🩹 [Patch]: Crypto operations are faster after Sodium dependency upgrade to 2.2.5#124
Draft
Marius Storhaug (MariusStorhaug) wants to merge 3 commits into
Draft
🩹 [Patch]: Crypto operations are faster after Sodium dependency upgrade to 2.2.5#124Marius Storhaug (MariusStorhaug) wants to merge 3 commits into
Marius Storhaug (MariusStorhaug) wants to merge 3 commits into
Conversation
Sodium 2.2.5 delivers significant performance improvements with no breaking API changes. Key gains since 2.2.2: - ConvertFrom-SodiumSealedBox: -44% per-call overhead (196 -> 109 µs) - ConvertTo-SodiumSealedBox: -22% per-call overhead (136 -> 105 µs) - New-SodiumKeyPair -Seed: -49% per-call overhead (95 -> 49 µs) - Module cold import: -37% (67 ms -> 42 ms) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Measures median µs per iteration for the three hot paths: New-SodiumKeyPair seed derivation, Set-Context (seal), and Get-Context (open/decrypt). Script is self-contained, cleans up after itself, and outputs a formatted table plus objects for downstream capture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter POWERSHELL |
Two-part test confirms the on-disk contract is fully preserved: - Part 1: New-SodiumKeyPair -Seed produces byte-identical keys in both Sodium versions; a sealed box from 2.2.2 is decryptable by 2.2.5. - Part 2: vault files written by Context 8.1.3 (Sodium 2.2.2) are correctly decrypted using Sodium 2.2.5 key derivation directly, including SecureString-prefixed values and null fields. All 9 assertions pass. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter POWERSHELL |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumping the Sodium dependency from 2.2.2 to 2.2.5 brings substantial per-operation performance improvements to every
Set-ContextandGet-Contextcall with no API changes required. Backward compatibility with existing vault data is confirmed by an automated cross-version test.Changed: Significantly lower crypto overhead per context operation
Sodium 2.2.3–2.2.5 delivered incremental perf wins across the three operations Context calls on every vault read/write.
Improvements in Sodium itself (from release notes, Windows x64):
New-SodiumKeyPair -Seed(key derivation)ConvertFrom-SodiumSealedBox(decrypt)ConvertTo-SodiumSealedBox(encrypt)Measured in Context with Sodium 2.2.5 (500 iterations,
tests/Context.Benchmark.ps1):New-SodiumKeyPair -SeedSet-Context(seal + disk write)Get-Context(disk read + decrypt)Changed: Fail-fast input validation
ConvertFrom-SodiumSealedBoxnow rejects sealed payloads shorter than 48 bytes with a clearArgumentExceptionbefore reaching native interop.Changed: Backward compatibility confirmed — no breaking changes
tests/Context.CrossVersionCompat.ps1verifies the on-disk contract across the version boundary:New-SodiumKeyPair -Seedproduces byte-identical keys in 2.2.2 and 2.2.5[SECURESTRING]prefixed values preserved across version boundaryAll 9 assertions pass.
Technical Details
#Requires -Modules @{ ModuleName = 'Sodium'; RequiredVersion = '2.2.2' }to'2.2.5'inGet-Context.ps1andSet-Context.ps1.-PublicKeyonConvertFrom-SodiumSealedBoxis now optional — the public key can be derived internally from-PrivateKeyviacrypto_scalarmult_base. Future refactoring ofGet-ContextVaultKeyPaircould leverage this to avoid storing the public key separately.tests/Context.Benchmark.ps1for reproducible per-operation timing.tests/Context.CrossVersionCompat.ps1for on-disk contract verification across Sodium version boundaries.Related issues