SEC-2521: Improve StandardPasswordEncoder performance

crypto/src/main/java/org/springframework/security/crypto/password/Digester.java

@@ -17,7 +17,6 @@ package org.springframework.security.crypto.password;
 
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
 
 /**
  * Helper for working with the MessageDigest API.
@@ -30,7 +29,7 @@ import java.security.NoSuchProviderException;
  */
 final class Digester {
 
-	private final MessageDigest messageDigest;
+	private final String algorithm;
 
 	private final int iterations;
 
@@ -40,22 +39,26 @@ final class Digester {
 	 * @param iterations the number of times to apply the digest algorithm to the input
 	 */
 	public Digester(String algorithm, int iterations) {
-		try {
-			messageDigest = MessageDigest.getInstance(algorithm);
-		}
-		catch (NoSuchAlgorithmException e) {
-			throw new IllegalStateException("No such hashing algorithm", e);
-		}
-
+		// eagerly validate the algorithm
+		createDigest(algorithm);
+		this.algorithm = algorithm;
 		this.iterations = iterations;
 	}
 
 	public byte[] digest(byte[] value) {
-		synchronized (messageDigest) {
-			for (int i = 0; i < iterations; i++) {
-				value = messageDigest.digest(value);
-			}
-			return value;
+		MessageDigest messageDigest = createDigest(algorithm);
+		for (int i = 0; i < iterations; i++) {
+			value = messageDigest.digest(value);
+		}
+		return value;
+	}
+
+	private static MessageDigest createDigest(String algorithm) {
+		try {
+			return MessageDigest.getInstance(algorithm);
+		}
+		catch (NoSuchAlgorithmException e) {
+			throw new IllegalStateException("No such hashing algorithm", e);
 		}
 	}
 }