Skip to content

crypto: cache valid ECDH key pairs - #65615

Open
panva wants to merge 2 commits into
nodejs:mainfrom
panva:crypto-cache-valid-ecdh-key-pairs
Open

crypto: cache valid ECDH key pairs#65615
panva wants to merge 2 commits into
nodejs:mainfrom
panva:crypto-cache-valid-ecdh-key-pairs

Conversation

@panva

@panva panva commented Aug 28, 2026

Copy link
Copy Markdown
Member

Avoid repeating EC key-pair validation after a pair has already been established or validated. Invalidate the positive-only cache whenever public-key mutation can make the pair inconsistent.

Avoid repeating EC key-pair validation after a pair has already been
established or validated. Invalidate the positive-only cache whenever
public-key mutation can make the pair inconsistent.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/performance

@nodejs-github-bot nodejs-github-bot added c++ 问题 and PRs that require attention from people who are familiar with C++. crypto 问题 and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Aug 28, 2026
@github-actions

This comment was marked as outdated.

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Benchmark GHA (crypto / ecdh-compute-secret): https://github.com/nodejs/node/actions/runs/33163372222

Results

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

Benchmark results:

                                                                       confidence improvement accuracy (*)   (**)  (***)
crypto/ecdh-compute-secret.js n=5000 scenario='first-after-generate'          ***     33.41 %       ±5.73% ±7.55% ±9.69%
crypto/ecdh-compute-secret.js n=5000 scenario='full-lifecycle'                ***     21.08 %       ±5.41% ±7.13% ±9.15%
crypto/ecdh-compute-secret.js n=5000 scenario='reused-local-peer-pool'        ***     32.58 %       ±5.65% ±7.45% ±9.57%
crypto/ecdh-compute-secret.js n=5000 scenario='reused-local-same-peer'        ***     34.34 %       ±5.45% ±7.18% ±9.22%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 4 comparisons, you can thus
expect the following amount of false-positive results:
  0.20 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.04 false positives, when considering a   1% risk acceptance (**, ***),
  0.00 false positives, when considering a 0.1% risk acceptance (***)

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

Edit: 🚀

@codecov

codecov Bot commented Aug 28, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.07%. Comparing base (2743045) to head (2b1f95e).
⚠️ Report is 20 commits behind head on main.

Files with missing lines Patch % Lines
src/crypto/crypto_ec.cc 87.50% 0 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #65615      +/-   ##
==========================================
+ Coverage   90.06%   90.07%   +0.01%     
==========================================
  Files         751      751              
  Lines      254917   254931      +14     
  分支    48133    48132       -1     
==========================================
+ Hits       229580   229628      +48     
+ Misses      16493    16482      -11     
+ Partials     8844     8821      -23     
Files with missing lines Coverage Δ
src/crypto/crypto_ec.h 16.66% <ø> (ø)
src/crypto/crypto_ec.cc 68.42% <87.50%> (+0.50%) ⬆️

... and 33 files with indirect coverage changes

🚀 新建 features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@panva
panva requested a review from jasnell August 29, 2026 07:57
@panva panva added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 29, 2026
注册 for free to join this conversation on GitHub. Already have an account? 登录 to comment

标签

c++ 问题 and PRs that require attention from people who are familiar with C++. crypto 问题 and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. request-ci Add this label to start a Jenkins CI on a PR.

项目

None yet

Development

Successfully merging this pull request may close these issues.

2 participants