Replaced an O(N) algorithm with an O(1) algorithm. This shaves off 2/3 of the server cert checking time or ~200ms on Sapphire. This is in preparation for tripling the number of certs in an upcoming change.

1 files changed, 16 insertions, 1 deletions

diff --git a/security/src/main/java/org/bouncycastle/jce/provider/IndexedPKIXParameters.java b/security/src/main/java/org/bouncycastle/jce/provider/IndexedPKIXParameters.java
index e8e834a..03679e2 100644
--- a/security/src/main/java/org/bouncycastle/jce/provider/IndexedPKIXParameters.java
+++ b/security/src/main/java/org/bouncycastle/jce/provider/IndexedPKIXParameters.java
@@ -109,7 +109,7 @@ public class IndexedPKIXParameters extends PKIXParameters {
             if (anchor != null) {
                 return anchor;
             }
-        } catch (Exception e) { 
+        } catch (Exception e) {
             Logger.getLogger(IndexedPKIXParameters.class.getName()).log(
                     Level.WARNING, "Error encoding cert.", e);
         }
@@ -125,6 +125,21 @@ public class IndexedPKIXParameters extends PKIXParameters {
     }
 
     /**
+     * Returns true if the given certificate is found in the trusted key
+     * store.
+     */
+    public boolean isDirectlyTrusted(X509Certificate cert) {
+        try {
+            Bytes encoded = new Bytes(cert.getEncoded());
+            return encodings.containsKey(encoded);
+        } catch (Exception e) {
+            Logger.getLogger(IndexedPKIXParameters.class.getName()).log(
+                    Level.WARNING, "Error encoding cert.", e);
+            return false;
+        }
+    }
+
+    /**
      * Wraps a byte[] and adds equals() and hashCode() support.
      */
     static class Bytes {