Is AesGcm thread safe?

[kostya9]

I would like to cache the AesGcm instance in a way that only one instance is created per key, but I have not found any documentation if I can use one AesGcm instance in multiple threads concurrently (imagine a web API use-case).

Can I reuse one AesGcm instance across multiple threads?

[PathogenDavid]

You cannot.

Looking at the implementation of EncryptCore (specifically the OpenSSL implementation) you can see there's state being stored in the _ctxHandle that would not appreciate differing across threads.

[kostya9]

Ah, I feared that's the case. I came to the same conclusion but wanted to double-check and get a second opinion. Thanks!

[TonyValenti]

You could likely wrap the class and put the appropriate locks in place though.

[Xyncgas]

Or use Bouncy Castle !

[GrabYourPitchforks]

@PathogenDavid answered the question for this type specifically.

But in general, the rule of thumb is that instance APIs are not thread-safe for multiple callers. If there are exceptions, they'll be called out in the API documentation. See the Dictionary<TKey, TValue> docs and the HttpClient docs for examples of what it looks like when the docs call out these special-cases.