Check Send/Sync

[fortanix]

Check Send/Sync

[jethrogb]

I did some investigation:

Pk is Sync if:

• It's an RSA key and mbedTLS threading is enabled.
• It's an EC key of type ECKEY
  • In general: EC operations are not Sync, and in particular mbedtls_ecp_mul, mbedtls_ecp_muladd and by extension mbedtls_ecdsa_sign and mbedtls_ecdsa_verify.
  • The PK wrapper for keys of type ECKEY makes a stack-local copy of the necessary data (EC group) before invoking any of the above-mentioned functions
• It's an EC key of type ECKEY_DH (because no operation can be called on such a key, only sign/verify/encrypt/decrypt are supported on Pk. DH operations are separate)

Pk is not Sync if:

• It's an EC key of type ECDSA. There are no stack-local copies. It's very unlikely you'll have a Pk with an EC key type of ECDSA, because loading from DER/PEM always results in a ECKEY or ECKEY_DH (see mbedtls_oid_get_pk_alg).

Operations directly on the underlying key objects of a Pk of any EC type are probably not Sync.

All of Config's and Context's uses of a shared Pk are therefore probably Sync.

[jethrogb]

Problem: SSL Context is only Sync if the RNG is Sync