CODEWITHSUNDEEP
javassljava-native-interfacetls1.2
user3236898
user3236898

Reputation: 69

SunJCE vs OpenSSL

Recently I did replacement of SunJCE with OpenSSLJCE, a private package which implements JCE using Openssl primitives(native library) for TLS termination.

Around 35% of performance improvement has been observed by using OpenSSLJCE.

My questions are,

  1. What would be reason of this performance gain? Is it just because openssl is executing in native code?

  2. I believe that SunJCE is decrypting(TLS termination) the content which is in java heap, while native Openssl needs to copy the content to process heap then decrypt the content and send it back to java heap, which involves two copies. Is my understanding correct?

Please provide your suggestions and references.

Upvotes: 2

Views: 980

Answers (1)

Sergey V.
Sergey V.

Reputation: 858

I'll try to answer your first question by providing my example. I've created a JMeter test to create TLS connections to a Java application. As load get increased Java application had a significant challenge to handle TLS handshakes as it seems a very expensive operation for Java. I've run another test on the same hardware, where Nginx was responsible to terminate TLS and proxy TCP connection to Java application. Nginx (which is using OpenSSL) had no issues at all to handle the same load.

OpenSSL is definitely using hardware acceleration for its crypto processing.

The following article compares performance of different JCEs and the role of hardware acceleration: https://developer.ibm.com/javasdk/2018/02/16/performance-ibm-jdk-security-ibmjceplus/

Upvotes: 2

Related Questions