Table of Contents generated with DocToc

• Overview
• Benchmark Categories
• Running Benchmarks
• Cargo Features
• Pipeline Benchmark Binaries
  • mtcbench — Merkle Tree Certificate pipeline
  • x509bench — X.509 PKI pipeline
• Test Vector Dependencies
• Performance Results (2026-03-12, X.509 Certificate Parsing)
  • Parse-only (no field access)
  • Parse + all fields
  • Field-level string formatting (parse + format issuer DN, subject DN, OID, validity)
  • Language binding overhead (parse-only, traditional certs)
  • Post-quantum ML-DSA parse-only (avg of 3 cert sizes)
  • CA Root Store — NSS comparison (2026-03-04)
• See Also
• License

Benchmark suite for the synta ASN.1 library.

This crate contains Criterion-based benchmarks measuring the performance of synta's encoding, decoding, and X.509 certificate parsing. It also includes comparison benchmarks against other Rust and C ASN.1 libraries, and language-binding overhead measurements.

This crate is not published to crates.io (publish = false).

All commands should be run from the workspace root using -p synta-bench.

# Run all benchmarks that do not require external libraries
cargo bench -p synta-bench

# Run a specific benchmark group
cargo bench -p synta-bench --bench encoding
cargo bench -p synta-bench --bench derive_performance
cargo bench -p synta-bench --bench certificates

# Filter by name within a group
cargo bench -p synta-bench --bench certificates certificate_parsing
cargo bench -p synta-bench --bench certificates ml_dsa
cargo bench -p synta-bench --bench certificates ml_kem

# Library comparison (requires bench-compare feature)
cargo bench -p synta-bench --bench comparison --features bench-compare

# Element (lazy/eager) vs typed Certificate parsing (no extra feature needed)
cargo bench -p synta-bench --bench comparison_typed

# Language binding overhead (requires bench-bindings feature)
cargo bench -p synta-bench --bench bindings --features bench-bindings

# CA root store benchmarks (synta only; downloads data on first run, cached thereafter)
cargo bench -p synta-bench --bench mozilla_ca_certs
cargo bench -p synta-bench --bench ccadb_certs

# CA root store with NSS comparison (requires system libnss3)
cargo bench -p synta-bench --bench mozilla_ca_certs --features bench-nss
cargo bench -p synta-bench --bench ccadb_certs --features bench-nss

# Run comparison benchmarks and display a summary table
./contrib/ci/local-ci.sh --show-results bench-compare

# Run binding benchmarks and display a summary table
./contrib/ci/local-ci.sh --show-results bench-bindings

In addition to the Criterion library benchmarks, this crate ships two standalone binary tools that drive end-to-end certificate issuance pipelines, write every timed operation to a SQLite database, and support a fuzzing mode that verifies cryptographic invariants on random inputs.

mtcbench exercises the complete MTC issuance pipeline: CA key generation, TBS certificate issuance, log-entry conversion, Merkle tree construction, inclusion proof generation, checkpoint creation, and standalone certificate assembly. Eighteen operations are timed per (batch_size, algorithm) combination and stored to a SQLite database.

Build and run:

cargo build --release -p synta-bench --features bench-mtc-sqlite --bin mtcbench
./target/release/mtcbench bench --sizes 1,4,16,64 --algos sha256,sha384
./target/release/mtcbench fuzz --iterations 500 --seed 42
./target/release/mtcbench stats
./target/release/mtcbench export --output results.csv

Subcommands: bench, fuzz, ca generate, ca show, stats, export.

Key flags (bench):

Timed operations: cert_gen, entry_convert, leaf_hash, db_insert_entries, tree_build, proof_gen_all, proof_gen_one, checkpoint_create, db_insert_checkpoint, proof_encode, db_insert_proofs, standalone_build, standalone_encode, db_insert_standalone, proof_verify_one, proof_verify_all, db_read_entries, db_read_standalone.

Note: The bench-mtc-sqlite feature enables synta-mtc with the large-trees flag, raising internal tree-size limits for benchmark use. The database is opened in WAL mode (synchronous = NORMAL) for realistic non-durable write throughput measurements.

x509bench exercises the traditional X.509 issuance pipeline: CA self-signing, subscriber certificate issuance, CRL construction and signing, and OCSP response production. Up to 15 operations are timed per batch and stored to a SQLite database.

Build and run:

cargo build --release -p synta-bench --features bench-x509-sqlite --bin x509bench
./target/release/x509bench bench --sizes 1,4,16,64
./target/release/x509bench bench --sizes 64 --skip-crl --skip-ocsp
./target/release/x509bench fuzz --iterations 200 --seed 42
./target/release/x509bench stats
./target/release/x509bench export --output results.csv

Subcommands: bench, fuzz, ca generate, ca show, stats, export.

Key flags (bench):

Timed operations: ca_self_sign, cert_gen, db_insert_certs, cert_verify, db_read_certs, crl_build, crl_sign, db_insert_crl, crl_verify, db_read_crl, ocsp_build, ocsp_sign, db_insert_ocsp, ocsp_verify, db_read_ocsp.

Note: A fresh ephemeral CA is generated for each batch size so that serial numbers always start at 1. The database is opened in WAL mode (synchronous = NORMAL) for realistic non-durable write throughput measurements.

Certificate benchmarks use the same test vectors as the integration test suite, stored under tests/vectors/. Vectors are downloaded automatically on first run via sparse git clone, or can be pre-fetched:

bash tests/vectors/fetch.sh

Subsequent runs reuse cached vectors for consistent measurements.

synta (Rust typed):     ~0.48 µs   1st  3.1× faster than cryptography-x509
cryptography-x509:      ~1.51 µs   2nd
x509-parser (nom):      ~2.13 µs   3rd
x509-cert (RustCrypto): ~3.33 µs   4th

synta:                  ~1.38 µs   1st
cryptography-x509:      ~1.51 µs   2nd
x509-parser (nom):      ~2.11 µs   3rd
x509-cert (RustCrypto): ~3.36 µs   4th

Traditional certs (914–968 bytes):

synta:                  ~1.55 µs   1st
x509-parser (nom):      ~3.95 µs   2nd  (~2.5× slower)
NSS:                    ~8.45 µs   3rd  (~5.5× slower)
x509-cert (RustCrypto): ~11.35 µs  4th  (~7.3× slower)
rust-openssl:           ~18.20 µs  5th  (~11.7× slower)

ML-DSA certs (3,992–7,479 bytes):

synta:                  ~1.30 µs   1st  (faster than on traditional — field formatting
x509-parser (nom):      ~3.32 µs   2nd   is size-independent; others parse full cert first)
NSS:                    ~7.72 µs   3rd
x509-cert (RustCrypto): ~8.19 µs   4th
rust-openssl:           ~17.29 µs  5th

rust_typed (zero-copy):          ~0.49 µs
c_ffi (14 allocations):          ~1.99 µs
rust_element (lazy O(1) decode): ~2.02 µs

synta:                  ~0.48 µs   1st  (size-independent: 7 KB ≈ 900 B)
cryptography-x509:      ~1.33 µs   2nd
x509-parser (nom):      ~1.79 µs   3rd
x509-cert (RustCrypto): ~2.97 µs   4th

Mozilla root store (180 certs):
  synta:          ~92 µs total   2.0 M/sec    ~528 ns/cert
  NSS (nss-sys):  ~1.73 ms total  104 K/sec  ~9.6 µs/cert   (19× slower)

CCADB all certs (9,898 certs):
  synta:          ~5.30 ms total  1.9 M/sec    ~522 ns/cert
  NSS (nss-sys):  ~111 ms total   90 K/sec   ~11.2 µs/cert  (21× slower)

NSS CERT_NewTempCertificate eagerly formats DN strings during decode; synta stores issuer/subject as RawDer<'a> (zero-copy borrowed bytes) and defers DN formatting to the caller. The higher per-cert NSS cost on CCADB reflects more complex DN structures in intermediate CA certificates.

See docs/performance.md for detailed per-certificate data, optimization history, and methodology.

• benches/README.md — Detailed benchmark infrastructure documentation
• docs/COMPARISON_BENCHMARK.md — Library comparison methodology
• tests/README.md — Integration test suite
• docs/performance.md — Full performance analysis

Licensed under either of:

• Apache License, Version 2.0 (LICENSE-APACHE)
• MIT license (LICENSE-MIT)

at your option.