ANKASecure Performance Benchmarks

Overview

This section contains comprehensive performance benchmarks for the ANKASecure Post-Quantum Cryptography Platform, measuring cryptographic operation efficiency across classical and post-quantum algorithms.

All benchmarks follow a consistent micro-benchmark methodology using JUnit 5 parameterized tests with:

• Deterministic execution (sequential, fixed RNG seed for reproducibility)
• Warm-up and measurement phases (configurable via system properties)
• Multiple payload sizes (1 KiB → 5 MiB)
• Comprehensive metrics (wall-clock time, CPU time, heap delta)
• Median aggregation (robust against outliers)
• CSV export (for external analysis)

Purpose

These benchmarks serve multiple critical purposes:

🎯 Performance Validation

• Validate that cryptographic operations meet enterprise performance requirements
• Identify performance characteristics across algorithm families
• Establish baseline metrics for regression testing

📊 Algorithm Comparison

• Compare classical vs. post-quantum algorithm performance
• Evaluate trade-offs between security level and computational cost
• Guide algorithm selection for specific use cases

🔬 Architectural Decision Support

• Provide quantitative data for capacity planning
• Support hardware sizing and scaling decisions
• Inform caching and optimization strategies

📈 External Auditing

• Provide transparent, reproducible evidence of platform capabilities
• Support security certifications and compliance requirements
• Enable third-party validation of performance claims

Available Benchmarks

Single-Algorithm Benchmarks

These benchmarks measure performance of individual cryptographic algorithms:

Algorithms covered:

• Symmetric: AES-GCM, AES-CCM, ChaCha20-Poly1305, Camellia-GCM, SEED-GCM, SM4-{GCM,CCM}, ARIA-{GCM,CCM}
• Classical Asymmetric: RSA (2048-8192), ECDSA (P-256/384/521), EdDSA (Ed25519/448), X25519/X448
• Post-Quantum KEMs: ML-KEM-{512,768,1024}, FRODO-{976,1344}, HQC-{128,192,256}, BIKE, SABER, NTRU, NTRUPRIME, Classic McEliece
• Post-Quantum Signatures: ML-DSA-{44,65,87}, FALCON-{512,1024}, SLH-DSA (SPHINCS+), XMSS, LMS
• MACs: HMAC-SHA{2,3}, KMAC, CMAC-AES, HMAC-SM3, HMAC-Streebog

Composite-Algorithm Benchmarks

These benchmarks measure performance of hybrid composite keys combining classical and post-quantum algorithms:

Composite modes:

• COMPOSITE_KEM_COMBINE: Combines classical KEM (X25519, X448, P-256/384/521) with PQC KEM (ML-KEM, HQC) through the NIST SP 800-227 key combiner, instantiated by the key's KDF token (HKDF-SHA256 by default). The composite KEM runs recorded here (2026-01-18) predate that combiner, and their HQC-192 / HQC-256 rows ran on HQC-128 material; each page says so
• COMPOSITE_SIGNATURE: Composite signature scheme — one signature from a classical algorithm (Ed25519, Ed448, P-256/384) and a PQC algorithm (ML-DSA-44/65/87), valid only when both verify

Security constraints:

• Security level difference ≤ 2 steps
• Only RECOMMENDED status algorithms
• NIST FIPS compliance (ML-KEM, ML-DSA)

End-to-End API Latency (External Round-Trip)

A separate, complementary benchmark family measures the full client-observed round-trip latency of the crypto REST endpoints — calling them from outside the platform (through the NGINX edge) instead of calling the crypto engine in-process.

These two families are complementary: the micro-benchmarks above isolate the cryptographic cost only; the End-to-End suite captures everything a client waits for. Subtracting one from the other (joined on algorithm + payloadSizeBytes) yields the non-crypto orchestration overhead — see the Latency Attribution^* table. It lives in ankasecure-integration-tests, runs against a live deployment, and is classified INTERNAL (its numbers are environment-specific, not a portable platform claim).

Benchmark Methodology

Execution Environment

All benchmarks execute in a controlled, sequential environment:

• Single-threaded execution (@Execution(SAME_THREAD))
• Isolated keystores per test (temporary BKS keystores)
• Mock HSM key protector (pass-through for determinism)
• Fixed RNG seed (0xC0FFEE_BABEFACE)

Iteration Strategy

Each (algorithm, payload_size) combination undergoes:

1. Key Generation: Fresh key generated with standard test parameters (100K max usage, 365-day expiry)
2. Warm-up Phase: 5 iterations (default, configurable via sc.perf.warmup)
3. Measurement Phase: 10 iterations (default, configurable via sc.perf.measurements)
4. Cleanup: Key removal, GC hints between iterations

Metrics Collection

For each operation (encrypt/decrypt, sign/verify):

Aggregation: Median value across measurement iterations (robust against outliers)

Payload Sizes

All benchmarks test 8 standardized payload sizes:

Output Formats

All benchmarks produce:

1. Console Output: ASCII table with formatted results
2. CSV Export: Machine-readable data in /tmp/sc_bench_*/benchmark_*.csv

Test Execution

Running Benchmarks

Single test with default settings (5 warm-up, 10 measurement iterations):

cd ankasecure-core-api
mvn test -Dtest=SCPerformanceEnhancedEncryptionTest

Custom iteration counts:

mvn test -Dtest=SCPerformanceEnhancedSignatureTest \
  -Dsc.perf.warmup=10 \
  -Dsc.perf.measurements=20

All performance benchmarks:

mvn test -Dtest="SCPerformanceEnhanced*Test"

Requirements

• Java 25 (LTS)
• Maven 3.9+
• CPU time metrics enabled (test skips if unavailable)
• Sufficient heap (recommended: -Xmx4g for 5 MiB payloads)

Expected Runtime

Approximate execution times with default settings:

Compact Benchmarks (1 KiB - 5 MiB payloads):

Streaming Benchmarks (1 MiB - 100 MiB payloads; the signature suites start at 1 MiB, the rest at 5 MiB):

Total: ~7-10 hours for the twelve benchmarks listed in the two tables above. The two composite streaming suites and the two pending non-composite streaming suites are not included in that figure.

Performance Summary

Based on the latest benchmark runs, the ANKASecure platform demonstrates:

✅ Enterprise-Grade Performance

• Sub-millisecond operations for most algorithms at small payload sizes
• Linear scaling with payload size for streaming operations
• Predictable memory footprint (heap deltas proportional to key size)

✅ Post-Quantum Readiness

• ML-KEM (Kyber) encryption competitive with classical ECDH
• ML-DSA (Dilithium) signatures ~2-3× slower than EdDSA but acceptable for most use cases
• Composite keys overhead minimal (~10-20% vs single-algorithm operations)

✅ Algorithm Diversity

• 50+ encryption algorithms spanning symmetric, classical asymmetric, and PQC KEMs
• 40+ signature algorithms including MACs, classical signatures, and PQC schemes
• 30+ composite combinations with security level validation

📊 Key Findings

• Fastest encryption: ChaCha20-Poly1305, AES-GCM (hardware-accelerated)
• Fastest PQC KEM: ML-KEM-512 (~5-10ms for 1 KiB payloads)
• Fastest signatures: Ed25519, HMAC-SHA256 (<1ms for small payloads)
• Fastest PQC signature: ML-DSA-44 (~10-15ms for 1 KiB payloads)
• Memory efficiency: Most operations <10 MiB heap delta even for 5 MiB payloads

Related Documentation

• End-to-End API Latency^* - External round-trip latency suite + the crypto-vs-overhead attribution
• Scalability Architecture^* - High-level performance architecture

Changelog