From c635e41d8576f5587d47e51a98dfd4a8920315f0 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 18:26:33 +0100 Subject: Seal delivered sends to the receiver's key (086) --seal OUTPUT=KEY seals each request's body whole to the receiving node's public key with HPKE (RFC 9180, base mode: X25519, HKDF-SHA256, AES-128-GCM where the CPU has AES, else ChaCha20-Poly1305), bound to the request's source, first number and count; X-Pure-Seal names the suite. A receiver's --key is a raw 32-byte file, made 0600 when missing, held in OpenSSL's secure heap; it opens the body where it lies (400 seal when it does not open) and zeroes the plain text when the request's ticket goes. --sealed-only refuses unsealed deliveries (403 unsealed). The check puts a recording relay between two apps: every order applies once, no body shows an item or a field name, a flipped bit is refused, a replayed request applies nothing twice, and a seal to another key does not open. Its hosts choose their own ports (--port 0). Sealed sends drain at 233-235k a second against 469-470k plain (Raspberry Pi 5): three X25519 operations a request, 164 us each. The plain request path measured the same as before. --- .../2026-09-27-drain-linux-aarch64.jsonl | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 research/experiments/014-sealed-sends/2026-09-27-drain-linux-aarch64.jsonl (limited to 'research/experiments/014-sealed-sends/2026-09-27-drain-linux-aarch64.jsonl') diff --git a/research/experiments/014-sealed-sends/2026-09-27-drain-linux-aarch64.jsonl b/research/experiments/014-sealed-sends/2026-09-27-drain-linux-aarch64.jsonl new file mode 100644 index 0000000..f7a9477 --- /dev/null +++ b/research/experiments/014-sealed-sends/2026-09-27-drain-linux-aarch64.jsonl @@ -0,0 +1,16 @@ +{"round": 0, "variant": "plain", "sends": 20000, "sends_per_second": 469622, "receiver_requests": 85, "delivery_attempts": 80} +{"round": 0, "variant": "sealed", "sends": 20000, "sends_per_second": 235074, "receiver_requests": 89, "delivery_attempts": 80} +{"round": 0, "variant": "baseline", "sends": 20000, "sends_per_second": 91082, "receiver_requests": 102, "delivery_attempts": 80} +{"round": 1, "variant": "sealed", "sends": 20000, "sends_per_second": 234780, "receiver_requests": 89, "delivery_attempts": 80} +{"round": 1, "variant": "baseline", "sends": 20000, "sends_per_second": 90993, "receiver_requests": 102, "delivery_attempts": 80} +{"round": 1, "variant": "plain", "sends": 20000, "sends_per_second": 469046, "receiver_requests": 85, "delivery_attempts": 80} +{"round": 2, "variant": "baseline", "sends": 20000, "sends_per_second": 95491, "receiver_requests": 101, "delivery_attempts": 80} +{"round": 2, "variant": "plain", "sends": 20000, "sends_per_second": 469907, "receiver_requests": 85, "delivery_attempts": 80} +{"round": 2, "variant": "sealed", "sends": 20000, "sends_per_second": 232933, "receiver_requests": 89, "delivery_attempts": 80} +{"aead": "aes-128-gcm", "bytes": 64, "kb_per_second": 182960.79} +{"aead": "chacha20-poly1305", "bytes": 64, "kb_per_second": 257240.61} +{"aead": "aes-128-gcm", "bytes": 1024, "kb_per_second": 1349597.18} +{"aead": "chacha20-poly1305", "bytes": 1024, "kb_per_second": 682410.58} +{"aead": "aes-128-gcm", "bytes": 16384, "kb_per_second": 2282373.12} +{"aead": "chacha20-poly1305", "bytes": 16384, "kb_per_second": 707640.6} +{"x25519_per_second": 6105.0} -- cgit v1.2.3