From c065137496f0bd8979497c15cb55f0276dd7cabd Mon Sep 17 00:00:00 2001 From: Alejandro Abdelnur Date: Thu, 21 Aug 2014 19:00:03 +0000 Subject: [PATCH] HADOOP-10967. Improve DefaultCryptoExtension#generateEncryptedKey performance. (hitliuyi via tucu) Conflicts: hadoop-common-project/hadoop-common/CHANGES.txt git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/branches/branch-2@1619551 13f79535-47bb-0310-9956-ffa450edef68 --- hadoop-common-project/hadoop-common/CHANGES.txt | 3 +++ .../crypto/key/KeyProviderCryptoExtension.java | 13 ++++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 9fd9d6cb029..89d75ff4c64 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -300,6 +300,9 @@ Release 2.6.0 - UNRELEASED HADOOP-10862. Miscellaneous trivial corrections to KMS classes. (asuresh via tucu) + HADOOP-10967. Improve DefaultCryptoExtension#generateEncryptedKey + performance. (hitliuyi via tucu) + Release 2.5.0 - 2014-08-11 INCOMPATIBLE CHANGES diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderCryptoExtension.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderCryptoExtension.java index 4327785b0bf..00f8ff7a47c 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderCryptoExtension.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/KeyProviderCryptoExtension.java @@ -219,6 +219,13 @@ public class KeyProviderCryptoExtension extends private static class DefaultCryptoExtension implements CryptoExtension { private final KeyProvider keyProvider; + private static final ThreadLocal RANDOM = + new ThreadLocal() { + @Override + protected SecureRandom initialValue() { + return new SecureRandom(); + } + }; private DefaultCryptoExtension(KeyProvider keyProvider) { this.keyProvider = keyProvider; @@ -233,10 +240,10 @@ public class KeyProviderCryptoExtension extends "No KeyVersion exists for key '%s' ", encryptionKeyName); // Generate random bytes for new key and IV Cipher cipher = Cipher.getInstance("AES/CTR/NoPadding"); - SecureRandom random = SecureRandom.getInstance("SHA1PRNG"); final byte[] newKey = new byte[encryptionKey.getMaterial().length]; - random.nextBytes(newKey); - final byte[] iv = random.generateSeed(cipher.getBlockSize()); + RANDOM.get().nextBytes(newKey); + final byte[] iv = new byte[cipher.getBlockSize()]; + RANDOM.get().nextBytes(iv); // Encryption key IV is derived from new key's IV final byte[] encryptionIV = EncryptedKeyVersion.deriveIV(iv); // Encrypt the new key