AES-KWP Performance Improvements for Apple

[vcsjones]

This gives anywhere for a 5x to 10x performance improvement for AES-KWP on Apple and reduces allocations for any input larger than 8 bytes. That is expected to be the common use case, as wrapping even a small symmetric key like AES is going to be 16 bytes.

The general theme of the change is not using EncryptEcb on our internal AesImplementation. Each invocation of EncryptEcb creates and tears down handles. We need to keep calling EncryptEcb in our base class implementation because it protected virtual and we need to keep calling the virtual.

The sealed internal implementation can fast-path this though by re-using a lite cipher for each invocation of ECB.

"Single block" inputs don't change and are basically noise and are within error.

For [1, 8] there is no performance change.
For (8, 512] the improvement is ~5x.
For (512..] the improvement is ~10x.

Allocations are significantly down. Previously the allocations linearly scaled with the input length. Now the allocations are constant regardless of the input size. For example, before this change a 4096 input allocated 221,192 bytes. It now allocates 72.

---

What about Windows? That will be a follow up PR.

---

Method	Job	PlaintextLength	Mean	Ratio	Allocated	Alloc Ratio
EncryptKeyWrapPadded	branch	1	286.9 ns	1.01	72 B	1.00
EncryptKeyWrapPadded	main	1	283.4 ns	1.00	72 B	1.00
DecryptKeyWrapPadded	branch	1	306.3 ns	0.99	72 B	1.00
DecryptKeyWrapPadded	main	1	310.1 ns	1.00	72 B	1.00
EncryptKeyWrapPadded	branch	8	287.7 ns	1.01	72 B	1.00
EncryptKeyWrapPadded	main	8	283.9 ns	1.00	72 B	1.00
DecryptKeyWrapPadded	branch	8	288.7 ns	0.97	72 B	1.00
DecryptKeyWrapPadded	main	8	297.0 ns	1.00	72 B	1.00
EncryptKeyWrapPadded	branch	15	594.4 ns	0.17	72 B	0.08
EncryptKeyWrapPadded	main	15	3,439.5 ns	1.00	864 B	1.00
DecryptKeyWrapPadded	branch	15	600.5 ns	0.17	72 B	0.08
DecryptKeyWrapPadded	main	15	3,542.5 ns	1.00	864 B	1.00
EncryptKeyWrapPadded	branch	16	633.2 ns	0.18	72 B	0.08
EncryptKeyWrapPadded	main	16	3,539.1 ns	1.00	864 B	1.00
DecryptKeyWrapPadded	branch	16	607.5 ns	0.17	72 B	0.08
DecryptKeyWrapPadded	main	16	3,520.2 ns	1.00	864 B	1.00
EncryptKeyWrapPadded	branch	512	11,922.3 ns	0.11	72 B	0.003
EncryptKeyWrapPadded	main	512	110,421.3 ns	1.00	27649 B	1.000
DecryptKeyWrapPadded	branch	512	10,237.2 ns	0.09	72 B	0.003
DecryptKeyWrapPadded	main	512	110,095.8 ns	1.00	27649 B	1.000
EncryptKeyWrapPadded	branch	513	10,392.5 ns	0.09	72 B	0.003
EncryptKeyWrapPadded	main	513	109,674.0 ns	1.00	28081 B	1.000
DecryptKeyWrapPadded	branch	513	10,383.4 ns	0.09	72 B	0.003
DecryptKeyWrapPadded	main	513	111,808.8 ns	1.00	28081 B	1.000
EncryptKeyWrapPadded	branch	4096	93,152.7 ns	0.11	72 B	0.000
EncryptKeyWrapPadded	main	4096	882,443.6 ns	1.00	221192 B	1.000
DecryptKeyWrapPadded	branch	4096	79,761.4 ns	0.09	72 B	0.000
DecryptKeyWrapPadded	main	4096	881,431.3 ns	1.00	221192 B	1.000
EncryptKeyWrapPadded	branch	4097	79,879.8 ns	0.09	72 B	0.000
EncryptKeyWrapPadded	main	4097	867,367.3 ns	1.00	221624 B	1.000
DecryptKeyWrapPadded	branch	4097	80,013.8 ns	0.09	72 B	0.000
DecryptKeyWrapPadded	main	4097	889,664.7 ns	1.00	221624 B	1.000

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Improves the Apple-specific AES Key Wrap with Padding (RFC 5649) implementation by avoiding repeated per-block EncryptEcb/DecryptEcb setup costs, while keeping the base Aes virtual implementation behaviorally equivalent.

Changes:

• Refactors Aes key-wrap core logic to support injecting an ECB “transform” delegate (enabling reuse of a single ECB cipher across many block operations).
• Adds an Apple AesImplementation override for key wrap padded encrypt/decrypt that uses a single AppleCCCryptorLite instance for the whole operation (reducing setup overhead and allocations).

Show a summary per file

File	Description
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/AesImplementation.Apple.cs	Adds Apple-specific EncryptKeyWrapPaddedCore/DecryptKeyWrapPaddedCore overrides that reuse a single ECB lite cipher across the full wrap/unwrap operation.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/Aes.cs	Introduces delegate-based helper overloads for RFC3394 wrap/unwrap so platform implementations can supply a fast ECB transform without changing the protected virtual surface behavior.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0