| Implementation | Algorithm | MiB/s | Gbit/s |
|---|---|---|---|
| libaegis (VAES/AVX-512) | AEGIS-128X4 | 25,746 | 216.0 |
| libaegis | AEGIS-128X2 | 18,175 | 152.5 |
| BoringSSL AES128-GCM | AES-128-GCM | 7,343 | 61.6 |
| Implementation | Algorithm | MiB/s | Gbits/s |
|---|---|---|---|
| libhiae | HiAE (enc) | 1,014 | 7.92 |
| libhiae | HiAE (dec) | 997 | 7.7 |
| hand-optimized for wasmtime | AEGIS-128X4 | 644 | 5.1 |
| hand-optimized for wasmtime | AEGIS-128X2 | 628 | 4.9 |
| libaegis | AEGIS-128X4 | 618 | 4.8 |
| libaegis | AEGIS-128X2 | 600 | 4.7 |
| hand-optimized for wasmtime | CHACHA-POLY | 492 | 3.8 |
| aes-wasm | AEGIS-128X2 | 487 | 3.8 |
| hand-optimized for wasmtime | ASCON-AEAD | 376 | 2.9 |
| aegis-bitsliced (protected) | AEGIS-128X2 | 333 | 2.6 |
| aes-wasm | AES-128-GCM | 90 | 0.7 |
RustCrypto aes-gcm 0.10.3 |
AES-128-GCM | 46 | 0.4 |
Experimental: MonkeySpongeWrap with Keccak-p (c=256, 12 rounds, 2-way interleaved):
| MiB/s | Gbits/s |
|---|---|
| 798 | 99.75 |
Native (or WebAssembly with WASI-Crypto):
| Algorithm | Gbits/s |
|---|---|
| AEGIS-128L | 193.48 |
| AEGIS-128X2 | 375.25 |
| AEGIS-128X4 | 507.38 |
| AES-128-GCM | 127.38 |
| HiAE | 259.46 |
Pure WebAssembly implementations, except AES-128-GCM on Cloudflare and Bunny:
| Algorithm | Fastly (wasmtime) | Cloudflare (V8) | Bunny (V8) |
|---|---|---|---|
| AEGIS-128L | 2.575 | 5.980 | 6.830 |
| AEGIS-128X2 | 2.549 | 5.815 | 5.691 |
| AEGIS-128X4 | 2.502 | 5.289 | 5.392 |
| AES-128-GCM | (wasm) 0.351 | (native) 7.665 | (native) 3.809 |
| HiAE | 4.386 | 10.370 | 9.412 |
Cipher performance generally has a negligible impact on end-user-perceived latency, and the actual cost cannot be inferred directly from the measured cipher performance.
Fastly AES-128-GCM uses aes-wasm (fastest WebAssembly implementation, no hardware acceleration); Cloudflare and Bunny use SubtleCrypto (native, hardware accelerated).
For that cipher, note that the benchmark compares in-place Wasm encryption wih the SubtleCrypto API that requires Promises and copying the output to a new buffer, which adds overhead unrelated to the cipher itself. But this represents the API surface exposed to real-world applications.
The WebAssembly modules are exactly the same, but Fastly uses Wasmtime for WebAssembly, Cloudflare and Bunny use V8.
The WebAssembly implementations of HiAE and AEGIS are constant-time (using a composite field AES S-box implementation), assuming that WebAssembly compilers emit proper SIMD permutation instructions for i8x16.relaxed_swizzle.
Achieving optimal performance requires WebAssembly code to be tailored to each runtime, even for similar CPU classes.
Conclusion: If you need to run across multiple CDNs or migrate between them without friction, use HiAE or AEGIS. AES-GCM's performance is too inconsistent.
The WASI-Crypto extension is the long-term solution. SubtleCrypto (tied to JavaScript anyway) is not.