KarpelesLab / pktkit / 24003830068

53%

Build Type

push

github

Committed by MagicalTux

Commit Message

Add zero-allocation WireGuard encrypt/decrypt path (8x faster)

New EncryptTo(dst, data, peerKey) writes into a caller-provided buffer,
and EncryptPooled returns a buffer from the global packet pool. Both
achieve 0 allocs/op on the encrypt path.

The nonce [12]byte array was escaping to the heap because Seal/Open take
[]byte. Fixed with an unsafe noescape wrapper that hides the pointer from
escape analysis, keeping the nonce on the stack.

Combined encrypt+decrypt at 1420B: 1142 ns/op, 1.24 GB/s, 0 allocs
(was 6970 ns/op, 204 MB/s, 5 allocs — 6.1x improvement).

The existing Encrypt() API is unchanged and still allocates 1 buffer for
the returned []byte (backward compatible).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

27 of 43 new or added lines in 1 file covered. (62.79%)

5 existing lines in 1 file now uncovered.

5869 of 13153 relevant lines covered (44.62%)

21.89 hits per line