You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2024/08/06 14:32:51 UTC
(pulsar) 05/08: [improve][misc] Improve AES-GCM cipher performance (#23122)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.3
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 9966ddc0ea3c6cb2e0aeab803e79fded3e914c5f
Author: Okada Haruki <oc...@gmail.com>
AuthorDate: Mon Aug 5 17:41:54 2024 +0900
[improve][misc] Improve AES-GCM cipher performance (#23122)
(cherry picked from commit e9deb408eaed2c04e30a27be5fba130f5d4e94b7)
---
.../apache/pulsar/client/impl/crypto/MessageCryptoBc.java | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java b/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java
index f31fb1aa8b0..aa97421a42f 100644
--- a/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java
+++ b/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java
@@ -92,6 +92,7 @@ public class MessageCryptoBc implements MessageCrypto<MessageMetadata, MessageMe
// from assuming hardcoded value. However, it will increase the size of the message even further.
public static final String RSA_TRANS = "RSA/NONE/OAEPWithSHA1AndMGF1Padding";
public static final String AESGCM = "AES/GCM/NoPadding";
+ private static final String AESGCM_PROVIDER_NAME;
private static KeyGenerator keyGenerator;
private static final int tagLen = 16 * 8;
@@ -123,6 +124,15 @@ public class MessageCryptoBc implements MessageCrypto<MessageMetadata, MessageMe
// Initial seed
secureRandom.nextBytes(new byte[IV_LEN]);
+ // Prefer SunJCE provider for AES-GCM for performance reason.
+ // For cases where SunJCE is not available (e.g. non-hotspot JVM), use BouncyCastle as fallback.
+ String sunJceProviderName = "SunJCE";
+ if (Security.getProvider(sunJceProviderName) != null) {
+ AESGCM_PROVIDER_NAME = sunJceProviderName;
+ } else {
+ AESGCM_PROVIDER_NAME = BouncyCastleProvider.PROVIDER_NAME;
+ }
+
// Add provider only if it's not in the JVM
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
Security.addProvider(new BouncyCastleProvider());
@@ -145,7 +155,7 @@ public class MessageCryptoBc implements MessageCrypto<MessageMetadata, MessageMe
try {
- cipher = Cipher.getInstance(AESGCM, BouncyCastleProvider.PROVIDER_NAME);
+ cipher = Cipher.getInstance(AESGCM, AESGCM_PROVIDER_NAME);
// If keygen is not needed(e.g: consumer), data key will be decrypted from the message
if (!keyGenNeeded) {
// codeql[java/weak-cryptographic-algorithm] - md5 is sufficient for this use case