[jdk11u-dev] RFR: 8268427: Improve AlgorithmConstraints:checkAlgorithm performance
Evgeny Astigeevich
github.com+42899633+eastig at openjdk.java.net
Wed Aug 4 15:15:44 UTC 2021
A backport of JDK-8233228 to 11u increased the list of disabled algorithms. For TLS the size of the list increased from 9 to 56. `sun.security.util.AbstractAlgorithmConstraints.checkAlgorithm()` uses linear search to check if an algorithm has been disabled. Its execution time significantly increased in the most common case: a checked algorithm is not disabled.
This backport improves `AbstractAlgorithmConstraints.checkAlgorithm()` performance.
Tier1 and tier2 tests pass with the patch.
The patch contains a microbenchmark.
Baseline results before patch:
Benchmark (algorithm) Mode Cnt Score Error Units
AlgorithmConstraintsPermits.permits SSLv3 avgt 25 17.296 ± 0.282 ns/op
AlgorithmConstraintsPermits.permits DES avgt 25 288.010 ± 2.502 ns/op
AlgorithmConstraintsPermits.permits NULL avgt 25 459.496 ± 6.160 ns/op
AlgorithmConstraintsPermits.permits TLS1.3 avgt 25 1361.700 ± 12.871 ns/op
Benchmark results after patch:
Benchmark (algorithm) Mode Cnt Score Error Units
AlgorithmConstraintsPermits.permits SSLv3 avgt 25 119.320 ± 2.572 ns/op
AlgorithmConstraintsPermits.permits DES avgt 25 82.259 ± 0.668 ns/op
AlgorithmConstraintsPermits.permits NULL avgt 25 57.302 ± 3.611 ns/op
AlgorithmConstraintsPermits.permits TLS1.3 avgt 25 465.914 ± 2.553 ns/op
Before the patch the list of the disabled algorithms has `SSLv3` first, `DES` second, `NULL` 9th and `TLS1.3` not on the list. As `SSLv3` is the first, accesses to it are the fastest. As we get far from the head, the access time increases. `NULL` had been the last before JDK-8233228. In a case of TLS1.3 the whole list has to be checked.
The patch replaces the list with an ordered set. Despite the increased time for `SSLv3` all other times, especially for permitted algorithms such as `TLS1.3`, significantly decreased.
-------------
Commit messages:
- Backport 3b83bc1bc331d268987f56ea4f23124a7f6ee38b
Changes: https://git.openjdk.java.net/jdk11u-dev/pull/193/files
Webrev: https://webrevs.openjdk.java.net/?repo=jdk11u-dev&pr=193&range=00
Issue: https://bugs.openjdk.java.net/browse/JDK-8268427
Stats: 112 lines in 4 files changed: 72 ins; 17 del; 23 mod
Patch: https://git.openjdk.java.net/jdk11u-dev/pull/193.diff
Fetch: git fetch https://git.openjdk.java.net/jdk11u-dev pull/193/head:pull/193
PR: https://git.openjdk.java.net/jdk11u-dev/pull/193
More information about the jdk-updates-dev
mailing list