Re: R: OutofMemory with CMSEnvelopedData from fileInputStream
Arshad Noor <arshad.noor-NeRrhQ6gTz/qlBn2x/[email protected]> Thu, 26 Sep 2019 05:18:30 -0700
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Organization | StrongKey |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------2E51AFD949D240CCA83494D7
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
I haven't worked with the Luna HSM in nearly 20 years - but looking at=20
this code it seems to me that the private-key has come _out_ of the HSM=20
and is now under the control of the SunJCE (software) provider to=20
perform the cryptographic operation.
Going from 6+ minutes to 15 seconds for a 130MB file indicates that the=20
local computer + software provider is performing the cryptographic=20
operation - not the HSM. This may be acceptable to your business, but=20
given that the point of using an HSM is to protect cryptographic keys,=20
unless the local computer is part of your security boundary, the key has=20
just been exposed. You might want to check with your Security people if=20
that is an acceptable risk for your business use-case.
Arshad Noor
StrongKey
On 9/26/19 2:15 AM, Emiliano Latini wrote:
>
> Guys I=E2=80=99v tried this way:
>
> JceKeyTransEnvelopedRecipient trans=3Dnew=20
> JceKeyTransEnvelopedRecipient((PrivateKey)jcaProvider.getKeystore().get=
Key(alias,jcaProvider.getPwd().toCharArray()));
>
> trans.setMustProduceEncodableUnwrappedKey(true);
>
> trans.setProvider(provider);
>
> trans.setContentProvider("SunJCE");
>
> where provider is =E2=80=9CLunaSA=E2=80=9D provider and seems I=E2=80=99=
ve nailed it.
>
> Is it right to assume I=E2=80=99ve getted the key from the HSM and decr=
ypted=20
> the content with local software implementation?
>
> *Da:*Emiliano Latini [mailto:[email protected]]
> *Inviato:* gioved=C3=AC 26 settembre 2019 09:27
> *A:* Eckenfels. Bernd
> *Cc:* [email protected]
> *Oggetto:* Re: [dev-crypto] OutofMemory with CMSEnvelopedData from=20
> fileInputStream
>
> Since the Hsm is a network attached one could make sense to use the=20
> hsm provider and BC ad content provider?
>
> Inviato da TypeApp <http://www.typeapp.com/r?b=3D15620>
>
> Il giorno 25 set 2019, alle ore 19:02, "Eckenfels. Bernd"=20
> <[email protected] <mailto:[email protected]>> ha scritto=
:
>
> For such a scenario it seems to make sense to fall back to a software=20
> hash implementation and do only the signature in the HSM. Thats a bit=20
> tricky in terms of compliance and might require some infrastructure to=20
> have two providers, but even though HSMs claim ridiculous speeds I=20
> would just not use them for hashing large payloads.
>
> Gruss
>
> Bernd
>
> *Von:*Emiliano Latini <[email protected]>
> *Gesendet:* Mittwoch, 25. September 2019 18:14
> *An:* [email protected]
> *Betreff:* [dev-crypto] OutofMemory with CMSEnvelopedData from=20
> fileInputStream
>
> I=E2=80=99ve solved the issue extracting directly the recipient :
>
> RecipientInformation recipient =3D recipients.get(new=20
> JceKeyTransRecipientId((java.security.cert.X509Certificate)jcaProvider.=
getKeystore().getCertificate(alias)));
>
> The problem is the operation is very slow even with a 130mb file. I=E2=80=
=99ve=20
> tried with the size of inputstream used for the CMSEnvelopedDataParser:
>
> =C2=A0 CMSEnvelopedDataParser=C2=A0=C2=A0=C2=A0=C2=A0 envelopedData =3D=
new=20
> CMSEnvelopedDataParser(new BufferedInputStream(encEnvelopedData,parsBuf=
));
>
> And with the buffer used in IOUtils.copylarge used for copying the=20
> decripted file:
>
> IOUtils.copyLarge(decryptedStream, os, buf);
>
> Below some execution times:
>
> copytime:00:06:24.178 With parsebuf:8192 and copybuf:1024
>
> copytime:00:06:46.668 With parsebuf:8192 and copybuf:8192
>
> copytime:00:06:45.187 With parsebuf:16384 and copybuf:16384
>
> copytime:00:06:39.961 With parsebuf:524288 and copybuf:524288
>
> could be the HSM the bottleneck?
>
>
>
>
>
> =09
>
> =09
>
> *SEEBURGER AG*
>
> =09
>
> =09
>
> Vorstand/SEEBURGER Executive Board:
>
> Sitz der Gesellschaft/Registered Office:
>
> =09
>
> =09
>
> Axel Haas, Michael Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias=20
> Fe=C3=9Fenbecker
>
> Edisonstr. 1
>
> =09
>
> =09
>
> D-75015 Bretten
>
> =09
> =09
>
> Vorsitzende des Aufsichtsrats/Chairperson of the SEEBURGER Supervisory=20
> Board:
>
> Tel.: 07252 / 96 - 0
>
> =09
> =09
>
> Prof. Dr. Simone Zeuchner
>
> Fax: 07252 / 96 - 2222
>
> =09
> =09
>
> Internet: http://www.seeburger.de
>
> =09
> =09
>
> Registergericht/Commercial Register:
>
> e-mail: [email protected]
>
> =09
> =09
>
> HRB 240708 Mannheim
>
> Dieses E-Mail ist nur f=C3=BCr den Empf=C3=A4nger bestimmt, an den es g=
erichtet=20
> ist und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes=20
> Material enthalten. Jegliche darin enthaltene Ansicht oder=20
> Meinungs=C3=A4u=C3=9Ferung ist die des Autors und stellt nicht notwendi=
gerweise=20
> die Ansicht oder Meinung der SEEBURGER AG dar. Sind Sie nicht der=20
> Empf=C3=A4nger, so haben Sie diese E-Mail irrt=C3=BCmlich erhalten und =
jegliche=20
> Verwendung, Ver=C3=B6ffentlichung, Weiterleitung, Abschrift oder jeglic=
her=20
> Druck dieser E-Mail ist strengstens untersagt. Weder die SEEBURGER AG=20
> noch der Absender (Eckenfels. Bernd) =C3=BCbernehmen die Haftung f=C3=BC=
r Viren;=20
> es obliegt Ihrer Verantwortung, die E-Mail und deren Anh=C3=A4nge auf V=
iren=20
> zu pr=C3=BCfen.
>
> This email is intended only for the recipient(s) to whom it is=20
> addressed. This email may contain confidential material that may be=20
> protected by professional secrecy. Any fact or opinion contained, or=20
> expression of the material herein, does not necessarily reflect that=20
> of SEEBURGER AG. If you are not the addressee or if you have received=20
> this email in error, any use, publication or distribution including=20
> forwarding, copying or printing is strictly prohibited. Neither=20
> SEEBURGER AG, nor the sender (Eckenfels. Bernd) accept liability for=20
> viruses; it is your responsibility to check this email and its=20
> attachments for viruses.
>
--------------2E51AFD949D240CCA83494D7
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
</head>
<body text=3D"#000000" bgcolor=3D"#FFFFFF">
<p>I haven't worked with the Luna HSM in nearly 20 years - but
looking at this code it seems to me that the private-key has come
<u>out</u> of the HSM and is now under the control of the SunJCE
(software) provider to perform the cryptographic operation. <br>
</p>
<p>Going from 6+ minutes to 15 seconds for a 130MB file indicates
that the local computer + software provider is performing the
cryptographic operation - not the HSM. This may be acceptable to
your business, but given that the point of using an HSM is to
protect cryptographic keys, unless the local computer is part of
your security boundary, the key has just been exposed. You might
want to check with your Security people if that is an acceptable
risk for your business use-case.<br>
</p>
<p>Arshad Noor<br>
StrongKey<br>
</p>
<div class=3D"moz-cite-prefix">On 9/26/19 2:15 AM, Emiliano Latini
wrote:<br>
</div>
<blockquote type=3D"cite"
cite=3D"mid:PR1PR01MB479591ECEBE44B250312229498860-RV51X3Ztkg05m3H0FNGn92g+FMJmE8Ca@public.gmane.org=
.prod.exchangelabs.com">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
<meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.StileMessaggioDiPostaElettronica18
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.StileMessaggioDiPostaElettronica19
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.StileMessaggioDiPostaElettronica20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.StileMessaggioDiPostaElettronica22
{mso-style-type:personal-reply;
font-family:"Tahoma","sans-serif";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">Guys I=E2=80=99v tried this way:<o:p></o:p></s=
pan></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US"><o:p>=C2=A0</o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">JceKeyTransEnvelopedRecipient trans=3Dnew
JceKeyTransEnvelopedRecipient((PrivateKey)jcaProvider.getKeystore().getKe=
y(alias,jcaProvider.getPwd().toCharArray()));<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
trans.setMustProduceEncodableUnwrappedKey(true);<o:p></o:p></=
span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
trans.setProvider(provider);<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
trans.setContentProvider("SunJCE");<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US"><o:p>=C2=A0</o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">where provider is =E2=80=9CLunaSA=E2=80=9D pro=
vider and seems
I=E2=80=99ve nailed it.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">Is it right to assume I=E2=80=99ve getted the =
key from
the HSM and decrypted the content with local software
implementation?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US"><o:p>=C2=A0</o:p></span></p>
<div>
<p class=3D"MsoNormal"><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:blue"
lang=3D"EN-US">=C2=A0</span><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:blue"
lang=3D"EN-US"><o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US"><o:p>=C2=A0</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><b><span
style=3D"font-size:10.0pt;font-family:"Segoe
UI","sans-serif"">Da:</span></b><span
style=3D"font-size:10.0pt;font-family:"Segoe
UI","sans-serif""> Emiliano Latini
[<a class=3D"moz-txt-link-freetext" href=3D"mailto:emilia=
[email protected]">mailto:[email protected]</a>]
<br>
<b>Inviato:</b> gioved=C3=AC 26 settembre 2019 09:27<br>
<b>A:</b> Eckenfels. Bernd<br>
<b>Cc:</b> <a class=3D"moz-txt-link-abbreviated" href=3D"=
mailto:[email protected]">[email protected]</a><br>
<b>Oggetto:</b> Re: [dev-crypto] OutofMemory with
CMSEnvelopedData from fileInputStream<o:p></o:p></span></=
p>
</div>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><o:p>=C2=A0</=
o:p></p>
<div>
<p class=3D"MsoNormal"
style=3D"mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;mar=
gin-left:35.4pt"><span
lang=3D"DE">Since the Hsm is a network attached one could
make sense to use the hsm provider and BC ad content
provider?<br>
<br>
<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
lang=3D"DE">Inviato da <a
href=3D"http://www.typeapp.com/r?b=3D15620"
moz-do-not-send=3D"true">
TypeApp</a> <o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
lang=3D"DE">Il giorno 25 set 2019, alle ore 19:02,
"Eckenfels. Bernd" <<a
href=3D"mailto:[email protected]" target=3D"_blank=
"
moz-do-not-send=3D"true">[email protected]</a>>
ha scritto:
<o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:#1F497D;mso-fareast-language:EN-US"
lang=3D"DE">For such a scenario it seems to make sense to
fall back to a software hash implementation and do only
the signature in the HSM. Thats a bit tricky in terms of
compliance and might require some infrastructure to have
two providers, but even though HSMs claim ridiculous
speeds I would just not use them for hashing large
payloads.</span><span lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:#1F497D;mso-fareast-language:EN-US"
lang=3D"DE">Gruss</span><span lang=3D"DE"><o:p></o:p></span=
></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:#1F497D;mso-fareast-language:EN-US"
lang=3D"DE">Bernd</span><span lang=3D"DE"><o:p></o:p></span=
></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><b><spa=
n
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f""
lang=3D"DE">Von:</span></b><span
style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f""
lang=3D"DE"> Emiliano Latini
<a class=3D"moz-txt-link-rfc2396E" href=3D"mailto:emili=
[email protected]"><[email protected]></a>
<br>
<b>Gesendet:</b> Mittwoch, 25. September 2019 18:14<br>
<b>An:</b> <a class=3D"moz-txt-link-abbreviated" href=3D=
"mailto:[email protected]">[email protected]</a><br>
<b>Betreff:</b> [dev-crypto] OutofMemory with
CMSEnvelopedData from fileInputStream</span><span
lang=3D"DE"><o:p></o:p></span></p>
</div>
</div>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">I=E2=80=99ve solved the issue extracting dir=
ectly the
recipient :</span><span lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"
style=3D"margin-left:35.4pt;text-indent:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">RecipientInformation recipient =3D
recipients.get(new
JceKeyTransRecipientId((java.security.cert.X509Certificate)jcaProvider.ge=
tKeystore().getCertificate(alias)));</span><span
lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">The problem is the operation is very slow
even with a 130mb file. I=E2=80=99ve tried with the size of
inputstream used for the CMSEnvelopedDataParser:</span><spa=
n
lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">=C2=A0 CMSEnvelopedDataParser=C2=A0=C2=A0=C2=
=A0=C2=A0 envelopedData =3D
new CMSEnvelopedDataParser(new
BufferedInputStream(encEnvelopedData,parsBuf));</span><span
lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">And with the buffer used in IOUtils.copylarg=
e
used for copying the decripted file:</span><span lang=3D"DE=
"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal"
style=3D"margin-left:35.4pt;text-indent:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">IOUtils.copyLarge(decryptedStream, os, buf);=
</span><span
lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">Below some execution times:</span><span
lang=3D"DE"><o:p></o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">copytime:00:06:24.178 With parsebuf:8192 and
copybuf:1024</span><span lang=3D"DE"><o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">copytime:00:06:46.668 With parsebuf:8192 and
copybuf:8192</span><span lang=3D"DE"><o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">copytime:00:06:45.187 With parsebuf:16384 an=
d
copybuf:16384</span><span lang=3D"DE"><o:p></o:p></span></p=
>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">copytime:00:06:39.961 With parsebuf:524288
and copybuf:524288</span><span lang=3D"DE"><o:p></o:p></spa=
n></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE">=C2=A0<o:p></=
o:p></span></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span
style=3D"font-size:10.0pt;font-family:"Tahoma","sans-serif=
";color:blue"
lang=3D"EN-US">could be the HSM the bottleneck?</span><span
lang=3D"DE"><o:p></o:p></span></p>
<p class=3D"MsoNormal"
style=3D"mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;mar=
gin-left:35.4pt"><span
lang=3D"DE"><br>
<br>
<br>
<br>
<o:p></o:p></span></p>
<table class=3D"MsoNormalTable"
style=3D"width:100.0%;margin-left:35.4pt;border-collapse:coll=
apse"
id=3D"table1" width=3D"100%" cellspacing=3D"0" cellpadding=3D=
"0"
border=3D"0">
<tbody>
<tr>
<td
style=3D"width:204.0pt;border:none;border-bottom:double
windowtext 2.25pt;padding:.75pt .75pt .75pt .75pt"
width=3D"272">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
<td
style=3D"width:33.75pt;border:none;border-bottom:double
windowtext 2.25pt;padding:.75pt .75pt .75pt .75pt"
width=3D"45">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
<td style=3D"border:none;border-bottom:double windowtext
2.25pt;padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class=3D"MsoNormal"
style=3D"mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;mar=
gin-left:35.4pt"><span
lang=3D"DE"><o:p>=C2=A0</o:p></span></p>
<table class=3D"MsoNormalTable"
style=3D"width:100.0%;margin-left:35.4pt;border-collapse:coll=
apse"
id=3D"table1" width=3D"100%" cellspacing=3D"0" cellpadding=3D=
"0"
border=3D"0">
<tbody>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><b><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">SEEBURGER
AG</span></b><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Vorstand/SEEBURGER
Executive Board:</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Sitz
der Gesellschaft/Registered Office:</span><o:p></o:=
p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Axel
Haas, Michael Kleeberg, Axel Otto, Dr. Martin
Kuntz, Matthias Fe=C3=9Fenbecker</span><o:p></o:p><=
/p>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Edisonstr.
1</span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45">
<p class=3D"MsoNormal">=C2=A0<o:p></o:p></p>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt"><br>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">D-75015
Bretten</span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45"><br>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Vorsitzende
des Aufsichtsrats/Chairperson of the SEEBURGER
Supervisory Board:</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Tel.:
07252 / 96 - 0</span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45"><br>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Prof.
Dr. Simone Zeuchner</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Fax:
07252 / 96 - 2222</span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45"><br>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt"><br>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Internet:
<a class=3D"moz-txt-link-freetext" href=3D"http://w=
ww.seeburger.de">http://www.seeburger.de</a></span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45"><br>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">Registergericht/Commercial
Register:</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style=3D"width:204.0pt;padding:.75pt .75pt .75pt
.75pt" width=3D"272">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">e-mail:
<a class=3D"moz-txt-link-abbreviated" href=3D"mailt=
o:[email protected]">[email protected]</a></span><o:p></o:p></p>
</td>
<td style=3D"width:33.75pt;padding:.75pt .75pt .75pt
.75pt" width=3D"45"><br>
</td>
<td style=3D"padding:.75pt .75pt .75pt .75pt">
<p class=3D"MsoNormal"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray">HRB
240708 Mannheim</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p style=3D"margin-left:35.4pt"><span lang=3D"DE"><o:p>=C2=A0</=
o:p></span></p>
<p
style=3D"mso-margin-top-alt:5.0pt;margin-right:0cm;margin-bottom:12.0pt;m=
argin-left:35.4pt"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray"
lang=3D"DE">Dieses E-Mail ist nur f=C3=BCr den Empf=C3=A4ng=
er
bestimmt, an den es gerichtet ist und kann vertrauliches
bzw. unter das Berufsgeheimnis fallendes Material
enthalten. Jegliche darin enthaltene Ansicht oder
Meinungs=C3=A4u=C3=9Ferung ist die des Autors und stellt ni=
cht
notwendigerweise die Ansicht oder Meinung der SEEBURGER AG
dar. Sind Sie nicht der Empf=C3=A4nger, so haben Sie diese
E-Mail irrt=C3=BCmlich erhalten und jegliche Verwendung,
Ver=C3=B6ffentlichung, Weiterleitung, Abschrift oder jeglic=
her
Druck dieser E-Mail ist strengstens untersagt. Weder die
SEEBURGER AG noch der Absender (Eckenfels. Bernd)
=C3=BCbernehmen die Haftung f=C3=BCr Viren; es obliegt Ihre=
r
Verantwortung, die E-Mail und deren Anh=C3=A4nge auf Viren =
zu
pr=C3=BCfen.
</span><span lang=3D"DE"><o:p></o:p></span></p>
<p
style=3D"mso-margin-top-alt:5.0pt;margin-right:0cm;margin-bottom:12.0pt;m=
argin-left:35.4pt"><span
style=3D"font-size:7.5pt;font-family:"Arial","sans-serif&q=
uot;;color:gray"
lang=3D"DE">This email is intended only for the recipient(s=
)
to whom it is addressed. This email may contain
confidential material that may be protected by
professional secrecy. Any fact or opinion contained, or
expression of the material herein, does not necessarily
reflect that of SEEBURGER AG. If you are not the addressee
or if you have received this email in error, any use,
publication or distribution including forwarding, copying
or printing is strictly prohibited. Neither SEEBURGER AG,
nor the sender (Eckenfels. Bernd) accept liability for
viruses; it is your responsibility to check this email and
its attachments for viruses.
</span><span lang=3D"DE"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</body>
</html>
--------------2E51AFD949D240CCA83494D7--