High-Speed Cryptography in Java: X25519, Poly1305, and EdDSA
summary
JDK 11 ships Java implementations of X25519 (JEP 324), ChaCha20-Poly1305 (JEP 329) and EdDSA work (JEP 339 in progress). Implementations use branchless finite-field arithmetic with five 51-bit limbs for X25519, mutable objects to avoid GC, and a hand-unrolled inner loop where manual unrolling doubled performance. X25519 in Java runs ~5× faster than existing P-256 code and ~10× faster than BigInteger; EdDSA keygen is ~2× faster than P-256; Poly1305 is ~2× HMAC-SHA256. Panama vector prototypes exist but native AVX still leads.
AI-written summary · about
chapters (27)
- 0:00Intro
- 4:10Sources of Branching in Crypto Code
- 5:29Crypto Algorithms in Context: TLS 1.3
- 6:33Java Cryptography Architecture JCA
- 7:14New Crypto Algorithms in the JDK
- 8:26Benefits of New Algorithms
- 10:15Efficient Branchless Elliptic Curve Implementation
- 11:31Efficient Branchless Finite Field Arithmetic
- 12:46Finite Field Arithmetic in Crypto Algorithms
- 13:37Traditional Big Number Modular Arithmetic
- 14:38Traditional Modular Arithmetic Example
- 15:53Better Modular Arithmetic
- 16:55Modular Arithmetic Example: Curve25519
- 18:23Efficient Modular Reduction
- 19:29Implementation Notes
- 20:35Pure Java Challenges
- 22:02Overview of Solution
- 23:42Finite Field implementation
- 25:05Optimization: Manual Loap Unrolling
- 26:30Benchmarking Overview
- 27:08Benchmarks: X25519/X448
- 28:47Benchmarks: EDSA (1 KB message)
- 29:47Benchmarks: Poly1305
- 30:52Better Code Generation
- 31:57Better Low.level instructions
- 35:00Conclusion
- 35:32Other Sessions
related talks
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
51mJava and Post-Quantum Cryptography
52mSecurity Control Enhancements
39mEvolving the Security of the Java Platform
52mCryptography 101 for Java developers
30mAre we using Java Crypto API Securely ?
48mSecure Java Applications against Quantum Threats
44mMaking the JDK More Secure