TKSS-1051: Backport JDK-8344144: AES/CBC slow at big payloads

Tencent · Jan 15, 2025 · 24f166b · 24f166b
1 parent 914abab
commit 24f166b
Showing 1 changed file with 29 additions and 3 deletions.
diff --git a/kona-crypto/src/main/java/com/tencent/kona/crypto/provider/CipherBlockChaining.java b/kona-crypto/src/main/java/com/tencent/kona/crypto/provider/CipherBlockChaining.java
@@ -58,10 +58,15 @@ class CipherBlockChaining extends FeedbackCipher  {
     // variables for save/restore calls
     private byte[] rSave = null;
 
+    // chunkSize is a multiple of block size and used to divide up
+    // input data to trigger the intrinsic.
+    private final int chunkSize;
+
     CipherBlockChaining(SymmetricCipher embeddedCipher) {
         super(embeddedCipher);
         k = new byte[blockSize];
         r = new byte[blockSize];
+        chunkSize = blockSize * 6400;
     }
 
     /**
@@ -147,8 +152,18 @@ int encrypt(byte[] plain, int plainOffset, int plainLen,
         ArrayUtil.blockSizeCheck(plainLen, blockSize);
         ArrayUtil.nullAndBoundsCheck(plain, plainOffset, plainLen);
         ArrayUtil.nullAndBoundsCheck(cipher, cipherOffset, plainLen);
-        return implEncrypt(plain, plainOffset, plainLen,
-                           cipher, cipherOffset);
+        int processed = 0;
+        for (;  plainLen > chunkSize; cipherOffset += chunkSize,
+                plainOffset += chunkSize, plainLen -= chunkSize) {
+            processed +=
+                    implEncrypt(plain, plainOffset, chunkSize, cipher, cipherOffset);
+        }
+        // note: above loop always leaves some data to process (more than zero,
+        // less than or equal to chunkSize) so this last call can be
+        // unconditional
+        processed +=
+                implEncrypt(plain, plainOffset, plainLen, cipher, cipherOffset);
+        return processed;
     }
 
     private int implEncrypt(byte[] plain, int plainOffset, int plainLen,
@@ -197,7 +212,18 @@ int decrypt(byte[] cipher, int cipherOffset, int cipherLen,
         ArrayUtil.blockSizeCheck(cipherLen, blockSize);
         ArrayUtil.nullAndBoundsCheck(cipher, cipherOffset, cipherLen);
         ArrayUtil.nullAndBoundsCheck(plain, plainOffset, cipherLen);
-        return implDecrypt(cipher, cipherOffset, cipherLen, plain, plainOffset);
+        int processed = 0;
+        for (;  cipherLen > chunkSize; cipherOffset += chunkSize,
+                plainOffset += chunkSize, cipherLen -= chunkSize) {
+            processed +=
+                    implDecrypt(cipher, cipherOffset, chunkSize, plain, plainOffset);
+        }
+        // note: above loop always leaves some data to process (more than zero,
+        // less than or equal to chunkSize) so this last call can be
+        // unconditional
+        processed +=
+                implDecrypt(cipher, cipherOffset, cipherLen, plain, plainOffset);
+        return processed;
     }
 
     private int implDecrypt(byte[] cipher, int cipherOffset, int cipherLen,