Encryption performance benchmarked for latency SLAs

Financial services have latency SLAs that encryption operations must fit within. Application-level field encryption in Node.js, if implemented naively (synchronous crypto in request handlers, per-field key derivation on every read), can add hundreds of milliseconds to database read paths — degrading payment confirmation UX and potentially triggering timeout-based retry loops that amplify costs. ISO 25010 performance-efficiency requirements apply to cryptographic subsystems as much as to application code. If encryption overhead pushes p99 latency above payment processor timeout thresholds, the fallback logic (retries, error responses) can itself create inconsistent transaction states.

Benchmark encryption operations as part of your load testing suite, not in isolation. Add a benchmark script to scripts/bench-encryption.ts:

import crypto from 'node:crypto';

const key = crypto.randomBytes(32);
const ITERATIONS = 10_000;
const PAYLOAD = 'sensitive-account-number-1234567890';

const start = performance.now();
for (let i = 0; i < ITERATIONS; i++) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  const encrypted = Buffer.concat([cipher.update(PAYLOAD, 'utf8'), cipher.final()]);
  void cipher.getAuthTag();
  void encrypted;
}
const elapsed = performance.now() - start;
console.log(`AES-256-GCM: ${(elapsed / ITERATIONS).toFixed(3)}ms per operation`);

Document results and the SLA target in docs/encryption-performance.md. If overhead exceeds 5ms per field operation, switch to envelope encryption: encrypt data with a local key, wrap only the local key with KMS — this reduces KMS API call frequency dramatically.

• ID: encryption-performance-sla
• Severity: low
• What to look for: Count all performance benchmark results or latency documentation referencing encryption. Quote the actual latency numbers found. Verify encryption overhead is under 10ms per transaction. Count all SLA targets that account for encryption.
• Pass criteria: At least 1 benchmark or documentation shows encryption performance overhead under 10ms per transaction. Report the count even on pass (e.g., "1 benchmark found: AES-256-GCM adds 2.3ms per transaction, within 10ms SLA target").
• Fail criteria: No performance data (0 benchmarks), or encryption adds more than 10ms latency per transaction.
• Skip (N/A) when: Project has not yet reached performance testing phase — cite the actual development stage found.
• Detail on fail: "0 encryption performance benchmarks found — overhead unknown" or "Encryption adds 500ms per transaction — exceeds 10ms maximum"
• Remediation:
  • Benchmark encryption overhead:

    import crypto from 'crypto';
    
    const encryptionBenchmark = () => {
      const start = performance.now();
      for (let i = 0; i < 1000; i++) {
        const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
        cipher.update('test data');
        cipher.final();
      }
      const elapsed = performance.now() - start;
      console.log(`Encryption: ${(elapsed / 1000).toFixed(2)}ms per 1000 ops`);
    };
    encryptionBenchmark();
    

  • Document SLA targets:

    # Encryption Performance SLAs
    - Target latency: <5ms per transaction
    - Measured latency: 2.3ms (AES-256-GCM)
    - Acceptable overhead: <10% of total transaction time
    - Load test: Verified under 1000 TPS