[
https://issues.apache.org/jira/browse/LUCENE-9379?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17151920#comment-17151920
]
Bruno Roustant commented on LUCENE-9379:
----------------------------------------
I tested with FST ON-HEAP: we gain +15% to +20% perf on all queries.
I tested my Light version of javax.crypto.Cipher. It is indeed much faster for
construction and cloning, but not for the core encryption. The reason is that
two internal classes in com.sun.crypto have an @HotSpotIntrinsicCandidate
annotation that makes the encryption extremely fast.
I tested with a hack version that takes the best of the two versions. It brings
a cumulative +10% perf improvement.
So as a conclusion for the perf benchmark:
* An OS level encryption is best and fastest.
* If really it’s not possible, expect an average of -20% perf impact on most
queries, -60% on multiterm queries.
* If you need more you can make FST on-heap and expect +15% perf.
* If you need more you can use a Cipher hack to get +10% perf.
> Directory based approach for index encryption
> ---------------------------------------------
>
> Key: LUCENE-9379
> URL: https://issues.apache.org/jira/browse/LUCENE-9379
> Project: Lucene - Core
> Issue Type: New Feature
> Reporter: Bruno Roustant
> Assignee: Bruno Roustant
> Priority: Major
> Time Spent: 2h 20m
> Remaining Estimate: 0h
>
> The goal is to provide optional encryption of the index, with a scope limited
> to an encryptable Lucene Directory wrapper.
> Encryption is at rest on disk, not in memory.
> This simple approach should fit any Codec as it would be orthogonal, without
> modifying APIs as much as possible.
> Use a standard encryption method. Limit perf/memory impact as much as
> possible.
> Determine how callers provide encryption keys. They must not be stored on
> disk.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
