docs(v2): port comparisons (FHE/KMS/HSM/Vault) into /concepts/compare#43
Open
coderdan wants to merge 4 commits into
Open
docs(v2): port comparisons (FHE/KMS/HSM/Vault) into /concepts/compare#43coderdan wants to merge 4 commits into
coderdan wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Jul 5, 2026
coderdan
changed the title
coderdan
force-pushed
the
docs/v2-comparisons
branch
from
1c38305 to
eea1c10
Compare
coderdan
changed the title
Ports the comparison content from PR #31 (AWS KMS merge + ZeroKMS vs HSM) and PR #34 (HashiCorp Vault) out of the legacy content/stack tree and into the new IA `/compare` section: - content/docs/compare/aws-kms.mdx (from #31) - content/docs/compare/zerokms-vs-hsm.mdx (from #31; retains its WIP TODOs) - content/docs/compare/hashicorp-vault.mdx (from #34) - public/images/hsm.png (from #31) Each page gains v2 facets (type: concept, components, audience, reviewBy — the claims-page review date rather than verifiedAgainst). Intra-comparison links are rewritten to `/compare/*`; all other cross-links keep pointing at the still-served legacy `/stack/...` pages (which hold the real content until their sections migrate). The dead `/stack/cipherstash/secrets` link on the Vault page (no secrets page exists in this repo) is delinked. The comparisons overview and nav (index.mdx, meta.json) list the three ported pages. The FHE comparison stays in the legacy tree for now — it is written against EQL v2 (eql_v2_encrypted, BLAKE3) and needs a v3 content refresh before porting, tracked separately in IA.md (/compare/fhe port). Supersedes #31 and #34 for the v2 branch. Claude-Session: https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA
Completes the /compare section: content/docs/compare/fhe.mdx, updated from EQL v2 to EQL v3 and wired into the overview cards and nav. - Types/operators: eql_v2_encrypted -> the eql_v3 domain-variant model (text_eq / int8_ord / text_match / text_search), typed-operand casts, and encrypted text match via bloom-filter `@>` (LIKE is blocked on ciphertext, now stated explicitly). - Scheme portfolio + leakage rewritten around the v3 terms (hm / ob / bf) and the new order-preserving encryption (OPE) fast path; dropped the unverified BLAKE3 primitive claim. - New "Real-world performance on EQL v3" section with v3 database-level numbers (0.12 ms exact equality ~1.3x plaintext; OPE range 0.12 ms ~1.2x plaintext; ORE range 4x faster than v2; bloom match 100-400x vs no index -- 1M rows, M1 Max, PG 17), from cipherstash/benches PR #23. Kept the primitive-level TFHE-vs-ORE table (tfhe-ore-bench). A public citation for the v3 DB figures is flagged with a TODO pending publication. - Links repointed to the v3 EQL reference (/reference/eql, core-concepts); cross-links to un-ported pages keep pointing at the served legacy /stack tree. Based on the v3 EQL reference; source of truth for terminology and terms is content/docs/reference/eql/core-concepts. Claude-Session: https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA
The revised IA folds Comparisons into Concepts (no top-level /compare tab). The rebase already moved these pages into content/docs/concepts/compare/; this adjusts their in-file content to match: - repoint /compare/* cross-links and index Cards to /concepts/compare/* - components facet [zerokms] -> [platform] (zerokms collapsed into platform in the components enum) fhe.mdx keeps [encryption, eql]. The zerokms-vs-hsm page is retained.
coderdan
force-pushed
the
docs/v2-comparisons
branch
from
eea1c10 to
6db2352
Compare
…sed API The ported snippet used new LockContext().identify(userJwt), deprecated in protect-ffi 0.25, and passed the resulting Result straight to withLockContext() instead of unwrapping .data. main fixed this in #57; this carries the fix across so merging the port doesn't reintroduce it.
Contributor
Author
|
Pushed The const lockContext = await new LockContext().identify(userJwt); // deprecated
await client.encrypt(...).withLockContext(lockContext); // Result, not LockContext
Merging as-is would have reintroduced into the v2 tree exactly what #57 removed from
Heads up that this branch is 33 commits behind |
This was referenced Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the comparison pages into the
/concepts/comparesection (content/docs/concepts/compare/), rebased ontov2. Covers the content from #31 (AWS KMS merge + ZeroKMS vs HSM), #34 (HashiCorp Vault), and the existing FHE comparison.Pages
concepts/compare/fhe.mdx— rewritten for EQL v3 (see below)concepts/compare/aws-kms.mdx— from docs: add ZeroKMS vs HSM comparison + merge Cloud KMS into AWS KMS #31 (architecture + trust model, data-key caching, cost, developer-experience comparison)concepts/compare/zerokms-vs-hsm.mdx— from docs: add ZeroKMS vs HSM comparison + merge Cloud KMS into AWS KMS #31 (retains its WIPTODOs)concepts/compare/hashicorp-vault.mdx— from docs: add CipherStash vs HashiCorp Vault comparison #34 (the trilemma, direct vs envelope modes)public/images/hsm.png— from docs: add ZeroKMS vs HSM comparison + merge Cloud KMS into AWS KMS #31concepts/compare/index.mdx+meta.json— overview cards and nav (all four pages)FHE page: EQL v2 → v3
The FHE comparison was written against EQL v2; it's been rewritten against the v3 EQL reference (
content/docs/reference/eql/core-conceptsas the source of truth):eql_v2_encrypted→ theeql_v3domain-variant model (text_eq/int8_ord/text_match/text_search), typed-operand casts, and bloom-filter@>for encrypted text match (LIKEis blocked on ciphertext — now stated).hm/ob/bf) and the new order-preserving encryption (OPE) fast path; dropped the unverified BLAKE3 claim.Adaptation to v2 + IA
type: concept,components,audience,reviewBy(comparisons are claims pages). Thecomponentsfacet usesplatform(thezerokmsvalue was collapsed intoplatformin the revised IA's components enum)./concepts/compare/*and the FHE page to/reference/eql; all other cross-links keep pointing at the still-served legacy/stack/...pages.Verify before merge
TODOfor a public citation once cipherstash/benches PR SEO: fix OG tags, canonicals, titles & meta descriptions (Ahrefs May 2026 audit) #23 / the v3 benchmarks are published (mirrors the aws-kms benchmark TODO convention).TODOs carried over from the originals (AWS KMS ~16×/~85×; Vault in-region numbers; HSM section stubs).Supersedes #31 and #34 for the v2 branch.
https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA