palantir / palantir/conjure-java-runtime
CipherSuites should prioritise faster suites on Java11
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 95
- Forks
- 96
- Avg merge
- 3h 38m
- Merged PRs (30d)
- 33
Description
Current world
Currently, CipherSuites.java contains an ordered list of 'fastCipherSuites'. This has been hand tuned for Java8, but doesn't take advantage of the fast new CPU instructions on newer JVMs.
This means that as we move to Java11, we're leaving performance on the table (an internal benchmark shows TLS_RSA_WITH_AES_128_GCM_SHA256 coming out on top, but this is right at the bottom of our list!)
Proposal
Ensure CipherSuites returns suites fastest first, automatically detecting Java8 or Java11.
(Example output from an internal benchmark)
| Benchmark | JDK | (cipher) | Score | Error | Units |
|---|---|---|---|---|---|
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_128_GCM_SHA256 | 352.28 | 3.21 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_256_GCM_SHA384 | 345.29 | 2.44 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 260.97 | 5.7 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 230.26 | 1.39 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_128_CBC_SHA256 | 228.43 | 3.15 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_256_CBC_SHA256 | 220.38 | 2.18 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_128_CBC_SHA | 187.2 | 1.36 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_128_CBC_SHA | 182.45 | 3.42 | MiB/s |
| sendOneMegabyte | 11.0.1 | TLS_RSA_WITH_AES_256_CBC_SHA | 180.7 | 1.89 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_256_CBC_SHA | 176.09 | 2.19 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 164.35 | 5.11 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_128_CBC_SHA256 | 131.06 | 2.47 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | 130.47 | 2.93 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_256_CBC_SHA256 | 127.47 | 0.97 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_128_GCM_SHA256 | 59.77 | 1.23 | MiB/s |
| sendOneMegabyte | 1.8.0_192 | TLS_RSA_WITH_AES_256_GCM_SHA384 | 58.83 | 0.87 | MiB/s |
cc @dansanduleac
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with client-config/src/main/java/com/palantir/conjure/java/client/config/CipherSuites.java and review how the ordered fastCipherSuites list is selected. Compare the benchmark results for Java 8 and Java 11, then make the selection detect the runtime version and return the appropriate suites fastest first. Done means Java 8 and Java 11 each receive their intended ordering.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, performance
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100