Re: AES GCM slow

[Chris Hegarty]

Cross posting to security-dev, since the question cipher related.

-Chris.

On 27/01/14 09:28, Mark Christiaens wrote:

I wrote  a little test client/server setup that transfers 100 MB of data
over an SSL socket configured to use TLS 1.2 AES GCM
(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256).  On my i7-4770 CPU @ 3.40GHz
with OpenJDK 1.8.0-ea-b124 I get a transfer rate of around 5.2
MiB/second.  I expected a higher speed.  Using
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 I reach 100 MiB/s.  Is this to
be expected?

For reference, here is my code:

///// Client.java

package ssl;

import javax.net.ssl.*;
import java.io.*;
import java.util.Arrays;

public class Client {

     public static void main(String[] arstring) {
         try {
             SSLSocketFactory sslsocketfactory = (SSLSocketFactory)
SSLSocketFactory.getDefault();
             SSLSocket sslsocket = (SSLSocket)
sslsocketfactory.createSocket("localhost", 9999);
             Helper.requireAESCipherSuites(sslsocket);
             sslsocket.setEnabledProtocols(new String[]{"TLSv1.2"});

             try (OutputStream outputstream = sslsocket.getOutputStream()) {
                 byte[] buf = new byte[Helper.BUF_SIZE];
                 Arrays.fill(buf, (byte) 1);
                 for (int i = 0; i < Helper.BUF_COUNT; ++i) {
                     outputstream.write(buf);
                 }

                 System.out.println("Using cipher suite: " +
(sslsocket.getSession()).getCipherSuite());

                 outputstream.flush();
             }

         } catch (IOException exception) {
             exception.printStackTrace();
         }
     }
}

///// Server.java

package ssl;

import javax.net.ssl.*;
import java.io.*;

public class Server {

     public static void main(String[] arstring) {
         try {
             SSLServerSocketFactory sslserversocketfactory =
(SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
             SSLServerSocket sslserversocket = (SSLServerSocket)
sslserversocketfactory.createServerSocket(9999);
             SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

             InputStream inputstream = sslsocket.getInputStream();

             byte[] buf = new byte[Helper.BUF_SIZE];
             long bytesToRead = BYTES_TO_READ;

             long startTime = System.currentTimeMillis();

             while (bytesToRead > 0) {
                 bytesToRead -= inputstream.read(buf);
             }

             long stopTime = System.currentTimeMillis();
             long totalTimeMs = stopTime - startTime;
             double mbRead = BYTES_TO_READ / (1024.0 * 1024);
             double totalTimeSeconds = totalTimeMs / 1000.0;
             double mibPerSecond = mbRead / totalTimeSeconds;

             System.out.println("Using cipher suite: " +
(sslsocket.getSession()).getCipherSuite());
             System.out.println("Read " + mbRead + "MiB in " +
totalTimeSeconds + "s");
             System.out.println("Bandwidth: " + mibPerSecond + "MiB/s");

         } catch (IOException exception) {
             exception.printStackTrace();
         }
     }

     private static final int BYTES_TO_READ = Helper.BUF_COUNT *
Helper.BUF_SIZE;
}

///// Helper.java

package ssl;

import java.util.*;
import java.util.regex.*;
import javax.net.ssl.*;

public class Helper {

     static int BUF_SIZE = 1024 * 1024;
     static int BUF_COUNT = 100;

     static SSLSocket requireAESCipherSuites(SSLSocket socket) {
         String supportedCipherSuites[] = socket.getSupportedCipherSuites();

         System.out.println("Supported cipher suite: " +
Arrays.toString(supportedCipherSuites));

         List<String> selectedCipherSuites = new ArrayList<>();

//        String patternString = ".*";
         String patternString = "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256";
//        String patternString = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256";

         Pattern pattern = Pattern.compile(patternString);

         for (String cipherSuite : supportedCipherSuites) {
             Matcher matcher = pattern.matcher(cipherSuite);
             if (matcher.find()) {
                 selectedCipherSuites.add(cipherSuite);
             }
         }

         System.out.println("Selected cipher suites: " +
selectedCipherSuites);

         socket.setEnabledCipherSuites(selectedCipherSuites.toArray(new
String[0]));

         return socket;
     }
}