improved performance and battery usage on older devices

lib/push/push_decryptor.dart

@@ -1,7 +1,7 @@
 import 'dart:convert';
-import 'dart:typed_data';
 
 import 'package:crypton/crypton.dart';
+import 'package:flutter/foundation.dart';
 import 'package:pointycastle/export.dart' as pc;
 
 import 'push_subject.dart';
@@ -25,6 +25,14 @@ class PushDecryptor {
 
   const PushDecryptor({required this.devicePrivateKey, this.serverPublicKey});
 
+  /// [verify] + [decrypt] on a background isolate: pure-Dart RSA-2048 (with
+  /// the OAEP → PKCS#1 fallback) takes tens of ms up to >100 ms on older
+  /// phones, which would otherwise land on the UI thread for every push.
+  Future<({bool verified, PushSubject? subject})> verifyAndDecryptInBackground(
+    String subjectBase64,
+    String signatureBase64,
+  ) => compute(_verifyAndDecrypt, (this, subjectBase64, signatureBase64));
+
   /// Returns true when [signatureBase64] is a valid server signature over the
   /// encrypted subject. Returns true when no server key is configured (the
   /// proxy already verified the signature before forwarding).
@@ -75,3 +83,13 @@ class PushDecryptor {
     }
   }
 }
+
+({bool verified, PushSubject? subject}) _verifyAndDecrypt(
+  (PushDecryptor, String, String) args,
+) {
+  final (decryptor, subject, signature) = args;
+  if (!decryptor.verify(subject, signature)) {
+    return (verified: false, subject: null);
+  }
+  return (verified: true, subject: decryptor.decrypt(subject));
+}

lib/push/push_message_handler.dart

@@ -178,11 +178,15 @@ class PushMessageHandler {
       devicePrivateKey: privateKey,
       serverPublicKey: serverPublicKey,
     );
-    if (!decryptor.verify(subjectBase64, signatureBase64)) {
+    final result = await decryptor.verifyAndDecryptInBackground(
+      subjectBase64,
+      signatureBase64,
+    );
+    if (!result.verified) {
       log('Push: signature verification failed');
       return;
     }
-    final subject = decryptor.decrypt(subjectBase64);
+    final subject = result.subject;
     if (subject == null) {
       log('Push: could not decrypt subject');
       return;