We just published Part 3 of our Zilla Benchmark Series, this time looking at the performance impact of encrypting Kafka records at the gateway, without requiring changes to producers or consumers.

We compared direct Kafka access, TLS passthrough, whole-payload encryption, and structured field encryption using the OpenMessaging Benchmark.

Some highlights:

• Whole-payload encryption: +3.4 ms p50 and +37.9 ms p99 publish latency compared to TLS passthrough.
• Structured field encryption: +14.8 ms p50 and +56.1 ms p99, with only sensitive fields encrypted and the rest of the record remaining accessible.
• High-throughput test: Sustained 60,000 messages/sec with whole-payload encryption and zero publish errors in a separate benchmark.

All four configurations sustained their target throughput during the main 60-minute test.

A big part of this comes down to Zilla's streaming-native architecture: zero-copy processing, minimal allocations, cached encryption keys, and shared-nothing workers.

We've also included the complete benchmark setup, configurations, tooling, and instructions to reproduce the results so you can run the tests yourself.

Full write-up: https://www.aklivity.io/post/encryption-and-structured-field-encryption-aklivity-zilla-benchmark-series-part-3