MSVC - libsodium vs libaegis - AEGIS massive performance difference

[GPUex]

Windows 11, Visual Studio 2026 18.4.0, libsodium 1.0.21-stable, libaegis 0.9.1
Intel Core i7-8700K DDR4-3000-CL16
libsodium compiled as dynamic library, release. libaegis compiled as static library, release. Both using default compiler settings, only relevant difference is libsodium by default uses /Ob1 vs libaegis /Ob2
Benchmarking code over 1 MB data:

#include <iostream>
#include <vector>
#include <sodium.h>
#include <aegis/aegis.h>

#define ANKERL_NANOBENCH_IMPLEMENT
#include "nanobench.h"

int main()
{

	if (sodium_init() < 0)
	{
		std::cout << "sodium_init failed!\n";
		return 1;
	}

	aegis_init();

	constexpr size_t data_size = 1024 * 1024;
	constexpr size_t encrypted_data_size = data_size + 32;
	constexpr size_t adSize = 64;

	unsigned char key[32];
	unsigned char nonce[32];
	unsigned char ad[adSize];

	std::vector<unsigned char> data;
	data.resize(data_size);

	std::vector<unsigned char> ciphertext;
	ciphertext.resize(encrypted_data_size);

	randombytes_buf(data.data(), data.size());
	randombytes_buf(key, 32);
	randombytes_buf(nonce, 32);
	randombytes_buf(ad, adSize);

	unsigned char* keyPtr = key;
	unsigned char* noncePtr = nonce;
	unsigned char* adPtr = ad;
	unsigned char* dataPtr = data.data();
	unsigned char* ciphertextPtr = ciphertext.data();

	std::cout << "Data size: " << data_size / 1024 << " KB\n";

	constexpr auto benchMinEpochTime = std::chrono::milliseconds(500);

	ankerl::nanobench::Bench().minEpochTime(benchMinEpochTime).run("crypto_aead_aegis128l_encrypt", [keyPtr, noncePtr, dataPtr,adPtr, ciphertextPtr] {
		int result = crypto_aead_aegis128l_encrypt(
			ciphertextPtr,
			nullptr,
			dataPtr, data_size,
			adPtr, adSize,
			nullptr,
			noncePtr,
			keyPtr
		);
		ankerl::nanobench::doNotOptimizeAway(result);
	});

	ankerl::nanobench::Bench().minEpochTime(benchMinEpochTime).run("aegis128l_encrypt", [keyPtr, noncePtr, dataPtr, adPtr, ciphertextPtr] {
		int result = aegis128l_encrypt(
			ciphertextPtr,
			32,
			dataPtr, data_size,
			adPtr, adSize,
			noncePtr,
			keyPtr
		);
		ankerl::nanobench::doNotOptimizeAway(result);
	});

	ankerl::nanobench::Bench().minEpochTime(benchMinEpochTime).run("crypto_aead_aegis256_encrypt", [keyPtr, noncePtr, dataPtr, adPtr, ciphertextPtr] {
		int result = crypto_aead_aegis256_encrypt(
			ciphertextPtr,
			nullptr,
			dataPtr, data_size,
			adPtr, adSize,
			nullptr,
			noncePtr,
			keyPtr
		);
		ankerl::nanobench::doNotOptimizeAway(result);
	});

	ankerl::nanobench::Bench().minEpochTime(benchMinEpochTime).run("aegis256_encrypt", [keyPtr, noncePtr, dataPtr, adPtr, ciphertextPtr] {
		int result = aegis256_encrypt(
			ciphertextPtr,
			32,
			dataPtr, data_size,
			adPtr, adSize,
			noncePtr,
			keyPtr
		);
		ankerl::nanobench::doNotOptimizeAway(result);
	});

}

Gives these results:

Data size: 1024 KB

|               ns/op |                op/s |    err% |     total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
|          148,942.73 |            6,713.99 |    0.0% |      6.04 | `crypto_aead_aegis128l_encrypt`
|           78,233.05 |           12,782.32 |    0.1% |      6.05 | `aegis128l_encrypt`
|          232,074.19 |            4,308.97 |    0.0% |      6.05 | `crypto_aead_aegis256_encrypt`
|          108,996.52 |            9,174.60 |    0.0% |      6.05 | `aegis256_encrypt`

As you can see, libsodium is about 2x slower.
But then I recompiled llibsodium with /Ob2, then I get these results:

Data size: 1024 KB

|               ns/op |                op/s |    err% |     total | benchmark
|--------------------:|--------------------:|--------:|----------:|:----------
|           78,234.76 |           12,782.04 |    0.0% |      6.05 | `crypto_aead_aegis128l_encrypt`
|           78,244.18 |           12,780.50 |    0.0% |      6.05 | `aegis128l_encrypt`
|          109,193.61 |            9,158.05 |    0.0% |      6.05 | `crypto_aead_aegis256_encrypt`
|          108,963.13 |            9,177.42 |    0.0% |      6.05 | `aegis256_encrypt`

Identical performance.

[jedisct1]

I'm not too familiar with MSVC, but apparently, /Ob1 (default for Release), only functions explicitly marked inline/__forceinline get inlined. /Ob2 lets the compiler inline anything it wants.

Functions like aegis128l_enc and aegis128l_dec should really be inlined. We can do it manually, but I guess enabling /Ob2 globally would be a good thing.

[jedisct1]

Can you check the current master branch? If that works well, the changes will be applied to the stable branch.

[GPUex]

It did the trick. Even with /Ob1 performance is on par with libaegis (marking with inline did the trick). With global /Ob2 it maybe looks like a little bit more performance, but it might down to run to run variance. What was rationale for /Ob1?

[jedisct1]

The rationale is that I kept the settings from the original PR that added a MSVC solution to compile libsodium :)