perf(aead-frame): write the storage profile three times faster and read it a third faster, with every blob byte-for-byte the same by coderdan · Pull Request #559 · cipherstash/vitaminc

perf(aead-frame): refuse a repeated key as the storage writer writes, so no blob is read back before it is returned

coderdan

committed

41f8492

perf(protected): wipe sixteen bytes a store, so a growing frame or blob is not wiped a byte at a time

coderdan

committed

0ad15fa

perf(protected)!: return frames and blobs in a Buffer, so the plaintext they hold is wiped sixteen bytes a store

coderdan

committed

6c6880a

refactor(protected)!: make Buffer a Controlled type, so its bytes are read through risky_ref and not a plain slice

coderdan

committed

13c2892

perf(aead-frame): build an entry's error path only when an error is placed at it, so reading or writing a field allocates nothing

coderdan

committed

1cabc0a

perf(aead-frame): tell a node's kind from its tag, so a text or bytes value is decoded once on read and not twice

coderdan

committed

b9499f7

perf(aead): compare an object's keys one by one while there are few, so validating a record allocates no hash set

coderdan

committed

7d4e650

fix(protected): unwind the wipe_raw proof 65 times, so Kani can finish its 64-byte check loop

coderdan

committed

615a035

test(protected): check that a Buffer's drop wipes it and that risky_inner_mut reaches its bytes, so neither can be removed unnoticed

coderdan

committed

e9f9fc8

test(aead-frame): check a null, a boolean and a float read as a string, bytes or a struct are refused by their kind

coderdan

committed

094bbe7

docs(aead-frame): say the storage blob comes back in a Buffer, since to_vec no longer returns it Protected

coderdan

committed

40dd628

docs(aead-frame): rewrap the Buffer return docs and name Buffer in the test helper, so the text reads as the rest of the file

coderdan

committed

04b3d12

docs(aead-frame): state that the performance tables predate the Buffer and reader changes, rather than promise a re-measure

coderdan

committed

c8b9a9e

refactor(protected): keep wipe_vec inside the crate, since only Buffer calls it and a public Vec wipe invites unwrapped secrets

coderdan

committed

e1bc397

refactor(protected): drop Buffer::clear and Buffer::capacity, since no writer uses them and each is more surface to review

coderdan

committed

55745a3

refactor(aead): seal the scalar writer's output trait and name it ByteSink, so it is not an open extension point named Out

coderdan

committed

fccc2fe

docs(protected): limit Buffer's no-copy promise to its own methods, since the Controlled methods that lend the Vec can grow it unwiped

coderdan

committed

eec32dc

test(protected): check that Buffer wipes the old block when it grows, so the guarantee is tested at the type that owns it

coderdan

committed

e26d907

fix(aead): check in debug builds that a Vec leaf sink was sized with max_len, and show presized wiping sinks in the examples, since a growing Vec frees plaintext unwiped

coderdan

committed

0fb1740

docs(aead-frame): say that the writer's wipes run on drop, so a panic under panic=abort leaves a partly written blob unwiped

coderdan

committed

0ce4346

perf(protected): tell the compiler reserve made room, so Vec's own reallocating growth is compiled out of Buffer's push paths

coderdan

committed

6f983f9

test(aead): pin the debug checks on a Vec leaf sink and document their panic, so removing one fails a test and a caller with an unsized Vec knows why it panics

coderdan

committed

5e67c17

test(protected): check that Buffer::reserve panics when it cannot allocate the room, since the room it then promises the compiler rests on that panic

coderdan

committed

0b1a5fc

refactor(aead): hide SeenKeys from the docs, since only vitaminc-aead-frame uses it and it should not read as an API to keep stable

coderdan

committed

efac5e4

refactor(aead): move SeenKeys into frame::__private, so its path says it is shared with vitaminc-aead-frame and is not an API

coderdan

committed

bd45c10

Navigation Menu

Repository navigation

perf(aead-frame): write the storage profile three times faster and read it a third faster, with every blob byte-for-byte the same - #559

perf(aead-frame): write the storage profile three times faster and read it a third faster, with every blob byte-for-byte the same#559
coderdan merged 25 commits into
mainfrom
perf/storage-writer-key-check

Commits on Nov 2, 2026

perf(aead-frame): refuse a repeated key as the storage writer writes, so no blob is read back before it is returned

perf(protected): wipe sixteen bytes a store, so a growing frame or blob is not wiped a byte at a time

perf(protected)!: return frames and blobs in a Buffer, so the plaintext they hold is wiped sixteen bytes a store

refactor(protected)!: make Buffer a Controlled type, so its bytes are read through risky_ref and not a plain slice

perf(aead-frame): build an entry's error path only when an error is placed at it, so reading or writing a field allocates nothing

perf(aead-frame): tell a node's kind from its tag, so a text or bytes value is decoded once on read and not twice

perf(aead): compare an object's keys one by one while there are few, so validating a record allocates no hash set

fix(protected): unwind the wipe_raw proof 65 times, so Kani can finish its 64-byte check loop

test(protected): check that a Buffer's drop wipes it and that risky_inner_mut reaches its bytes, so neither can be removed unnoticed

test(aead-frame): check a null, a boolean and a float read as a string, bytes or a struct are refused by their kind

docs(aead-frame): say the storage blob comes back in a Buffer, since to_vec no longer returns it Protected

docs(aead-frame): rewrap the Buffer return docs and name Buffer in the test helper, so the text reads as the rest of the file

docs(aead-frame): state that the performance tables predate the Buffer and reader changes, rather than promise a re-measure

refactor(protected): keep wipe_vec inside the crate, since only Buffer calls it and a public Vec wipe invites unwrapped secrets

refactor(protected): drop Buffer::clear and Buffer::capacity, since no writer uses them and each is more surface to review

refactor(aead): seal the scalar writer's output trait and name it ByteSink, so it is not an open extension point named Out

docs(protected): limit Buffer's no-copy promise to its own methods, since the Controlled methods that lend the Vec can grow it unwiped

test(protected): check that Buffer wipes the old block when it grows, so the guarantee is tested at the type that owns it

fix(aead): check in debug builds that a Vec leaf sink was sized with max_len, and show presized wiping sinks in the examples, since a growing Vec frees plaintext unwiped

docs(aead-frame): say that the writer's wipes run on drop, so a panic under panic=abort leaves a partly written blob unwiped

perf(protected): tell the compiler reserve made room, so Vec's own reallocating growth is compiled out of Buffer's push paths

test(aead): pin the debug checks on a Vec leaf sink and document their panic, so removing one fails a test and a caller with an unsized Vec knows why it panics

test(protected): check that Buffer::reserve panics when it cannot allocate the room, since the room it then promises the compiler rests on that panic

refactor(aead): hide SeenKeys from the docs, since only vitaminc-aead-frame uses it and it should not read as an API to keep stable

refactor(aead): move SeenKeys into frame::__private, so its path says it is shared with vitaminc-aead-frame and is not an API