perf(upload): derive v4 filename-metadata Argon2id via libsodium (~15x faster) - #2
Merged
Merged
Conversation
…x faster) encryptMetadataV4 derived its per-file metadata key with @noble pure-JS argon2id at interactive params (t=2, m=64 MiB) — ~1.1 s per file, once per file, so `sf sync`/`sf push` over many small files was KDF-bound. Switch the ENCRYPT side to libsodium crypto_pwhash (ARGON2ID13, opslimit=2, memlimit=64 MiB), which is byte-identical to @noble at these params (verified for both interactive and moderate) but ~15x faster (~74 ms). The v4 envelope (v/ct/iv/tag/salt/kdf) is unchanged, so filenames still decrypt on the web and mobile clients and are indistinguishable on the wire — no server change, no migration. decryptMetadataV4 stays on @noble: it is off the upload hot path and keeping a second independent Argon2id implementation guards reads against a libsodium regression. libsodium-wrappers-sumo is already a dependency and already initialised in the unlock path. encryptMetadataV4 becomes async (libsodium ready gate); its only caller, createUploadSession, is already async. Tests: the metadata round-trip now encrypts with libsodium and decrypts with @noble (proving the backends agree), plus a new test reconstructs a legacy @noble-produced envelope and asserts it still decrypts. 36/36 pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
encryptMetadataV4derived its per-file metadata key with@noblepure-JS Argon2id at interactive params (t=2, m=64 MiB) — ~1.1 s per file, once per file, sosf sync/sf pushover many small files was KDF-bound (all that time before any bytes move).Switch the encrypt side to libsodium
crypto_pwhash(ARGON2ID13, opslimit=2, memlimit=64 MiB), which is byte-identical to@nobleat these params (verified here for both interactive and moderate) but ~15× faster (~74 ms).v/ct/iv/tag/salt/kdf) is unchanged → filenames still decrypt on web + mobile and are indistinguishable on the wire. No server change, no migration, no stored-data touch.decryptMetadataV4stays on@noble— off the upload hot path, and keeping a second independent Argon2id implementation guards reads against a libsodium regression.libsodium-wrappers-sumois already a dependency and already initialised in the unlock path — no new dep.encryptMetadataV4becomes async (libsodium ready gate); its only callercreateUploadSessionis already async.Verify: the metadata round-trip test now encrypts with libsodium and decrypts with
@noble(proving the backends agree byte-for-byte), plus a new test reconstructs a legacy@noble-produced envelope and asserts it still decrypts. 36/36 pass.Independent of PR #1 (WebCrypto chunk encryption + part retry) — different function, no conflict.