Optimize `crypto::tink::subtle::EncryptThenAuthenticate::Decrypt` by removing a redundant deep copy of the decrypted plaintext. `Decrypt` stores the result of `ind_cpa_cipher_->Decrypt(payload)` in a local `StatusOr<string>`, checks the status, then returns `pt.value()`. Because `.value()` on an lvalue `StatusOr` returns `const T&`, this forces a full deep copy of the decrypted string into the returned `StatusOr`. For large plaintexts, this temporarily doubles the live memory. The fix returns `ind_cpa_cipher_->Decrypt(payload)` directly, which allows the compiler to construct the return value in-place (guaranteed copy elision via prvalue). The MAC verification is performed before this point, so there is no change in behavior. Compiler Explorer demonstrations showing that returning a member of a local struct (analogous to `.value()` on a local `StatusOr`) forces a copy, while returning the expression directly enables elision: - `std::vector<int>` member (Clang): https://godbolt.org/z/fGcEojM89 - `std::vector<int>` member (GCC): https://godbolt.org/z/vWExP8bva - `std::string` member, multi-member struct: https://godbolt.org/z/TMs7srs7T - `std::string` member, single-member struct: https://godbolt.org/z/3ToPWK8r3 PiperOrigin-RevId: 946327633 Change-Id: I833496d9db3aef477e038396fb6fd1c1cc408e4c
| Test | GCP Ubuntu | macOS | GCP Windows |
|---|---|---|---|
| Bazel |  |  |  |
| Bazel w/ BoringCrypto (FIPS) |  | N/A | N/A |
| CMake |  |  |  |
| CMake w/ OpenSSL |  |  | N/A |
| CMake w/ OpenSSL3 |  | N/A | N/A |
| CMake w/ Installed Deps |  | N/A | N/A |
Using crypto in your application shouldn't have to feel like juggling chainsaws in the dark. Tink is a crypto library written by a group of cryptographers and security engineers at Google. It was born out of our extensive experience working with Google's product teams, fixing weaknesses in implementations, and providing simple APIs that can be used safely without needing a crypto background.
Tink provides secure APIs that are easy to use correctly and hard(er) to misuse. It reduces common crypto pitfalls with user-centered design, careful implementation and code reviews, and extensive testing. At Google, Tink is one of the standard crypto libraries, and has been deployed in hundreds of products and systems.
To get a quick overview of Tink's design please take a look at Tink's goals.
The official documentation is available at https://developers.google.com/tink.
If you want to contribute, please read CONTRIBUTING and send us pull requests. You can also report bugs or file feature requests.
If you'd like to talk to the developers or get notified about major product updates, you may want to subscribe to our mailing list.
Tink is maintained by (A-Z):
Alumni: