Slow AES GCM encryption and decryption with Java 8u20

by

Micro-benchmarking aside, the performance of the GCM implementation in JDK 8 (at least up to 1.8.0_25) is crippled.

I can consistently reproduce the 3MB/s (on a Haswell i7 laptop) with a more mature micro-benchmark.

From a code dive, this appears to be due to a naive multiplier implementation and no hardware acceleration for the GCM calculations.

By comparison AES (in ECB or CBC mode) in JDK 8 uses an AES-NI accelerated intrinsic and is (for Java at least) very quick (in the order of 1GB/s on the same hardware), but the overall AES/GCM performance is completely dominated by the broken GCM performance.

There are plans to implement hardware acceleration, and there have been third party submissions to improve the performance with, but these haven’t made it to a release yet.

Something else to be aware of is that the JDK GCM implementation also buffers the entire plaintext on decryption until the authentication tag at the end of the ciphertext is verified, which cripples it for use with large messages.

Bouncy Castle has (at the time of writing) faster GCM implementations (and OCB if you’re writing open source software of not encumbered by software patent laws).

Updated July 2015 – 1.8.0_45 and JDK 9

JDK 8+ will get an improved (and constant time) Java implementation (contributed by Florian Weimer of RedHat) – this has landed in JDK 9 EA builds, but apparently not yet in 1.8.0_45.
JDK9 (since EA b72 at least) also has GCM intrinsics – AES/GCM speed on b72 is 18MB/s without intrinsics enabled and 25MB/s with intrinsics enabled, both of which are disappointing – for comparison the fastest (not constant time) BC implementation is ~60MB/s and the slowest (constant time, not fully optimised) is ~26MB/s.

Updated Jan 2016 – 1.8.0_72:

Some performance fixes landed in JDK 1.8.0_60 and performance on the same benchmark now is 18MB/s – a 6x improvement from the original, but still much slower than the BC implementations.

More Related Contents:

  1. Is SHA-1 secure for password storage?
  2. Why is XOR the default way to combine hashes?
  3. PKCS#1 and PKCS#8 format for RSA private key [closed]
  4. RSA Encryption Problem [Size of payload data]
  5. Is it possible to get identical SHA1 hash? [duplicate]
  6. How do one-way hash functions work? (Edited)
  7. Digital signature for a file using openssl
  8. Is it possible to encrypt data with AES (256 bit) GCM mode in .net framework 4.7?
  9. How are the IV and authentication tag handled for “AES/GCM/NoPadding”?
  10. Run Java 8 code on JDK 11 – what might break? [closed]
  11. Difference between final and effectively final
  12. Reflection type inference on Java 8 Lambdas
  13. how to get private key from PEM file?
  14. Why does Iterable not provide stream() and parallelStream() methods?
  15. Java Streams: How to do an efficient “distinct and sort”?
  16. Why do I need to use the Rfc2898DeriveBytes class (in .NET) instead of directly using the password as a key or IV?
  17. Java 8 grouping using custom collector?
  18. Why am I getting a parse exception when I try to parse the current LocalDateTime [duplicate]
  19. What is the reason why “synchronized” is not allowed in Java 8 interface methods?
  20. How to apply Filtering on groupBy in java streams
  21. How to serialize and deserialize Java 8’s java.time types with Gson? [closed]
  22. Android N Java8 java.time
  23. How to speed up matrix multiplication in C++?
  24. How to implement Triple DES in C# (complete example)
  25. Group sequences of values
  26. Should these arguments be added or removed?
  27. Why StringJoiner when we already have StringBuilder?
  28. Java 8 stream map to list of keys sorted by values
  29. How to convert Integer[] to int[] array in Java?
  30. Is A==0 really better than ~A?

Leave a Comment