R: OutofMemory with CMSEnvelopedData from fileInputStream

Now with a 130 mb file I'm down to 15 secs using Luna's keystore implementa=
tion with key handle.


=A0

-----Messaggio originale-----
Da: Eckenfels. Bernd [mailto:[email protected]]=20
Inviato: gioved=EC 26 settembre 2019 11:42
A: Emiliano Latini
Cc: [email protected]
Oggetto: RE: [dev-crypto] OutofMemory with CMSEnvelopedData from fileInputS=
tream

Hello,

Looks right, what's your speed now?

BTW, is,this an exported key in a localkeystore or is this a Keystore imple=
mentation from Luna with a key handle?

Gruss
Bernd

--
http://www.seeburger.com
________________________________________
From: Emiliano Latini [[email protected]]
Sent: Thursday, September 26, 2019 11:15
To: Emiliano Latini; Eckenfels. Bernd
Cc: [email protected]
Subject: R: [dev-crypto] OutofMemory with CMSEnvelopedData from fileInputSt=
ream

Guys I'v tried this way:

JceKeyTransEnvelopedRecipient trans=3Dnew JceKeyTransEnvelopedRecipient((Pr=
ivateKey)jcaProvider.getKeystore().getKey(alias,jcaProvider.getPwd().toChar=
Array()));
                                                           trans.setMustPro=
duceEncodableUnwrappedKey(true);
                                                           trans.setProvide=
r(provider);
                                                           trans.setContent=
Provider("SunJCE");

where provider is "LunaSA" provider and seems I've nailed it.
Is it right to assume I've getted the key from the HSM and decrypted the co=
ntent with local software implementation?



Da: Emiliano Latini [mailto:[email protected]]
Inviato: gioved=EC 26 settembre 2019 09:27
A: Eckenfels. Bernd
Cc: [email protected]
Oggetto: Re: [dev-crypto] OutofMemory with CMSEnvelopedData from fileInputS=
tream

Since the Hsm is a network attached one could make sense to use the hsm pro=
vider and BC ad content provider?

Inviato da TypeApp<http://www.typeapp.com/r?b=3D15620>
Il giorno 25 set 2019, alle ore 19:02, "Eckenfels. Bernd" <b.eckenfels@seeb=
urger.de<mailto:[email protected]>> ha scritto:
For such a scenario it seems to make sense to fall back to a software hash =
implementation and do only the signature in the HSM. Thats a bit tricky in =
terms of compliance and might require some infrastructure to have two provi=
ders, but even though HSMs claim ridiculous speeds I would just not use the=
m for hashing large payloads.


Gruss
Bernd


Von: Emiliano Latini <[email protected]>
Gesendet: Mittwoch, 25. September 2019 18:14
An: [email protected]
Betreff: [dev-crypto] OutofMemory with CMSEnvelopedData from fileInputStrea=
m


I've solved the issue extracting directly the recipient :


RecipientInformation recipient =3D recipients.get(new JceKeyTransRecipientI=
d((java.security.cert.X509Certificate)jcaProvider.getKeystore().getCertific=
ate(alias)));






The problem is the operation is very slow even with a 130mb file. I've trie=
d with the size of inputstream used for the CMSEnvelopedDataParser:


  CMSEnvelopedDataParser     envelopedData =3D new CMSEnvelopedDataParser(n=
ew BufferedInputStream(encEnvelopedData,parsBuf));




And with the buffer used in IOUtils.copylarge used for copying the decripte=
d file:


IOUtils.copyLarge(decryptedStream, os, buf);




Below some execution times:


copytime:00:06:24.178 With parsebuf:8192 and copybuf:1024
copytime:00:06:46.668 With parsebuf:8192 and copybuf:8192
copytime:00:06:45.187 With parsebuf:16384 and copybuf:16384
copytime:00:06:39.961 With parsebuf:524288 and copybuf:524288




could be the HSM the bottleneck?











SEEBURGER AG



Vorstand/SEEBURGER Executive Board:

Sitz der Gesellschaft/Registered Office:



Axel Haas, Michael Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias Fe=DFenb=
ecker

Edisonstr. 1



D-75015 Bretten

Vorsitzende des Aufsichtsrats/Chairperson of the SEEBURGER Supervisory Boar=
d:

Tel.: 07252 / 96 - 0

Prof. Dr. Simone Zeuchner

Fax: 07252 / 96 - 2222

Internet: http://www.seeburger.de

Registergericht/Commercial Register:

e-mail: [email protected]

HRB 240708 Mannheim




Dieses E-Mail ist nur f=FCr den Empf=E4nger bestimmt, an den es gerichtet i=
st und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes Material=
 enthalten. Jegliche darin enthaltene Ansicht oder Meinungs=E4u=DFerung ist=
 die des Autors und stellt nicht notwendigerweise die Ansicht oder Meinung =
der SEEBURGER AG dar. Sind Sie nicht der Empf=E4nger, so haben Sie diese E-=
Mail irrt=FCmlich erhalten und jegliche Verwendung, Ver=F6ffentlichung, Wei=
terleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengstens un=
tersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd) =FCber=
nehmen die Haftung f=FCr Viren; es obliegt Ihrer Verantwortung, die E-Mail =
und deren Anh=E4nge auf Viren zu pr=FCfen.

This email is intended only for the recipient(s) to whom it is addressed. T=
his email may contain confidential material that may be protected by profes=
sional secrecy. Any fact or opinion contained, or expression of the materia=
l herein, does not necessarily reflect that of SEEBURGER AG. If you are not=
 the addressee or if you have received this email in error, any use, public=
ation or distribution including forwarding, copying or printing is strictly=
 prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels. Bernd) accept=
 liability for viruses; it is your responsibility to check this email and i=
ts attachments for viruses.









SEEBURGER AG            Vorstand/SEEBURGER Executive Board:
Sitz der Gesellschaft/Registered Office:                Axel Haas, Michael =
Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias Fe=DFenbecker
Edisonstr. 1
D-75015 Bretten         Vorsitzende des Aufsichtsrats/Chairperson of the SE=
EBURGER Supervisory Board:
Tel.: 07252 / 96 - 0            Prof. Dr. Simone Zeuchner
Fax: 07252 / 96 - 2222
Internet: http://www.seeburger.de               Registergericht/Commercial =
Register:
e-mail: [email protected]               HRB 240708 Mannheim


Dieses E-Mail ist nur f=FCr den Empf=E4nger bestimmt, an den es gerichtet i=
st und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes Material=
 enthalten. Jegliche darin enthaltene Ansicht oder Meinungs=E4u=DFerung ist=
 die des Autors und stellt nicht notwendigerweise die Ansicht oder Meinung =
der SEEBURGER AG dar. Sind Sie nicht der Empf=E4nger, so haben Sie diese E-=
Mail irrt=FCmlich erhalten und jegliche Verwendung, Ver=F6ffentlichung, Wei=
terleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengstens un=
tersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd) =FCber=
nehmen die Haftung f=FCr Viren; es obliegt Ihrer Verantwortung, die E-Mail =
und deren Anh=E4nge auf Viren zu pr=FCfen.


This email is intended only for the recipient(s) to whom it is addressed. T=
his email may contain confidential material that may be protected by profes=
sional secrecy. Any fact or opinion contained, or expression of the materia=
l herein, does not necessarily reflect that of SEEBURGER AG. If you are not=
 the addressee or if you have received this email in error, any use, public=
ation or distribution including forwarding, copying or printing is strictly=
 prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels. Bernd) accept=
 liability for viruses; it is your responsibility to check this email and i=
ts attachments for viruses.