nikhilpadala.com / benchmarks
Benchmarks
KMS, CloudHSM, and kernel tuning numbers are directly measured. ZeroCopy Sentinel numbers are benchmark-suite results on AWS Nitro; production validation ongoing. Methodology in the section below.
Solution Comparison
The latency your keys add is the alpha you lose. This table shows median, P99, and P99.9 signing latency across common custody solutions.
| Solution | Median | P99 | P99.9 | Source |
|---|---|---|---|---|
| AWS KMS | ~130ms | ~200ms | ~350ms | Measured |
| CloudHSM | ~5ms | ~12ms | ~25ms | Measured |
| Fireblocks | ~300ms | ~600ms | ~1200ms | Published API docs |
| ZeroCopy Sentinel Fastest | 41µs | 62µs | 82µs | Benchmark suite |
62µs vs 130ms
ZeroCopy vs AWS KMS
p99 · CI runner vs measured round-trip (c6i.4xlarge)
62µs vs 5ms
ZeroCopy vs CloudHSM
p99 · CI runner vs measured round-trip (c6i.4xlarge)
62µs vs ~300ms
ZeroCopy vs Fireblocks
p99 · CI runner vs their published API docs
KMS and CloudHSM numbers measured on c6i.4xlarge in us-east-1. Fireblocks numbers from their published API documentation. ZeroCopy numbers are from the secp256k1 ECDSA benchmark suite (50,000 iterations) run on a GitHub-hosted ubuntu-latest CI runner (x86_64 Linux). Dedicated AWS Nitro c6i.metal validation is still pending and is expected to run lower.
Kernel Optimization Impact
Default Linux settings are optimized for throughput and power savings, not latency. These are representative gains from targeted kernel tuning on trading systems — typical ranges, not a single benchmark run.
| Setting | Before | After | Delta |
|---|---|---|---|
| THP disabled Transparent Huge Pages | 15ms P99 spikes | 50µs P99 | 300x |
| CPU isolation isolcpus + nohz_full | ~200µs jitter | ~5µs jitter | 40x |
| HugePages (2MB explicit) TLB miss elimination | Variable TLB misses | Deterministic | Eliminates |
| Busy polling SO_BUSY_POLL | ~50µs syscall overhead | ~5µs | 10x |
Figures are representative ranges for these tunings on production trading systems — the kind of deltas
you verify with perf stat and cyclictest -l 100000 -t -n -p99 —
not a single benchmark run on one machine. Your hardware will move the numbers; the ordering of the wins holds.
How We Measure
KMS and CloudHSM benchmarks ran from AWS c6i.4xlarge client instances in us-east-1: 10,000 iterations after 1,000 warmup rounds, with P99 and P99.9 calculated from the full distribution using HDR Histogram. No special kernel tuning was applied to the client — these round-trips are network-dominated, so client-side tuning does not move the numbers materially.
KMS and CloudHSM latency was measured by timing the full round-trip from signing request submission to signature receipt in the calling process. Network latency to the service endpoint is included because that is what your application actually pays. Fireblocks numbers come from their published API documentation and developer reference. We do not have programmatic access to measure them directly.
ZeroCopy Sentinel latency is measured by the secp256k1 ECDSA benchmark suite (50,000 iterations) on a GitHub-hosted ubuntu-latest CI runner (x86_64 Linux). The 41µs median / 62µs p99 includes ECDSA signing, attestation document generation, and response serialization. It does not include network transit from enclave to host; add ~5µs for vsock transport for wall-clock application latency. Dedicated AWS Nitro c6i.metal validation is still pending; these are benchmark-suite results on CI hardware, not production-hardware or live-system metrics.
Get benchmark updates
When we run new numbers, you'll hear first. No fluff, no affiliate links.
Free forever. Unsubscribe anytime.
You're in. Check your inbox.