Adaptive crypto#15
Merged
Merged
Conversation
Since our chunking format is self describing we don't need half close hacks like age does where it reads beyond the stream. Now the client no longer needs to close the connection and if we wanted to pipeline commands from the client in the future we could.
We are basically reading ahead so the pipe can be kept full as much as possible, instead of relying on fadvise to do the right thing we are explicitly requesting the pages enter page cache.
jolynch
force-pushed
the
adaptive-crypto
branch
2 times, most recently
from
April 5, 2026 02:07
ed798b6 to
9769caf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This patch does two things: it migrates FTCP encryption from the old mixed
age/AES scheme to a single self-describing (low/no allocation) internal AEAD transport, and it cleans up a few concurrency issues in the CLI surfaced by race detection.On the wire, authenticated sessions now negotiate
aesorchacha20explicitly,autoresolves from the server hint, and the chosen cipher applies symmetrically to both request and response payloads. That removes the old half-close/EOF coupling fromage, drops per-frameenc=metadata, simplifies frame parsing, and updates the CLI/docs/bench tooling to match. The patch also adds the new AEAD implementation and tests/benchmarks, lowers default server IO depth to4, lowers the default client request window to512 MiB, improves server key loading/generation behavior, and fixes CLI progress/reporting races while pruning some dead helper code.Benchmarks
Measured on
linux/amd64(AMD Ryzen AI 9 HX 370).