Skip to content

Commit d52289b

Browse files
rwinchrwinch
committed
Remove Unnecessary Backwards Compatability
Since this is going to be merged into Spring Security 7 (a major release) and AESFastEngine is deprecated, we should no longer support it (as it will likely be removed from Bouncy Castle)
1 parent 5eb232c commit d52289b

File tree

3 files changed

+6
-103
lines changed

3 files changed

+6
-103
lines changed

‎crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesCbcBytesEncryptor.java

+4-22
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,9 @@
1616

1717
package org.springframework.security.crypto.encrypt;
1818

19-
import java.util.function.Supplier;
20-
2119
import org.bouncycastle.crypto.BufferedBlockCipher;
2220
import org.bouncycastle.crypto.InvalidCipherTextException;
2321
import org.bouncycastle.crypto.engines.AESEngine;
24-
import org.bouncycastle.crypto.engines.AESFastEngine;
2522
import org.bouncycastle.crypto.modes.CBCBlockCipher;
2623
import org.bouncycastle.crypto.modes.CBCModeCipher;
2724
import org.bouncycastle.crypto.paddings.PKCS7Padding;
@@ -41,8 +38,6 @@
4138
*/
4239
public class BouncyCastleAesCbcBytesEncryptor extends BouncyCastleAesBytesEncryptor {
4340

44-
private Supplier<CBCModeCipher> cipherFactory = () -> CBCBlockCipher.newInstance(AESEngine.newInstance());
45-
4641
public BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt) {
4742
super(password, salt);
4843
}
@@ -54,19 +49,19 @@ public BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt, Byte
5449
@Override
5550
public byte[] encrypt(byte[] bytes) {
5651
byte[] iv = this.ivGenerator.generateKey();
57-
PaddedBufferedBlockCipher blockCipher = new PaddedBufferedBlockCipher(this.cipherFactory.get(),
58-
new PKCS7Padding());
52+
CBCModeCipher cbcModeCipher = CBCBlockCipher.newInstance(AESEngine.newInstance());
53+
PaddedBufferedBlockCipher blockCipher = new PaddedBufferedBlockCipher(cbcModeCipher, new PKCS7Padding());
5954
blockCipher.init(true, new ParametersWithIV(this.secretKey, iv));
6055
byte[] encrypted = process(blockCipher, bytes);
6156
return (iv != null) ? EncodingUtils.concatenate(iv, encrypted) : encrypted;
6257
}
6358

6459
@Override
6560
public byte[] decrypt(byte[] encryptedBytes) {
61+
CBCModeCipher cbcModeCipher = CBCBlockCipher.newInstance(AESEngine.newInstance());
6662
byte[] iv = EncodingUtils.subArray(encryptedBytes, 0, this.ivGenerator.getKeyLength());
6763
encryptedBytes = EncodingUtils.subArray(encryptedBytes, this.ivGenerator.getKeyLength(), encryptedBytes.length);
68-
PaddedBufferedBlockCipher blockCipher = new PaddedBufferedBlockCipher(this.cipherFactory.get(),
69-
new PKCS7Padding());
64+
PaddedBufferedBlockCipher blockCipher = new PaddedBufferedBlockCipher(cbcModeCipher, new PKCS7Padding());
7065
blockCipher.init(false, new ParametersWithIV(this.secretKey, iv));
7166
return process(blockCipher, encryptedBytes);
7267
}
@@ -88,17 +83,4 @@ private byte[] process(BufferedBlockCipher blockCipher, byte[] in) {
8883
return out;
8984
}
9085

91-
/**
92-
* Used to test compatibility with deprecated {@link AESFastEngine}.
93-
*/
94-
@SuppressWarnings("deprecation")
95-
static BouncyCastleAesCbcBytesEncryptor withAESFastEngine(String password, CharSequence salt,
96-
BytesKeyGenerator ivGenerator) {
97-
BouncyCastleAesCbcBytesEncryptor bytesEncryptor = new BouncyCastleAesCbcBytesEncryptor(password, salt,
98-
ivGenerator);
99-
bytesEncryptor.cipherFactory = () -> new CBCBlockCipher(new AESFastEngine());
100-
101-
return bytesEncryptor;
102-
}
103-
10486
}

‎crypto/src/main/java/org/springframework/security/crypto/encrypt/BouncyCastleAesGcmBytesEncryptor.java

+2-21
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,8 @@
1616

1717
package org.springframework.security.crypto.encrypt;
1818

19-
import java.util.function.Supplier;
20-
2119
import org.bouncycastle.crypto.InvalidCipherTextException;
2220
import org.bouncycastle.crypto.engines.AESEngine;
23-
import org.bouncycastle.crypto.engines.AESFastEngine;
2421
import org.bouncycastle.crypto.modes.AEADBlockCipher;
2522
import org.bouncycastle.crypto.modes.GCMBlockCipher;
2623
import org.bouncycastle.crypto.params.AEADParameters;
@@ -39,9 +36,6 @@
3936
*/
4037
public class BouncyCastleAesGcmBytesEncryptor extends BouncyCastleAesBytesEncryptor {
4138

42-
private Supplier<GCMBlockCipher> cipherFactory = () -> (GCMBlockCipher) GCMBlockCipher
43-
.newInstance(AESEngine.newInstance());
44-
4539
public BouncyCastleAesGcmBytesEncryptor(String password, CharSequence salt) {
4640
super(password, salt);
4741
}
@@ -53,7 +47,7 @@ public BouncyCastleAesGcmBytesEncryptor(String password, CharSequence salt, Byte
5347
@Override
5448
public byte[] encrypt(byte[] bytes) {
5549
byte[] iv = this.ivGenerator.generateKey();
56-
AEADBlockCipher blockCipher = this.cipherFactory.get();
50+
AEADBlockCipher blockCipher = GCMBlockCipher.newInstance(AESEngine.newInstance());
5751
blockCipher.init(true, new AEADParameters(this.secretKey, 128, iv, null));
5852
byte[] encrypted = process(blockCipher, bytes);
5953
return (iv != null) ? EncodingUtils.concatenate(iv, encrypted) : encrypted;
@@ -63,7 +57,7 @@ public byte[] encrypt(byte[] bytes) {
6357
public byte[] decrypt(byte[] encryptedBytes) {
6458
byte[] iv = EncodingUtils.subArray(encryptedBytes, 0, this.ivGenerator.getKeyLength());
6559
encryptedBytes = EncodingUtils.subArray(encryptedBytes, this.ivGenerator.getKeyLength(), encryptedBytes.length);
66-
AEADBlockCipher blockCipher = this.cipherFactory.get();
60+
AEADBlockCipher blockCipher = GCMBlockCipher.newInstance(AESEngine.newInstance());
6761
blockCipher.init(false, new AEADParameters(this.secretKey, 128, iv, null));
6862
return process(blockCipher, encryptedBytes);
6963
}
@@ -85,17 +79,4 @@ private byte[] process(AEADBlockCipher blockCipher, byte[] in) {
8579
return out;
8680
}
8781

88-
/**
89-
* Used to test compatibility with deprecated {@link AESFastEngine}.
90-
*/
91-
@SuppressWarnings("deprecation")
92-
static BouncyCastleAesGcmBytesEncryptor withAESFastEngine(String password, CharSequence salt,
93-
BytesKeyGenerator ivGenerator) {
94-
BouncyCastleAesGcmBytesEncryptor bytesEncryptor = new BouncyCastleAesGcmBytesEncryptor(password, salt,
95-
ivGenerator);
96-
bytesEncryptor.cipherFactory = () -> new GCMBlockCipher(new AESFastEngine());
97-
98-
return bytesEncryptor;
99-
}
100-
10182
}

‎crypto/src/test/java/org/springframework/security/crypto/encrypt/BouncyCastleAesBytesEncryptorEquivalencyTests.java

-60
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@
2323
import java.util.UUID;
2424

2525
import org.junit.jupiter.api.BeforeEach;
26-
import org.junit.jupiter.api.Disabled;
27-
import org.junit.jupiter.api.RepeatedTest;
2826
import org.junit.jupiter.api.Test;
2927

3028
import org.springframework.security.crypto.codec.Hex;
@@ -93,64 +91,6 @@ public void bouncyCastleAesGcmWithSecureIvCompatible() throws Exception {
9391
testCompatibility(bcEncryptor, jceEncryptor);
9492
}
9593

96-
@Test
97-
public void bouncyCastleAesGcmWithAESFastEngineCompatible() throws Exception {
98-
CryptoAssumptions.assumeGCMJCE();
99-
BytesEncryptor fastEngineEncryptor = BouncyCastleAesGcmBytesEncryptor.withAESFastEngine(this.password,
100-
this.salt, KeyGenerators.secureRandom(16));
101-
BytesEncryptor defaultEngineEncryptor = new BouncyCastleAesGcmBytesEncryptor(this.password, this.salt,
102-
KeyGenerators.secureRandom(16));
103-
testCompatibility(fastEngineEncryptor, defaultEngineEncryptor);
104-
}
105-
106-
@Test
107-
public void bouncyCastleAesCbcWithAESFastEngineCompatible() throws Exception {
108-
CryptoAssumptions.assumeCBCJCE();
109-
BytesEncryptor fastEngineEncryptor = BouncyCastleAesCbcBytesEncryptor.withAESFastEngine(this.password,
110-
this.salt, KeyGenerators.secureRandom(16));
111-
BytesEncryptor defaultEngineEncryptor = new BouncyCastleAesCbcBytesEncryptor(this.password, this.salt,
112-
KeyGenerators.secureRandom(16));
113-
testCompatibility(fastEngineEncryptor, defaultEngineEncryptor);
114-
}
115-
116-
/**
117-
* Comment out @Disabled below to compare relative speed of deprecated AESFastEngine
118-
* with the default AESEngine.
119-
*/
120-
@Disabled
121-
@RepeatedTest(100)
122-
public void bouncyCastleAesGcmWithAESFastEngineSpeedTest() throws Exception {
123-
CryptoAssumptions.assumeGCMJCE();
124-
BytesEncryptor defaultEngineEncryptor = new BouncyCastleAesGcmBytesEncryptor(this.password, this.salt,
125-
KeyGenerators.secureRandom(16));
126-
BytesEncryptor fastEngineEncryptor = BouncyCastleAesGcmBytesEncryptor.withAESFastEngine(this.password,
127-
this.salt, KeyGenerators.secureRandom(16));
128-
long defaultNanos = testSpeed(defaultEngineEncryptor);
129-
long fastNanos = testSpeed(fastEngineEncryptor);
130-
System.out.println(nanosToReadableString("AES GCM w/Default Engine", defaultNanos));
131-
System.out.println(nanosToReadableString("AES GCM w/ Fast Engine", fastNanos));
132-
assertThat(fastNanos).isLessThan(defaultNanos);
133-
}
134-
135-
/**
136-
* Comment out @Disabled below to compare relative speed of deprecated AESFastEngine
137-
* with the default AESEngine.
138-
*/
139-
@Disabled
140-
@RepeatedTest(100)
141-
public void bouncyCastleAesCbcWithAESFastEngineSpeedTest() throws Exception {
142-
CryptoAssumptions.assumeCBCJCE();
143-
BytesEncryptor defaultEngineEncryptor = new BouncyCastleAesCbcBytesEncryptor(this.password, this.salt,
144-
KeyGenerators.secureRandom(16));
145-
BytesEncryptor fastEngineEncryptor = BouncyCastleAesCbcBytesEncryptor.withAESFastEngine(this.password,
146-
this.salt, KeyGenerators.secureRandom(16));
147-
long defaultNanos = testSpeed(defaultEngineEncryptor);
148-
long fastNanos = testSpeed(fastEngineEncryptor);
149-
System.out.println(nanosToReadableString("AES CBC w/Default Engine", defaultNanos));
150-
System.out.println(nanosToReadableString("AES CBC w/ Fast Engine", fastNanos));
151-
assertThat(fastNanos).isLessThan(defaultNanos);
152-
}
153-
15494
private void testEquivalence(BytesEncryptor left, BytesEncryptor right) {
15595
for (int size = 1; size < 2048; size++) {
15696
this.testData = new byte[size];

0 commit comments

Comments
 (0)