Re-write Android PBKDF2 one shot in Java #103016
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
|
/azp list |
This comment was marked as off-topic.
This comment was marked as off-topic.
|
/azp run runtime-androidemulator |
|
Azure Pipelines successfully started running 1 pipeline(s). |
bartonjs
reviewed
Jun 4, 2024
...ative/libs/System.Security.Cryptography.Native.Android/net/dot/android/crypto/PalPbkdf2.java
Outdated
Show resolved
Hide resolved
jkoritzinsky
reviewed
Jun 4, 2024
...ative/libs/System.Security.Cryptography.Native.Android/net/dot/android/crypto/PalPbkdf2.java
Outdated
Show resolved
Hide resolved
bartonjs
reviewed
Jun 4, 2024
...ative/libs/System.Security.Cryptography.Native.Android/net/dot/android/crypto/PalPbkdf2.java
Outdated
Show resolved
Hide resolved
|
/azp run runtime-androidemulator |
|
Azure Pipelines successfully started running 1 pipeline(s). |
bartonjs
approved these changes
Jun 4, 2024
This was referenced Jun 5, 2024
|
/cc @simonrozsival |
|
If anyone with an Android focus wants to speak up before merge (including "please wait until [a specific deadline]"), please do so before noonishly tomorrow (Redmond time). So, consider this a 20 hour impending merge notice 😄 |
simonrozsival
approved these changes
Jun 7, 2024
jonathanpeppers
pushed a commit
to dotnet/android
that referenced
this pull request
Jun 19, 2024
Context: dotnet/runtime#103016 Context: dotnet/runtime#103337 In dotnet/runtime we are adding a few more Java classes to assist with .NET crypto. One was added in dotnet/runtime#103016, and another may be added in dotnet/runtime#103337. This PR changes ProGuard to keep all of the classes in this package rather than individually adding them. Co-authored-by: Alexander Köplinger <[email protected]>
bartonjs
added
the
cryptographic-docs-impact
bartonjs
added
the
tracking
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This re-writes the
Pbkdf2one shot from .NET primitives to Java to improve performance.PBKDF2 works by doing many HMAC calls, anywhere from thousands to hundreds of thousands or even millions. With the managed implementation, each HMAC invocation incurs small overhead, but with the number of them needed, it adds up.
SetByteArrayRegion) and data out (GetByteArrayRegion) between JNI and .NET.The Java VM itself is allocating potentially millions of byte arrays during this process.
Building off of #77386, now that we have the ability to write real Java, this re-writes the PBKDF2 implementation for Android in Java. This
doFinalcan write to an existing buffer. So instead of creating tons of small byte arrays and copying them in and out, the Java implementation only needs to allocate two buffers (uandu-previousin PBKDF2 terms) and a Java buffer of the final result to get the array back over to JNI.Performance improvements are favorable for small and large work factors.
For SHA-2-256 with a 64-byte output:
Closes #102406