Re: R: OutofMemory with CMSEnvelopedData from fileInputStream

--000000000000378ccc05937432eb
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

The private key should be used only to verify the signature, so only the
hash need to be sent to the HSM to verify the signature.
What need to be exported is the symmetric key used to encrypt and, if I'm
not wrong, that is what is happening here and that would explain the speed
improvement.

I don't know what restrictions you have to oblige, but as far as I remember
Italian laws wanted the HSM to be FIPS3, and if I remember correct with
FIPS3 private keys are never exportable

Il giorno gio 26 set 2019 alle ore 14:33 Emiliano Latini <
[email protected]> ha scritto:

> Hello Arshad,
>
> thanks for the clarification. It was clear to me the key is exposed, but
> this happens only for this particular use case when we receive this key
> from trusted actors in secure ways.The Application servers are also part =
of
> the security boundary.
>
>
>
> cheers
>
>
>
>
>
>
>
> *Da:* Arshad Noor [mailto:arshad.noor-NeRrhQ6gTz/qlBn2x/[email protected]]
> *Inviato:* gioved=C3=AC 26 settembre 2019 14:19
> *A:* Emiliano Latini
> *Cc:* [email protected]
> *Oggetto:* Re: R: [dev-crypto] OutofMemory with CMSEnvelopedData from
> fileInputStream
>
>
>
> I haven't worked with the Luna HSM in nearly 20 years - but looking at
> this code it seems to me that the private-key has come *out* of the HSM
> and is now under the control of the SunJCE (software) provider to perform
> the cryptographic operation.
>
> Going from 6+ minutes to 15 seconds for a 130MB file indicates that the
> local computer + software provider is performing the cryptographic
> operation - not the HSM. This may be acceptable to your business, but giv=
en
> that the point of using an HSM is to protect cryptographic keys, unless t=
he
> local computer is part of your security boundary, the key has just been
> exposed. You might want to check with your Security people if that is an
> acceptable risk for your business use-case.
>
> Arshad Noor
> StrongKey
>
> On 9/26/19 2:15 AM, Emiliano Latini wrote:
>
> Guys I=E2=80=99v tried this way:
>
>
>
> JceKeyTransEnvelopedRecipient trans=3Dnew
> JceKeyTransEnvelopedRecipient((PrivateKey)jcaProvider.getKeystore().getKe=
y(alias,jcaProvider.getPwd().toCharArray()));
>
>
> trans.setMustProduceEncodableUnwrappedKey(true);
>
>
> trans.setProvider(provider);
>
>
> trans.setContentProvider("SunJCE");
>
>
>
> where provider is =E2=80=9CLunaSA=E2=80=9D provider and seems I=E2=80=99v=
e nailed it.
>
> Is it right to assume I=E2=80=99ve getted the key from the HSM and decryp=
ted the
> content with local software implementation?
>
>
>
>
>
>
>
> *Da:* Emiliano Latini [mailto:[email protected]
> <[email protected]>]
> *Inviato:* gioved=C3=AC 26 settembre 2019 09:27
> *A:* Eckenfels. Bernd
> *Cc:* [email protected]
> *Oggetto:* Re: [dev-crypto] OutofMemory with CMSEnvelopedData from
> fileInputStream
>
>
>
> Since the Hsm is a network attached one could make sense to use the hsm
> provider and BC ad content provider?
>
>
> Inviato da TypeApp <http://www.typeapp.com/r?b=3D15620>
>
> Il giorno 25 set 2019, alle ore 19:02, "Eckenfels. Bernd" <
> [email protected]> ha scritto:
>
> For such a scenario it seems to make sense to fall back to a software has=
h
> implementation and do only the signature in the HSM. Thats a bit tricky i=
n
> terms of compliance and might require some infrastructure to have two
> providers, but even though HSMs claim ridiculous speeds I would just not
> use them for hashing large payloads.
>
>
>
> Gruss
>
> Bernd
>
>
>
> *Von:* Emiliano Latini <[email protected]> <[email protected]>
> *Gesendet:* Mittwoch, 25. September 2019 18:14
> *An:* [email protected]
> *Betreff:* [dev-crypto] OutofMemory with CMSEnvelopedData from
> fileInputStream
>
>
>
> I=E2=80=99ve solved the issue extracting directly the recipient :
>
>
>
> RecipientInformation recipient =3D recipients.get(new
> JceKeyTransRecipientId((java.security.cert.X509Certificate)jcaProvider.ge=
tKeystore().getCertificate(alias)));
>
>
>
>
>
>
>
> The problem is the operation is very slow even with a 130mb file. I=E2=80=
=99ve
> tried with the size of inputstream used for the CMSEnvelopedDataParser:
>
>
>
>   CMSEnvelopedDataParser     envelopedData =3D new
> CMSEnvelopedDataParser(new BufferedInputStream(encEnvelopedData,parsBuf))=
;
>
>
>
>
>
> And with the buffer used in IOUtils.copylarge used for copying the
> decripted file:
>
>
>
> IOUtils.copyLarge(decryptedStream, os, buf);
>
>
>
>
>
> Below some execution times:
>
>
>
> copytime:00:06:24.178 With parsebuf:8192 and copybuf:1024
>
> copytime:00:06:46.668 With parsebuf:8192 and copybuf:8192
>
> copytime:00:06:45.187 With parsebuf:16384 and copybuf:16384
>
> copytime:00:06:39.961 With parsebuf:524288 and copybuf:524288
>
>
>
>
>
> could be the HSM the bottleneck?
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *SEEBURGER AG*
>
>
>
> Vorstand/SEEBURGER Executive Board:
>
> Sitz der Gesellschaft/Registered Office:
>
>
>
> Axel Haas, Michael Kleeberg, Axel Otto, Dr. Martin Kuntz, Matthias
> Fe=C3=9Fenbecker
>
> Edisonstr. 1
>
>
>
> D-75015 Bretten
>
> Vorsitzende des Aufsichtsrats/Chairperson of the SEEBURGER Supervisory
> Board:
>
> Tel.: 07252 / 96 - 0
>
> Prof. Dr. Simone Zeuchner
>
> Fax: 07252 / 96 - 2222
>
> Internet: http://www.seeburger.de
>
> Registergericht/Commercial Register:
>
> e-mail: [email protected]
>
> HRB 240708 Mannheim
>
>
>
> Dieses E-Mail ist nur f=C3=BCr den Empf=C3=A4nger bestimmt, an den es ger=
ichtet ist
> und kann vertrauliches bzw. unter das Berufsgeheimnis fallendes Material
> enthalten. Jegliche darin enthaltene Ansicht oder Meinungs=C3=A4u=C3=9Fer=
ung ist die
> des Autors und stellt nicht notwendigerweise die Ansicht oder Meinung der
> SEEBURGER AG dar. Sind Sie nicht der Empf=C3=A4nger, so haben Sie diese E=
-Mail
> irrt=C3=BCmlich erhalten und jegliche Verwendung, Ver=C3=B6ffentlichung,
> Weiterleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengste=
ns
> untersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd)
> =C3=BCbernehmen die Haftung f=C3=BCr Viren; es obliegt Ihrer Verantwortun=
g, die
> E-Mail und deren Anh=C3=A4nge auf Viren zu pr=C3=BCfen.
>
> This email is intended only for the recipient(s) to whom it is addressed.
> This email may contain confidential material that may be protected by
> professional secrecy. Any fact or opinion contained, or expression of the
> material herein, does not necessarily reflect that of SEEBURGER AG. If yo=
u
> are not the addressee or if you have received this email in error, any us=
e,
> publication or distribution including forwarding, copying or printing is
> strictly prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels.
> Bernd) accept liability for viruses; it is your responsibility to check
> this email and its attachments for viruses.
>
>

--000000000000378ccc05937432eb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">The private key should be used only to verify the signatur=
e, so only the hash need to be sent to the HSM to verify the signature.=C2=
=A0<div>What need to be exported is the symmetric key used to encrypt and, =
if I&#39;m not wrong, that is what is happening here and that would explain=
 the speed improvement.</div><div><br></div><div>I don&#39;t know what rest=
rictions you have to oblige, but as far as I remember Italian laws wanted t=
he HSM to be FIPS3, and if I remember correct with FIPS3 private keys are n=
ever exportable</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">Il giorno gio 26 set 2019 alle ore 14:33 Emiliano Lati=
ni &lt;<a href=3D"mailto:[email protected]">[email protected]</a>=
&gt; ha scritto:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
>





<div bgcolor=3D"white" lang=3D"IT">
<div class=3D"gmail-m_3366692948816259964WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue">Hello Arshad,<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue">thanks for the clarification. It was cle=
ar to me the key is exposed, but this happens only for this particular use =
case when we receive this key from
 trusted actors in secure ways.The Application servers are also part of the=
 security boundary.<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue">cheers<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue"><u></u>=C2=A0<u></u></span></p>
<div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt;font-fa=
mily:Calibri,sans-serif;color:blue">=C2=A0</span><span lang=3D"EN-US" style=
=3D"font-size:11pt;font-family:Calibri,sans-serif;color:blue"><u></u><u></u=
></span></p>
</div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10pt;font-fa=
mily:Tahoma,sans-serif;color:blue"><u></u>=C2=A0<u></u></span></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><b><span lang=3D"EN-US"=
 style=3D"font-size:10pt;font-family:&quot;Segoe UI&quot;,sans-serif;color:=
windowtext">Da:</span></b><span lang=3D"EN-US" style=3D"font-size:10pt;font=
-family:&quot;Segoe UI&quot;,sans-serif;color:windowtext">
 Arshad Noor [mailto:<a href=3D"mailto:arshad.noor-NeRrhQ6gTz/qlBn2x/[email protected]" target=3D=
"_blank">arshad.noor-NeRrhQ6gTz/qlBn2x/[email protected]</a>] <br>
<b>Inviato:</b> gioved=C3=AC 26 settembre 2019 14:19<br>
<b>A:</b> Emiliano </span><span style=3D"font-size:10pt;font-family:&quot;S=
egoe UI&quot;,sans-serif;color:windowtext">Latini<br>
<b>Cc:</b> <a href=3D"mailto:[email protected]" target=3D"_blank"=
>[email protected]</a><br>
<b>Oggetto:</b> Re: R: [dev-crypto] OutofMemory with CMSEnvelopedData from =
fileInputStream<u></u><u></u></span></p>
</div>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><u></u>=C2=A0<u></u></p=
>
<p style=3D"margin-left:35.4pt">I haven&#39;t worked with the Luna HSM in n=
early 20 years - but looking at this code it seems to me that the private-k=
ey has come
<u>out</u> of the HSM and is now under the control of the SunJCE (software)=
 provider to perform the cryptographic operation.
<u></u><u></u></p>
<p style=3D"margin-left:35.4pt">Going from 6+ minutes to 15 seconds for a 1=
30MB file indicates that the local computer + software provider is performi=
ng the cryptographic operation - not the HSM. This may be acceptable to you=
r business, but given that the point
 of using an HSM is to protect cryptographic keys, unless the local compute=
r is part of your security boundary, the key has just been exposed. You mig=
ht want to check with your Security people if that is an acceptable risk fo=
r your business use-case.<u></u><u></u></p>
<p style=3D"margin-left:35.4pt">Arshad Noor<br>
StrongKey<u></u><u></u></p>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt">On 9/26/19 2:15 AM, Emi=
liano Latini wrote:<u></u><u></u></p>
</div>
<blockquote style=3D"margin-top:5pt;margin-bottom:5pt">
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">Guys I=E2=
=80=99v tried this way:</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0</spa=
n><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">JceKeyTrans=
EnvelopedRecipient trans=3Dnew JceKeyTransEnvelopedRecipient((PrivateKey)jc=
aProvider.getKeystore().getKey(alias,jcaProvider.getPwd().toCharArray()));<=
/span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trans.setMustProduceEncodableUnwrap=
pedKey(true);</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trans.setProvider(provider);</span>=
<u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trans.setContentProvider(&quot;SunJ=
CE&quot;);</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0</spa=
n><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">where provi=
der is =E2=80=9CLunaSA=E2=80=9D provider and seems I=E2=80=99ve nailed it.<=
/span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">Is it right=
 to assume I=E2=80=99ve getted the key from the HSM and decrypted the conte=
nt with local software implementation?</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0</spa=
n><u></u><u></u></p>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:11pt;font-family:Calibri,sans-serif;color:blue">=C2=A0</sp=
an><u></u><u></u></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:35.4pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0</spa=
n><u></u><u></u></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><b><span style=3D"font-=
size:10pt;font-family:&quot;Segoe UI , sans-serif&quot;,serif">Da:</span></=
b><span style=3D"font-size:10pt;font-family:&quot;Segoe UI , sans-serif&quo=
t;,serif"> Emiliano Latini [<a href=3D"mailto:[email protected]" targe=
t=3D"_blank">mailto:[email protected]</a>]
<br>
<b>Inviato:</b> gioved=C3=AC 26 settembre 2019 09:27<br>
<b>A:</b> Eckenfels. Bernd<br>
<b>Cc:</b> <a href=3D"mailto:[email protected]" target=3D"_blank"=
>[email protected]</a><br>
<b>Oggetto:</b> Re: [dev-crypto] OutofMemory with CMSEnvelopedData from fil=
eInputStream</span><u></u><u></u></p>
</div>
</div>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt">=C2=A0<u></u><u></u></p=
>
<div>
<p class=3D"MsoNormal" style=3D"margin-right:0cm;margin-bottom:12pt;margin-=
left:70.8pt">
<span lang=3D"DE">Since the Hsm is a network attached one could make sense =
to use the hsm provider and BC ad content provider?<br>
<br>
<br>
</span><u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"DE">Invia=
to da <a href=3D"http://www.typeapp.com/r?b=3D15620" target=3D"_blank">
TypeApp</a> </span><u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"DE">Il gi=
orno 25 set 2019, alle ore 19:02, &quot;Eckenfels. Bernd&quot; &lt;<a href=
=3D"mailto:[email protected]" target=3D"_blank">b.eckenfels@seeburge=
r.de</a>&gt; ha scritto:
</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"DE" style=
=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">For=
 such a scenario it seems to make sense to fall back to a software hash imp=
lementation and
 do only the signature in the HSM. Thats a bit tricky in terms of complianc=
e and might require some infrastructure to have two providers, but even tho=
ugh HSMs claim ridiculous speeds I would just not use them for hashing larg=
e payloads.</span><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"DE" style=
=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Gru=
ss</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"DE" style=
=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Ber=
nd</span><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<div>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><b><span lang=3D"DE" st=
yle=3D"font-size:11pt;font-family:Calibri,sans-serif">Von:</span></b><span =
lang=3D"DE" style=3D"font-size:11pt;font-family:Calibri,sans-serif"> Emilia=
no Latini
<a href=3D"mailto:[email protected]" target=3D"_blank">&lt;emiliano.la=
[email protected]&gt;</a> <br>
<b>Gesendet:</b> Mittwoch, 25. September 2019 18:14<br>
<b>An:</b> <a href=3D"mailto:[email protected]" target=3D"_blank"=
>[email protected]</a><br>
<b>Betreff:</b> [dev-crypto] OutofMemory with CMSEnvelopedData from fileInp=
utStream</span><u></u><u></u></p>
</div>
</div>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">I=E2=80=99v=
e solved the issue extracting directly the recipient :</span><u></u><u></u>=
</p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt;text-indent:35.4pt"><spa=
n lang=3D"EN-US" style=3D"font-size:10pt;font-family:Tahoma,sans-serif;colo=
r:blue">RecipientInformation recipient =3D recipients.get(new JceKeyTransRe=
cipientId((java.security.cert.X509Certificate)jcaProvider.getKeystore().get=
Certificate(alias)));</span><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">The problem=
 is the operation is very slow even with a 130mb file. I=E2=80=99ve tried w=
ith the size of inputstream used for the CMSEnvelopedDataParser:</span><u><=
/u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">=C2=A0 CMSE=
nvelopedDataParser=C2=A0=C2=A0=C2=A0=C2=A0 envelopedData =3D new CMSEnvelop=
edDataParser(new BufferedInputStream(encEnvelopedData,parsBuf));</span><u><=
/u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">And with th=
e buffer used in IOUtils.copylarge used for copying the decripted file:</sp=
an><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt;text-indent:35.4pt"><spa=
n lang=3D"EN-US" style=3D"font-size:10pt;font-family:Tahoma,sans-serif;colo=
r:blue">IOUtils.copyLarge(decryptedStream, os, buf);</span><u></u><u></u></=
p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">Below some =
execution times:</span><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">copytime:00=
:06:24.178 With parsebuf:8192 and copybuf:1024</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">copytime:00=
:06:46.668 With parsebuf:8192 and copybuf:8192</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">copytime:00=
:06:45.187 With parsebuf:16384 and copybuf:16384</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">copytime:00=
:06:39.961 With parsebuf:524288 and copybuf:524288</span><u></u><u></u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p class=3D"MsoNormal" style=3D"margin-left:70.8pt"><span lang=3D"EN-US" st=
yle=3D"font-size:10pt;font-family:Tahoma,sans-serif;color:blue">could be th=
e HSM the bottleneck?</span><u></u><u></u></p>
<p class=3D"MsoNormal" style=3D"margin-right:0cm;margin-bottom:12pt;margin-=
left:70.8pt">
<span lang=3D"DE"><br>
<br>
<br>
<br>
<br>
</span><u></u><u></u></p>
<table class=3D"gmail-m_3366692948816259964MsoNormalTable" border=3D"0" cel=
lspacing=3D"0" cellpadding=3D"0" width=3D"100%" style=3D"width:100%;margin-=
left:70.8pt;border-collapse:collapse" id=3D"gmail-m_3366692948816259964tabl=
e1">
<tbody>
<tr>
<td width=3D"272" style=3D"width:204pt;border-top:none;border-right:none;bo=
rder-left:none;border-bottom:2.25pt double windowtext;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;border-top:none;border-right:none;b=
order-left:none;border-bottom:2.25pt double windowtext;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
<td style=3D"border-top:none;border-right:none;border-left:none;border-bott=
om:2.25pt double windowtext;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
<p class=3D"MsoNormal" style=3D"margin-right:0cm;margin-bottom:12pt;margin-=
left:70.8pt">
<span lang=3D"DE">=C2=A0</span><u></u><u></u></p>
<table class=3D"gmail-m_3366692948816259964MsoNormalTable" border=3D"0" cel=
lspacing=3D"0" cellpadding=3D"0" width=3D"100%" style=3D"width:100%;margin-=
left:70.8pt;border-collapse:collapse" id=3D"gmail-m_3366692948816259964tabl=
e1">
<tbody>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><b><span style=3D"font-size:7.5pt;font-family:Arial,=
sans-serif;color:gray">SEEBURGER AG</span></b><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Vorstand/SEEBURGER Executive Board:</span><u></u><u></u=
></p>
</td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Sitz der Gesellschaft/Registered Office:</span><u></u><=
u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Axel Haas, Michael Kleeberg, Axel Otto, Dr. Martin Kunt=
z, Matthias Fe=C3=9Fenbecker</span><u></u><u></u></p>
</td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Edisonstr. 1</span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt">
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</td>
<td style=3D"padding:0.75pt"></td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">D-75015 Bretten</span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt"></td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Vorsitzende des Aufsichtsrats/Chairperson of the SEEBUR=
GER Supervisory Board:</span><u></u><u></u></p>
</td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Tel.: 07252 / 96 - 0</span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt"></td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Prof. Dr. Simone Zeuchner</span><u></u><u></u></p>
</td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Fax: 07252 / 96 - 2222</span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt"></td>
<td style=3D"padding:0.75pt"></td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Internet:
<a href=3D"http://www.seeburger.de" target=3D"_blank">http://www.seeburger.=
de</a></span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt"></td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">Registergericht/Commercial Register:</span><u></u><u></=
u></p>
</td>
</tr>
<tr>
<td width=3D"272" style=3D"width:204pt;padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">e-mail:
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a=
></span><u></u><u></u></p>
</td>
<td width=3D"45" style=3D"width:33.75pt;padding:0.75pt"></td>
<td style=3D"padding:0.75pt">
<p class=3D"MsoNormal"><span style=3D"font-size:7.5pt;font-family:Arial,san=
s-serif;color:gray">HRB 240708 Mannheim</span><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
<p style=3D"margin-left:70.8pt"><span lang=3D"DE">=C2=A0</span><u></u><u></=
u></p>
<p style=3D"margin-right:0cm;margin-bottom:12pt;margin-left:70.8pt">
<span lang=3D"DE" style=3D"font-size:7.5pt;font-family:Arial,sans-serif;col=
or:gray">Dieses E-Mail ist nur f=C3=BCr den Empf=C3=A4nger bestimmt, an den=
 es gerichtet ist und kann vertrauliches bzw. unter das Berufsgeheimnis fal=
lendes Material enthalten. Jegliche darin
 enthaltene Ansicht oder Meinungs=C3=A4u=C3=9Ferung ist die des Autors und =
stellt nicht notwendigerweise die Ansicht oder Meinung der SEEBURGER AG dar=
. Sind Sie nicht der Empf=C3=A4nger, so haben Sie diese E-Mail irrt=C3=BCml=
ich erhalten und jegliche Verwendung, Ver=C3=B6ffentlichung,
 Weiterleitung, Abschrift oder jeglicher Druck dieser E-Mail ist strengsten=
s untersagt. Weder die SEEBURGER AG noch der Absender (Eckenfels. Bernd) =
=C3=BCbernehmen die Haftung f=C3=BCr Viren; es obliegt Ihrer Verantwortung,=
 die E-Mail und deren Anh=C3=A4nge auf Viren zu pr=C3=BCfen.
</span><u></u><u></u></p>
<p style=3D"margin-right:0cm;margin-bottom:12pt;margin-left:70.8pt">
<span lang=3D"DE" style=3D"font-size:7.5pt;font-family:Arial,sans-serif;col=
or:gray">This email is intended only for the recipient(s) to whom it is add=
ressed. This email may contain confidential material that may be protected =
by professional secrecy. Any fact
 or opinion contained, or expression of the material herein, does not neces=
sarily reflect that of SEEBURGER AG. If you are not the addressee or if you=
 have received this email in error, any use, publication or distribution in=
cluding forwarding, copying or printing
 is strictly prohibited. Neither SEEBURGER AG, nor the sender (Eckenfels. B=
ernd) accept liability for viruses; it is your responsibility to check this=
 email and its attachments for viruses.
</span><u></u><u></u></p>
</div>
</blockquote>
</div>
</div>

</blockquote></div>

--000000000000378ccc05937432eb--