The queue is necessary because we can only decrypt 16 bytes at a time, but the client of this code does not necessarily read 16 block at a time. As a solution for this, all 16 bytes will go to a queue, and if for instance the client only reads 2 bytes, the other 14 will stay in the queue and will be directly read (without decrypting) the next time.

Also, performance wise I don't think there's an issue, because it only involve in memory access without any difficult calculation. I checked, the performance culprit in this class is the SHA1 calculation.