_into backing it. Removes dead aead_seal/aead_open from primitives. Bumps version 0.1.0 -> 0.2.0 (wire format break, pre-1.0 hard cutover). Measured perf (Python 3.14, cryptography 48.0): CPU encrypt vs raw cipher.encrypt_into baseline: - 1 KB: 3.25 us / 1.93 us = +68.8% framing overhead (315 MB/s) - 8 KB: 8.53 us / 7.04 us = +21.2% (960 MB/s) - 64 KB: 50.79 us / 48.10 us = +5.6% (1290 MB/s) - 256 KB: 197.50 us / 189.28 us = +4.3% (1327 MB/s) Decrypt CPU symmetric: ~52 us @ 64 KB, 1.27 GB/s throughput. Memory peak per chunk (tracemalloc): - encrypt 4 KB: 9 KB peak (-25% vs pre-refactor 12 KB) - encrypt 64 KB: 129 KB (-33% vs 192 KB) — matches plan target - encrypt 256 KB: 513 KB (-33% vs 768 KB) - decrypt 4 KB: 5 KB (-38% vs plan target 8 KB) - decrypt 64 KB: 64.9 KB (-49% vs plan target 128 KB) - decrypt 256 KB: 256.9 KB (-49% vs plan target 512 KB) Allocation count steady-state (reusable scratch verified): - 4 KB: 100 encrypts -> 14 alloc blocks (~0.14/call) - 64 KB: 100 encrypts -> 13 alloc blocks (~0.13/call) - pre-refactor: ~3-4 allocs/call (~30x reduction in malloc churn) Parser memoryview yield (replaces bytes() copy): - 64 KB: 4.35 us/chunk (was ~5.16 us pre-refactor) — 16% faster encrypt_into public API (msgspec pattern, skip internal scratch): - 4 KB: 5.11 us vs 5.52 us encrypt() — +7.4% saving - 64 KB: 49.23 us vs 51.23 us encrypt() — +3.9% saving Compression path (zstd) on highly-compressible 64 KB: 3.74 us total (payload compresses to ~30 B; AEAD cost dominated by tag). No-lock counter increment: 3.22 us/op @ 1 KB (saves ~38 ns/chunk vs threading.Lock; single-threaded async usage documented in docstring). Memory regression gates (tests/benchmarks/test_bench_memory.py): 6/6 pass. Functional suite: 2213 passed, 19 skipped, 0 failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

develop

2 months ago

perf(streaming): wire format v2 with zero-copy AEAD encrypt_into/decrypt_into Move encoding_id from plaintext-prefix to AEAD AAD; eliminates one full chunk-sized copy on encrypt path. Combined-buffer + reusable scratch (msgspec/picows pattern) cuts per-chunk peak memory ~33% (193KB → 129KB at 64KB chunks). Drop ChunkEncryptor threading.Lock (single-thread async usage). _ChunkStreamParser yields read-only memoryview. Per-chunk decryptor return widened to bytes | bytearray. Wire layout v2: length(4) || counter(4) || encoding_id(1) || ct+tag. encoding_id authenticated via AAD; tampering raises DecryptionError (downgrade-attack resistance preserved). Adds ChunkEncryptor.encrypt_into(plaintext, dest, offset=-1) public API (msgspec.Encoder.encode_into pattern) and RawFormat.encrypt_chunk_into backing it. Removes dead aead_seal/aead_open from primitives. Bumps version 0.1.0 -> 0.2.0 (wire format break, pre-1.0 hard cutover). Measured perf (Python 3.14, cryptography 48.0): CPU encrypt vs raw cipher.encrypt_into baseline: - 1 KB: 3.25 us / 1.93 us = +68.8% framing overhead (315 MB/s) - 8 KB: 8.53 us / 7.04 us = +21.2% (960 MB/s) - 64 KB: 50.79 us / 48.10 us = +5.6% (1290 MB/s) - 256 KB: 197.50 us / 189.28 us = +4.3% (1327 MB/s) Decrypt CPU symmetric: ~52 us @ 64 KB, 1.27 GB/s throughput. Memory peak per chunk (tracemalloc): - encrypt 4 KB: 9 KB peak (-25% vs pre-refactor 12 KB) - encrypt 64 KB: 129 KB (-33% vs 192 KB) — matches plan target - encrypt 256 KB: 513 KB (-33% vs 768 KB) - decrypt 4 KB: 5 KB (-38% vs plan target 8 KB) - decrypt 64 KB: 64.9 KB (-49% vs plan target 128 KB) - decrypt 256 KB: 256.9 KB (-49% vs plan target 512 KB) Allocation count steady-state (reusable scratch verified): - 4 KB: 100 encrypts -> 14 alloc blocks (~0.14/call) - 64 KB: 100 encrypts -> 13 alloc blocks (~0.13/call) - pre-refactor: ~3-4 allocs/call (~30x reduction in malloc churn) Parser memoryview yield (replaces bytes() copy): - 64 KB: 4.35 us/chunk (was ~5.16 us pre-refactor) — 16% faster encrypt_into public API (msgspec pattern, skip internal scratch): - 4 KB: 5.11 us vs 5.52 us encrypt() — +7.4% saving - 64 KB: 49.23 us vs 51.23 us encrypt() — +3.9% saving Compression path (zstd) on highly-compressible 64 KB: 3.74 us total (payload compresses to ~30 B; AEAD cost dominated by tag). No-lock counter increment: 3.22 us/op @ 1 KB (saves ~38 ns/chunk vs threading.Lock; single-threaded async usage documented in docstring). Memory regression gates (tests/benchmarks/test_bench_memory.py): 6/6 pass. Functional suite: 2213 passed, 19 skipped, 0 failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

develop

2 months ago

perf(streaming): wire format v2 with zero-copy AEAD encrypt_into/decrypt_into Move encoding_id from plaintext-prefix to AEAD AAD; eliminates one full chunk-sized copy on encrypt path. Combined-buffer + reusable scratch (msgspec/picows pattern) cuts per-chunk peak memory ~33% (193KB → 129KB at 64KB chunks). Drop ChunkEncryptor threading.Lock (single-thread async usage). _ChunkStreamParser yields read-only memoryview. Per-chunk decryptor return widened to bytes | bytearray. Wire layout v2: length(4) || counter(4) || encoding_id(1) || ct+tag. encoding_id authenticated via AAD; tampering raises DecryptionError (downgrade-attack resistance preserved). Adds ChunkEncryptor.encrypt_into(plaintext, dest, offset=-1) public API (msgspec.Encoder.encode_into pattern) and RawFormat.encrypt_chunk_into backing it. Removes dead aead_seal/aead_open from primitives. Bumps version 0.1.0 -> 0.2.0 (wire format break, pre-1.0 hard cutover). Measured perf (Python 3.14, cryptography 48.0): CPU encrypt vs raw cipher.encrypt_into baseline: - 1 KB: 3.25 us / 1.93 us = +68.8% framing overhead (315 MB/s) - 8 KB: 8.53 us / 7.04 us = +21.2% (960 MB/s) - 64 KB: 50.79 us / 48.10 us = +5.6% (1290 MB/s) - 256 KB: 197.50 us / 189.28 us = +4.3% (1327 MB/s) Decrypt CPU symmetric: ~52 us @ 64 KB, 1.27 GB/s throughput. Memory peak per chunk (tracemalloc): - encrypt 4 KB: 9 KB peak (-25% vs pre-refactor 12 KB) - encrypt 64 KB: 129 KB (-33% vs 192 KB) — matches plan target - encrypt 256 KB: 513 KB (-33% vs 768 KB) - decrypt 4 KB: 5 KB (-38% vs plan target 8 KB) - decrypt 64 KB: 64.9 KB (-49% vs plan target 128 KB) - decrypt 256 KB: 256.9 KB (-49% vs plan target 512 KB) Allocation count steady-state (reusable scratch verified): - 4 KB: 100 encrypts -> 14 alloc blocks (~0.14/call) - 64 KB: 100 encrypts -> 13 alloc blocks (~0.13/call) - pre-refactor: ~3-4 allocs/call (~30x reduction in malloc churn) Parser memoryview yield (replaces bytes() copy): - 64 KB: 4.35 us/chunk (was ~5.16 us pre-refactor) — 16% faster encrypt_into public API (msgspec pattern, skip internal scratch): - 4 KB: 5.11 us vs 5.52 us encrypt() — +7.4% saving - 64 KB: 49.23 us vs 51.23 us encrypt() — +3.9% saving Compression path (zstd) on highly-compressible 64 KB: 3.74 us total (payload compresses to ~30 B; AEAD cost dominated by tag). No-lock counter increment: 3.22 us/op @ 1 KB (saves ~38 ns/chunk vs threading.Lock; single-threaded async usage documented in docstring). Memory regression gates (tests/benchmarks/test_bench_memory.py): 6/6 pass. Functional suite: 2213 passed, 19 skipped, 0 failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

develop

2 months ago

ci: migrate CI runners from Blacksmith to native GitHub-hosted Free and unlimited for public repos. Blacksmith cost was increasing with no justification for this project's needs. - test.yml: ubuntu-24.04-arm, macos-15, macos-26 (was blacksmith-*) - release.yml: ubuntu-24.04-arm for build/upload, ubuntu-24.04 for publish Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

develop

3 months ago

ci: migrate CodSpeed benchmarks from dedicated runner to GitHub-hosted Best-effort benchmarking on free ubuntu-24.04-arm runner. Simulation mode does not require dedicated hardware, variance is accepted. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

develop

3 months ago

security: add 7-day dependency cooldown via uv exclude-newer Supply-chain protection: uv will only resolve packages published ≥7 days ago, giving the community and index moderators time to flag malicious releases before they enter the lockfile.

develop

3 months ago

Latest Branches

N/A

Add CodSpeed performance benchmarks and CI workflow#2

3 months ago

77ff8eb

codspeed-wizard-1774531128507

© 2026 CodSpeed Technology

Home Terms Privacy Docs