Accelerating QUIC Encryption in WebAssembly Using WASM-SIMD

Abstract

WebAssembly (Wasm) runs untrusted code in a portable, lightweight sandbox and is increasingly used to host services on shared servers and edge platforms. Running the QUIC transport protocol inside Wasm would let each application choose and update its own transport without changing the host. QUIC, however, encrypts every packet, and Wasm offers neither dedicated AES instructions nor carry-less multiplication; a Wasm QUIC stack has been reported to reach only 17.6% of native goodput, with cryptography as its largest cost. Whether the 128-bit SIMD extension of Wasm (WASM-SIMD) can recover this cost, and what limits a pure-Wasm stack once it does, has remained unclear. Here we show that explicit WASM-SIMD kernels recover much of the cryptographic cost, after which non-cryptographic costs become the limit. On two hosts connected by 10-Gigabit Ethernet, kernels that process eight AES blocks or four ChaCha20 blocks per pass raise receiver goodput over a non-SIMD baseline by 61.34% for AES-128-GCM and 31.55% for ChaCha20-Poly1305, whereas compiler auto-vectorization gains only 1.28% for AES-128-GCM. ChaCha20-Poly1305 still delivers 1.99 times the goodput of AES-128-GCM, confirming end to end the preference that stand-alone cipher benchmarks suggest. Receiver-side profiling combined with Amdahl's law predicts that even native-speed cryptography would leave Wasm at roughly one third of the goodput of the fastest native stack. Cryptographic acceleration is therefore necessary but not sufficient: memory allocation, runtime overhead and per-datagram UDP I/O now bound pure-Wasm transports. We anticipate that this per-category cost breakdown will guide further optimization of Wasm network stacks and the design of system interfaces for batched I/O.