Encryption performance benchmarked for latency SLAs

Financial services have latency SLAs that encryption operations must fit within. Application-level field encryption in Node.js, if implemented naively (synchronous crypto in request handlers, per-field key derivation on every read), can add hundreds of milliseconds to database read paths — degrading payment confirmation UX and potentially triggering timeout-based retry loops that amplify costs. ISO 25010 performance-efficiency requirements apply to cryptographic subsystems as much as to application code. If encryption overhead pushes p99 latency above payment processor timeout thresholds, the fallback logic (retries, error responses) can itself create inconsistent transaction states.

Benchmark encryption operations as part of your load testing suite, not in isolation. Add a benchmark script to scripts/bench-encryption.ts:

import crypto from 'node:crypto';

const key = crypto.randomBytes(32);
const ITERATIONS = 10_000;
const PAYLOAD = 'sensitive-account-number-1234567890';

const start = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  const encrypted = Buffer.concat([cipher.update(PAYLOAD, 'utf8'), cipher.final()]);
  void cipher.getAuthTag();
  void encrypted;
}
const elapsed = performance.now() - start;
console.log(`AES-256-GCM: ${(elapsed / ITERATIONS).toFixed(3)}ms per operation`);

Document results and the SLA target in docs/encryption-performance.md. If overhead exceeds 5ms per field operation, switch to envelope encryption: encrypt data with a local key, wrap only the local key with KMS — this reduces KMS API call frequency dramatically.