Botan 3.11.0
Crypto and TLS for C&
Namespaces | Classes | Concepts | Typedefs | Enumerations | Functions | Variables
Botan Namespace Reference

Namespaces

namespace  AES_AARCH64
namespace  ARIA_AVX512
namespace  ARIA_F
namespace  ASN1
namespace  Camellia_AVX2_GFNI
namespace  Camellia_AVX512
namespace  Camellia_F
namespace  Cert_Extension
namespace  CMCE_CT
namespace  concepts
namespace  CryptoBox
namespace  CRYSTALS
namespace  CT
namespace  detail
namespace  Dilithium_Algos
namespace  fmt_detail
namespace  FPE
namespace  HTTP
namespace  KeyPair
namespace  Kuznyechik_F
namespace  Kyber_Algos
namespace  OCSP
namespace  OIDS
namespace  OS
namespace  PCurve
namespace  PEM_Code
namespace  PK_Ops
namespace  PKCS11
namespace  PKCS8
namespace  PKIX
namespace  ranges
namespace  Roughtime
namespace  Serpent_F
namespace  SHA1_F
namespace  SHACAL2_AVX2_F
namespace  SHACAL2_AVX512_F
namespace  SM4_AVX512_GFNI
namespace  Sodium
namespace  Threefish_F
namespace  TLS
namespace  TPM2
namespace  Twofish_KS
namespace  X509

Classes

class  Adler32
class  AEAD_Mode
class  AES_128
class  AES_192
class  AES_256
class  AES_256_CTR_XOF
class  AffineCurvePoint
class  AffinePointTable
class  Algorithm_Not_Found
class  AlgorithmIdentifier
class  AlignmentBuffer
 Alignment buffer helper. More...
struct  all_same
class  Allocator_Initializer
class  AlternativeName
class  ANSI_X919_MAC
class  ANSI_X923_Padding
class  Argon2
class  Argon2_Family
class  ARIA_128
class  ARIA_192
class  ARIA_256
class  Ascon_AEAD128_Decryption
class  Ascon_AEAD128_Encryption
class  Ascon_AEAD128_Mode
class  Ascon_Hash256
class  Ascon_p
class  Ascon_XOF128
class  ASN1_Formatter
class  ASN1_Object
class  ASN1_Pretty_Printer
class  ASN1_String
class  ASN1_Time
class  Asymmetric_Key
class  Atomic
class  Attribute
class  AutoSeeded_RNG
class  Barrett_Reduction
class  Barrier
class  Base64_Decoder
class  Base64_Encoder
class  Bcrypt_PBKDF
class  Bcrypt_PBKDF_Family
class  BER_Bad_Tag
class  BER_Decoder
class  BER_Decoding_Error
class  BER_Object
class  BigInt
class  BitBucket
class  bitvector_base
class  BLAKE2b
class  BLAKE2bMAC
class  BLAKE2s
class  BlindedScalarBits
class  Blinder
class  Block_Cipher_Fixed_Params
class  BlockCipher
class  BlockCipherModePaddingMethod
class  Blowfish
class  Buffered_Computation
class  Buffered_Filter
class  BufferSlicer
class  BufferStuffer
 Helper class to ease in-place marshalling of concatenated fixed-length values. More...
class  Bzip2_Compression
class  Bzip2_Decompression
class  calendar_point
class  Camellia_128
class  Camellia_192
class  Camellia_256
class  Cascade_Cipher
class  CAST_128
class  CBC_Decryption
class  CBC_Encryption
class  CBC_Mode
class  CCM_Decryption
class  CCM_Encryption
class  CCM_Mode
class  Certificate_Extension
class  Certificate_Store
class  Certificate_Store_In_Memory
class  Certificate_Store_In_SQL
class  Certificate_Store_In_SQLite
class  Certificate_Store_MacOS
class  Certificate_Store_Windows
class  CFB_Decryption
class  CFB_Encryption
class  CFB_Mode
class  ChaCha
class  ChaCha20Poly1305_Decryption
class  ChaCha20Poly1305_Encryption
class  ChaCha20Poly1305_Mode
class  ChaCha_RNG
class  Chain
class  Cipher_Mode
class  Cipher_Mode_Filter
class  Classic_McEliece_Decryptor
class  Classic_McEliece_Encryptor
class  Classic_McEliece_Field_Ordering
 Represents a field ordering for the Classic McEliece cryptosystem. More...
class  Classic_McEliece_GF
 Represents an element of the finite field GF(q) for q = 2^m. More...
struct  Classic_McEliece_KeyPair_Internal
 Representation of a Classic McEliece key pair. More...
class  Classic_McEliece_Matrix
 Representation of the binary Classic McEliece matrix H, with H = (I_mt | T). More...
class  Classic_McEliece_Minimal_Polynomial
 Representation of a minimal polynomial in GF(q)[y]. More...
class  Classic_McEliece_Parameter_Set
class  Classic_McEliece_Parameters
class  Classic_McEliece_Polynomial
 Representation of a Classic McEliece polynomial. More...
class  Classic_McEliece_Polynomial_Ring
 Represents the polynomial ring GF(q)[y]/F(y) where F(y) is the modulus polynomial in GF(q)[y] of degree t. More...
class  Classic_McEliece_PrivateKey
class  Classic_McEliece_PrivateKeyInternal
 Representation of a Classic McEliece private key. More...
class  Classic_McEliece_PublicKey
class  Classic_McEliece_PublicKeyInternal
 Representation of a Classic McEliece public key. More...
class  CMAC
class  Comb4P
class  CommonCrypto_Error
struct  CommonCryptor_Opts
class  Compression_Algorithm
class  Compression_Alloc_Info
class  Compression_Error
class  Compression_Stream
class  CPUFeature
class  CPUID
class  CRC24
class  CRC32
class  Credentials_Manager
class  CRL_Entry
class  cSHAKE_128_XOF
class  cSHAKE_256_XOF
class  cSHAKE_XOF
class  CTR_BE
class  CTS_Decryption
class  CTS_Encryption
class  CurveGFp
class  DataSink
class  DataSink_Stream
class  DataSource
class  DataSource_Memory
class  DataSource_Stream
class  Decoding_Error
class  Decompression_Algorithm
class  Deflate_Compression
class  Deflate_Decompression
class  DER_Encoder
class  DES
class  DH_PrivateKey
class  DH_PublicKey
class  Dilithium_AES_Symmetric_Primitives
class  Dilithium_Expanded_Keypair_Codec
class  Dilithium_Keypair_Codec
class  Dilithium_PrivateKey
class  Dilithium_PrivateKeyInternal
class  Dilithium_PublicKey
class  Dilithium_PublicKeyInternal
class  Dilithium_Round3_Symmetric_Primitives
class  Dilithium_Symmetric_Primitives
class  Dilithium_Symmetric_Primitives_Base
class  DilithiumConstants
class  DilithiumMessageHash
class  DilithiumMode
class  DilithiumPolyTraits
class  DilithiumShakeXOF
class  DilithiumXOF
class  divide_precomp
class  DL_Group
class  DL_PrivateKey
class  DL_PublicKey
class  DLIES_Decryptor
class  DLIES_Encryptor
class  donna128
class  DSA_PrivateKey
class  DSA_PublicKey
class  Dynamically_Loaded_Library
class  EAX_Decryption
class  EAX_Encryption
class  EAX_Mode
class  EC_AffinePoint
class  EC_AffinePoint_Data
class  EC_AffinePoint_Data_BN
class  EC_AffinePoint_Data_PC
class  EC_Group
class  EC_Group_Data
class  EC_Mul2Table_Data
class  EC_Mul2Table_Data_BN
class  EC_Mul2Table_Data_PC
class  EC_Point
class  EC_Point_Base_Point_Precompute
class  EC_Point_Multi_Point_Precompute
class  EC_Point_Var_Point_Precompute
class  EC_PrivateKey
class  EC_PrivateKey_Data
class  EC_PublicKey
class  EC_PublicKey_Data
class  EC_Scalar
class  EC_Scalar_Data
class  EC_Scalar_Data_BN
class  EC_Scalar_Data_PC
class  ECDH_PrivateKey
class  ECDH_PublicKey
class  ECDSA_PrivateKey
class  ECDSA_PublicKey
class  ECGDSA_PrivateKey
class  ECGDSA_PublicKey
class  ECIES_Decryptor
class  ECIES_Encryptor
class  ECIES_KA_Operation
class  ECIES_KA_Params
class  ECIES_System_Params
class  ECKCDSA_PrivateKey
class  ECKCDSA_PublicKey
class  Ed25519_FieldElement
class  Ed25519_PrivateKey
class  Ed25519_PublicKey
class  Ed448_PrivateKey
 A private key for Ed448/Ed448ph according to RFC 8032. More...
class  Ed448_PublicKey
 A public key for Ed448/Ed448ph according to RFC 8032. More...
class  Ed448Point
 Representation of a point on the Ed448 curve. More...
struct  eea_result
class  ElGamal_PrivateKey
class  ElGamal_PublicKey
class  EllipticCurve
class  EllipticCurveParameters
class  EME_PKCS1v15
class  EME_Raw
struct  EnableArithmeticWithPlainNumber
class  Encoding_Error
class  Encrypted_PSK_Database
class  Encrypted_PSK_Database_SQL
class  EncryptionPaddingScheme
class  Entropy_Source
class  Entropy_Sources
class  ESDM_RNG
class  ESP_Padding
class  Exception
class  Expanded_Keypair_Codec
 Codec for expanded private keys (as specified in FIPS 203). More...
class  Extensions
class  Fanout_Filter
class  Filter
class  Flatfile_Certificate_Store
class  Fork
class  FPE_FE1
class  FrodoKEM_PrivateKey
class  FrodoKEM_PublicKey
class  FrodoKEMConstants
class  FrodoKEMMode
class  FrodoMatrix
class  GCM_Decryption
class  GCM_Encryption
class  GCM_Mode
class  GeneralName
 X.509 GeneralName Type. More...
class  GeneralSubtree
 A single Name Constraint. More...
class  Getentropy
class  GF2m_Field
class  Gf448Elem
class  GF_Mask
 Constant time mask wrapper for GF(q) elements. More...
class  GHASH
class  GMAC
class  GOST_28147_89
class  GOST_28147_89_Params
class  GOST_3410_PrivateKey
class  GOST_3410_PublicKey
class  GOST_34_11
class  Gzip_Compression
class  Gzip_Decompression
class  Hardware_RNG
class  HashFunction
class  Hex_Decoder
class  Hex_Encoder
class  HKDF
class  HKDF_Expand
class  HKDF_Extract
class  HMAC
class  HMAC_DRBG
class  HOTP
class  HSS_LMS_Params
 The HSS-LMS parameters. More...
class  HSS_LMS_PrivateKey
 An HSS/LMS private key. More...
class  HSS_LMS_PrivateKeyInternal
 The internal HSS-LMS private key. More...
class  HSS_LMS_PublicKey
 An HSS/LMS public key. More...
class  HSS_LMS_PublicKeyInternal
 The internal HSS-LMS public key. More...
class  HSS_Signature
 A HSS-LMS signature. More...
class  Hybrid_PrivateKey
 Abstraction for a combined KEM private key. More...
class  Hybrid_PublicKey
 Abstraction for a combined KEM public key. More...
class  IDEA
class  Intel_Rdseed
class  Internal_Error
class  IntMod
struct  IntParams
class  Invalid_Algorithm_Name
class  Invalid_Argument
class  Invalid_Authentication_Tag
class  Invalid_IV_Length
class  Invalid_Key_Length
class  Invalid_State
struct  is_bitvector
struct  is_bitvector< bitvector_base< T > >
struct  is_strong_span
struct  is_strong_span< StrongSpan< T > >
struct  is_strong_type
struct  is_strong_type< Strong< Ts... > >
class  ISO_9796_DS2
class  ISO_9796_DS3
class  Jitter_RNG
class  KDF
class  KDF1
class  KDF1_18033
class  KDF2
class  Keccak_1600
class  Keccak_Permutation
struct  KeccakPadding
class  KEM_Decryption_with_Combiner
 Abstract interface for a KEM decryption operation for KEM combiners. More...
class  KEM_Encapsulation
class  KEM_Encryption_with_Combiner
 Abstract interface for a KEM encryption operation for KEM combiners. More...
class  KEX_to_KEM_Adapter_PrivateKey
class  KEX_to_KEM_Adapter_PublicKey
class  Key_Constraints
class  Key_Length_Specification
class  Key_Not_Set
class  Keyed_Filter
class  KMAC
class  KMAC128
class  KMAC256
class  Kuznyechik
class  Kyber_90s_Symmetric_Primitives
class  Kyber_KEM_Decryptor
class  Kyber_KEM_Decryptor_Base
class  Kyber_KEM_Encryptor
class  Kyber_KEM_Encryptor_Base
class  Kyber_KEM_Operation_Base
class  Kyber_Keypair_Codec
class  Kyber_Modern_Symmetric_Primitives
class  Kyber_PrivateKey
class  Kyber_PrivateKeyInternal
class  Kyber_PublicKey
class  Kyber_PublicKeyInternal
class  Kyber_Symmetric_Primitives
class  KyberConstants
class  KyberMode
class  KyberPolyTraits
struct  KyberPrivateKeySeed
class  Lion
class  LMOTS_Params
 The LM-OTS parameters. More...
class  LMOTS_Private_Key
 Representation of an LMOTS private key. More...
class  LMOTS_Public_Key
 Representation of an OTS public key. More...
class  LMOTS_Signature
 Representation of a LM-OTS signature. More...
class  LMS_Instance
 Base class for LMS private and public key. Contains public data associated with this LMS instance. More...
class  LMS_Params
 The LMS parameters. More...
class  LMS_PrivateKey
 Representation of an LMS Private key. More...
class  LMS_PublicKey
 The LMS public key. More...
class  LMS_Signature
 Container for LMS Signature data. More...
class  lock_guard
class  Lookup_Error
class  LZMA_Compression
class  LZMA_Decompression
class  McEliece_PrivateKey
class  McEliece_PublicKey
class  MD4
class  MD5
class  Memory_Pool
class  MerkleDamgard_Hash
class  MessageAuthenticationCode
class  ML_DSA_Expanding_Keypair_Codec
class  ML_DSA_MessageHash
class  ML_DSA_Symmetric_Primitives
class  ML_KEM_Decryptor
class  ML_KEM_Encryptor
class  ML_KEM_Symmetric_Primitives
class  mlock_allocator
class  Modular_Reducer
class  Montgomery_Int
class  Montgomery_Params
class  MontgomeryRep
class  NameConstraints
 Name Constraints. More...
class  No_Filesystem_Access
class  Noekeon
class  noop_mutex
class  Not_Implemented
class  Null_Padding
class  Null_RNG
class  OAEP
class  OCB_Decryption
class  OCB_Encryption
class  OCB_Mode
class  OctetString
class  OFB
class  OID
class  OID_Map
class  OneAndZeros_Padding
class  OpenPGP_S2K
class  OTS_Instance
 Base class for LMOTS private and public key. Contains the parameters for the specific OTS instance. More...
class  Output_Buffers
struct  overloaded
class  Parallel
class  PasswordHash
class  PasswordHashFamily
class  Path_Validation_Restrictions
class  Path_Validation_Result
class  PBKDF
class  PBKDF2
class  PBKDF2_Family
class  Pipe
class  PK_Decryptor
class  PK_Decryptor_EME
class  PK_Encryptor
class  PK_Encryptor_EME
class  PK_KEM_Decryptor
class  PK_KEM_Encryptor
class  PK_Key_Agreement
class  PK_Key_Agreement_Key
class  PK_Signer
class  PK_Verifier
class  PKCS10_Request
class  PKCS1v15_Raw_SignaturePaddingScheme
class  PKCS1v15_SignaturePaddingScheme
class  PKCS5_PBKDF2
class  PKCS7_Padding
class  PKCS8_Exception
class  Poly1305
class  polyn_gf2m
class  PrecomputedBaseMulTable
class  Private_Key
class  PRNG_Unseeded
class  Processor_RNG
class  ProjectiveCurvePoint
class  Provider_Not_Found
class  PseudorandomKeyGeneration
 Helper class used to derive secret values based in the pseudorandom key generation described in RFC 8554 Appendix A. More...
class  PSK_Database
class  PSS_Params
class  PSS_Raw
class  PSSR
class  Public_Key
class  RandomNumberGenerator
class  RawHashFunction
class  RC4
class  RFC4880_S2K
class  RFC4880_S2K_Family
class  RFC6979_Nonce_Generator
class  RIPEMD_160
class  RSA_PrivateKey
class  RSA_PublicKey
class  RTSS_Share
class  RWLock
class  Salsa20
class  Scalar448
 Representation of a scalar for X448. More...
class  SCAN_Name
class  scoped_cleanup
 Helper class to create a RAII-style cleanup callback. More...
class  Scrypt
class  Scrypt_Family
class  secure_allocator
class  SecureQueue
class  SEED
class  Seed_Expanding_Keypair_Codec
 Codec for private keys as 64-byte seeds: d || z. More...
class  Semaphore
class  Serpent
class  SHA_1
class  SHA_224
class  SHA_256
class  SHA_3
class  SHA_384
class  SHA_3_224
class  SHA_3_256
class  SHA_3_384
class  SHA_3_512
class  SHA_512
class  SHA_512_256
class  SHACAL2
class  SHAKE_128
class  SHAKE_128_Cipher
class  SHAKE_128_XOF
class  SHAKE_256
class  SHAKE_256_Cipher
class  SHAKE_256_XOF
class  SHAKE_Cipher
class  SHAKE_XOF
class  SignaturePaddingScheme
class  SignRawBytes
class  SIMD_16x32
class  SIMD_2x64
class  SIMD_4x32
class  SIMD_4x64
class  SIMD_8x32
class  SIMD_8x64
class  SipHash
class  SIV_Decryption
class  SIV_Encryption
class  SIV_Mode
class  Skein_512
class  SM2_PrivateKey
class  SM2_PublicKey
class  SM3
class  SM4
class  SolinasAccum
class  SP800_108_Counter
class  SP800_108_Feedback
class  SP800_108_Pipeline
class  SP800_56A_One_Step_KMAC_Abstract
class  SP800_56C_One_Step_Hash
class  SP800_56C_One_Step_HMAC
class  SP800_56C_One_Step_KMAC128
class  SP800_56C_One_Step_KMAC256
class  SP800_56C_Two_Step
class  Sphincs_Address
class  Sphincs_Hash_Functions
class  Sphincs_Hash_Functions_Sha2
class  Sphincs_Hash_Functions_Shake
class  Sphincs_Parameters
struct  SphincsMessageInternal
 M' representation of FIPS 205 (the input to slh_sign_internal and slh_verify_internal). More...
class  SphincsPlus_PrivateKey
 An SLH-DSA private key. More...
class  SphincsPlus_PublicKey
 An SLH-DSA (or SPHINCS+ Round 3.1) public key. More...
class  Sponge
class  SQL_Database
class  Sqlite3_Database
class  SRP6_Server_Session
class  Stateful_Key_Index_Registry
class  Stateful_RNG
class  Stream_Compression
class  Stream_Decompression
class  Stream_IO_Error
class  StreamCipher
class  Streebog
class  StringLiteral
class  Strong
class  StrongSpan
class  SymmetricAlgorithm
class  System_Certificate_Store
class  System_Error
class  System_RNG
class  Thread_Pool
class  Threefish_512
class  TLS_12_PRF
class  TOTP
class  TPM_Context
class  TPM_Error
class  TPM_PrivateKey
class  TPM_RNG
class  TripleDES
class  Truncated_Hash
class  Tweakable_Block_Cipher
class  Twofish
class  UnblindedScalarBits
class  Unknown_PK_Field_Name
class  URI
class  UUID
class  VartimeMul2Table
class  Whirlpool
class  Win32_EntropySource
class  WindowedBoothMulTable
class  WindowedMul2Table
class  WindowedMulTable
class  word3
struct  WordInfo
struct  WordInfo< uint32_t >
struct  WordInfo< uint64_t >
class  X25519_PrivateKey
class  X25519_PublicKey
class  X448_PrivateKey
 A private key for the X448 key agreement scheme according to RFC 7748. More...
class  X448_PublicKey
 A public key for the X448 key agreement scheme according to RFC 7748. More...
class  X509_CA
class  X509_Cert_Options
class  X509_Certificate
class  X509_CRL
class  X509_DN
class  X509_Object
class  X931_SignaturePadding
class  X942_PRF
class  XMSS_Address
class  XMSS_Common_Ops
class  XMSS_Hash
class  XMSS_Parameters
class  XMSS_PrivateKey
class  XMSS_PublicKey
class  XMSS_Signature
class  XMSS_Signature_Operation
class  XMSS_Verification_Operation
class  XMSS_WOTS_Base
class  XMSS_WOTS_Parameters
class  XMSS_WOTS_PrivateKey
class  XMSS_WOTS_PublicKey
class  XOF
class  XTS_Decryption
class  XTS_Encryption
class  XTS_Mode
class  ZFEC
class  Zlib_Compression
class  Zlib_Decompression
class  Zlib_Style_Stream

Concepts

concept  absorbing_object
concept  appendable_object
concept  bitvectorish
concept  curve_supports_fe_invert2
concept  curve_supports_fe_sqrt
concept  md_hash_implementation
concept  updatable_object
concept  WordType

Typedefs

typedef __vector unsigned int Altivec32x4
typedef __vector unsigned long long Altivec64x2
typedef __vector unsigned char Altivec8x16
using bitvector = bitvector_base<std::allocator>
template<size_t bound>
using Bounded_XOF = detail::Bounded_XOF<XOF&, bound>
using byte = std::uint8_t
typedef int32_t CCCryptorStatus
typedef std::vector< std::set< Certificate_Status_Code > > CertificatePathStatusCodes
using CmceCodeWord = Strong<secure_bitvector, struct CmceCodeWord_>
 Represents C of decapsulation.
using CmceColumnSelection = Strong<secure_bitvector, struct CmceColumnSelection_>
 Represents c of private key.
using CmceErrorVector = Strong<secure_bitvector, struct CmceErrorVector_>
 Represents e of encapsulation.
using CmceGfElem = Strong<uint16_t, struct CmceGfElem_>
 Represents a GF(q) element.
using CmceGfMod = Strong<uint16_t, struct CmceGfMod_>
 Represents a GF(q) modulus.
using CmceInitialSeed = Strong<secure_vector<uint8_t>, struct CmceInitialSeed_>
 Represents initial delta of keygen.
using CmceIrreducibleBits = Strong<secure_vector<uint8_t>, struct CmceIrreducibleBits_>
using CmceKeyGenSeed = Strong<secure_vector<uint8_t>, struct CmceKeyGenSeed_>
 Represents a delta (can be altered; final value stored in private key).
using CmceOrderingBits = Strong<secure_vector<uint8_t>, struct CmceOrderingBits_>
using CmcePermutation = Strong<secure_vector<uint16_t>, struct CmcePermutation_>
 Represents a permutation (pi in spec). Used in field ordering creation.
using CmcePermutationElement = Strong<uint16_t, struct CmcePermutationElement_>
 Represents an element of a permutation (pi in spec). Used in field ordering creation.
using CmceRejectionSeed = Strong<secure_vector<uint8_t>, struct CmceRejectionSeed_>
 Represents s of private key.
typedef X25519_PrivateKey Curve25519_PrivateKey
typedef X25519_PublicKey Curve25519_PublicKey
using DilithiumCommitmentHash = Strong<std::vector<uint8_t>, struct DilithiumCommitmentHash_>
 Hash of the message representative and the signer's commitment.
using DilithiumHashedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumHashedPublicKey_>
using DilithiumInternalKeypair
 Internal representation of a Dilithium key pair.
using DilithiumMessageRepresentative = Strong<std::vector<uint8_t>, struct DilithiumMessageRepresentative_>
 Representation of the message to be signed.
using DilithiumOptionalRandomness = Strong<secure_vector<uint8_t>, struct DilithiumOptionalRandomness_>
 Optional randomness 'rnd' used for rho prime computation in ML-DSA.
using DilithiumPoly = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>
using DilithiumPolyMatNTT = Botan::CRYSTALS::PolynomialMatrix<DilithiumPolyTraits>
using DilithiumPolyNTT = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>
using DilithiumPolyVec = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>
using DilithiumPolyVecNTT = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>
using DilithiumSeedRandomness = Strong<secure_vector<uint8_t>, struct DilithiumSeedRandomness_>
 Principal seed used to generate Dilithium key pairs.
using DilithiumSeedRho = Strong<std::vector<uint8_t>, struct DilithiumPublicSeed_>
 Public seed to sample the polynomial matrix A from.
using DilithiumSeedRhoPrime = Strong<secure_vector<uint8_t>, struct DilithiumSeedRhoPrime_>
 Private seed to sample the polynomial vectors s1 and s2 from.
using DilithiumSerializedCommitment = Strong<std::vector<uint8_t>, struct DilithiumSerializedCommitment_>
 Serialized representation of a commitment w1.
using DilithiumSerializedPrivateKey = Strong<secure_vector<uint8_t>, struct DilithiumSerializedPrivateKey_>
 Serialized private key data.
using DilithiumSerializedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumSerializedPublicKey_>
 Serialized public key data (result of pkEncode(pk)).
using DilithiumSerializedSignature = Strong<std::vector<uint8_t>, struct DilithiumSerializedSignature_>
 Serialized signature data.
using DilithiumSigningSeedK = Strong<secure_vector<uint8_t>, struct DilithiumSeedK_>
 Private seed K used during signing.
using ForsLeafSecret = Strong<secure_vector<uint8_t>, struct ForsLeafSecret_>
using ForsSignature = Strong<std::vector<uint8_t>, struct ForsSignature_>
using FrodoDomainSeparator = Strong<std::array<uint8_t, 1>, struct FrodoDomainSeparator_>
using FrodoIntermediateSharedSecret = Strong<secure_vector<uint8_t>, struct FrodoIntermediateSharedSecret_>
using FrodoPackedMatrix = Strong<std::vector<uint8_t>, struct FrodoPackedMatrix_>
using FrodoPlaintext = Strong<secure_vector<uint8_t>, struct FrodoPlaintext_>
using FrodoPublicKeyHash = Strong<std::vector<uint8_t>, struct FrodoPublicKeyHash_>
using FrodoSalt = Strong<std::vector<uint8_t>, struct FrodoSalt_>
using FrodoSampleR = Strong<secure_vector<uint8_t>, struct FrodoSampleR_>
using FrodoSeedA = Strong<std::vector<uint8_t>, struct FrodoSeedA_>
using FrodoSeedS = Strong<secure_vector<uint8_t>, struct FrodoSeedS_>
using FrodoSeedSE = Strong<secure_vector<uint8_t>, struct FrodoSeedSE_>
using FrodoSeedZ = Strong<std::vector<uint8_t>, struct FrodoSeedZ_>
using FrodoSerializedMatrix = Strong<secure_vector<uint8_t>, struct FrodoSerializedMatrix_>
using GenerateLeafFunction = std::function<void(StrongSpan<SphincsTreeNode> , TreeNodeIndex)>
typedef uint16_t gf2m
using HSS_Level = Strong<uint32_t, struct HSS_Level_, EnableArithmeticWithPlainNumber>
 The HSS layer in the HSS multi tree starting at 0 from the root.
using HSS_Sig_Idx = Strong<uint64_t, struct HSS_Sig_Idx_, EnableArithmeticWithPlainNumber>
 The index of a node within a specific LMS tree layer.
using HypertreeLayerIndex = Strong<uint32_t, struct HypertreeLayerIndex_>
 Index of a layer in the XMSS hyper-tree.
using InitializationVector = OctetString
typedef Invalid_Authentication_Tag Integrity_Failure
using KyberCompressedCiphertext = Strong<std::vector<uint8_t>, struct KyberCompressedCiphertext_>
 Compressed and serialized ciphertext value.
using KyberEncryptionRandomness = Strong<secure_vector<uint8_t>, struct KyberEncryptionRandomness_>
 Random value used to generate the Kyber ciphertext.
using KyberHashedCiphertext = Strong<std::vector<uint8_t>, struct KyberHashedCiphertext_>
using KyberHashedPublicKey = Strong<std::vector<uint8_t>, struct KyberHashedPublicKey_>
 Hash value of the serialized public key.
using KyberImplicitRejectionValue = Strong<secure_vector<uint8_t>, struct KyberImplicitRejectionValue_>
 Secret random value (called Z in the spec), used for implicit rejection in the decapsulation.
using KyberInternalKeypair
using KyberMessage = Strong<secure_vector<uint8_t>, struct KyberMessage_>
 Random message value to be encrypted by the CPA-secure Kyber encryption scheme.
using KyberPoly = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>
using KyberPolyMat = Botan::CRYSTALS::PolynomialMatrix<KyberPolyTraits>
using KyberPolyNTT = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>
using KyberPolyVec = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>
using KyberPolyVecNTT = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>
using KyberSamplingRandomness = Strong<secure_vector<uint8_t>, struct KyberSamplingRandomness_>
 PRF value used for sampling of error polynomials.
using KyberSeedRandomness = Strong<secure_vector<uint8_t>, struct KyberSeedRandomness_>
 Principal seed used to generate Kyber key pairs.
using KyberSeedRho = Strong<std::vector<uint8_t>, struct KyberSeedRho_>
 Public seed value to generate the Kyber matrix A.
using KyberSeedSigma = Strong<secure_vector<uint8_t>, struct KyberSeedSigma_>
 Private seed used to generate polynomial vectors s and e during key generation.
using KyberSerializedPublicKey = Strong<std::vector<uint8_t>, struct KyberSerializedPublicKey_>
 Public key in serialized form (t || rho).
using KyberSharedSecret = Strong<secure_vector<uint8_t>, struct KyberSharedSecret_>
 Shared secret value generated during encapsulation and recovered during decapsulation.
using KyberSigmaOrEncryptionRandomness
 Variant value of either a KyberSeedSigma or a KyberEncryptionRandomness.
using LMOTS_K = Strong<std::vector<uint8_t>, struct LMOTS_K_>
 The K value from the LM-OTS public key.
using LMOTS_Node = Strong<secure_vector<uint8_t>, struct LMOTS_Node_>
 One node within one LM-OTS hash chain.
using LMOTS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMOTS_Signature_Bytes_>
 Byte vector of an LM-OTS signature.
using LMS_AuthenticationPath = Strong<std::vector<uint8_t>, struct LMS_AuthenticationPath_>
 The authentication path of an LMS signature.
using LMS_Identifier = Strong<std::vector<uint8_t>, struct LMS_Identifier_>
 The identifier of an LMS tree (I in RFC 8554).
using LMS_Message = Strong<std::vector<uint8_t>, struct LMS_Message_>
 A message that is signed with an LMS tree.
using LMS_Seed = Strong<secure_vector<uint8_t>, struct LMS_SEED_>
 Seed of the LMS tree, used to generate the LM-OTS private keys.
using LMS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMS_Signature_Bytes_>
 Raw bytes of an LMS signature.
using LMS_Tree_Node = Strong<std::vector<uint8_t>, struct LMS_Tree_Node_>
 A node with the LMS tree.
using LMS_Tree_Node_Idx = Strong<uint32_t, struct LMS_Tree_Node_Idx_, EnableArithmeticWithPlainNumber>
 The index of a node within a specific LMS tree layer.
template<typename T>
using lock_guard_type = lock_guard<T>
typedef MessageAuthenticationCode MAC
using ML_DSA_Mode = DilithiumMode
using ML_DSA_PrivateKey = Dilithium_PrivateKey
using ML_DSA_PublicKey = Dilithium_PublicKey
using ML_KEM_Mode = KyberMode
using ML_KEM_PrivateKey = Kyber_PrivateKey
using ML_KEM_PublicKey = Kyber_PublicKey
using mutex_type = noop_mutex
template<std::signed_integral T>
using next_longer_int_t
template<std::unsigned_integral T>
using next_longer_uint_t
using Point448 = Strong<std::array<uint8_t, X448_LEN>, struct Point448_>
typedef EC_Point PointGFp
using recursive_mutex_type = noop_mutex
typedef RandomNumberGenerator RNG
typedef PBKDF S2K
using s32bit = std::int32_t
using ScalarX448 = Strong<std::array<uint8_t, X448_LEN>, struct ScalarX448_>
using secure_bitvector = bitvector_base<secure_allocator>
template<typename T>
using secure_deque = std::deque<T, secure_allocator<T>>
template<typename T>
using secure_vector = std::vector<T, secure_allocator<T>>
template<typename T>
using SecureVector = secure_vector<T>
typedef SM2_PrivateKey SM2_Encryption_PrivateKey
typedef SM2_PublicKey SM2_Encryption_PublicKey
typedef SM2_PrivateKey SM2_Signature_PrivateKey
typedef SM2_PublicKey SM2_Signature_PublicKey
using SphincsAuthenticationPath = Strong<std::vector<uint8_t>, struct SphincsAuthenticationPath_>
using SphincsContext = Strong<std::vector<uint8_t>, struct SphincsContext_>
using SphincsHashedMessage = Strong<std::vector<uint8_t>, struct SphincsHashedMessage_>
using SphincsHypertreeSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>
using SphincsInputMessage = Strong<std::vector<uint8_t>, struct SphincsInputMessage_>
using SphincsMessagePrefix = Strong<std::vector<uint8_t>, struct SphincsMessagePrefix_>
using SphincsMessageRandomness = Strong<secure_vector<uint8_t>, struct SphincsMessageRandomness_>
using SphincsOptionalRandomness = Strong<secure_vector<uint8_t>, struct SphincsOptionalRandomness_>
using SphincsPublicSeed = Strong<std::vector<uint8_t>, struct SphincsPublicSeed_>
using SphincsSecretPRF = Strong<secure_vector<uint8_t>, struct SphincsSecretPRF_>
using SphincsSecretSeed = Strong<secure_vector<uint8_t>, struct SphincsSecretSeed_>
using SphincsTreeNode = Strong<std::vector<uint8_t>, struct SphincsTreeNode_>
 Either an XMSS or FORS tree node or leaf.
using SphincsXmssSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>
template<typename T>
using strong_type_wrapped_type = typename detail::wrapped_type_helper<std::remove_cvref_t<T>>::type
 Extracts the wrapped type from a strong type.
using SymmetricKey = OctetString
using TreeLayerIndex = Strong<uint32_t, struct TreeLayerIndex_, EnableArithmeticWithPlainNumber>
 Index of the layer within a FORS/XMSS tree.
using TreeNodeIndex = Strong<uint32_t, struct TreeNodeIndex_, EnableArithmeticWithPlainNumber>
 Index of an individual node inside an XMSS or FORS tree.
using u16bit = std::uint16_t
using u32bit = std::uint32_t
using u64bit = std::uint64_t
using word = std::conditional_t<HasNative64BitRegisters, std::uint64_t, uint32_t>
typedef std::vector< secure_vector< uint8_t > > wots_keysig_t
using WotsChainIndex = Strong<uint32_t, struct WotsChainIndex_>
 Index of a WOTS chain within a single usage of WOTS.
using WotsHashIndex = Strong<uint8_t, struct WotsHashIndex_, EnableArithmeticWithPlainNumber>
 Index of a hash application inside a single WOTS chain (integers in "base_w").
using WotsNode = Strong<secure_vector<uint8_t>, struct WotsNode_>
 Start (or intermediate) node of a WOTS+ chain.
using WotsPublicKey = Strong<std::vector<uint8_t>, struct WotsPublicKey_>
using WotsPublicKeyNode = Strong<std::vector<uint8_t>, struct WotsPublicKeyNode_>
 End node of a WOTS+ chain (part of the WOTS+ public key).
using WotsSignature = Strong<secure_vector<uint8_t>, struct WotsSignature_>
typedef ASN1_Time X509_Time
using XmssTreeIndexInLayer = Strong<uint64_t, struct XmssTreeIndexInLayer_, EnableArithmeticWithPlainNumber>
 Index of an XMSS tree (unique for just the local hyper-tree layer).

Enumerations

enum class  AlignmentBufferFinalBlock : uint8_t { is_not_special = 0 , must_be_deferred = 1 }
enum class  ASN1_Class : uint32_t {
  Universal = 0b0000'0000 , Application = 0b0100'0000 , ContextSpecific = 0b1000'0000 , Private = 0b1100'0000 ,
  Constructed = 0b0010'0000 , ExplicitContextSpecific = Constructed | ContextSpecific , NoObject = 0xFF00
}
enum class  ASN1_Type : uint32_t {
  Eoc = 0x00 , Boolean = 0x01 , Integer = 0x02 , BitString = 0x03 ,
  OctetString = 0x04 , Null = 0x05 , ObjectId = 0x06 , Enumerated = 0x0A ,
  Sequence = 0x10 , Set = 0x11 , Utf8String = 0x0C , NumericString = 0x12 ,
  PrintableString = 0x13 , TeletexString = 0x14 , Ia5String = 0x16 , VisibleString = 0x1A ,
  UniversalString = 0x1C , BmpString = 0x1E , UtcTime = 0x17 , GeneralizedTime = 0x18 ,
  NoObject = 0xFF00
}
enum class  Certificate_Status_Code : uint16_t {
  OK = 0 , VERIFIED = 0 , OCSP_RESPONSE_GOOD = 1 , OCSP_SIGNATURE_OK = 2 ,
  VALID_CRL_CHECKED = 3 , OCSP_NO_HTTP = 4 , FIRST_WARNING_STATUS = 500 , CERT_SERIAL_NEGATIVE = 500 ,
  DN_TOO_LONG = 501 , OCSP_NO_REVOCATION_URL = 502 , OCSP_SERVER_NOT_AVAILABLE = 503 , TRUSTED_CERT_HAS_EXPIRED = 504 ,
  TRUSTED_CERT_NOT_YET_VALID = 505 , FIRST_ERROR_STATUS = 1000 , SIGNATURE_METHOD_TOO_WEAK = 1000 , UNTRUSTED_HASH = 1001 ,
  NO_REVOCATION_DATA = 1002 , NO_MATCHING_CRLDP = 1003 , OCSP_ISSUER_NOT_TRUSTED = 1004 , CERT_NOT_YET_VALID = 2000 ,
  CERT_HAS_EXPIRED = 2001 , OCSP_NOT_YET_VALID = 2002 , OCSP_HAS_EXPIRED = 2003 , CRL_NOT_YET_VALID = 2004 ,
  CRL_HAS_EXPIRED = 2005 , OCSP_IS_TOO_OLD = 2006 , CERT_ISSUER_NOT_FOUND = 3000 , CANNOT_ESTABLISH_TRUST = 3001 ,
  CERT_CHAIN_LOOP = 3002 , CHAIN_LACKS_TRUST_ROOT = 3003 , CHAIN_NAME_MISMATCH = 3004 , POLICY_ERROR = 4000 ,
  INVALID_USAGE = 4001 , CERT_CHAIN_TOO_LONG = 4002 , CA_CERT_NOT_FOR_CERT_ISSUER = 4003 , NAME_CONSTRAINT_ERROR = 4004 ,
  IPADDR_BLOCKS_ERROR = 4011 , AS_BLOCKS_ERROR = 4012 , CA_CERT_NOT_FOR_CRL_ISSUER = 4005 , OCSP_CERT_NOT_LISTED = 4006 ,
  OCSP_BAD_STATUS = 4007 , CERT_NAME_NOMATCH = 4008 , UNKNOWN_CRITICAL_EXTENSION = 4009 , DUPLICATE_CERT_EXTENSION = 4010 ,
  OCSP_SIGNATURE_ERROR = 4501 , OCSP_ISSUER_NOT_FOUND = 4502 , OCSP_RESPONSE_MISSING_KEYUSAGE = 4503 , OCSP_RESPONSE_INVALID = 4504 ,
  EXT_IN_V1_V2_CERT = 4505 , DUPLICATE_CERT_POLICY = 4506 , V2_IDENTIFIERS_IN_V1_CERT = 4507 , CERT_IS_REVOKED = 5000 ,
  CRL_BAD_SIGNATURE = 5001 , SIGNATURE_ERROR = 5002 , CERT_PUBKEY_INVALID = 5003 , SIGNATURE_ALGO_UNKNOWN = 5004 ,
  SIGNATURE_ALGO_BAD_PARAMS = 5005
}
enum class  Cipher_Dir : uint8_t { Encryption = 0 , Decryption = 1 , ENCRYPTION = Encryption , DECRYPTION = Decryption }
enum class  CRL_Code : uint8_t {
  Unspecified = 0 , KeyCompromise = 1 , CaCompromise = 2 , AffiliationChanged = 3 ,
  Superseded = 4 , CessationOfOperation = 5 , CertificateHold = 6 , RemoveFromCrl = 8 ,
  PrivilegeWithdrawn = 9 , AaCompromise = 10
}
enum  Decoder_Checking : uint8_t { NONE , IGNORE_WS , FULL_CHECK }
enum class  DL_Group_Format : uint8_t {
  ANSI_X9_42 = 0 , ANSI_X9_57 = 1 , PKCS_3 = 2 , DSA_PARAMETERS = ANSI_X9_57 ,
  DH_PARAMETERS = ANSI_X9_42 , ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42 , PKCS3_DH_PARAMETERS = PKCS_3
}
enum class  DL_Group_Source : uint8_t { Builtin , RandomlyGenerated , ExternalSource }
enum class  EC_Group_Encoding : uint8_t {
  Explicit = 0 , ImplicitCA = 1 , NamedCurve = 2 , EC_DOMPAR_ENC_EXPLICIT = Explicit ,
  EC_DOMPAR_ENC_IMPLICITCA = ImplicitCA , EC_DOMPAR_ENC_OID = NamedCurve
}
enum class  EC_Group_Engine : uint8_t { Optimized , Generic , Legacy }
enum class  EC_Group_Source : uint8_t { Builtin , ExternalSource }
enum class  EC_Point_Format : uint8_t {
  Uncompressed = 0 , Compressed = 1 , UNCOMPRESSED = Uncompressed , COMPRESSED = Compressed ,
  Hybrid = 2 , HYBRID = 2
}
enum class  ECIES_Flags : uint8_t {
  None = 0 , SingleHashMode = 1 , CofactorMode = 2 , OldCofactorMode = 4 ,
  CheckMode = 8 , NONE = None , SINGLE_HASH_MODE = SingleHashMode , COFACTOR_MODE = CofactorMode ,
  OLD_COFACTOR_MODE = OldCofactorMode , CHECK_MODE = CheckMode
}
enum class  ErrorType : uint16_t {
  Unknown = 1 , SystemError = 2 , NotImplemented = 3 , OutOfMemory = 4 ,
  InternalError = 5 , IoError = 6 , InvalidObjectState = 100 , KeyNotSet = 101 ,
  InvalidArgument = 102 , InvalidKeyLength = 103 , InvalidNonceLength = 104 , LookupError = 105 ,
  EncodingFailure = 106 , DecodingFailure = 107 , TLSError = 108 , HttpError = 109 ,
  InvalidTag = 110 , RoughtimeError = 111 , CommonCryptoError = 201 , Pkcs11Error = 202 ,
  TPMError = 203 , DatabaseError = 204 , ZlibError = 300 , Bzip2Error = 301 ,
  LzmaError = 302
}
enum class  LMOTS_Algorithm_Type : uint32_t {
  RESERVED = 0x00 , SHA256_N32_W1 = 0x01 , SHA256_N32_W2 = 0x02 , SHA256_N32_W4 = 0x03 ,
  SHA256_N32_W8 = 0x04 , SHA256_N24_W1 = 0x05 , SHA256_N24_W2 = 0x06 , SHA256_N24_W4 = 0x07 ,
  SHA256_N24_W8 = 0x08 , SHAKE_N32_W1 = 0x09 , SHAKE_N32_W2 = 0x0a , SHAKE_N32_W4 = 0x0b ,
  SHAKE_N32_W8 = 0x0c , SHAKE_N24_W1 = 0x0d , SHAKE_N24_W2 = 0x0e , SHAKE_N24_W4 = 0x0f ,
  SHAKE_N24_W8 = 0x10
}
 Enum of available LM-OTS algorithm types. More...
enum class  LMS_Algorithm_Type : uint32_t {
  RESERVED = 0x00 , SHA256_M32_H5 = 0x05 , SHA256_M32_H10 = 0x06 , SHA256_M32_H15 = 0x07 ,
  SHA256_M32_H20 = 0x08 , SHA256_M32_H25 = 0x09 , SHA256_M24_H5 = 0x0a , SHA256_M24_H10 = 0x0b ,
  SHA256_M24_H15 = 0x0c , SHA256_M24_H20 = 0x0d , SHA256_M24_H25 = 0x0e , SHAKE_M32_H5 = 0x0f ,
  SHAKE_M32_H10 = 0x10 , SHAKE_M32_H15 = 0x11 , SHAKE_M32_H20 = 0x12 , SHAKE_M32_H25 = 0x13 ,
  SHAKE_M24_H5 = 0x14 , SHAKE_M24_H10 = 0x15 , SHAKE_M24_H15 = 0x16 , SHAKE_M24_H20 = 0x17 ,
  SHAKE_M24_H25 = 0x18
}
 Enum of available LMS algorithm types. More...
enum class  MD_Endian : uint8_t { Little , Big }
enum class  MlPrivateKeyFormat : uint8_t { Seed , Expanded }
 Byte encoding format of ML-KEM and ML-DSA the private key. More...
enum class  PublicKeyOperation : uint8_t { Encryption , Signature , KeyEncapsulation , KeyAgreement }
enum class  Signature_Format : uint8_t { Standard = 0 , DerSequence = 1 , IEEE_1363 = Standard , DER_SEQUENCE = DerSequence }
enum class  Sphincs_Address_Type : uint32_t {
  WotsHash = 0 , WotsPublicKeyCompression = 1 , HashTree = 2 , ForsTree = 3 ,
  ForsTreeRootsCompression = 4 , WotsKeyGeneration = 5 , ForsKeyGeneration = 6
}
enum class  Sphincs_Hash_Type : uint8_t { Shake256 , Sha256 , Haraka }
enum class  Sphincs_Parameter_Set : uint8_t {
  Sphincs128Small , Sphincs128Fast , Sphincs192Small , Sphincs192Fast ,
  Sphincs256Small , Sphincs256Fast , SLHDSA128Small , SLHDSA128Fast ,
  SLHDSA192Small , SLHDSA192Fast , SLHDSA256Small , SLHDSA256Fast
}
enum class  TPM_Storage_Type { User , System }
enum class  Usage_Type : uint8_t {
  UNSPECIFIED , TLS_SERVER_AUTH , TLS_CLIENT_AUTH , CERTIFICATE_AUTHORITY ,
  OCSP_RESPONDER , ENCRYPTION
}
enum class  WOTS_Derivation_Method : uint8_t { Botan2x = 1 , NIST_SP800_208 = 2 }

Functions

BigInt abs (const BigInt &n)
void absorb_into_sponge (detail::SpongeLikeWithTrivialPermute auto &sponge, std::span< const uint8_t > input)
template<detail::SpongeLike SpongeT>
void absorb_into_sponge (SpongeT &sponge, std::span< const uint8_t > input, const detail::PermutationFn auto &permutation_fn)
BOTAN_MALLOC_FN void * allocate_memory (size_t elems, size_t elem_size)
template<typename... Ptrs>
bool any_null_pointers (Ptrs... ptr)
void argon2 (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, const uint8_t key[], size_t key_len, const uint8_t ad[], size_t ad_len, uint8_t y, size_t p, size_t M, size_t t)
bool argon2_check_pwhash (const char *password, size_t password_len, std::string_view input_hash)
std::string argon2_generate_pwhash (const char *password, size_t password_len, RandomNumberGenerator &rng, size_t p, size_t M, size_t t, uint8_t y, size_t salt_len, size_t output_len)
std::span< const uint8_t > as_span_of_bytes (const char *s, size_t len)
std::span< const uint8_t > as_span_of_bytes (const std::string &s)
std::span< const uint8_t > as_span_of_bytes (std::string_view s)
std::string asn1_class_to_string (ASN1_Class type)
std::string asn1_tag_to_string (ASN1_Type type)
void assert_unreachable (const char *file, int line)
void assertion_failure (const char *expr_str, const char *assertion_made, const char *func, const char *file, int line)
secure_vector< uint8_t > base32_decode (const char input[], size_t input_length, bool ignore_ws)
secure_vector< uint8_t > base32_decode (std::string_view input, bool ignore_ws)
size_t base32_decode (uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
size_t base32_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t base32_decode (uint8_t output[], std::string_view input, bool ignore_ws)
size_t base32_decode_max_output (size_t input_length)
size_t base32_encode (char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
std::string base32_encode (const uint8_t input[], size_t input_length)
std::string base32_encode (std::span< const uint8_t > input)
size_t base32_encode_max_output (size_t input_length)
std::vector< uint8_t > base58_check_decode (const char input[], size_t input_length)
std::vector< uint8_t > base58_check_decode (std::string_view s)
std::string base58_check_encode (const uint8_t input[], size_t input_length)
std::string base58_check_encode (std::span< const uint8_t > vec)
std::vector< uint8_t > base58_decode (const char input[], size_t input_length)
std::vector< uint8_t > base58_decode (std::string_view s)
std::string base58_encode (const uint8_t input[], size_t input_length)
std::string base58_encode (std::span< const uint8_t > vec)
secure_vector< uint8_t > base64_decode (const char input[], size_t input_length, bool ignore_ws)
size_t base64_decode (std::span< uint8_t > output, std::string_view input, bool ignore_ws)
secure_vector< uint8_t > base64_decode (std::string_view input, bool ignore_ws)
size_t base64_decode (uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
size_t base64_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t base64_decode (uint8_t output[], std::string_view input, bool ignore_ws)
size_t base64_decode_max_output (size_t input_length)
size_t base64_encode (char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
std::string base64_encode (const uint8_t input[], size_t input_length)
std::string base64_encode (std::span< const uint8_t > input)
size_t base64_encode_max_output (size_t input_length)
template<typename Base>
size_t base_decode (const Base &base, uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws=true)
template<typename Base>
size_t base_decode_full (const Base &base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
template<typename Vector, typename Base>
Vector base_decode_to_vec (const Base &base, const char input[], size_t input_length, bool ignore_ws)
template<class Base>
size_t base_encode (const Base &base, char output[], const uint8_t input[], size_t input_length, size_t &input_consumed, bool final_inputs)
template<typename Base>
std::string base_encode_to_string (const Base &base, const uint8_t input[], size_t input_length)
BOTAN_FUZZER_API void basecase_mul (word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size)
BOTAN_FUZZER_API void basecase_sqr (word z[], size_t z_size, const word x[], size_t x_size)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint basemul_booth_exec (std::span< const typename C::AffinePoint > table, const BlindedScalar &scalar, RandomNumberGenerator &rng)
template<typename C, size_t WindowBits>
std::vector< typename C::AffinePoint > basemul_booth_setup (const typename C::AffinePoint &p, size_t max_scalar_bits)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint basemul_exec (std::span< const typename C::AffinePoint > table, const BlindedScalar &scalar, RandomNumberGenerator &rng)
template<typename C, size_t WindowBits>
std::vector< typename C::AffinePoint > basemul_setup (const typename C::AffinePoint &p, size_t max_scalar_bits)
void bcrypt_pbkdf (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t rounds)
template<WordType W>
constexpr auto bigint_add2 (W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr auto bigint_add3 (W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr int32_t bigint_cmp (const W x[], size_t x_size, const W y[], size_t y_size)
template<WordType W>
constexpr void bigint_cnd_abs (W cnd, W x[], size_t size)
template<WordType W>
constexpr W bigint_cnd_add (W cnd, W x[], const W y[], size_t size)
template<WordType W>
constexpr auto bigint_cnd_sub (W cnd, W x[], const W y[], size_t size) -> W
template<WordType W>
constexpr void bigint_cnd_swap (W cnd, W x[], W y[], size_t size)
void bigint_comba_mul16 (word z[32], const word x[16], const word y[16])
void bigint_comba_mul24 (word z[48], const word x[24], const word y[24])
void bigint_comba_mul4 (word z[8], const word x[4], const word y[4])
void bigint_comba_mul6 (word z[12], const word x[6], const word y[6])
void bigint_comba_mul7 (word z[14], const word x[7], const word y[7])
void bigint_comba_mul8 (word z[16], const word x[8], const word y[8])
void bigint_comba_mul9 (word z[18], const word x[9], const word y[9])
void bigint_comba_sqr16 (word z[32], const word x[16])
void bigint_comba_sqr24 (word z[48], const word x[24])
void bigint_comba_sqr4 (word z[8], const word x[4])
void bigint_comba_sqr6 (word z[12], const word x[6])
void bigint_comba_sqr7 (word z[14], const word x[7])
void bigint_comba_sqr8 (word z[16], const word x[8])
void bigint_comba_sqr9 (word z[18], const word x[9])
template<WordType W>
constexpr auto bigint_ct_is_eq (const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask< W >
template<WordType W>
constexpr auto bigint_ct_is_lt (const W x[], size_t x_size, const W y[], size_t y_size, bool lt_or_equal=false) -> CT::Mask< W >
template<WordType W>
constexpr auto bigint_linmul2 (W x[], size_t x_size, W y) -> W
template<WordType W>
constexpr void bigint_linmul3 (W z[], const W x[], size_t x_size, W y)
template<WordType W>
constexpr void bigint_monty_maybe_sub (size_t N, W z[], W x0, const W x[], const W p[])
template<size_t N, WordType W>
constexpr void bigint_monty_maybe_sub (W z[N], W x0, const W x[N], const W y[N])
void bigint_monty_redc (word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size)
BOTAN_FUZZER_API void bigint_monty_redc_12 (word r[12], const word z[24], const word p[12], word p_dash, word ws[12])
BOTAN_FUZZER_API void bigint_monty_redc_16 (word r[16], const word z[32], const word p[16], word p_dash, word ws[16])
BOTAN_FUZZER_API void bigint_monty_redc_24 (word r[24], const word z[48], const word p[24], word p_dash, word ws[24])
BOTAN_FUZZER_API void bigint_monty_redc_32 (word r[32], const word z[64], const word p[32], word p_dash, word ws[32])
BOTAN_FUZZER_API void bigint_monty_redc_4 (word r[4], const word z[8], const word p[4], word p_dash, word ws[4])
BOTAN_FUZZER_API void bigint_monty_redc_6 (word r[6], const word z[12], const word p[6], word p_dash, word ws[6])
BOTAN_FUZZER_API void bigint_monty_redc_8 (word r[8], const word z[16], const word p[8], word p_dash, word ws[8])
BOTAN_FUZZER_API void bigint_monty_redc_generic (word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[])
void bigint_monty_redc_inplace (word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size)
void bigint_mul (word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, const word y[], size_t y_size, size_t y_sw, word workspace[], size_t ws_size)
template<WordType W>
constexpr void bigint_shl1 (W x[], size_t x_size, size_t x_words, size_t shift)
template<WordType W>
constexpr void bigint_shl2 (W y[], const W x[], size_t x_size, size_t shift)
template<WordType W>
constexpr void bigint_shr1 (W x[], size_t x_size, size_t shift)
template<WordType W>
constexpr void bigint_shr2 (W y[], const W x[], size_t x_size, size_t shift)
void bigint_sqr (word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size)
template<WordType W>
constexpr auto bigint_sub2 (W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr void bigint_sub2_rev (W x[], const W y[], size_t y_size)
template<WordType W>
constexpr auto bigint_sub3 (W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr auto bigint_sub_abs (W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask< W >
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T bit_permute_step (T x, T mask, size_t shift)
size_t bit_size_to_32bit_size (size_t bit_size)
size_t bit_size_to_byte_size (size_t bit_size)
constexpr auto bitlen (size_t x)
template<size_t WindowBits, std::unsigned_integral T>
constexpr std::pair< size_t, CT::Choice > booth_recode (T x)
template<typename T, typename Alloc, typename Alloc2>
size_t buffer_insert (std::vector< T, Alloc > &buf, size_t buf_offset, const std::vector< T, Alloc2 > &input)
template<typename T, typename Alloc>
size_t buffer_insert (std::vector< T, Alloc > &buf, size_t buf_offset, const T input[], size_t input_length)
std::string bytes_to_string (std::span< const uint8_t > bytes)
template<WordType W, size_t N, size_t L>
constexpr auto bytes_to_words (std::span< const uint8_t, L > bytes)
template<size_t S, int64_t MUL = 1>
requires (S > 0 && S < 64)
void carry (int64_t &h0, int64_t &h1)
template<size_t S>
requires (S > 0 && S < 32)
void carry0 (int32_t &h0, int32_t &h1)
template<size_t S>
requires (S > 0 && S < 64)
void carry0 (int64_t &h0, int64_t &h1)
constexpr uint64_t carry_shift (const donna128 &a, size_t shift)
uint8_t * cast_char_ptr_to_uint8 (char *s)
const uint8_t * cast_char_ptr_to_uint8 (const char *s)
const char * cast_uint8_ptr_to_char (const uint8_t *b)
char * cast_uint8_ptr_to_char (uint8_t *b)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T ceil_division (T a, T b)
template<std::unsigned_integral T>
requires (sizeof(T) < 32)
constexpr uint8_t ceil_log2 (T x)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T ceil_tobytes (T bits)
std::vector< WotsHashIndex > chain_lengths (const SphincsTreeNode &msg, const Sphincs_Parameters &params)
std::string check_and_canonicalize_dns_name (std::string_view name)
bool check_bcrypt (std::string_view pass, std::string_view hash)
bool check_passhash9 (std::string_view pass, std::string_view hash)
template<std::unsigned_integral T>
constexpr std::optional< T > checked_add (T a, T b)
template<std::unsigned_integral T, std::unsigned_integral... Ts>
requires all_same_v<T, Ts...>
constexpr std::optional< T > checked_add (T a, T b, Ts... rest)
template<typename RT, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
constexpr RT checked_cast_to (AT i)
template<typename RT, typename ExceptionType, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
constexpr RT checked_cast_to_or_throw (AT i, std::string_view error_msg_on_fail)
template<std::unsigned_integral T>
constexpr std::optional< T > checked_mul (T a, T b)
template<std::unsigned_integral T>
constexpr std::optional< T > checked_sub (T a, T b)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T choose (T mask, T a, T b)
constexpr void clear_bytes (void *ptr, size_t bytes)
template<ranges::contiguous_output_range R>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<R>>
constexpr void clear_mem (R &&mem)
template<typename T>
constexpr void clear_mem (T *ptr, size_t n)
template<int M>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul (const SIMD_4x32 &H, const SIMD_4x32 &x)
template<size_t N, WordType W>
constexpr void comba_mul (W z[2 *N], const W x[N], const W y[N])
template<size_t N, WordType W>
constexpr void comba_sqr (W z[2 *N], const W x[N])
constexpr uint64_t combine_lower (const donna128 &a, size_t s1, const donna128 &b, size_t s2)
void commoncrypto_adjust_key_size (const uint8_t key[], size_t length, const CommonCryptor_Opts &opts, secure_vector< uint8_t > &full_key)
CommonCryptor_Opts commoncrypto_opts_from_algo (std::string_view algo)
CommonCryptor_Opts commoncrypto_opts_from_algo_name (std::string_view algo_name)
void compute_root (StrongSpan< SphincsTreeNode > out, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, const SphincsTreeNode &leaf, TreeNodeIndex leaf_idx, uint32_t idx_offset, StrongSpan< const SphincsAuthenticationPath > authentication_path, uint32_t total_tree_height, Sphincs_Address &tree_address)
template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void compute_root (StrongSpan< TreeNode > out_root, AuthPathSS authentication_path, TreeNodeIndex leaf_idx, StrongSpan< const TreeNode > leaf, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, Address &tree_address)
 Uses an authentication path and a leaf node to reconstruct the root node of a merkle tree.
BigInt compute_rsa_secret_exponent (const BigInt &e, const BigInt &phi_n, const BigInt &p, const BigInt &q)
template<typename OutR = detail::AutoDetect, ranges::spanable_range... Rs>
requires (all_same_v<std::ranges::range_value_t<Rs>...>)
constexpr auto concat (Rs &&... ranges)
bool constant_time_compare (const uint8_t x[], const uint8_t y[], size_t len)
bool constant_time_compare (std::span< const uint8_t > x, std::span< const uint8_t > y)
template<ranges::contiguous_output_range OutR, ranges::contiguous_range InR>
requires std::is_same_v<std::ranges::range_value_t<OutR>, std::ranges::range_value_t<InR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<InR>>
constexpr void copy_mem (OutR &&out, const InR &in)
template<typename T>
requires std::is_trivial_v<std::decay_t<T>>
constexpr void copy_mem (T *out, const T *in, size_t n)
template<ranges::spanable_range InR>
void copy_out_be (std::span< uint8_t > out, const InR &in)
template<ranges::spanable_range InR>
void copy_out_le (std::span< uint8_t > out, const InR &in)
template<WordType W, size_t N>
consteval size_t count_bits (const std::array< W, N > &p)
auto create_aes_row_generator (const FrodoKEMConstants &constants, StrongSpan< const FrodoSeedA > seed_a)
std::unique_ptr< Private_Key > create_ec_private_key (std::string_view alg_name, const EC_Group &ec_group, RandomNumberGenerator &rng)
std::string create_hex_fingerprint (const uint8_t bits[], size_t bits_len, std::string_view hash_name)
std::string create_hex_fingerprint (std::span< const uint8_t > vec, std::string_view hash_name)
std::array< uint8_t, ED448_LEN > create_pk_from_sk (std::span< const uint8_t, ED448_LEN > sk)
 Create a public key point from a secret key (RFC 8032 5.2.5).
std::unique_ptr< Private_Key > create_private_key (std::string_view alg_name, RandomNumberGenerator &rng, std::string_view params, std::string_view provider)
auto create_shake_row_generator (const FrodoKEMConstants &constants, StrongSpan< const FrodoSeedA > seed_a)
std::span< const uint8_t > cstr_as_span_of_bytes (const char *s)
uint8_t ct_compare_u8 (const uint8_t x[], const uint8_t y[], size_t len)
BigInt ct_divide (const BigInt &x, const BigInt &y)
void ct_divide (const BigInt &x, const BigInt &y, BigInt &q_out, BigInt &r_out)
BigInt ct_divide_pow2k (size_t k, const BigInt &y)
BigInt ct_divide_word (const BigInt &x, word y)
void ct_divide_word (const BigInt &x, word y, BigInt &q_out, word &r_out)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit (T a)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret (T x, size_t s)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T ct_is_zero (T x)
word ct_mod_word (const BigInt &x, word y)
BigInt ct_modulo (const BigInt &x, const BigInt &y)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr uint8_t ct_popcount (T x)
template<std::unsigned_integral T>
constexpr T ct_reverse_bits (T b)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t ctz (T n)
void curve25519_basepoint (uint8_t mypublic[32], const uint8_t secret[32])
void curve25519_donna (uint8_t mypublic[32], const uint8_t secret[32], const uint8_t basepoint[32])
template<typename ProjectivePoint>
constexpr ProjectivePoint dbl_a_minus_3 (const ProjectivePoint &pt)
template<typename ProjectivePoint>
constexpr ProjectivePoint dbl_a_zero (const ProjectivePoint &pt)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint dbl_generic (const ProjectivePoint &pt, const FieldElement &A)
template<typename ProjectivePoint>
constexpr ProjectivePoint dbl_n_a_minus_3 (const ProjectivePoint &pt, size_t n)
template<typename ProjectivePoint>
constexpr ProjectivePoint dbl_n_a_zero (const ProjectivePoint &pt, size_t n)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint dbl_n_generic (const ProjectivePoint &pt, const FieldElement &A, size_t n)
void deallocate_memory (void *p, size_t elems, size_t elem_size)
gf2m decode_gf2m (const uint8_t *mem)
Point448 decode_point (std::span< const uint8_t > p_bytes)
 Decode a point from a byte array. RFC 7748 Section 5 (decodeUCoordinate).
ScalarX448 decode_scalar (std::span< const uint8_t > scalar_bytes)
 Decode a scalar from a byte array. RFC 7748 Section 5 (decodeScalar448).
template<WordType W, W div>
requires (div == 10)
consteval std::pair< W, size_t > div_magic ()
template<WordType W>
constexpr W divide_10 (W x)
size_t dl_exponent_size (size_t p_bits)
size_t dl_work_factor (size_t bits)
template<typename E, typename... Args>
void do_throw_error (const char *file, int line, const char *func, Args... args)
size_t ecp_work_factor (size_t bits)
void ed25519_basepoint_mul (std::span< uint8_t, 32 > out, const uint8_t in[32])
void ed25519_gen_keypair (uint8_t pk[32], uint8_t sk[64], const uint8_t seed[32])
void ed25519_sign (uint8_t sig[64], const uint8_t m[], size_t mlen, const uint8_t sk[64], const uint8_t domain_sep[], size_t domain_sep_len)
bool ed25519_verify (const uint8_t *m, size_t mlen, const uint8_t sig[64], const uint8_t *pk, const uint8_t domain_sep[], size_t domain_sep_len)
bool ed25519_verify (const uint8_t msg[], size_t msg_len, const uint8_t sig[64], const uint8_t pk[32], const uint8_t domain_sep[], size_t domain_sep_len)
uint32_t encode_gf2m (gf2m to_enc, uint8_t *mem)
secure_vector< uint8_t > encode_point (const Point448 &p)
 Encode a point to a 56 byte vector. RFC 7748 Section 5 (encodeUCoordinate).
RandomNumberGenerator & esdm_rng ()
template<typename T>
uint16_t expand_mask_16bit (T tst)
void expand_message_xmd (std::string_view hash_fn, std::span< uint8_t > output, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep)
template<std::integral T>
consteval eea_result< T > extended_euclidean_algorithm (T a, T b)
secure_vector< gf2m > find_roots_gf2m_decomp (const polyn_gf2m &polyn, size_t code_length)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T floor_log2 (T n)
template<typename... T>
std::string fmt (std::string_view format, const T &... args)
std::string format_char_for_display (char c)
SphincsTreeNode fors_public_key_from_signature (const SphincsHashedMessage &hashed_message, StrongSpan< const ForsSignature > signature, const Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hash)
 FIPS 205, Algorithm 17: fors_pkFromSig.
SphincsTreeNode fors_sign_and_pkgen (StrongSpan< ForsSignature > sig_out, const SphincsHashedMessage &hashed_message, const SphincsSecretSeed &secret_seed, const Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 16: fors_sign (with simultaneous FORS pk generation).
BigInt gcd (const BigInt &a, const BigInt &b)
template<typename GeneralVariantT, typename SpecialT>
requires (std::is_constructible_v<GeneralVariantT, std::decay_t<SpecialT>>)
constexpr GeneralVariantT generalize_to (SpecialT &&specific)
 Converts a given variant into another variant-ish whose type states are a super set of the given variant.
template<typename GeneralVariantT, typename... SpecialTs>
constexpr GeneralVariantT generalize_to (std::variant< SpecialTs... > specific)
 Converts a given variant into another variant-ish whose type states are a super set of the given variant.
std::string generate_bcrypt (std::string_view pass, RandomNumberGenerator &rng, uint16_t work_factor, char version)
std::vector< uint8_t > generate_dsa_primes (RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits)
bool generate_dsa_primes (RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits, const std::vector< uint8_t > &seed_c, size_t offset)
McEliece_PrivateKey generate_mceliece_key (RandomNumberGenerator &rng, size_t ext_deg, size_t code_length, size_t t)
std::string generate_passhash9 (std::string_view pass, RandomNumberGenerator &rng, uint16_t work_factor, uint8_t alg_id)
BigInt generate_rfc6979_nonce (const BigInt &x, const BigInt &q, const BigInt &h, std::string_view hash)
BigInt generate_rsa_prime (RandomNumberGenerator &keygen_rng, RandomNumberGenerator &prime_test_rng, size_t bits, const BigInt &coprime, size_t prob)
AEAD_Mode * get_aead (std::string_view name, Cipher_Dir direction)
template<size_t B, typename T>
requires (B < sizeof(T))
constexpr uint8_t get_byte (T input)
template<typename T>
constexpr uint8_t get_byte_var (size_t byte_num, T input)
Keyed_Filter * get_cipher (std::string_view algo_spec, Cipher_Dir direction)
Keyed_Filter * get_cipher (std::string_view algo_spec, const SymmetricKey &key, Cipher_Dir direction)
Keyed_Filter * get_cipher (std::string_view algo_spec, const SymmetricKey &key, const InitializationVector &iv, Cipher_Dir direction)
Cipher_Mode * get_cipher_mode (std::string_view algo_spec, Cipher_Dir direction, std::string_view provider="")
std::vector< std::string > get_files_recursive (std::string_view dir)
KDF * get_kdf (std::string_view algo_spec)
PBKDF * get_pbkdf (std::string_view algo_spec, std::string_view provider="")
PBKDF * get_s2k (std::string_view algo_spec)
template<WordType W>
constexpr uint32_t get_uint32 (const W xw[], size_t i)
template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 gf2p8affine (const SIMD_8x32 &x)
template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 gf2p8affineinv (const SIMD_8x32 &x)
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 gf2p8mul (const SIMD_8x32 &a, const SIMD_8x32 &b)
consteval uint64_t gfni_matrix (std::string_view s)
gf2m gray_to_lex (gf2m gray)
bool has_filesystem_impl ()
template<typename C, bool RO, std::invocable< std::span< uint8_t > > ExpandMsg>
requires C::ValidForSswuHash
auto hash_to_curve_sswu (const ExpandMsg &expand_message) -> std::conditional_t< RO, typename C::ProjectivePoint, typename C::AffinePoint >
std::vector< uint8_t > hex_decode (const char input[], size_t input_length, bool ignore_ws)
size_t hex_decode (std::span< uint8_t > output, std::string_view input, bool ignore_ws)
std::vector< uint8_t > hex_decode (std::string_view input, bool ignore_ws)
size_t hex_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t hex_decode (uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool ignore_ws)
size_t hex_decode (uint8_t output[], std::string_view input, bool ignore_ws)
secure_vector< uint8_t > hex_decode_locked (const char input[], size_t input_length, bool ignore_ws)
secure_vector< uint8_t > hex_decode_locked (std::string_view input, bool ignore_ws)
void hex_encode (char output[], const uint8_t input[], size_t input_length, bool uppercase)
std::string hex_encode (const uint8_t input[], size_t input_length, bool uppercase)
std::string hex_encode (std::span< const uint8_t > input, bool uppercase=true)
template<WordType W, size_t N>
constexpr auto hex_to_words (const char(&s)[N])
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t high_bit (T n)
secure_vector< uint8_t > hkdf_expand_label (std::string_view hash_fn, std::span< const uint8_t > secret, std::string_view label, std::span< const uint8_t > hash_val, size_t length)
template<typename... Alts, typename... Ts>
constexpr bool holds_any_of (const std::variant< Ts... > &v) noexcept
bool host_wildcard_match (std::string_view issued_, std::string_view host_)
void ht_sign (StrongSpan< SphincsHypertreeSignature > out_sig, const SphincsTreeNode &message_to_sign, const SphincsSecretSeed &secret_seed, XmssTreeIndexInLayer tree_index_in_layer, TreeNodeIndex idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 12: ht_sign.
bool ht_verify (const SphincsTreeNode &signed_msg, StrongSpan< const SphincsHypertreeSignature > ht_sig, const SphincsTreeNode &pk_root, XmssTreeIndexInLayer tree_index_in_layer, TreeNodeIndex idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 13: ht_verify.
uint8_t ieee1363_hash_id (std::string_view name)
size_t if_work_factor (size_t bits)
template<typename... T>
constexpr void ignore_params (const T &... args)
template<std::unsigned_integral T>
constexpr size_t index_of_first_set_byte (T v)
void initialize_allocator ()
bool intersects (ASN1_Class x, ASN1_Class y)
BigInt inverse_mod (const BigInt &n, const BigInt &mod)
std::optional< BigInt > inverse_mod_general (const BigInt &x, const BigInt &mod)
BigInt inverse_mod_public_prime (const BigInt &x, const BigInt &p)
BigInt inverse_mod_rsa_public_modulus (const BigInt &x, const BigInt &n)
BigInt inverse_mod_secret_prime (const BigInt &x, const BigInt &p)
template<typename C>
constexpr auto invert_field_element (const typename C::FieldElement &fe)
std::string ipv4_to_string (uint32_t ip)
bool is_bailie_psw_probable_prime (const BigInt &n, const Barrett_Reduction &mod_n)
template<typename GeneralVariantT, typename SpecialT>
constexpr bool is_generalizable_to (const SpecialT &) noexcept
template<typename GeneralVariantT, typename... SpecialTs>
constexpr bool is_generalizable_to (const std::variant< SpecialTs... > &) noexcept
bool is_lucas_probable_prime (const BigInt &C, const Barrett_Reduction &mod_C)
bool is_miller_rabin_probable_prime (const BigInt &n, const Barrett_Reduction &mod_n, RandomNumberGenerator &rng, size_t test_iterations)
bool is_passhash9_alg_supported (uint8_t alg_id)
BigInt is_perfect_square (const BigInt &C)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr bool is_power_of_2 (T arg)
bool is_prime (const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
std::optional< uint32_t > is_sub_element_of (const OID &oid, std::initializer_list< uint32_t > prefix)
int32_t jacobi (BigInt a, BigInt n)
template<absorbing_object T, typename... Ts>
requires (std::constructible_from<std::span<const uint8_t>, Ts> && ...)
size_t keccak_absorb_padded_strings_encoding (T &sink, size_t padding_mod, Ts... byte_strings)
size_t keccak_int_encoding_size (size_t x)
std::span< const uint8_t > keccak_int_left_encode (std::span< uint8_t > out, size_t x)
std::span< const uint8_t > keccak_int_right_encode (std::span< uint8_t > out, size_t x)
constexpr size_t keccak_max_int_encoding_size ()
BOTAN_FORCE_INLINE void Keccak_Permutation_round (uint64_t T[25], const uint64_t A[25], uint64_t RC)
std::string key_constraints_to_string (Key_Constraints c)
std::string latin1_to_utf8 (const uint8_t chars[], size_t len)
BigInt lcm (const BigInt &a, const BigInt &b)
gf2m lex_to_gray (gf2m lex)
LMOTS_K lmots_compute_pubkey_from_sig (const LMOTS_Signature &sig, const LMS_Message &msg, const LMS_Identifier &identifier, LMS_Tree_Node_Idx q)
 Compute a public key candidate for an OTS-signature-message pair and the OTS instance parameters.
uint32_t load_3 (const uint8_t in[3])
uint32_t load_4 (const uint8_t *in)
template<typename OutT = detail::AutoDetect, typename... ParamTs>
constexpr auto load_be (ParamTs &&... params)
template<typename OutT = detail::AutoDetect, typename... ParamTs>
constexpr auto load_le (ParamTs &&... params)
std::unique_ptr< Private_Key > load_private_key (const AlgorithmIdentifier &alg_id, std::span< const uint8_t > key_bits)
std::unique_ptr< Public_Key > load_public_key (const AlgorithmIdentifier &alg_id, std::span< const uint8_t > key_bits)
template<typename T>
secure_vector< T > lock (const std::vector< T > &in)
size_t low_zero_bits (const BigInt &n)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T majority (T a, T b, T c)
std::unique_ptr< BlockCipher > make_commoncrypto_block_cipher (std::string_view name)
std::unique_ptr< Cipher_Mode > make_commoncrypto_cipher_mode (std::string_view name, Cipher_Dir direction)
std::unique_ptr< HashFunction > make_commoncrypto_hash (std::string_view name)
Compression_Algorithm * make_compressor (std::string_view type)
Decompression_Algorithm * make_decompressor (std::string_view type)
constexpr uint16_t make_uint16 (uint8_t i0, uint8_t i1)
constexpr uint32_t make_uint32 (uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3)
constexpr uint64_t make_uint64 (uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3, uint8_t i4, uint8_t i5, uint8_t i6, uint8_t i7)
template<typename T, typename Pred>
void map_remove_if (Pred pred, T &assoc)
template<typename C>
auto map_to_curve_sswu (const typename C::FieldElement &u) -> typename C::AffinePoint
secure_vector< uint8_t > mceliece_decrypt (secure_vector< gf2m > &error_pos, const uint8_t *ciphertext, size_t ciphertext_len, const McEliece_PrivateKey &key)
void mceliece_decrypt (secure_vector< uint8_t > &plaintext, secure_vector< uint8_t > &error_mask, const uint8_t ciphertext[], size_t ciphertext_len, const McEliece_PrivateKey &key)
void mceliece_decrypt (secure_vector< uint8_t > &plaintext_out, secure_vector< uint8_t > &error_mask_out, const secure_vector< uint8_t > &ciphertext, const McEliece_PrivateKey &key)
void mceliece_encrypt (secure_vector< uint8_t > &ciphertext_out, secure_vector< uint8_t > &error_mask_out, const secure_vector< uint8_t > &plaintext, const McEliece_PublicKey &key, RandomNumberGenerator &rng)
size_t mceliece_work_factor (size_t n, size_t t)
template<typename F>
uint64_t measure_cost (uint64_t trial_msec, F func)
void mgf1_mask (HashFunction &hash, std::span< const uint8_t > input, std::span< uint8_t > output)
size_t miller_rabin_test_iterations (size_t n_bits, size_t prob, bool random)
template<std::integral T, std::integral T2 = next_longer_int_t<T>>
requires (sizeof(T) <= 4)
consteval T modular_inverse (T q, T2 m=T2(1)<< sizeof(T) *8)
template<std::integral T>
requires (sizeof(T) <= 4)
consteval T montgomery_R (T q)
template<std::integral T>
requires (sizeof(T) <= 4)
consteval T montgomery_R2 (T q)
Montgomery_Int monty_execute (const Montgomery_Exponentiation_State &precomputed_state, const BigInt &k, size_t max_k_bits)
Montgomery_Int monty_execute_vartime (const Montgomery_Exponentiation_State &precomputed_state, const BigInt &k)
Montgomery_Int monty_exp (const Montgomery_Params &params_p, const BigInt &g, const BigInt &k, size_t max_k_bits)
Montgomery_Int monty_exp_vartime (const Montgomery_Params &params_p, const BigInt &g, const BigInt &k)
template<WordType W>
constexpr auto monty_inverse (W a) -> W
Montgomery_Int monty_multi_exp (const Montgomery_Params &params_p, const BigInt &x_bn, const BigInt &z1, const BigInt &y_bn, const BigInt &z2)
std::shared_ptr< const Montgomery_Exponentiation_State > monty_precompute (const Montgomery_Int &g, size_t window_bits, bool const_time)
std::shared_ptr< const Montgomery_Exponentiation_State > monty_precompute (const Montgomery_Params &params, const BigInt &g, size_t window_bits, bool const_time)
template<WordType W, size_t N>
constexpr auto monty_redc (const std::array< W, 2 *N > &z, const std::array< W, N > &p, W p_dash) -> std::array< W, N >
template<WordType W, size_t N>
constexpr auto monty_redc_pdash1 (const std::array< W, 2 *N > &z, const std::array< W, N > &p) -> std::array< W, N >
template<WordType W, size_t N>
consteval std::array< W, N > montygomery_r (const std::array< W, N > &p)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint mul2_exec (const AffinePointTable< C > &table, const BlindedScalar &x, const BlindedScalar &y, RandomNumberGenerator &rng)
template<typename C, size_t WindowBits>
std::vector< typename C::ProjectivePoint > mul2_setup (const typename C::AffinePoint &p, const typename C::AffinePoint &q)
constexpr void mul64x64_128 (uint64_t a, uint64_t b, uint64_t *lo, uint64_t *hi)
Gf448Elem mul_a24 (const Gf448Elem &a)
 Multiply a field element by the Curve448 constant a24 = 39081.
template<WordType W, size_t N>
consteval std::array< W, N > mul_mod (const std::array< W, N > &x, const std::array< W, N > &y, const std::array< W, N > &p)
EC_Point multi_exponentiate (const EC_Point &p1, const BigInt &z1, const EC_Point &p2, const BigInt &z2)
BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 mulx_polyval (const SIMD_4x32 &h)
secure_vector< uint8_t > nist_key_unwrap (const uint8_t input[], size_t input_len, const BlockCipher &bc)
secure_vector< uint8_t > nist_key_unwrap (std::span< const uint8_t > input, const BlockCipher &bc)
secure_vector< uint8_t > nist_key_unwrap_padded (const uint8_t input[], size_t input_len, const BlockCipher &bc)
secure_vector< uint8_t > nist_key_unwrap_padded (std::span< const uint8_t > input, const BlockCipher &bc)
std::vector< uint8_t > nist_key_wrap (const uint8_t input[], size_t input_len, const BlockCipher &bc)
std::vector< uint8_t > nist_key_wrap (std::span< const uint8_t > input, const BlockCipher &bc)
std::vector< uint8_t > nist_key_wrap_padded (const uint8_t input[], size_t input_len, const BlockCipher &bc)
std::vector< uint8_t > nist_key_wrap_padded (std::span< const uint8_t > input, const BlockCipher &bc)
CT::Option< size_t > oaep_find_delim (std::span< const uint8_t > input, std::span< const uint8_t > phash)
bool operator!= (const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
bool operator!= (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator!= (const BigInt &a, const BigInt &b)
bool operator!= (const BigInt &a, word b)
bool operator!= (const CRL_Entry &a1, const CRL_Entry &a2)
bool operator!= (const EC_Group &lhs, const EC_Group &rhs)
bool operator!= (const OctetString &s1, const OctetString &s2)
bool operator!= (const OID &a, const OID &b)
template<typename T, typename U>
bool operator!= (const secure_allocator< T > &, const secure_allocator< U > &)
bool operator!= (const X509_Certificate &cert1, const X509_Certificate &cert2)
bool operator!= (const X509_DN &dn1, const X509_DN &dn2)
BigInt operator% (const BigInt &n, const BigInt &mod)
word operator% (const BigInt &n, word mod)
template<bitvectorish T1, bitvectorish T2>
auto operator& (const T1 &lhs, const T2 &rhs)
ECIES_Flags operator& (ECIES_Flags a, ECIES_Flags b)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator& (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator& (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator& (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator&= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator&= (Strong< T1, Tags... > &a, T2 b)
EC_Point operator* (const BigInt &scalar, const EC_Point &point)
BigInt operator* (const BigInt &x, const BigInt &y)
BigInt operator* (const BigInt &x, word y)
template<std::integral T>
constexpr donna128 operator* (const donna128 &x, T y)
EC_Point operator* (const EC_Point &point, const BigInt &scalar)
Ed25519_FieldElement operator* (const Ed25519_FieldElement &x, const Ed25519_FieldElement &y)
Ed448Point operator* (const Scalar448 &lhs, const Ed448Point &rhs)
 Syntax sugar for scalar multiplication.
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator* (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator* (Strong< T1, Tags... > a, T2 b)
template<std::integral T>
constexpr donna128 operator* (T y, const donna128 &x)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator* (T1 a, Strong< T2, Tags... > b)
BigInt operator* (word x, const BigInt &y)
template<std::integral T, typename... Tags>
constexpr auto operator*= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator*= (Strong< T1, Tags... > &a, T2 b)
BigInt operator+ (const BigInt &x, const BigInt &y)
BigInt operator+ (const BigInt &x, word y)
constexpr donna128 operator+ (const donna128 &x, const donna128 &y)
constexpr donna128 operator+ (const donna128 &x, uint64_t y)
EC_Point operator+ (const EC_Point &lhs, const EC_Point &rhs)
Ed25519_FieldElement operator+ (const Ed25519_FieldElement &x, const Ed25519_FieldElement &y)
OctetString operator+ (const OctetString &k1, const OctetString &k2)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator+ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator+ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator+ (T1 a, Strong< T2, Tags... > b)
BigInt operator+ (word x, const BigInt &y)
template<std::integral T, typename... Tags>
constexpr auto operator++ (Strong< T, Tags... > &a)
template<std::integral T, typename... Tags>
constexpr auto operator++ (Strong< T, Tags... > &a, int)
template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > & operator+= (std::vector< T, Alloc > &out, const std::pair< const T *, L > &in)
template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > & operator+= (std::vector< T, Alloc > &out, const std::pair< T *, L > &in)
template<typename T, typename Alloc, typename Alloc2>
std::vector< T, Alloc > & operator+= (std::vector< T, Alloc > &out, const std::vector< T, Alloc2 > &in)
template<typename T, typename Alloc>
std::vector< T, Alloc > & operator+= (std::vector< T, Alloc > &out, std::span< const T > in)
template<typename T, typename Alloc>
std::vector< T, Alloc > & operator+= (std::vector< T, Alloc > &out, T in)
template<std::integral T, typename... Tags>
constexpr auto operator+= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator+= (Strong< T1, Tags... > &a, T2 b)
BigInt operator- (const BigInt &x, const BigInt &y)
BigInt operator- (const BigInt &x, word y)
EC_Point operator- (const EC_Point &lhs)
EC_Point operator- (const EC_Point &lhs, const EC_Point &rhs)
Ed25519_FieldElement operator- (const Ed25519_FieldElement &x)
Ed25519_FieldElement operator- (const Ed25519_FieldElement &x, const Ed25519_FieldElement &y)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator- (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator- (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator- (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator-- (Strong< T, Tags... > &a)
template<std::integral T, typename... Tags>
constexpr auto operator-- (Strong< T, Tags... > &a, int)
template<std::integral T, typename... Tags>
constexpr auto operator-= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator-= (Strong< T1, Tags... > &a, T2 b)
BigInt operator/ (const BigInt &x, const BigInt &y)
BigInt operator/ (const BigInt &x, word y)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator/ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator/ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator/ (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator/= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator/= (Strong< T1, Tags... > &a, T2 b)
bool operator< (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator< (const BigInt &a, const BigInt &b)
bool operator< (const BigInt &a, word b)
bool operator< (const OID &a, const OID &b)
bool operator< (const X509_DN &dn1, const X509_DN &dn2)
BigInt operator<< (const BigInt &x, size_t shift)
int operator<< (int fd, Pipe &pipe)
std::ostream & operator<< (std::ostream &os, const GeneralName &gn)
std::ostream & operator<< (std::ostream &os, const GeneralSubtree &gs)
template<typename T, typename... Tags>
requires (concepts::streamable<T>)
decltype(auto) operator<< (std::ostream &os, const Strong< T, Tags... > &v)
std::ostream & operator<< (std::ostream &out, const OID &oid)
std::ostream & operator<< (std::ostream &out, const X509_DN &dn)
std::ostream & operator<< (std::ostream &out, Pipe &pipe)
std::ostream & operator<< (std::ostream &stream, const BigInt &n)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator<< (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator<< (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator<< (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator<<= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator<<= (Strong< T1, Tags... > &a, T2 b)
bool operator<= (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator<= (const BigInt &a, const BigInt &b)
bool operator<= (const BigInt &a, word b)
template<typename T, typename... Tags>
requires (std::three_way_comparable<T>)
auto operator<=> (const Strong< T, Tags... > &lhs, const Strong< T, Tags... > &rhs)
template<std::integral T1, std::integral T2, typename... Tags>
auto operator<=> (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
auto operator<=> (T1 a, Strong< T2, Tags... > b)
bool operator== (const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
bool operator== (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator== (const BigInt &a, const BigInt &b)
bool operator== (const BigInt &a, word b)
bool operator== (const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &lhs, const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &rhs)
bool operator== (const CRL_Entry &a1, const CRL_Entry &a2)
bool operator== (const OctetString &s1, const OctetString &s2)
template<typename T, typename U>
bool operator== (const secure_allocator< T > &, const secure_allocator< U > &)
template<typename T, typename... Tags>
requires (std::equality_comparable<T>)
bool operator== (const Strong< T, Tags... > &lhs, const Strong< T, Tags... > &rhs)
template<bitvectorish T1, bitvectorish T2>
bool operator== (const T1 &lhs, const T2 &rhs)
bool operator== (const X509_DN &dn1, const X509_DN &dn2)
template<std::integral T1, std::integral T2, typename... Tags>
auto operator== (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
auto operator== (T1 a, Strong< T2, Tags... > b)
bool operator> (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator> (const BigInt &a, const BigInt &b)
bool operator> (const BigInt &a, word b)
bool operator>= (const ASN1_Time &t1, const ASN1_Time &t2)
bool operator>= (const BigInt &a, const BigInt &b)
bool operator>= (const BigInt &a, word b)
BigInt operator>> (const BigInt &x, size_t shift)
int operator>> (int fd, Pipe &pipe)
std::istream & operator>> (std::istream &in, Pipe &pipe)
std::istream & operator>> (std::istream &in, X509_DN &dn)
std::istream & operator>> (std::istream &stream, BigInt &n)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator>> (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator>> (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator>> (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator>>= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator>>= (Strong< T1, Tags... > &a, T2 b)
OctetString operator^ (const OctetString &k1, const OctetString &k2)
template<bitvectorish T1, bitvectorish T2>
auto operator^ (const T1 &lhs, const T2 &rhs)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator^ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator^ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator^ (T1 a, Strong< T2, Tags... > b)
template<typename Alloc, typename Alloc2>
std::vector< uint8_t, Alloc > & operator^= (std::vector< uint8_t, Alloc > &out, const std::vector< uint8_t, Alloc2 > &in)
template<std::integral T, typename... Tags>
constexpr auto operator^= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator^= (Strong< T1, Tags... > &a, T2 b)
ASN1_Class operator| (ASN1_Class x, ASN1_Class y)
uint32_t operator| (ASN1_Class x, ASN1_Type y)
uint32_t operator| (ASN1_Type x, ASN1_Class y)
ASN1_Type operator| (ASN1_Type x, ASN1_Type y)
constexpr donna128 operator| (const donna128 &x, const donna128 &y)
constexpr donna128 operator| (const donna128 &x, uint64_t y)
template<bitvectorish T1, bitvectorish T2>
auto operator| (const T1 &lhs, const T2 &rhs)
ECIES_Flags operator| (ECIES_Flags a, ECIES_Flags b)
template<std::integral T, typename... Tags>
constexpr decltype(auto) operator| (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator| (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto) operator| (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto operator|= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto operator|= (Strong< T1, Tags... > &a, T2 b)
EC_Point OS2ECP (const uint8_t data[], size_t data_len, const CurveGFp &curve)
std::pair< BigInt, BigInt > OS2ECP (const uint8_t pt[], size_t pt_len, const BigInt &p, const BigInt &a, const BigInt &b)
EC_Point OS2ECP (std::span< const uint8_t > data, const CurveGFp &curve)
template<typename T>
constexpr auto out_ptr (T &outptr) noexcept
template<class... Ts>
 overloaded (Ts...) -> overloaded< Ts... >
uint32_t P0 (uint32_t X)
uint32_t P1 (uint32_t X)
template<WordType W, size_t N>
consteval std::array< W, N > p_div_2_plus_1 (const std::array< W, N > &p)
template<uint8_t X, WordType W, size_t N>
consteval std::array< W, N > p_minus (const std::array< W, N > &p)
template<WordType W, size_t N>
consteval std::array< W, N > p_minus_1_over_2 (const std::array< W, N > &p)
template<WordType W, size_t N>
consteval std::array< W, N > p_plus_1_over_4 (const std::array< W, N > &p)
std::vector< std::string > parse_algorithm_name (std::string_view scan_name)
bool passes_miller_rabin_test (const BigInt &n, const Barrett_Reduction &mod_n, const Montgomery_Params &monty_n, const BigInt &a)
secure_vector< uint8_t > pbes2_decrypt (std::span< const uint8_t > key_bits, std::string_view passphrase, const std::vector< uint8_t > &params)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt (std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt_iter (std::span< const uint8_t > key_bits, std::string_view passphrase, size_t pbkdf_iter, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt_msec (std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, size_t *out_iterations_if_nonnull, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
void pbkdf2 (MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, const uint8_t salt[], size_t salt_len, size_t iterations)
size_t pbkdf2 (MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t iterations, std::chrono::milliseconds msec)
std::vector< uint8_t > pkcs_hash_id (std::string_view name)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint point_add (const ProjectivePoint &a, const ProjectivePoint &b)
template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
constexpr ProjectivePoint point_add_mixed (const ProjectivePoint &a, const AffinePoint &b, const FieldElement &one)
template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
constexpr ProjectivePoint point_add_or_sub_mixed (const ProjectivePoint &a, const AffinePoint &b, CT::Choice sub, const FieldElement &one)
void poly_double_n (uint8_t buf[], size_t n)
void poly_double_n (uint8_t out[], const uint8_t in[], size_t n)
void poly_double_n_le (uint8_t out[], const uint8_t in[], size_t n)
bool poly_double_supported_size (size_t n)
template<uint8_t POLY, std::unsigned_integral T>
constexpr T poly_mul (T x, uint8_t y)
BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL polyval_multiply (const SIMD_4x32 &H, const SIMD_4x32 &x)
BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL polyval_reduce (const SIMD_4x32 &hi, const SIMD_4x32 &lo)
BigInt power_mod (const BigInt &base, const BigInt &exp, const BigInt &mod)
uint64_t prefetch_array_raw (size_t bytes, const void *arrayv) noexcept
template<std::unsigned_integral T, size_t... Ns>
T prefetch_arrays (T(&... arr)[Ns]) noexcept
std::vector< std::string > probe_provider_private_key (std::string_view alg_name, const std::vector< std::string > &possible)
template<typename T>
std::vector< std::string > probe_providers_of (std::string_view algo_spec, const std::vector< std::string > &possible={"base"})
template<detail::SpongeLikeWithTrivialPermute SpongeT>
void process_bytes_in_sponge (SpongeT &sponge, size_t bytes_to_process, const detail::ModifierFn< SpongeT > auto &modifier_fn)
template<detail::SpongeLike SpongeT>
BOTAN_FORCE_INLINE void process_bytes_in_sponge (SpongeT &sponge, size_t bytes_to_process, const detail::PermutationFn auto &permutation_fn, const detail::ModifierFn< SpongeT > auto &modifier_fn)
void R1 (uint32_t A, uint32_t &B, uint32_t C, uint32_t &D, uint32_t E, uint32_t &F, uint32_t G, uint32_t &H, uint32_t TJ, uint32_t Wi, uint32_t Wj)
void R2 (uint32_t A, uint32_t &B, uint32_t C, uint32_t &D, uint32_t E, uint32_t &F, uint32_t G, uint32_t &H, uint32_t TJ, uint32_t Wi, uint32_t Wj)
gf2m random_code_element (uint16_t code_length, RandomNumberGenerator &rng)
gf2m random_gf2m (RandomNumberGenerator &rng)
BigInt random_prime (RandomNumberGenerator &rng, size_t bits, const BigInt &coprime, size_t equiv, size_t modulo, size_t prob)
BigInt random_safe_prime (RandomNumberGenerator &rng, size_t bits)
std::map< std::string, std::string > read_cfg (std::istream &is)
BOTAN_TEST_API std::map< std::string, std::string > read_kv (std::string_view kv)
template<size_t WindowBits, typename W, size_t N>
constexpr size_t read_window_bits (std::span< const W, N > words, size_t offset)
template<WordType W, size_t N, W C>
constexpr std::array< W, N > redc_crandall (std::span< const W, 2 *N > z)
void redc_mul (int64_t &s1, int64_t &s2, int64_t &s3, int64_t &s4, int64_t &s5, int64_t &s6, int64_t &X)
template<typename RetT, typename KeyT, typename ReducerT>
requires std::invocable<ReducerT&, RetT, const KeyT&> && std::convertible_to<std::invoke_result_t<ReducerT&, RetT, const KeyT&>, RetT>
RetT reduce (const std::vector< KeyT > &keys, RetT acc, ReducerT reducer)
template<WordType W, size_t N, size_t XN>
consteval std::array< W, N > reduce_mod (const std::array< W, XN > &x, const std::array< W, N > &p)
template<std::unsigned_integral T>
requires (sizeof(T) == 1 || sizeof(T) == 2 || sizeof(T) == 4 || sizeof(T) == 8)
constexpr T reverse_bytes (T x)
BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 reverse_vector (const SIMD_4x32 &in)
secure_vector< uint8_t > rfc3394_keyunwrap (const secure_vector< uint8_t > &key, const SymmetricKey &kek)
secure_vector< uint8_t > rfc3394_keywrap (const secure_vector< uint8_t > &key, const SymmetricKey &kek)
size_t RFC4880_decode_count (uint8_t iter)
uint8_t RFC4880_encode_count (size_t desired_iterations)
size_t RFC4880_round_iterations (size_t iterations)
template<size_t R1, size_t R2, size_t R3, std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T rho (T x)
Gf448Elem root (const Gf448Elem &elem)
 Compute the root of elem in the field.
template<size_t R>
SIMD_16x32 BOTAN_FN_ISA_AVX512 rotl (SIMD_16x32 input)
template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 rotl (SIMD_4x32 input)
template<size_t R>
SIMD_8x32 BOTAN_FN_ISA_AVX2 rotl (SIMD_8x32 input)
template<size_t ROT, std::unsigned_integral T>
requires (ROT > 0 && ROT < 8 * sizeof(T))
BOTAN_FORCE_INLINE constexpr T rotl (T input)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T rotl_var (T input, size_t rot)
template<size_t R>
SIMD_16x32 BOTAN_FN_ISA_AVX512 rotr (SIMD_16x32 input)
template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 rotr (SIMD_4x32 input)
template<size_t R>
SIMD_8x32 BOTAN_FN_ISA_AVX2 rotr (SIMD_8x32 input)
template<size_t ROT, std::unsigned_integral T>
requires (ROT > 0 && ROT < 8 * sizeof(T))
BOTAN_FORCE_INLINE constexpr T rotr (T input)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T rotr_var (T input, size_t rot)
constexpr size_t round_up (size_t n, size_t align_to)
std::string runtime_version_check (uint32_t major, uint32_t minor, uint32_t patch)
template<typename T>
bool same_mem (const T *p1, const T *p2, size_t n)
void sc_muladd (uint8_t *s, const uint8_t *a, const uint8_t *b, const uint8_t *c)
void sc_reduce (uint8_t *s)
constexpr size_t scalar_blinding_bits (size_t scalar_bits)
void scrypt (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p)
void scrypt (uint8_t output[], size_t output_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p)
void secure_scrub_memory (ranges::contiguous_output_range auto &&data)
void secure_scrub_memory (void *ptr, size_t n)
void secure_zeroize_buffer (void *ptr, size_t n)
constexpr void set_mem (uint8_t *ptr, size_t n, uint8_t val)
BOTAN_FORCE_INLINE void SHA2_32_F (uint32_t A, uint32_t B, uint32_t C, uint32_t &D, uint32_t E, uint32_t F, uint32_t G, uint32_t &H, uint32_t &M1, uint32_t M2, uint32_t M3, uint32_t M4, uint32_t magic)
BOTAN_FORCE_INLINE void SHA2_32_F (uint32_t A, uint32_t B, uint32_t C, uint32_t &D, uint32_t E, uint32_t F, uint32_t G, uint32_t &H, uint32_t M)
BOTAN_FORCE_INLINE void SHA2_64_F (uint64_t A, uint64_t B, uint64_t C, uint64_t &D, uint64_t E, uint64_t F, uint64_t G, uint64_t &H, uint64_t &M1, uint64_t M2, uint64_t M3, uint64_t M4, uint64_t magic)
BOTAN_FORCE_INLINE void SHA2_64_F (uint64_t A, uint64_t B, uint64_t C, uint64_t &D, uint64_t E, uint64_t F, uint64_t G, uint64_t &H, uint64_t M)
template<WordType W, size_t N>
consteval std::pair< size_t, std::array< W, N > > shanks_tonelli_c1c2 (const std::array< W, N > &p)
template<WordType W, size_t N>
consteval std::array< W, N > shanks_tonelli_c3 (const std::array< W, N > &c2)
template<typename Z, WordType W, size_t N>
consteval auto shanks_tonelli_c4 (const std::array< W, N > &p_minus_1_over_2) -> Z
template<size_t S, WordType W, size_t N>
constexpr W shift_left (std::array< W, N > &x)
template<size_t S, WordType W, size_t N>
constexpr W shift_right (std::array< W, N > &x)
template<size_t S>
SIMD_16x32 BOTAN_FN_ISA_AVX512 shl (SIMD_16x32 input)
template<size_t S>
SIMD_4x32 shl (SIMD_4x32 input)
template<size_t S>
SIMD_8x32 BOTAN_FN_ISA_AVX2 shl (SIMD_8x32 input)
const char * short_version_cstr ()
std::string short_version_string ()
template<size_t R1, size_t R2, size_t S, std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T sigma (T x)
std::array< uint8_t, 2 *ED448_LEN > sign_message (std::span< const uint8_t, ED448_LEN > sk, std::span< const uint8_t, ED448_LEN > pk, bool f, std::span< const uint8_t > context, std::span< const uint8_t > msg)
 Sign a message using a keypair (RFC 8032 5.2.6).
bool signature_check (std::span< const uint8_t, 32 > pk, const uint8_t h[32], const uint8_t r[32], const uint8_t s[32])
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t significant_bytes (T n)
std::vector< uint8_t > sm2_compute_za (HashFunction &hash, std::string_view user_id, const EC_Group &group, const EC_AffinePoint &pubkey)
uint32_t SM3_E (uint32_t W0, uint32_t W7, uint32_t W13, uint32_t W3, uint32_t W10)
template<size_t N, WordType W>
constexpr void solinas_correct_redc (std::array< W, N > &r, const std::array< W, N > &P, const std::array< W, N > &C)
std::vector< std::string > split_on (std::string_view str, char delim)
template<typename C>
constexpr CT::Option< typename C::FieldElement > sqrt_field_element (const typename C::FieldElement &fe)
BigInt sqrt_modulo_prime (const BigInt &a, const BigInt &p)
BigInt square (const BigInt &x)
Gf448Elem square (const Gf448Elem &elem)
 Computes elem^2. Faster than operator*.
void squeeze_from_sponge (detail::SpongeLikeWithTrivialPermute auto &sponge, std::span< uint8_t > output)
template<detail::SpongeLike SpongeT>
void squeeze_from_sponge (SpongeT &sponge, std::span< uint8_t > output, const detail::PermutationFn auto &permutation_fn)
std::pair< BigInt, SymmetricKey > srp6_client_agree (std::string_view identifier, std::string_view password, const DL_Group &group, std::string_view hash_id, const std::vector< uint8_t > &salt, const BigInt &B, const size_t a_bits, RandomNumberGenerator &rng)
std::pair< BigInt, SymmetricKey > srp6_client_agree (std::string_view identifier, std::string_view password, std::string_view group_id, std::string_view hash_id, const std::vector< uint8_t > &salt, const BigInt &B, RandomNumberGenerator &rng)
BigInt srp6_generate_verifier (std::string_view identifier, std::string_view password, const std::vector< uint8_t > &salt, const DL_Group &group, std::string_view hash_id)
BigInt srp6_generate_verifier (std::string_view identifier, std::string_view password, const std::vector< uint8_t > &salt, std::string_view group_id, std::string_view hash_id)
std::string srp6_group_identifier (const BigInt &N, const BigInt &g)
template<typename C>
requires C::ValidForSswuHash
const auto & SSWU_C1 ()
template<typename C>
requires C::ValidForSswuHash
const auto & SSWU_C2 ()
template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
constexpr auto store_be (ParamTs &&... params)
template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
constexpr auto store_le (ParamTs &&... params)
std::string string_join (const std::vector< std::string > &strs, char delim)
std::optional< uint32_t > string_to_ipv4 (std::string_view str)
template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr void swap_bits (T &x, T &y, T mask, size_t shift)
template<std::unsigned_integral T>
constexpr T swar_in_range (T v, T lower, T upper)
template<std::unsigned_integral T>
constexpr T swar_lt (T a, T b)
std::vector< polyn_gf2m > syndrome_init (const polyn_gf2m &generator, const std::vector< gf2m > &support, int n)
RandomNumberGenerator & system_rng ()
void throw_invalid_argument (const char *message, const char *func, const char *file)
void throw_invalid_state (const char *expr, const char *func, const char *file)
template<typename C>
constexpr auto to_affine (const typename C::ProjectivePoint &pt)
template<typename C, bool VariableTime = false>
auto to_affine_batch (std::span< const typename C::ProjectivePoint > projective)
template<typename C>
auto to_affine_x (const typename C::ProjectivePoint &pt)
const char * to_string (Certificate_Status_Code code)
std::string to_string (ErrorType type)
 Convert an ErrorType to string.
uint32_t to_u32bit (std::string_view str_view)
uint16_t to_uint16 (std::string_view str)
template<typename T>
requires std::is_enum_v<T>
auto to_underlying (T e) noexcept
std::string tolower_string (std::string_view str)
void treehash (StrongSpan< SphincsTreeNode > out_root, StrongSpan< SphincsAuthenticationPath > out_auth_path, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, std::optional< TreeNodeIndex > leaf_idx, uint32_t idx_offset, uint32_t total_tree_height, const GenerateLeafFunction &gen_leaf, Sphincs_Address &tree_address)
template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void treehash (StrongSpan< TreeNode > out_root, std::optional< AuthPathSS > out_auth_path, std::optional< TreeNodeIndex > leaf_idx, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, concepts::tree_gen_leaf< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto gen_leaf, Address &tree_address)
 Treehash logic to build up a merkle hash tree.
template<typename ToT, ranges::contiguous_range FromR>
requires std::is_default_constructible_v<ToT> && std::is_trivially_copyable_v<ToT> && std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>>
constexpr ToT typecast_copy (const FromR &src)
template<typename To>
requires std::is_trivial_v<To>
constexpr To typecast_copy (const uint8_t src[]) noexcept
template<typename T>
requires std::is_trivial_v<std::decay_t<T>>
constexpr void typecast_copy (T &out, const uint8_t in[])
template<typename T>
requires std::is_trivial_v<T>
constexpr void typecast_copy (T out[], const uint8_t in[], size_t N)
template<ranges::contiguous_output_range ToR, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
constexpr void typecast_copy (ToR &&out, const FromR &in)
template<ranges::contiguous_output_range ToR, typename FromT>
requires std::is_trivially_copyable_v<FromT> && (!std::ranges::range<FromT>) && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
constexpr void typecast_copy (ToR &&out, const FromT &in)
template<typename ToT, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<ToT> && (!std::ranges::range<ToT>)
constexpr void typecast_copy (ToT &out, const FromR &in)
template<typename T>
constexpr void typecast_copy (uint8_t out[], const T &in)
template<typename T>
requires std::is_trivially_copyable_v<T>
constexpr void typecast_copy (uint8_t out[], T in[], size_t N)
std::string ucs2_to_utf8 (const uint8_t ucs2[], size_t len)
std::string ucs4_to_utf8 (const uint8_t ucs4[], size_t len)
template<std::unsigned_integral T>
void unchecked_copy_memory (T *out, const T *in, size_t n)
template<typename T>
std::vector< T > unlock (const secure_vector< T > &in)
bool unsafe_for_production_build ()
template<typename T>
constexpr decltype(auto) unwrap_strong_type (T &&t)
 Generically unwraps a strong type to its underlying type.
template<typename T, typename V>
bool value_exists (const std::vector< T > &vec, const V &val)
BOTAN_FORCE_INLINE constexpr size_t var_ctz32 (uint32_t n)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint varpoint_exec (const AffinePointTable< C > &table, const BlindedScalar &scalar, RandomNumberGenerator &rng)
template<typename C, size_t TableSize>
AffinePointTable< C > varpoint_setup (const typename C::AffinePoint &p)
void vartime_divide (const BigInt &x, const BigInt &y_arg, BigInt &q_out, BigInt &r_out)
BigInt vartime_divide_pow2k (size_t k, const BigInt &y_arg)
bool verify_signature (std::span< const uint8_t, ED448_LEN > pk, bool phflag, std::span< const uint8_t > context, std::span< const uint8_t > sig, std::span< const uint8_t > msg)
 Verify a signature(RFC 8032 5.2.7).
const char * version_cstr ()
uint32_t version_datestamp ()
std::optional< std::string > version_distribution_info ()
uint32_t version_major ()
uint32_t version_minor ()
uint32_t version_patch ()
std::string version_string ()
std::optional< std::string > version_vc_revision ()
template<WordType W>
constexpr auto word8_add2 (W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto word8_add3 (W z[8], const W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto word8_linmul3 (W z[8], const W x[8], W y, W carry) -> W
template<WordType W>
constexpr auto word8_madd3 (W z[8], const W x[8], W y, W carry) -> W
template<WordType W>
constexpr auto word8_sub2 (W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto word8_sub3 (W z[8], const W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto word_add (W x, W y, W *carry) -> W
template<WordType W>
constexpr auto word_madd2 (W a, W b, W *c) -> W
template<WordType W>
constexpr auto word_madd3 (W a, W b, W c, W *d) -> W
template<WordType W>
constexpr auto word_sub (W x, W y, W *carry) -> W
constexpr size_t words_for_bits (size_t x)
WotsPublicKey wots_public_key_from_signature (const SphincsTreeNode &hashed_message, StrongSpan< const WotsSignature > signature, Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 8: wots_pkFromSig.
void wots_sign_and_pkgen (StrongSpan< WotsSignature > sig_out, StrongSpan< SphincsTreeNode > leaf_out, const SphincsSecretSeed &secret_seed, TreeNodeIndex leaf_idx, std::optional< TreeNodeIndex > sign_leaf_idx, const std::vector< WotsHashIndex > &wots_steps, Sphincs_Address &leaf_addr, Sphincs_Address &pk_addr, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 6 and 7: wots_pkGen and wots_sign.
template<typename T, typename ParamT>
requires std::constructible_from<T, ParamT> || (concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>)
constexpr decltype(auto) wrap_strong_type (ParamT &&t)
 Wraps a value into a caller-defined (strong) type.
Point448 x448 (const ScalarX448 &k, const Point448 &u)
 Multiply a scalar k with a point u.
Point448 x448_basepoint (const ScalarX448 &k)
 Multiply a scalar with the base group element (5).
bool x500_name_cmp (std::string_view name1, std::string_view name2)
Path_Validation_Result x509_path_validate (const std::vector< X509_Certificate > &end_certs, const Path_Validation_Restrictions &restrictions, const Certificate_Store &store, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result x509_path_validate (const std::vector< X509_Certificate > &end_certs, const Path_Validation_Restrictions &restrictions, const std::vector< Certificate_Store * > &trusted_roots, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point ref_time, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result x509_path_validate (const X509_Certificate &end_cert, const Path_Validation_Restrictions &restrictions, const Certificate_Store &store, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result x509_path_validate (const X509_Certificate &end_cert, const Path_Validation_Restrictions &restrictions, const std::vector< Certificate_Store * > &trusted_roots, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
template<std::unsigned_integral T>
void xmss_concat (secure_vector< uint8_t > &target, const T &src)
template<std::unsigned_integral T>
void xmss_concat (secure_vector< uint8_t > &target, const T &src, size_t len)
SphincsTreeNode xmss_gen_root (const Sphincs_Parameters &params, const SphincsSecretSeed &secret_seed, Sphincs_Hash_Functions &hashes)
SphincsTreeNode xmss_sign_and_pkgen (StrongSpan< SphincsXmssSignature > out_sig, const SphincsTreeNode &message, const SphincsSecretSeed &secret_seed, Sphincs_Address &wots_addr, Sphincs_Address &tree_addr, std::optional< TreeNodeIndex > idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
 FIPS 205, Algorithm 10: xmss_sign.
constexpr void xor_buf (ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
constexpr void xor_buf (ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in1, ranges::contiguous_range< uint8_t > auto &&in2)
void xor_buf (std::span< uint8_t > out, std::span< const uint8_t > in, size_t n)
template<typename Alloc, typename Alloc2>
void xor_buf (std::vector< uint8_t, Alloc > &out, const uint8_t *in, const std::vector< uint8_t, Alloc2 > &in2, size_t n)
template<typename Alloc>
void xor_buf (std::vector< uint8_t, Alloc > &out, const uint8_t *in, size_t n)
void xor_buf (uint8_t out[], const uint8_t in[], const uint8_t in2[], size_t length)
void xor_buf (uint8_t out[], const uint8_t in[], size_t length)
void xts_compute_tweak_block (uint8_t tweak[], size_t BS, size_t blocks_in_tweak)
template<typename T, typename Alloc>
void zap (std::vector< T, Alloc > &vec)
template<typename T, typename Alloc>
void zeroise (std::vector< T, Alloc > &vec)
template<std::unsigned_integral T>
void zeroize_buffer (T buf[], size_t n)

Variables

constexpr size_t BLAKE2B_BLOCKBYTES = 128
constexpr size_t BYTES_448 = ceil_tobytes<size_t>(448)
constexpr size_t DefaultBufferSize = 4096
constexpr size_t ED448_LEN = 57
const size_t HEX_CODEC_BUFFER_SIZE = 256
template<typename T>
constexpr bool is_strong_span_v = is_strong_span<T>::value
template<typename... Ts>
constexpr bool is_strong_type_v = is_strong_type<std::remove_const_t<Ts>...>::value
constexpr size_t LMS_IDENTIFIER_LEN = 16
 The length in bytes of the LMS identifier (I).
const size_t MAX_EXT_DEG = 16
const size_t PRIME_TABLE_SIZE = 6541
const uint16_t PRIMES []
constexpr size_t WORDS_448 = 7
constexpr size_t X448_LEN = 56

Detailed Description

Wrapper for truncated hashes (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2019 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019,2021 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019,2022 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2023 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2022 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018 Jack Lloyd (C) 2018 Ribose Inc

Botan is released under the Simplified BSD License (see license.txt)

Symmetric primitives for dilithium

(C) 2022-2023 Jack Lloyd (C) 2022-2023 Michael Boric, René Meusel - Rohde & Schwarz Cybersecurity (C) 2022 Manuel Glaser - Rohde & Schwarz Cybersecurity (C) 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

HSS - Hierarchical Signatures System (RFC 8554) (C) 2023,2026 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

HSS - Hierarchical Signatures System (RFC 8554) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

HSS-LMS (C) 2023 Jack Lloyd 2023 Fabian Albert, René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Utils for HSS/LMS (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LM-OTS - Leighton-Micali One-Time Signatures (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LM-OTS - Leighton-Micali One-Time Signatures (RFC 8554 Section 4) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LMS - Leighton-Micali Hash-Based Signatures (RFC 8554) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

Abstraction for a combined KEM public and private key.

(C) 2024 Jack Lloyd 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Abstraction for a combined KEM encryptors and decryptors.

(C) 2024 Jack Lloyd 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Adapter that allows using a KEX key as a KEM, using an ephemeral key in the KEM encapsulation.

(C) 2023 Jack Lloyd 2023,2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Ordinary applications should never need to include or use this header. It is exposed only for specialized applications which want to implement new versions of public key crypto without merging them as changes to the library. One actual example of such usage is an application which creates RSA signatures using a custom TPM library. Unless you're doing something like that, you don't need anything here. Instead use pubkey.h which wraps these types safely and provides a stable application-oriented API.

Note: This header was accidentally pulled from the public API between Botan 3.0.0 and 3.2.0, and then restored in 3.3.0. If you are maintaining an application which used this header in Botan 2.x, you should make sure to use Botan 3.3.0 or later when migrating.

Hybrid Session Manager emitting both Tickets and storing sessions in Memory (C) 2023 Jack Lloyd (C) 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

TLS Session Manager in Memory (C) 2011 Jack Lloyd (C) 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

TLS Stateless Session Manager for stateless servers (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Useful concepts that are available throughout the library (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2025 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2025 Jack Lloyd (C) 2025 polarnis

Botan is released under the Simplified BSD License (see license.txt)

A wrapper class to implement strong types (C) 2022 Jack Lloyd 2022 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2024 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

Treehash logic used for hash-based signatures (C) 2023 Jack Lloyd 2023 Fabian Albert, René Meusel, Amos Treiber, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Parts of this file have been adapted from https://github.com/sphincs/sphincsplus

Botan is released under the Simplified BSD License (see license.txt)

utilities for PKIX::build_all_certificate_paths

Typedef Documentation

◆ Altivec32x4

typedef __vector unsigned int Botan::Altivec32x4

Definition at line 26 of file aes_power8.cpp.

◆ Altivec64x2

typedef __vector unsigned long long Botan::Altivec64x2

Definition at line 25 of file aes_power8.cpp.

◆ Altivec8x16

typedef __vector unsigned char Botan::Altivec8x16

Definition at line 27 of file aes_power8.cpp.

◆ bitvector

using Botan::bitvector = bitvector_base<std::allocator>

Definition at line 1305 of file bitvector.h.

◆ Bounded_XOF

template<size_t bound>
using Botan::Bounded_XOF = detail::Bounded_XOF<XOF&, bound>

Definition at line 224 of file pqcrystals_helpers.h.

◆ byte

using Botan::byte = std::uint8_t

Definition at line 110 of file types.h.

◆ CCCryptorStatus

typedef int32_t Botan::CCCryptorStatus

Definition at line 24 of file commoncrypto.h.

◆ CertificatePathStatusCodes

typedef std::vector<std::set<Certificate_Status_Code> > Botan::CertificatePathStatusCodes

This type represents the validation status of an entire certificate path. There is one set of status codes for each certificate in the path.

Definition at line 28 of file x509path.h.

◆ CmceCodeWord

using Botan::CmceCodeWord = Strong<secure_bitvector, struct CmceCodeWord_>

Represents C of decapsulation.

Definition at line 52 of file cmce_types.h.

◆ CmceColumnSelection

using Botan::CmceColumnSelection = Strong<secure_bitvector, struct CmceColumnSelection_>

Represents c of private key.

Definition at line 46 of file cmce_types.h.

◆ CmceErrorVector

using Botan::CmceErrorVector = Strong<secure_bitvector, struct CmceErrorVector_>

Represents e of encapsulation.

Definition at line 49 of file cmce_types.h.

◆ CmceGfElem

using Botan::CmceGfElem = Strong<uint16_t, struct CmceGfElem_>

Represents a GF(q) element.

Definition at line 19 of file cmce_types.h.

◆ CmceGfMod

using Botan::CmceGfMod = Strong<uint16_t, struct CmceGfMod_>

Represents a GF(q) modulus.

Definition at line 22 of file cmce_types.h.

◆ CmceInitialSeed

using Botan::CmceInitialSeed = Strong<secure_vector<uint8_t>, struct CmceInitialSeed_>

Represents initial delta of keygen.

Definition at line 31 of file cmce_types.h.

◆ CmceIrreducibleBits

using Botan::CmceIrreducibleBits = Strong<secure_vector<uint8_t>, struct CmceIrreducibleBits_>

Definition at line 40 of file cmce_types.h.

◆ CmceKeyGenSeed

using Botan::CmceKeyGenSeed = Strong<secure_vector<uint8_t>, struct CmceKeyGenSeed_>

Represents a delta (can be altered; final value stored in private key).

Definition at line 34 of file cmce_types.h.

◆ CmceOrderingBits

using Botan::CmceOrderingBits = Strong<secure_vector<uint8_t>, struct CmceOrderingBits_>

Definition at line 37 of file cmce_types.h.

◆ CmcePermutation

using Botan::CmcePermutation = Strong<secure_vector<uint16_t>, struct CmcePermutation_>

Represents a permutation (pi in spec). Used in field ordering creation.

Definition at line 28 of file cmce_types.h.

◆ CmcePermutationElement

using Botan::CmcePermutationElement = Strong<uint16_t, struct CmcePermutationElement_>

Represents an element of a permutation (pi in spec). Used in field ordering creation.

Definition at line 25 of file cmce_types.h.

◆ CmceRejectionSeed

using Botan::CmceRejectionSeed = Strong<secure_vector<uint8_t>, struct CmceRejectionSeed_>

Represents s of private key.

Definition at line 43 of file cmce_types.h.

◆ Curve25519_PrivateKey

typedef X25519_PrivateKey Botan::Curve25519_PrivateKey

Definition at line 18 of file curve25519.h.

◆ Curve25519_PublicKey

typedef X25519_PublicKey Botan::Curve25519_PublicKey

Definition at line 17 of file curve25519.h.

◆ DilithiumCommitmentHash

using Botan::DilithiumCommitmentHash = Strong<std::vector<uint8_t>, struct DilithiumCommitmentHash_>

Hash of the message representative and the signer's commitment.

Definition at line 64 of file dilithium_types.h.

◆ DilithiumHashedPublicKey

using Botan::DilithiumHashedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumHashedPublicKey_>

Hash value of the serialized public key data (result of H(BytesToBits(pkEncode(pk)), also referred to as 'tr')

Definition at line 52 of file dilithium_types.h.

◆ DilithiumInternalKeypair

using Botan::DilithiumInternalKeypair
Initial value:
std::pair<std::shared_ptr<Dilithium_PublicKeyInternal>, std::shared_ptr<Dilithium_PrivateKeyInternal>>

Internal representation of a Dilithium key pair.

Definition at line 67 of file dilithium_types.h.

◆ DilithiumMessageRepresentative

using Botan::DilithiumMessageRepresentative = Strong<std::vector<uint8_t>, struct DilithiumMessageRepresentative_>

Representation of the message to be signed.

Definition at line 55 of file dilithium_types.h.

◆ DilithiumOptionalRandomness

using Botan::DilithiumOptionalRandomness = Strong<secure_vector<uint8_t>, struct DilithiumOptionalRandomness_>

Optional randomness 'rnd' used for rho prime computation in ML-DSA.

Definition at line 39 of file dilithium_types.h.

◆ DilithiumPoly

using Botan::DilithiumPoly = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 26 of file dilithium_types.h.

◆ DilithiumPolyMatNTT

using Botan::DilithiumPolyMatNTT = Botan::CRYSTALS::PolynomialMatrix<DilithiumPolyTraits>

Definition at line 24 of file dilithium_types.h.

◆ DilithiumPolyNTT

using Botan::DilithiumPolyNTT = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 22 of file dilithium_types.h.

◆ DilithiumPolyVec

using Botan::DilithiumPolyVec = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 27 of file dilithium_types.h.

◆ DilithiumPolyVecNTT

using Botan::DilithiumPolyVecNTT = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 23 of file dilithium_types.h.

◆ DilithiumSeedRandomness

using Botan::DilithiumSeedRandomness = Strong<secure_vector<uint8_t>, struct DilithiumSeedRandomness_>

Principal seed used to generate Dilithium key pairs.

Definition at line 30 of file dilithium_types.h.

◆ DilithiumSeedRho

using Botan::DilithiumSeedRho = Strong<std::vector<uint8_t>, struct DilithiumPublicSeed_>

Public seed to sample the polynomial matrix A from.

Definition at line 33 of file dilithium_types.h.

◆ DilithiumSeedRhoPrime

using Botan::DilithiumSeedRhoPrime = Strong<secure_vector<uint8_t>, struct DilithiumSeedRhoPrime_>

Private seed to sample the polynomial vectors s1 and s2 from.

Definition at line 36 of file dilithium_types.h.

◆ DilithiumSerializedCommitment

using Botan::DilithiumSerializedCommitment = Strong<std::vector<uint8_t>, struct DilithiumSerializedCommitment_>

Serialized representation of a commitment w1.

Definition at line 61 of file dilithium_types.h.

◆ DilithiumSerializedPrivateKey

using Botan::DilithiumSerializedPrivateKey = Strong<secure_vector<uint8_t>, struct DilithiumSerializedPrivateKey_>

Serialized private key data.

Definition at line 45 of file dilithium_types.h.

◆ DilithiumSerializedPublicKey

using Botan::DilithiumSerializedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumSerializedPublicKey_>

Serialized public key data (result of pkEncode(pk)).

Definition at line 48 of file dilithium_types.h.

◆ DilithiumSerializedSignature

using Botan::DilithiumSerializedSignature = Strong<std::vector<uint8_t>, struct DilithiumSerializedSignature_>

Serialized signature data.

Definition at line 58 of file dilithium_types.h.

◆ DilithiumSigningSeedK

using Botan::DilithiumSigningSeedK = Strong<secure_vector<uint8_t>, struct DilithiumSeedK_>

Private seed K used during signing.

Definition at line 42 of file dilithium_types.h.

◆ ForsLeafSecret

using Botan::ForsLeafSecret = Strong<secure_vector<uint8_t>, struct ForsLeafSecret_>

Definition at line 71 of file sp_types.h.

◆ ForsSignature

using Botan::ForsSignature = Strong<std::vector<uint8_t>, struct ForsSignature_>

Definition at line 72 of file sp_types.h.

◆ FrodoDomainSeparator

using Botan::FrodoDomainSeparator = Strong<std::array<uint8_t, 1>, struct FrodoDomainSeparator_>

Definition at line 47 of file frodo_types.h.

◆ FrodoIntermediateSharedSecret

using Botan::FrodoIntermediateSharedSecret = Strong<secure_vector<uint8_t>, struct FrodoIntermediateSharedSecret_>

Definition at line 56 of file frodo_types.h.

◆ FrodoPackedMatrix

using Botan::FrodoPackedMatrix = Strong<std::vector<uint8_t>, struct FrodoPackedMatrix_>

Definition at line 41 of file frodo_types.h.

◆ FrodoPlaintext

using Botan::FrodoPlaintext = Strong<secure_vector<uint8_t>, struct FrodoPlaintext_>

Definition at line 50 of file frodo_types.h.

◆ FrodoPublicKeyHash

using Botan::FrodoPublicKeyHash = Strong<std::vector<uint8_t>, struct FrodoPublicKeyHash_>

Definition at line 38 of file frodo_types.h.

◆ FrodoSalt

using Botan::FrodoSalt = Strong<std::vector<uint8_t>, struct FrodoSalt_>

Definition at line 53 of file frodo_types.h.

◆ FrodoSampleR

using Botan::FrodoSampleR = Strong<secure_vector<uint8_t>, struct FrodoSampleR_>

Definition at line 35 of file frodo_types.h.

◆ FrodoSeedA

using Botan::FrodoSeedA = Strong<std::vector<uint8_t>, struct FrodoSeedA_>

Definition at line 23 of file frodo_types.h.

◆ FrodoSeedS

using Botan::FrodoSeedS = Strong<secure_vector<uint8_t>, struct FrodoSeedS_>

Definition at line 26 of file frodo_types.h.

◆ FrodoSeedSE

using Botan::FrodoSeedSE = Strong<secure_vector<uint8_t>, struct FrodoSeedSE_>

Definition at line 29 of file frodo_types.h.

◆ FrodoSeedZ

using Botan::FrodoSeedZ = Strong<std::vector<uint8_t>, struct FrodoSeedZ_>

Definition at line 32 of file frodo_types.h.

◆ FrodoSerializedMatrix

using Botan::FrodoSerializedMatrix = Strong<secure_vector<uint8_t>, struct FrodoSerializedMatrix_>

Definition at line 44 of file frodo_types.h.

◆ GenerateLeafFunction

using Botan::GenerateLeafFunction = std::function<void(StrongSpan<SphincsTreeNode> , TreeNodeIndex)>

Definition at line 25 of file sp_treehash.h.

◆ gf2m

typedef uint16_t Botan::gf2m

Definition at line 20 of file gf2m_small_m.h.

◆ HSS_Level

using Botan::HSS_Level = Strong<uint32_t, struct HSS_Level_, EnableArithmeticWithPlainNumber>

The HSS layer in the HSS multi tree starting at 0 from the root.

Definition at line 35 of file hss.h.

◆ HSS_Sig_Idx

using Botan::HSS_Sig_Idx = Strong<uint64_t, struct HSS_Sig_Idx_, EnableArithmeticWithPlainNumber>

The index of a node within a specific LMS tree layer.

Definition at line 30 of file hss.h.

◆ HypertreeLayerIndex

using Botan::HypertreeLayerIndex = Strong<uint32_t, struct HypertreeLayerIndex_>

Index of a layer in the XMSS hyper-tree.

Definition at line 86 of file sp_types.h.

◆ InitializationVector

using Botan::InitializationVector = OctetString

Alternate name for octet string showing intent to use as an IV

Definition at line 145 of file symkey.h.

◆ Integrity_Failure

typedef Invalid_Authentication_Tag Botan::Integrity_Failure

For compatibility with older versions

Definition at line 284 of file exceptn.h.

◆ KyberCompressedCiphertext

using Botan::KyberCompressedCiphertext = Strong<std::vector<uint8_t>, struct KyberCompressedCiphertext_>

Compressed and serialized ciphertext value.

Definition at line 63 of file kyber_types.h.

◆ KyberEncryptionRandomness

using Botan::KyberEncryptionRandomness = Strong<secure_vector<uint8_t>, struct KyberEncryptionRandomness_>

Random value used to generate the Kyber ciphertext.

Definition at line 48 of file kyber_types.h.

◆ KyberHashedCiphertext

using Botan::KyberHashedCiphertext = Strong<std::vector<uint8_t>, struct KyberHashedCiphertext_>

Hash of the compressed and serialized ciphertext value TODO: Remove this once Kyber-R3 is removed

Definition at line 67 of file kyber_types.h.

◆ KyberHashedPublicKey

using Botan::KyberHashedPublicKey = Strong<std::vector<uint8_t>, struct KyberHashedPublicKey_>

Hash value of the serialized public key.

Definition at line 60 of file kyber_types.h.

◆ KyberImplicitRejectionValue

using Botan::KyberImplicitRejectionValue = Strong<secure_vector<uint8_t>, struct KyberImplicitRejectionValue_>

Secret random value (called Z in the spec), used for implicit rejection in the decapsulation.

Definition at line 42 of file kyber_types.h.

◆ KyberInternalKeypair

using Botan::KyberInternalKeypair
Initial value:
std::pair<std::shared_ptr<Kyber_PublicKeyInternal>, std::shared_ptr<Kyber_PrivateKeyInternal>>

Definition at line 73 of file kyber_types.h.

◆ KyberMessage

using Botan::KyberMessage = Strong<secure_vector<uint8_t>, struct KyberMessage_>

Random message value to be encrypted by the CPA-secure Kyber encryption scheme.

Definition at line 45 of file kyber_types.h.

◆ KyberPoly

using Botan::KyberPoly = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 29 of file kyber_types.h.

◆ KyberPolyMat

using Botan::KyberPolyMat = Botan::CRYSTALS::PolynomialMatrix<KyberPolyTraits>

Definition at line 27 of file kyber_types.h.

◆ KyberPolyNTT

using Botan::KyberPolyNTT = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 25 of file kyber_types.h.

◆ KyberPolyVec

using Botan::KyberPolyVec = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 30 of file kyber_types.h.

◆ KyberPolyVecNTT

using Botan::KyberPolyVecNTT = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 26 of file kyber_types.h.

◆ KyberSamplingRandomness

using Botan::KyberSamplingRandomness = Strong<secure_vector<uint8_t>, struct KyberSamplingRandomness_>

PRF value used for sampling of error polynomials.

Definition at line 51 of file kyber_types.h.

◆ KyberSeedRandomness

using Botan::KyberSeedRandomness = Strong<secure_vector<uint8_t>, struct KyberSeedRandomness_>

Principal seed used to generate Kyber key pairs.

Definition at line 33 of file kyber_types.h.

◆ KyberSeedRho

using Botan::KyberSeedRho = Strong<std::vector<uint8_t>, struct KyberSeedRho_>

Public seed value to generate the Kyber matrix A.

Definition at line 36 of file kyber_types.h.

◆ KyberSeedSigma

using Botan::KyberSeedSigma = Strong<secure_vector<uint8_t>, struct KyberSeedSigma_>

Private seed used to generate polynomial vectors s and e during key generation.

Definition at line 39 of file kyber_types.h.

◆ KyberSerializedPublicKey

using Botan::KyberSerializedPublicKey = Strong<std::vector<uint8_t>, struct KyberSerializedPublicKey_>

Public key in serialized form (t || rho).

Definition at line 57 of file kyber_types.h.

◆ KyberSharedSecret

using Botan::KyberSharedSecret = Strong<secure_vector<uint8_t>, struct KyberSharedSecret_>

Shared secret value generated during encapsulation and recovered during decapsulation.

Definition at line 54 of file kyber_types.h.

◆ KyberSigmaOrEncryptionRandomness

using Botan::KyberSigmaOrEncryptionRandomness
Initial value:
std::variant<StrongSpan<const KyberSeedSigma>, StrongSpan<const KyberEncryptionRandomness>>

Variant value of either a KyberSeedSigma or a KyberEncryptionRandomness.

Definition at line 70 of file kyber_types.h.

◆ LMOTS_K

using Botan::LMOTS_K = Strong<std::vector<uint8_t>, struct LMOTS_K_>

The K value from the LM-OTS public key.

Definition at line 38 of file lm_ots.h.

◆ LMOTS_Node

using Botan::LMOTS_Node = Strong<secure_vector<uint8_t>, struct LMOTS_Node_>

One node within one LM-OTS hash chain.

Definition at line 33 of file lm_ots.h.

◆ LMOTS_Signature_Bytes

using Botan::LMOTS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMOTS_Signature_Bytes_>

Byte vector of an LM-OTS signature.

Definition at line 43 of file lm_ots.h.

◆ LMS_AuthenticationPath

using Botan::LMS_AuthenticationPath = Strong<std::vector<uint8_t>, struct LMS_AuthenticationPath_>

The authentication path of an LMS signature.

Definition at line 74 of file lms.h.

◆ LMS_Identifier

using Botan::LMS_Identifier = Strong<std::vector<uint8_t>, struct LMS_Identifier_>

The identifier of an LMS tree (I in RFC 8554).

Definition at line 53 of file lm_ots.h.

◆ LMS_Message

using Botan::LMS_Message = Strong<std::vector<uint8_t>, struct LMS_Message_>

A message that is signed with an LMS tree.

Definition at line 58 of file lm_ots.h.

◆ LMS_Seed

using Botan::LMS_Seed = Strong<secure_vector<uint8_t>, struct LMS_SEED_>

Seed of the LMS tree, used to generate the LM-OTS private keys.

Definition at line 28 of file lm_ots.h.

◆ LMS_Signature_Bytes

using Botan::LMS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMS_Signature_Bytes_>

Raw bytes of an LMS signature.

Definition at line 84 of file lms.h.

◆ LMS_Tree_Node

using Botan::LMS_Tree_Node = Strong<std::vector<uint8_t>, struct LMS_Tree_Node_>

A node with the LMS tree.

Definition at line 79 of file lms.h.

◆ LMS_Tree_Node_Idx

using Botan::LMS_Tree_Node_Idx = Strong<uint32_t, struct LMS_Tree_Node_Idx_, EnableArithmeticWithPlainNumber>

The index of a node within a specific LMS tree layer.

Definition at line 48 of file lm_ots.h.

◆ lock_guard_type

template<typename T>
using Botan::lock_guard_type = lock_guard<T>

Definition at line 55 of file mutex.h.

◆ MAC

typedef MessageAuthenticationCode Botan::MAC

Definition at line 131 of file mac.h.

◆ ML_DSA_Mode

using Botan::ML_DSA_Mode = DilithiumMode

Definition at line 21 of file ml_dsa.h.

◆ ML_DSA_PrivateKey

using Botan::ML_DSA_PrivateKey = Dilithium_PrivateKey

Definition at line 23 of file ml_dsa.h.

◆ ML_DSA_PublicKey

using Botan::ML_DSA_PublicKey = Dilithium_PublicKey

Definition at line 22 of file ml_dsa.h.

◆ ML_KEM_Mode

using Botan::ML_KEM_Mode = KyberMode

Definition at line 21 of file ml_kem.h.

◆ ML_KEM_PrivateKey

using Botan::ML_KEM_PrivateKey = Kyber_PrivateKey

Definition at line 23 of file ml_kem.h.

◆ ML_KEM_PublicKey

using Botan::ML_KEM_PublicKey = Kyber_PublicKey

Definition at line 22 of file ml_kem.h.

◆ mutex_type

using Botan::mutex_type = noop_mutex

Definition at line 37 of file mutex.h.

◆ next_longer_int_t

template<std::signed_integral T>
using Botan::next_longer_int_t
Initial value:
std::conditional_t<sizeof(T) == 1, int16_t,
std::conditional_t<sizeof(T) == 2, int32_t,
std::conditional_t<sizeof(T) == 4, int64_t, void>>>

Definition at line 35 of file pqcrystals_helpers.h.

◆ next_longer_uint_t

template<std::unsigned_integral T>
using Botan::next_longer_uint_t
Initial value:
std::conditional_t<sizeof(T) == 1, uint16_t,
std::conditional_t<sizeof(T) == 2, uint32_t,
std::conditional_t<sizeof(T) == 4, uint64_t, void>>>

Definition at line 28 of file pqcrystals_helpers.h.

◆ Point448

using Botan::Point448 = Strong<std::array<uint8_t, X448_LEN>, struct Point448_>

Definition at line 18 of file x448_internal.h.

◆ PointGFp

typedef EC_Point Botan::PointGFp

Definition at line 430 of file ec_point.h.

◆ recursive_mutex_type

using Botan::recursive_mutex_type = noop_mutex

Definition at line 38 of file mutex.h.

◆ RNG

typedef RandomNumberGenerator Botan::RNG

Convenience typedef

Definition at line 335 of file rng.h.

◆ S2K

typedef PBKDF Botan::S2K

Definition at line 237 of file pbkdf.h.

◆ s32bit

using Botan::s32bit = std::int32_t

Definition at line 114 of file types.h.

◆ ScalarX448

using Botan::ScalarX448 = Strong<std::array<uint8_t, X448_LEN>, struct ScalarX448_>

Definition at line 24 of file x448_internal.h.

◆ secure_bitvector

using Botan::secure_bitvector = bitvector_base<secure_allocator>

Definition at line 1304 of file bitvector.h.

◆ secure_deque

template<typename T>
using Botan::secure_deque = std::deque<T, secure_allocator<T>>

Definition at line 72 of file secmem.h.

◆ secure_vector

template<typename T>
using Botan::secure_vector = std::vector<T, secure_allocator<T>>

Definition at line 68 of file secmem.h.

◆ SecureVector

template<typename T>
using Botan::SecureVector = secure_vector<T>

Definition at line 77 of file secmem.h.

◆ SM2_Encryption_PrivateKey

typedef SM2_PrivateKey Botan::SM2_Encryption_PrivateKey

Definition at line 164 of file sm2.h.

◆ SM2_Encryption_PublicKey

typedef SM2_PublicKey Botan::SM2_Encryption_PublicKey

Definition at line 161 of file sm2.h.

◆ SM2_Signature_PrivateKey

typedef SM2_PrivateKey Botan::SM2_Signature_PrivateKey

Definition at line 163 of file sm2.h.

◆ SM2_Signature_PublicKey

typedef SM2_PublicKey Botan::SM2_Signature_PublicKey

Definition at line 160 of file sm2.h.

◆ SphincsAuthenticationPath

using Botan::SphincsAuthenticationPath = Strong<std::vector<uint8_t>, struct SphincsAuthenticationPath_>

Definition at line 67 of file sp_types.h.

◆ SphincsContext

using Botan::SphincsContext = Strong<std::vector<uint8_t>, struct SphincsContext_>

Definition at line 57 of file sp_types.h.

◆ SphincsHashedMessage

using Botan::SphincsHashedMessage = Strong<std::vector<uint8_t>, struct SphincsHashedMessage_>

Definition at line 59 of file sp_types.h.

◆ SphincsHypertreeSignature

using Botan::SphincsHypertreeSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>

Definition at line 66 of file sp_types.h.

◆ SphincsInputMessage

using Botan::SphincsInputMessage = Strong<std::vector<uint8_t>, struct SphincsInputMessage_>

Definition at line 49 of file sp_types.h.

◆ SphincsMessagePrefix

using Botan::SphincsMessagePrefix = Strong<std::vector<uint8_t>, struct SphincsMessagePrefix_>

The prefix appended to the message in [hash_]slh_sign and slh_verify. E.g. for SLH-DSA (pure): 0x00 || |ctx| || ctx. Empty for SPHINCS+.

Definition at line 47 of file sp_types.h.

◆ SphincsMessageRandomness

using Botan::SphincsMessageRandomness = Strong<secure_vector<uint8_t>, struct SphincsMessageRandomness_>

Definition at line 64 of file sp_types.h.

◆ SphincsOptionalRandomness

using Botan::SphincsOptionalRandomness = Strong<secure_vector<uint8_t>, struct SphincsOptionalRandomness_>

Definition at line 63 of file sp_types.h.

◆ SphincsPublicSeed

using Botan::SphincsPublicSeed = Strong<std::vector<uint8_t>, struct SphincsPublicSeed_>

Definition at line 60 of file sp_types.h.

◆ SphincsSecretPRF

using Botan::SphincsSecretPRF = Strong<secure_vector<uint8_t>, struct SphincsSecretPRF_>

Definition at line 62 of file sp_types.h.

◆ SphincsSecretSeed

using Botan::SphincsSecretSeed = Strong<secure_vector<uint8_t>, struct SphincsSecretSeed_>

Definition at line 61 of file sp_types.h.

◆ SphincsTreeNode

using Botan::SphincsTreeNode = Strong<std::vector<uint8_t>, struct SphincsTreeNode_>

Either an XMSS or FORS tree node or leaf.

Definition at line 70 of file sp_types.h.

◆ SphincsXmssSignature

using Botan::SphincsXmssSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>

Definition at line 65 of file sp_types.h.

◆ strong_type_wrapped_type

template<typename T>
using Botan::strong_type_wrapped_type = typename detail::wrapped_type_helper<std::remove_cvref_t<T>>::type

Extracts the wrapped type from a strong type.

If the provided type is not a strong type, it is returned as is.

Note
This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary ::wrapped_type declaration if you know that you are dealing with a strong type.

Definition at line 307 of file strong_type.h.

◆ SymmetricKey

using Botan::SymmetricKey = OctetString

Alternate name for octet string showing intent to use as a key

Definition at line 140 of file symkey.h.

◆ TreeLayerIndex

using Botan::TreeLayerIndex = Strong<uint32_t, struct TreeLayerIndex_, EnableArithmeticWithPlainNumber>

Index of the layer within a FORS/XMSS tree.

Definition at line 83 of file sp_types.h.

◆ TreeNodeIndex

using Botan::TreeNodeIndex = Strong<uint32_t, struct TreeNodeIndex_, EnableArithmeticWithPlainNumber>

Index of an individual node inside an XMSS or FORS tree.

Definition at line 92 of file sp_types.h.

◆ u16bit

using Botan::u16bit = std::uint16_t

Definition at line 111 of file types.h.

◆ u32bit

using Botan::u32bit = std::uint32_t

Definition at line 112 of file types.h.

◆ u64bit

using Botan::u64bit = std::uint64_t

Definition at line 113 of file types.h.

◆ word

using Botan::word = std::conditional_t<HasNative64BitRegisters, std::uint64_t, uint32_t>

Definition at line 119 of file types.h.

◆ wots_keysig_t

typedef std::vector< secure_vector< uint8_t > > Botan::wots_keysig_t

Definition at line 20 of file xmss_common_ops.h.

◆ WotsChainIndex

using Botan::WotsChainIndex = Strong<uint32_t, struct WotsChainIndex_>

Index of a WOTS chain within a single usage of WOTS.

Definition at line 95 of file sp_types.h.

◆ WotsHashIndex

using Botan::WotsHashIndex = Strong<uint8_t, struct WotsHashIndex_, EnableArithmeticWithPlainNumber>

Index of a hash application inside a single WOTS chain (integers in "base_w").

Definition at line 98 of file sp_types.h.

◆ WotsNode

using Botan::WotsNode = Strong<secure_vector<uint8_t>, struct WotsNode_>

Start (or intermediate) node of a WOTS+ chain.

Definition at line 79 of file sp_types.h.

◆ WotsPublicKey

using Botan::WotsPublicKey = Strong<std::vector<uint8_t>, struct WotsPublicKey_>

Definition at line 73 of file sp_types.h.

◆ WotsPublicKeyNode

using Botan::WotsPublicKeyNode = Strong<std::vector<uint8_t>, struct WotsPublicKeyNode_>

End node of a WOTS+ chain (part of the WOTS+ public key).

Definition at line 76 of file sp_types.h.

◆ WotsSignature

using Botan::WotsSignature = Strong<secure_vector<uint8_t>, struct WotsSignature_>

Definition at line 80 of file sp_types.h.

◆ X509_Time

typedef ASN1_Time Botan::X509_Time

Definition at line 23 of file asn1_obj.h.

◆ XmssTreeIndexInLayer

using Botan::XmssTreeIndexInLayer = Strong<uint64_t, struct XmssTreeIndexInLayer_, EnableArithmeticWithPlainNumber>

Index of an XMSS tree (unique for just the local hyper-tree layer).

Definition at line 89 of file sp_types.h.

Enumeration Type Documentation

◆ AlignmentBufferFinalBlock

enum class Botan::AlignmentBufferFinalBlock : uint8_t
strong

Defines the strategy for handling the final block of input data in the handle_unaligned_data() method of the AlignmentBuffer<>.

  • is_not_special: the final block is treated like any other block
  • must_be_deferred: the final block is not emitted while bulk processing (typically add_data()) but is deferred until manually consumed (typically final_result())

The AlignmentBuffer<> assumes data to be "the final block" if no further input data is available in the BufferSlicer<>. This might result in some performance overhead when using the must_be_deferred strategy.

Enumerator
is_not_special 
must_be_deferred 

Definition at line 33 of file alignment_buffer.h.

33 : uint8_t {
34 is_not_special = 0,
35 must_be_deferred = 1,
36};

◆ ASN1_Class

enum class Botan::ASN1_Class : uint32_t
strong

ASN.1 Class Tags

Enumerator
Universal 
Application 
ContextSpecific 
Private 
Constructed 
ExplicitContextSpecific 
NoObject 

Definition at line 28 of file asn1_obj.h.

28 : uint32_t /* NOLINT(performance-enum-size) */ {
29 Universal = 0b0000'0000,
30 Application = 0b0100'0000,
31 ContextSpecific = 0b1000'0000,
32 Private = 0b1100'0000,
33
34 Constructed = 0b0010'0000,
35 ExplicitContextSpecific = Constructed | ContextSpecific,
36
37 NoObject = 0xFF00
38};

◆ ASN1_Type

enum class Botan::ASN1_Type : uint32_t
strong

ASN.1 Type Tags

Enumerator
Eoc 
Boolean 
Integer 
BitString 
OctetString 
Null 
ObjectId 
Enumerated 
Sequence 
Set 
Utf8String 
NumericString 
PrintableString 
TeletexString 
Ia5String 
VisibleString 
UniversalString 
BmpString 
UtcTime 
GeneralizedTime 
NoObject 

Definition at line 43 of file asn1_obj.h.

43 : uint32_t /* NOLINT(performance-enum-size) */ {
44 Eoc = 0x00,
45 Boolean = 0x01,
46 Integer = 0x02,
47 BitString = 0x03,
48 OctetString = 0x04,
49 Null = 0x05,
50 ObjectId = 0x06,
51 Enumerated = 0x0A,
52 Sequence = 0x10,
53 Set = 0x11,
54
55 Utf8String = 0x0C,
56 NumericString = 0x12,
57 PrintableString = 0x13,
58 TeletexString = 0x14,
59 Ia5String = 0x16,
60 VisibleString = 0x1A,
61 UniversalString = 0x1C,
62 BmpString = 0x1E,
63
64 UtcTime = 0x17,
65 GeneralizedTime = 0x18,
66
67 NoObject = 0xFF00,
68};

◆ Certificate_Status_Code

enum class Botan::Certificate_Status_Code : uint16_t
strong

Certificate validation status code

Enumerator
OK 
VERIFIED 
OCSP_RESPONSE_GOOD 
OCSP_SIGNATURE_OK 
VALID_CRL_CHECKED 
OCSP_NO_HTTP 
FIRST_WARNING_STATUS 
CERT_SERIAL_NEGATIVE 
DN_TOO_LONG 
OCSP_NO_REVOCATION_URL 
OCSP_SERVER_NOT_AVAILABLE 
TRUSTED_CERT_HAS_EXPIRED 
TRUSTED_CERT_NOT_YET_VALID 
FIRST_ERROR_STATUS 
SIGNATURE_METHOD_TOO_WEAK 
UNTRUSTED_HASH 
NO_REVOCATION_DATA 
NO_MATCHING_CRLDP 
OCSP_ISSUER_NOT_TRUSTED 
CERT_NOT_YET_VALID 
CERT_HAS_EXPIRED 
OCSP_NOT_YET_VALID 
OCSP_HAS_EXPIRED 
CRL_NOT_YET_VALID 
CRL_HAS_EXPIRED 
OCSP_IS_TOO_OLD 
CERT_ISSUER_NOT_FOUND 
CANNOT_ESTABLISH_TRUST 
CERT_CHAIN_LOOP 
CHAIN_LACKS_TRUST_ROOT 
CHAIN_NAME_MISMATCH 
POLICY_ERROR 
INVALID_USAGE 
CERT_CHAIN_TOO_LONG 
CA_CERT_NOT_FOR_CERT_ISSUER 
NAME_CONSTRAINT_ERROR 
IPADDR_BLOCKS_ERROR 
AS_BLOCKS_ERROR 
CA_CERT_NOT_FOR_CRL_ISSUER 
OCSP_CERT_NOT_LISTED 
OCSP_BAD_STATUS 
CERT_NAME_NOMATCH 
UNKNOWN_CRITICAL_EXTENSION 
DUPLICATE_CERT_EXTENSION 
OCSP_SIGNATURE_ERROR 
OCSP_ISSUER_NOT_FOUND 
OCSP_RESPONSE_MISSING_KEYUSAGE 
OCSP_RESPONSE_INVALID 
EXT_IN_V1_V2_CERT 
DUPLICATE_CERT_POLICY 
V2_IDENTIFIERS_IN_V1_CERT 
CERT_IS_REVOKED 
CRL_BAD_SIGNATURE 
SIGNATURE_ERROR 
CERT_PUBKEY_INVALID 
SIGNATURE_ALGO_UNKNOWN 
SIGNATURE_ALGO_BAD_PARAMS 

Definition at line 20 of file pkix_enums.h.

20 : uint16_t {
21 // TODO(Botan4) renumber this, e.g. Validation Errors -> IP_ADDR_BLOCKS_ERROR
22 // TODO(Botan4) rename variants to CamelCase
23 OK = 0,
24 VERIFIED = 0,
25
26 // Revocation status
27 OCSP_RESPONSE_GOOD = 1,
28 OCSP_SIGNATURE_OK = 2,
29 VALID_CRL_CHECKED = 3,
30 OCSP_NO_HTTP = 4,
31
32 // Warnings
33 FIRST_WARNING_STATUS = 500,
34 CERT_SERIAL_NEGATIVE = 500,
35 DN_TOO_LONG = 501,
36 OCSP_NO_REVOCATION_URL = 502,
37 OCSP_SERVER_NOT_AVAILABLE = 503,
38 TRUSTED_CERT_HAS_EXPIRED = 504,
39 TRUSTED_CERT_NOT_YET_VALID = 505,
40
41 // Errors
42 FIRST_ERROR_STATUS = 1000,
43
44 SIGNATURE_METHOD_TOO_WEAK = 1000,
45 UNTRUSTED_HASH = 1001,
46 NO_REVOCATION_DATA = 1002,
47 NO_MATCHING_CRLDP = 1003,
48 OCSP_ISSUER_NOT_TRUSTED = 1004,
49
50 // Time problems
51 CERT_NOT_YET_VALID = 2000,
52 CERT_HAS_EXPIRED = 2001,
53 OCSP_NOT_YET_VALID = 2002,
54 OCSP_HAS_EXPIRED = 2003,
55 CRL_NOT_YET_VALID = 2004,
56 CRL_HAS_EXPIRED = 2005,
57 OCSP_IS_TOO_OLD = 2006,
58
59 // Chain generation problems
60 CERT_ISSUER_NOT_FOUND = 3000,
61 CANNOT_ESTABLISH_TRUST = 3001,
62 CERT_CHAIN_LOOP = 3002,
63 CHAIN_LACKS_TRUST_ROOT = 3003,
64 CHAIN_NAME_MISMATCH = 3004,
65
66 // Validation errors
67 POLICY_ERROR = 4000,
68 INVALID_USAGE = 4001,
69 CERT_CHAIN_TOO_LONG = 4002,
70 CA_CERT_NOT_FOR_CERT_ISSUER = 4003,
71 NAME_CONSTRAINT_ERROR = 4004,
72 IPADDR_BLOCKS_ERROR = 4011,
73 AS_BLOCKS_ERROR = 4012,
74
75 // Revocation errors
76 CA_CERT_NOT_FOR_CRL_ISSUER = 4005,
77 OCSP_CERT_NOT_LISTED = 4006,
78 OCSP_BAD_STATUS = 4007,
79
80 // Other problems
81 CERT_NAME_NOMATCH = 4008,
82 UNKNOWN_CRITICAL_EXTENSION = 4009,
83 DUPLICATE_CERT_EXTENSION = 4010,
84 OCSP_SIGNATURE_ERROR = 4501,
85 OCSP_ISSUER_NOT_FOUND = 4502,
86 OCSP_RESPONSE_MISSING_KEYUSAGE = 4503,
87 OCSP_RESPONSE_INVALID = 4504,
88 EXT_IN_V1_V2_CERT = 4505,
89 DUPLICATE_CERT_POLICY = 4506,
90 V2_IDENTIFIERS_IN_V1_CERT = 4507,
91
92 // Hard failures
93 CERT_IS_REVOKED = 5000,
94 CRL_BAD_SIGNATURE = 5001,
95 SIGNATURE_ERROR = 5002,
96 CERT_PUBKEY_INVALID = 5003,
97 SIGNATURE_ALGO_UNKNOWN = 5004,
98 SIGNATURE_ALGO_BAD_PARAMS = 5005
99};

◆ Cipher_Dir

enum class Botan::Cipher_Dir : uint8_t
strong

The two possible directions a Cipher_Mode can operate in

Enumerator
Encryption 
Decryption 
ENCRYPTION 
DECRYPTION 

Definition at line 25 of file cipher_mode.h.

25 : uint8_t {
26 Encryption = 0,
27 Decryption = 1,
28
29 ENCRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Encryption") = Encryption,
30 DECRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Decryption") = Decryption,
31};
BOTAN_DEPRECATED
#define BOTAN_DEPRECATED(msg)
Definition api.h:73

◆ CRL_Code

enum class Botan::CRL_Code : uint8_t
strong

X.509v2 CRL Reason Code.

Enumerator
Unspecified 
KeyCompromise 
CaCompromise 
AffiliationChanged 
Superseded 
CessationOfOperation 
CertificateHold 
RemoveFromCrl 
PrivilegeWithdrawn 
AaCompromise 

Definition at line 198 of file pkix_enums.h.

198 : uint8_t {
199 Unspecified = 0,
200 KeyCompromise = 1,
201 CaCompromise = 2,
202 AffiliationChanged = 3,
203 Superseded = 4,
204 CessationOfOperation = 5,
205 CertificateHold = 6,
206 RemoveFromCrl = 8,
207 PrivilegeWithdrawn = 9,
208 AaCompromise = 10,
209};

◆ Decoder_Checking

enum Botan::Decoder_Checking : uint8_t

The type of checking to be performed by decoders: NONE - no checks, IGNORE_WS - perform checks, but ignore whitespaces, FULL_CHECK - perform checks, also complain about white spaces.

Enumerator
NONE 
IGNORE_WS 
FULL_CHECK 

Definition at line 170 of file filter.h.

170: uint8_t /* NOLINT(*-use-enum-class) */ { NONE, IGNORE_WS, FULL_CHECK };
Botan::FULL_CHECK
@ FULL_CHECK
Definition filter.h:170
Botan::NONE
@ NONE
Definition filter.h:170
Botan::IGNORE_WS
@ IGNORE_WS
Definition filter.h:170

◆ DL_Group_Format

enum class Botan::DL_Group_Format : uint8_t
strong

The DL group encoding format variants.

Enumerator
ANSI_X9_42 
ANSI_X9_57 
PKCS_3 
DSA_PARAMETERS 
DH_PARAMETERS 
ANSI_X9_42_DH_PARAMETERS 
PKCS3_DH_PARAMETERS 

Definition at line 30 of file dl_group.h.

30 : uint8_t {
31 ANSI_X9_42 = 0,
32 ANSI_X9_57 = 1,
33 PKCS_3 = 2,
34
35 DSA_PARAMETERS = ANSI_X9_57,
36 DH_PARAMETERS = ANSI_X9_42,
37 ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42,
38 PKCS3_DH_PARAMETERS = PKCS_3
39};

◆ DL_Group_Source

enum class Botan::DL_Group_Source : uint8_t
strong
Enumerator
Builtin 
RandomlyGenerated 
ExternalSource 

Definition at line 21 of file dl_group.h.

21 : uint8_t {
22 Builtin,
23 RandomlyGenerated,
24 ExternalSource,
25};

◆ EC_Group_Encoding

enum class Botan::EC_Group_Encoding : uint8_t
strong

This enum indicates the method used to encode the EC parameters

Warning
All support for explicit or implicit domain encodings will be removed in Botan4. Only named curves will be supported.

TODO(Botan4) remove this enum

Enumerator
Explicit 
ImplicitCA 
NamedCurve 
EC_DOMPAR_ENC_EXPLICIT 
EC_DOMPAR_ENC_IMPLICITCA 
EC_DOMPAR_ENC_OID 

Definition at line 27 of file ec_point_format.h.

27 : uint8_t {
28 Explicit = 0,
29 ImplicitCA = 1,
30 NamedCurve = 2,
31
32 EC_DOMPAR_ENC_EXPLICIT = Explicit,
33 EC_DOMPAR_ENC_IMPLICITCA = ImplicitCA,
34 EC_DOMPAR_ENC_OID = NamedCurve
35};

◆ EC_Group_Engine

enum class Botan::EC_Group_Engine : uint8_t
strong

Enum indicating the way the group in question is implemented

This is returned by EC_Group::engine

Enumerator
Optimized 

Using per curve implementation; fastest available.

Generic 

A generic implementation that handles many curves in one implementation.

Legacy 

The old implementation, used as a fallback if none of the other implementations can be used TODO(Botan4) remove this

Definition at line 48 of file ec_group.h.

48 : uint8_t {
49 /// Using per curve implementation; fastest available
50 Optimized,
51 /// A generic implementation that handles many curves in one implementation
52 Generic,
53 /// The old implementation, used as a fallback if none of the other
54 /// implementations can be used
55 /// TODO(Botan4) remove this
56 Legacy,
57};
Botan::EC_Group_Engine::Optimized
@ Optimized
Using per curve implementation; fastest available.
Definition ec_group.h:50
Botan::EC_Group_Engine::Generic
@ Generic
A generic implementation that handles many curves in one implementation.
Definition ec_group.h:52

◆ EC_Group_Source

enum class Botan::EC_Group_Source : uint8_t
strong

This enum indicates the source of the elliptic curve parameters in use.

Builtin means the curve is a known standard one which was compiled in the library.

ExternalSource means the curve parameters came from either an explicit curve encoding or an application defined curve.

Enumerator
Builtin 
ExternalSource 

Definition at line 38 of file ec_group.h.

38 : uint8_t {
39 Builtin,
40 ExternalSource,
41};

◆ EC_Point_Format

enum class Botan::EC_Point_Format : uint8_t
strong
Enumerator
Uncompressed 
Compressed 
UNCOMPRESSED 
COMPRESSED 
Hybrid 
HYBRID 

Definition at line 37 of file ec_point_format.h.

37 : uint8_t {
38 Uncompressed = 0,
39 Compressed = 1,
40
41 UNCOMPRESSED BOTAN_DEPRECATED("Use EC_Point_Format::Uncompressed") = Uncompressed,
42 COMPRESSED BOTAN_DEPRECATED("Use EC_Point_Format::Compressed") = Compressed,
43
44 Hybrid BOTAN_DEPRECATED("Hybrid point encoding is deprecated") = 2,
45 HYBRID BOTAN_DEPRECATED("Hybrid point encoding is deprecated") = 2
46};

◆ ECIES_Flags

enum class Botan::ECIES_Flags : uint8_t
strong

Flags controlling ECIES operation

Two of the flags are related to how cofactors are handled. Support for cofactors is deprecated and will be removed in Botan4.

The CheckMode flag is completely ignored; we always check that the point is valid.

TODO(Botan4) remove this enum

Enumerator
None 
SingleHashMode 

if set: prefix the input of the (ecdh) key agreement with the encoded (ephemeral) public key

CofactorMode 

(decryption only) if set: use cofactor multiplication during (ecdh) key agreement This only matters if the curve has a cofactor

OldCofactorMode 

if set: use ecdhc instead of ecdh. This only matters if the curve has a cofactor

CheckMode 

(decryption only) if set: test if the (ephemeral) public key is on the curve Note that we actually ignore this flag and always check the key

NONE 
SINGLE_HASH_MODE 
COFACTOR_MODE 
OLD_COFACTOR_MODE 
CHECK_MODE 

Definition at line 44 of file ecies.h.

44 : uint8_t {
45 None = 0,
46 /// if set: prefix the input of the (ecdh) key agreement with the encoded (ephemeral) public key
47 SingleHashMode = 1,
48 /// (decryption only) if set: use cofactor multiplication during (ecdh) key agreement
49 /// This only matters if the curve has a cofactor
50 CofactorMode = 2,
51 /// if set: use ecdhc instead of ecdh.
52 /// This only matters if the curve has a cofactor
53 OldCofactorMode = 4,
54 /// (decryption only) if set: test if the (ephemeral) public key is on the curve
55 /// Note that we actually ignore this flag and always check the key
56 CheckMode = 8,
57
58 NONE BOTAN_DEPRECATED("Use None") = None,
59 SINGLE_HASH_MODE BOTAN_DEPRECATED("Use SingleHashMode") = SingleHashMode,
60 COFACTOR_MODE BOTAN_DEPRECATED("Use CofactorMode") = CofactorMode,
61 OLD_COFACTOR_MODE BOTAN_DEPRECATED("Use OldCofactorMode") = OldCofactorMode,
62 CHECK_MODE BOTAN_DEPRECATED("Use CheckMode") = CheckMode,
63};
Botan::ECIES_Flags::SingleHashMode
@ SingleHashMode
if set: prefix the input of the (ecdh) key agreement with the encoded (ephemeral) public key
Definition ecies.h:47

◆ ErrorType

enum class Botan::ErrorType : uint16_t
strong

Different types of errors that might occur

Enumerator
Unknown 

Some unknown error

SystemError 

An error while calling a system interface

NotImplemented 

An operation seems valid, but not supported by the current version

OutOfMemory 

Memory allocation failure

InternalError 

An internal error occurred

IoError 

An I/O error occurred

InvalidObjectState 

Invalid object state

KeyNotSet 

A key was not set on an object when this is required

InvalidArgument 

The application provided an argument which is invalid

InvalidKeyLength 

A key with invalid length was provided

InvalidNonceLength 

A nonce with invalid length was provided

LookupError 

An object type was requested but cannot be found

EncodingFailure 

Encoding a message or datum failed

DecodingFailure 

Decoding a message or datum failed

TLSError 

A TLS error (error_code will be the alert type)

HttpError 

An error during an HTTP operation

InvalidTag 

A message with an invalid authentication tag was detected

RoughtimeError 

An error during Roughtime validation

CommonCryptoError 

An error when interacting with CommonCrypto API

Pkcs11Error 

An error when interacting with a PKCS11 device

TPMError 

An error when interacting with a TPM device

DatabaseError 

An error when interacting with a database

ZlibError 

An error when interacting with zlib

Bzip2Error 

An error when interacting with bzip2

LzmaError 

An error when interacting with lzma

Definition at line 21 of file exceptn.h.

21 : uint16_t {
22 /** Some unknown error */
23 Unknown = 1,
24 /** An error while calling a system interface */
25 SystemError = 2,
26 /** An operation seems valid, but not supported by the current version */
27 NotImplemented = 3,
28 /** Memory allocation failure */
29 OutOfMemory = 4,
30 /** An internal error occurred */
31 InternalError = 5,
32 /** An I/O error occurred */
33 IoError = 6,
34
35 /** Invalid object state */
36 InvalidObjectState = 100,
37 /** A key was not set on an object when this is required */
38 KeyNotSet = 101,
39 /** The application provided an argument which is invalid */
40 InvalidArgument = 102,
41 /** A key with invalid length was provided */
42 InvalidKeyLength = 103,
43 /** A nonce with invalid length was provided */
44 InvalidNonceLength = 104,
45 /** An object type was requested but cannot be found */
46 LookupError = 105,
47 /** Encoding a message or datum failed */
48 EncodingFailure = 106,
49 /** Decoding a message or datum failed */
50 DecodingFailure = 107,
51 /** A TLS error (error_code will be the alert type) */
52 TLSError = 108,
53 /** An error during an HTTP operation */
54 HttpError = 109,
55 /** A message with an invalid authentication tag was detected */
56 InvalidTag = 110,
57 /** An error during Roughtime validation */
58 RoughtimeError = 111,
59
60 /** An error when interacting with CommonCrypto API */
61 CommonCryptoError = 201,
62 /** An error when interacting with a PKCS11 device */
63 Pkcs11Error = 202,
64 /** An error when interacting with a TPM device */
65 TPMError = 203,
66 /** An error when interacting with a database */
67 DatabaseError = 204,
68
69 /** An error when interacting with zlib */
70 ZlibError = 300,
71 /** An error when interacting with bzip2 */
72 Bzip2Error = 301,
73 /** An error when interacting with lzma */
74 LzmaError = 302,
75
76};

◆ LMOTS_Algorithm_Type

enum class Botan::LMOTS_Algorithm_Type : uint32_t
strong

Enum of available LM-OTS algorithm types.

The supported parameter sets are defined in RFC 8554 Section 4.1. and draft-fluhrer-lms-more-parm-sets-11 Section 4. HSS/LMS typecodes are introduced in RFC 8554 Section 3.2. and their format specified in Section 3.3.

Enumerator
RESERVED 
SHA256_N32_W1 
SHA256_N32_W2 
SHA256_N32_W4 
SHA256_N32_W8 
SHA256_N24_W1 
SHA256_N24_W2 
SHA256_N24_W4 
SHA256_N24_W8 
SHAKE_N32_W1 
SHAKE_N32_W2 
SHAKE_N32_W4 
SHAKE_N32_W8 
SHAKE_N24_W1 
SHAKE_N24_W2 
SHAKE_N24_W4 
SHAKE_N24_W8 

Definition at line 68 of file lm_ots.h.

68 : uint32_t /* NOLINT(*-enum-size) */ {
69 // --- RFC 8554 ---
70 RESERVED = 0x00,
71
72 // SHA-256 based
73 SHA256_N32_W1 = 0x01,
74 SHA256_N32_W2 = 0x02,
75 SHA256_N32_W4 = 0x03,
76 SHA256_N32_W8 = 0x04,
77
78 // --- draft-fluhrer-lms-more-parm-sets-11 ---
79 // SHA-256/192 based
80 SHA256_N24_W1 = 0x05,
81 SHA256_N24_W2 = 0x06,
82 SHA256_N24_W4 = 0x07,
83 SHA256_N24_W8 = 0x08,
84
85 // SHAKE-256/256 based
86 SHAKE_N32_W1 = 0x09,
87 SHAKE_N32_W2 = 0x0a,
88 SHAKE_N32_W4 = 0x0b,
89 SHAKE_N32_W8 = 0x0c,
90
91 // SHAKE-256/192 based
92 SHAKE_N24_W1 = 0x0d,
93 SHAKE_N24_W2 = 0x0e,
94 SHAKE_N24_W4 = 0x0f,
95 SHAKE_N24_W8 = 0x10,
96};

◆ LMS_Algorithm_Type

enum class Botan::LMS_Algorithm_Type : uint32_t
strong

Enum of available LMS algorithm types.

The supported parameter sets are defined in RFC 8554 Section 5.1. and draft-fluhrer-lms-more-parm-sets-11 Section 5. HSS/LMS typecodes are introduced in RFC 8554 Section 3.2. and their format specified in Section 3.3.

Enumerator
RESERVED 
SHA256_M32_H5 
SHA256_M32_H10 
SHA256_M32_H15 
SHA256_M32_H20 
SHA256_M32_H25 
SHA256_M24_H5 
SHA256_M24_H10 
SHA256_M24_H15 
SHA256_M24_H20 
SHA256_M24_H25 
SHAKE_M32_H5 
SHAKE_M32_H10 
SHAKE_M32_H15 
SHAKE_M32_H20 
SHAKE_M32_H25 
SHAKE_M24_H5 
SHAKE_M24_H10 
SHAKE_M24_H15 
SHAKE_M24_H20 
SHAKE_M24_H25 

Definition at line 32 of file lms.h.

32 : uint32_t /* NOLINT(*-enum-size) */ {
33 // --- RFC 8554 ---
34 RESERVED = 0x00,
35
36 // SHA-256 based
37 SHA256_M32_H5 = 0x05,
38 SHA256_M32_H10 = 0x06,
39 SHA256_M32_H15 = 0x07,
40 SHA256_M32_H20 = 0x08,
41 SHA256_M32_H25 = 0x09,
42
43 // --- draft-fluhrer-lms-more-parm-sets-11 ---
44 // SHA-256/192 based
45 SHA256_M24_H5 = 0x0a,
46 SHA256_M24_H10 = 0x0b,
47 SHA256_M24_H15 = 0x0c,
48 SHA256_M24_H20 = 0x0d,
49 SHA256_M24_H25 = 0x0e,
50
51 // SHAKE-256/256 based
52 SHAKE_M32_H5 = 0x0f,
53 SHAKE_M32_H10 = 0x10,
54 SHAKE_M32_H15 = 0x11,
55 SHAKE_M32_H20 = 0x12,
56 SHAKE_M32_H25 = 0x13,
57
58 // SHAKE-256/192 based
59 SHAKE_M24_H5 = 0x14,
60 SHAKE_M24_H10 = 0x15,
61 SHAKE_M24_H15 = 0x16,
62 SHAKE_M24_H20 = 0x17,
63 SHAKE_M24_H25 = 0x18
64};

◆ MD_Endian

enum class Botan::MD_Endian : uint8_t
strong
Enumerator
Little 
Big 

Definition at line 20 of file mdx_hash.h.

20 : uint8_t {
21 Little,
22 Big,
23};

◆ MlPrivateKeyFormat

enum class Botan::MlPrivateKeyFormat : uint8_t
strong

Byte encoding format of ML-KEM and ML-DSA the private key.

Enumerator
Seed 

Only supported for ML-KEM/ML-DSA keys:

  • ML-KEM: 64-byte seed: d || z
  • ML-DSA: 32-byte seed: xi (private_key_bits_with_format not yet yet supported for ML-DSA)
Expanded 

The expanded format, i.e., the format specified in FIPS-203/204.

Definition at line 81 of file kyber.h.

81 : uint8_t {
82 /// Only supported for ML-KEM/ML-DSA keys:
83 /// - ML-KEM: 64-byte seed: d || z
84 /// - ML-DSA: 32-byte seed: xi (private_key_bits_with_format not yet
85 /// yet supported for ML-DSA)
86 Seed,
87 /// The expanded format, i.e., the format specified in FIPS-203/204.
88 Expanded,
89};
Botan::MlPrivateKeyFormat::Expanded
@ Expanded
The expanded format, i.e., the format specified in FIPS-203/204.
Definition kyber.h:88

◆ PublicKeyOperation

enum class Botan::PublicKeyOperation : uint8_t
strong

Enumeration of possible operations a public key could be used for.

It is possible to query if a key supports a particular operation type using Asymmetric_Key::supports_operation()

Enumerator
Encryption 
Signature 
KeyEncapsulation 
KeyAgreement 

Definition at line 46 of file pk_keys.h.

46 : uint8_t {
47 Encryption,
48 Signature,
49 KeyEncapsulation,
50 KeyAgreement,
51};

◆ Signature_Format

enum class Botan::Signature_Format : uint8_t
strong

Enumeration specifying the signature format.

This is mostly used for requesting DER encoding of ECDSA signatures; most other algorithms only support "standard".

Enumerator
Standard 
DerSequence 
IEEE_1363 
DER_SEQUENCE 

Definition at line 32 of file pk_keys.h.

32 : uint8_t {
33 Standard = 0,
34 DerSequence = 1,
35
36 IEEE_1363 BOTAN_DEPRECATED("Use Standard") = Standard,
37 DER_SEQUENCE BOTAN_DEPRECATED("Use DerSequence") = DerSequence,
38};

◆ Sphincs_Address_Type

enum class Botan::Sphincs_Address_Type : uint32_t
strong
Enumerator
WotsHash 
WotsPublicKeyCompression 
HashTree 
ForsTree 
ForsTreeRootsCompression 
WotsKeyGeneration 
ForsKeyGeneration 

Definition at line 18 of file sp_address.h.

18 : uint32_t /* NOLINT(*-enum-size) */ {
19 WotsHash = 0,
20 WotsPublicKeyCompression = 1,
21 HashTree = 2,
22 ForsTree = 3,
23 ForsTreeRootsCompression = 4,
24 WotsKeyGeneration = 5,
25 ForsKeyGeneration = 6
26};

◆ Sphincs_Hash_Type

enum class Botan::Sphincs_Hash_Type : uint8_t
strong
Enumerator
Shake256 
Sha256 
Haraka 

Haraka is currently not supported.

Definition at line 18 of file sp_parameters.h.

18 : uint8_t {
19 Shake256,
20 Sha256,
21 Haraka BOTAN_DEPRECATED("Haraka is not and will not be supported"), ///< Haraka is currently not supported
22};
Botan::Sphincs_Hash_Type::Haraka
@ Haraka
Haraka is currently not supported.
Definition sp_parameters.h:21

◆ Sphincs_Parameter_Set

enum class Botan::Sphincs_Parameter_Set : uint8_t
strong
Enumerator
Sphincs128Small 
Sphincs128Fast 
Sphincs192Small 
Sphincs192Fast 
Sphincs256Small 
Sphincs256Fast 
SLHDSA128Small 
SLHDSA128Fast 
SLHDSA192Small 
SLHDSA192Fast 
SLHDSA256Small 
SLHDSA256Fast 

Definition at line 24 of file sp_parameters.h.

24 : uint8_t {
25 Sphincs128Small,
26 Sphincs128Fast,
27 Sphincs192Small,
28 Sphincs192Fast,
29 Sphincs256Small,
30 Sphincs256Fast,
31
32 SLHDSA128Small,
33 SLHDSA128Fast,
34 SLHDSA192Small,
35 SLHDSA192Fast,
36 SLHDSA256Small,
37 SLHDSA256Fast,
38};

◆ TPM_Storage_Type

enum class Botan::TPM_Storage_Type
strong
Enumerator
User 
System 

Definition at line 102 of file tpm.h.

102{ User, System };

◆ Usage_Type

enum class Botan::Usage_Type : uint8_t
strong
Enumerator
UNSPECIFIED 
TLS_SERVER_AUTH 
TLS_CLIENT_AUTH 
CERTIFICATE_AUTHORITY 
OCSP_RESPONDER 
ENCRYPTION 

Definition at line 211 of file pkix_enums.h.

211 : uint8_t {
212 UNSPECIFIED, // no restrictions
213 TLS_SERVER_AUTH,
214 TLS_CLIENT_AUTH,
215 CERTIFICATE_AUTHORITY,
216 OCSP_RESPONDER,
217 ENCRYPTION
218};

◆ WOTS_Derivation_Method

enum class Botan::WOTS_Derivation_Method : uint8_t
strong

Determines how WOTS+ private keys are derived from the XMSS private key

Enumerator
Botan2x 

This roughly followed the suggestions in RFC 8391 but is vulnerable to a multi-target attack. For new private keys, we recommend using the derivation as suggested in NIST SP.800-208. Private keys generated with Botan 2.x will need to stay with this mode, otherwise they won't be able to generate valid signatures any longer.

NIST_SP800_208 

Derivation as specified in NIST SP.800-208 to avoid a multi-target attack on the WOTS+ key derivation suggested in RFC 8391. New private keys should use this mode.

Definition at line 136 of file xmss.h.

136 : uint8_t {
137 /// This roughly followed the suggestions in RFC 8391 but is vulnerable
138 /// to a multi-target attack. For new private keys, we recommend using
139 /// the derivation as suggested in NIST SP.800-208.
140 /// Private keys generated with Botan 2.x will need to stay with this mode,
141 /// otherwise they won't be able to generate valid signatures any longer.
142 Botan2x = 1,
143
144 /// Derivation as specified in NIST SP.800-208 to avoid a multi-target attack
145 /// on the WOTS+ key derivation suggested in RFC 8391. New private keys
146 /// should use this mode.
147 NIST_SP800_208 = 2,
148};

Function Documentation

◆ abs()

BigInt Botan::abs ( const BigInt & n)
inline

Return the absolute value

Parameters
nan integer
Returns
absolute value of n

Definition at line 22 of file numthry.h.

22 {
23 return n.abs();
24}
Botan::BigInt::abs
BigInt abs() const
Definition bigint.cpp:386

References Botan::BigInt::abs().

Referenced by Botan::EC_Group::EC_Group(), gcd(), and Botan::EC_Group::verify_group().

◆ absorb_into_sponge() [1/2]

void Botan::absorb_into_sponge ( detail::SpongeLikeWithTrivialPermute auto & sponge,
std::span< const uint8_t > input )
inline

Definition at line 233 of file sponge_processing.h.

233 {
234 absorb_into_sponge(sponge, input, [&sponge] { sponge.permute(); });
235}
Botan::absorb_into_sponge
void absorb_into_sponge(SpongeT &sponge, std::span< const uint8_t > input, const detail::PermutationFn auto &permutation_fn)
Definition sponge_processing.h:221

References absorb_into_sponge().

◆ absorb_into_sponge() [2/2]

template<detail::SpongeLike SpongeT>
void Botan::absorb_into_sponge ( SpongeT & sponge,
std::span< const uint8_t > input,
const detail::PermutationFn auto & permutation_fn )
inline

Absorbs input data into the sponge state.

Parameters
spongeThe sponge state to absorb data into.
inputThe input data to absorb.
permutation_fnThe function to call for the sponge's permutation.

Definition at line 221 of file sponge_processing.h.

223 {
224 using word_t = typename SpongeT::word_t;
225
226 BufferSlicer input_slicer(input);
227 process_bytes_in_sponge(sponge, input.size(), permutation_fn, [&](word_t state_word, auto bounds) {
228 return state_word ^ bounds.read_from(input_slicer);
229 });
230 BOTAN_ASSERT_NOMSG(input_slicer.empty());
231}
BOTAN_ASSERT_NOMSG
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:75
Botan::process_bytes_in_sponge
BOTAN_FORCE_INLINE void process_bytes_in_sponge(SpongeT &sponge, size_t bytes_to_process, const detail::PermutationFn auto &permutation_fn, const detail::ModifierFn< SpongeT > auto &modifier_fn)
Definition sponge_processing.h:136

References BOTAN_ASSERT_NOMSG, Botan::BufferSlicer::empty(), and process_bytes_in_sponge().

Referenced by Botan::Ascon_p::absorb(), Botan::Keccak_Permutation::absorb(), and absorb_into_sponge().

◆ allocate_memory()

void * Botan::allocate_memory ( size_t elems,
size_t elem_size )

Allocate a memory buffer by some method. This should only be used for primitive types (uint8_t, uint32_t, etc).

Parameters
elemsthe number of elements
elem_sizethe size of each element
Returns
pointer to allocated and zeroed memory, or throw std::bad_alloc on failure

Definition at line 21 of file allocator.cpp.

21 {
22 if(elems == 0 || elem_size == 0) {
23 return nullptr;
24 }
25
26 // Some calloc implementations do not check for overflow (?!?)
27 if(!checked_mul(elems, elem_size).has_value()) {
28 throw std::bad_alloc();
29 }
30
31#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
32 // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
33 if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
34 return p;
35 }
36#endif
37
38#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
39 void* ptr = ::calloc_conceal(elems, elem_size);
40#else
41 // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
42 void* ptr = std::calloc(elems, elem_size); // NOLINT(*-no-malloc,*-owning-memory)
43#endif
44 if(ptr == nullptr) {
45 [[unlikely]] throw std::bad_alloc();
46 }
47 return ptr;
48}
Botan::mlock_allocator::instance
static mlock_allocator & instance() noexcept
Definition locking_allocator.cpp:74
Botan::checked_mul
constexpr std::optional< T > checked_mul(T a, T b)
Definition int_utils.h:46

References BOTAN_MALLOC_FN, checked_mul(), and Botan::mlock_allocator::instance().

Referenced by Botan::secure_allocator< T >::allocate().

◆ any_null_pointers()

template<typename... Ptrs>
bool Botan::any_null_pointers ( Ptrs... ptr)

Return true if any of the provided arguments are null

Definition at line 54 of file mem_utils.h.

54 {
55 static_assert((... && std::is_pointer_v<Ptrs>), "All arguments must be pointers");
56 return (... || (ptr == nullptr));
57}

Referenced by botan_x509_cert_allowed_extended_usage_str(), botan_x509_cert_excluded_name_constraints(), botan_x509_cert_excluded_name_constraints_count(), botan_x509_cert_get_issuer_dn_count(), botan_x509_cert_get_path_length_constraint(), botan_x509_cert_get_subject_dn_count(), botan_x509_cert_issuer_alternative_names(), botan_x509_cert_issuer_alternative_names_count(), botan_x509_cert_permitted_name_constraints(), botan_x509_cert_permitted_name_constraints_count(), botan_x509_cert_serial_number(), botan_x509_cert_subject_alternative_names(), botan_x509_cert_subject_alternative_names_count(), botan_x509_crl_create(), botan_x509_crl_entries(), botan_x509_crl_entries_count(), botan_x509_crl_entry_create(), botan_x509_crl_entry_reason(), botan_x509_crl_entry_revocation_date(), botan_x509_crl_entry_serial_number(), botan_x509_crl_next_update(), botan_x509_crl_this_update(), botan_x509_crl_update(), botan_x509_general_name_get_type(), botan_xof_block_size(), botan_xof_init(), botan_xof_name(), botan_xof_output(), and botan_xof_update().

◆ argon2()

void Botan::argon2 ( uint8_t output[],
size_t output_len,
const char * password,
size_t password_len,
const uint8_t salt[],
size_t salt_len,
const uint8_t key[],
size_t key_len,
const uint8_t ad[],
size_t ad_len,
uint8_t y,
size_t p,
size_t M,
size_t t )
inline

Argon2 key derivation function

Parameters
outputthe output will be placed here
output_lenlength of output
passwordthe user password
password_lenthe length of password
saltthe salt
salt_lenlength of salt
keyan optional secret key
key_lenthe length of key
adan optional additional input
ad_lenthe length of ad
ythe Argon2 variant (0 = Argon2d, 1 = Argon2i, 2 = Argon2id)
pthe parallelization parameter
Mthe amount of memory to use in Kb
tthe number of iterations to use

Definition at line 139 of file argon2.h.

152 {
153 auto pwdhash_fam = PasswordHashFamily::create_or_throw([y] {
154 switch(y) {
155 case 0:
156 return "Argon2d";
157 case 1:
158 return "Argon2i";
159 case 2:
160 return "Argon2id";
161 default:
162 throw Not_Implemented("Unknown Argon2 family type");
163 }
164 }());
165 auto pwdhash = pwdhash_fam->from_params(M, t, p);
166 pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len, ad, ad_len, key, key_len);
167}
Botan::Not_Implemented
Definition exceptn.h:335
Botan::PasswordHashFamily::create_or_throw
static std::unique_ptr< PasswordHashFamily > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition pwdhash.cpp:110

References argon2(), and Botan::PasswordHashFamily::create_or_throw().

Referenced by argon2().

◆ argon2_check_pwhash()

bool Botan::argon2_check_pwhash ( const char * password,
size_t password_len,
std::string_view hash )

Check a previously created password hash

Verify an Argon2 password hash against the provided password. Returns false if the input hash seems malformed or if the computed hash does not match.

Parameters
passwordthe password to check against
password_lenthe length of password
hashthe stored hash to check against

Definition at line 77 of file argon2fmt.cpp.

77 {
78 const std::vector<std::string> parts = split_on(input_hash, '$');
79
80 if(parts.size() != 5) {
81 return false;
82 }
83
84 uint8_t family = 0;
85
86 if(parts[0] == "argon2d") {
87 family = 0;
88 } else if(parts[0] == "argon2i") {
89 family = 1;
90 } else if(parts[0] == "argon2id") {
91 family = 2;
92 } else {
93 return false;
94 }
95
96 if(parts[1] != "v=19") {
97 return false;
98 }
99
100 const std::vector<std::string> params = split_on(parts[2], ',');
101
102 if(params.size() != 3) {
103 return false;
104 }
105
106 size_t M = 0;
107 size_t t = 0;
108 size_t p = 0;
109
110 for(const auto& param_str : params) {
111 const std::vector<std::string> param = split_on(param_str, '=');
112
113 if(param.size() != 2) {
114 return false;
115 }
116
117 const std::string_view key = param[0];
118 const size_t val = to_u32bit(param[1]);
119 if(key == "m") {
120 M = val;
121 } else if(key == "t") {
122 t = val;
123 } else if(key == "p") {
124 p = val;
125 } else {
126 return false;
127 }
128 }
129
130 std::vector<uint8_t> salt(base64_decode_max_output(parts[3].size()));
131 salt.resize(base64_decode(salt.data(), parts[3], false));
132
133 std::vector<uint8_t> hash(base64_decode_max_output(parts[4].size()));
134 hash.resize(base64_decode(hash.data(), parts[4], false));
135
136 if(hash.size() < 4) {
137 return false;
138 }
139
140 std::vector<uint8_t> generated(hash.size());
141 auto pwdhash_fam = PasswordHashFamily::create_or_throw(argon2_family(family));
142 auto pwdhash = pwdhash_fam->from_params(M, t, p);
143
144 pwdhash->derive_key(generated.data(), generated.size(), password, password_len, salt.data(), salt.size());
145
146 return CT::is_equal(generated.data(), hash.data(), generated.size()).as_bool();
147}
Botan::CT::is_equal
constexpr CT::Mask< T > is_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:798
Botan::to_u32bit
uint32_t to_u32bit(std::string_view str_view)
Definition parsing.cpp:32
Botan::split_on
std::vector< std::string > split_on(std::string_view str, char delim)
Definition parsing.cpp:111
Botan::base64_decode
size_t base64_decode(uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
Definition base64.cpp:167
Botan::base64_decode_max_output
size_t base64_decode_max_output(size_t input_length)
Definition base64.cpp:199

References base64_decode(), base64_decode_max_output(), Botan::PasswordHashFamily::create_or_throw(), Botan::CT::is_equal(), split_on(), and to_u32bit().

◆ argon2_generate_pwhash()

std::string Botan::argon2_generate_pwhash ( const char * password,
size_t password_len,
RandomNumberGenerator & rng,
size_t p,
size_t M,
size_t t,
uint8_t y = 2,
size_t salt_len = 16,
size_t output_len = 32 )

Generate an Argon2 hash of the specified password. The y parameter specifies the variant: 0 for Argon2d, 1 for Argon2i, and 2 for Argon2id.

Definition at line 42 of file argon2fmt.cpp.

50 {
51 std::vector<uint8_t> salt(salt_len);
52 rng.randomize(salt.data(), salt.size());
53
54 std::vector<uint8_t> output(output_len);
55
56 auto pwdhash_fam = PasswordHashFamily::create_or_throw(argon2_family(y));
57 auto pwdhash = pwdhash_fam->from_params(M, t, p);
58
59 pwdhash->derive_key(output.data(), output.size(), password, password_len, salt.data(), salt.size());
60
61 const auto enc_salt = strip_padding(base64_encode(salt));
62 const auto enc_output = strip_padding(base64_encode(output));
63
64 const std::string argon2_mode = [&]() -> std::string {
65 if(y == 0) {
66 return "d";
67 } else if(y == 1) {
68 return "i";
69 } else {
70 return "id";
71 }
72 }();
73
74 return fmt("$argon2{}$v=19$m={},t={},p={}${}${}", argon2_mode, M, t, p, enc_salt, enc_output);
75}
Botan::RandomNumberGenerator::randomize
void randomize(std::span< uint8_t > output)
Definition rng.h:75
Botan::fmt
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
Botan::base64_encode
size_t base64_encode(char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
Definition base64.cpp:159

References base64_encode(), Botan::PasswordHashFamily::create_or_throw(), fmt(), and Botan::RandomNumberGenerator::randomize().

◆ as_span_of_bytes() [1/3]

std::span< const uint8_t > Botan::as_span_of_bytes ( const char * s,
size_t len )
inline

Definition at line 59 of file mem_utils.h.

59 {
60 const uint8_t* b = reinterpret_cast<const uint8_t*>(s);
61 return std::span{b, len};
62}

Referenced by Botan::DER_Encoder::add_object(), Botan::TLS::append_tls_length_value(), as_span_of_bytes(), as_span_of_bytes(), check_bcrypt(), Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::cSHAKE_XOF::cSHAKE_XOF(), cstr_as_span_of_bytes(), Botan::DataSource_Memory::DataSource_Memory(), Botan::CryptoBox::decrypt(), Botan::CryptoBox::decrypt_bin(), Botan::Bcrypt_PBKDF::derive_key(), Botan::PK_Key_Agreement::derive_key(), Botan::PK_Key_Agreement::derive_key(), Botan::Scrypt::derive_key(), Botan::Encrypted_PSK_Database::get(), Botan::EC_AffinePoint::hash_to_curve_nu(), Botan::EC_AffinePoint::hash_to_curve_ro(), hkdf_expand_label(), Botan::TLS::Channel_Impl_12::key_material_export(), Botan::Pipe::process_msg(), Botan::Encrypted_PSK_Database::remove(), Botan::TLS::Server_Name_Indicator::serialize(), Botan::Encrypted_PSK_Database::set(), Botan::PSK_Database::set_str(), Botan::Buffered_Computation::update(), Botan::PK_Signer::update(), Botan::PK_Verifier::update(), and Botan::Pipe::write().

◆ as_span_of_bytes() [2/3]

std::span< const uint8_t > Botan::as_span_of_bytes ( const std::string & s)
inline

Definition at line 64 of file mem_utils.h.

64 {
65 return as_span_of_bytes(s.data(), s.size());
66}
Botan::as_span_of_bytes
std::span< const uint8_t > as_span_of_bytes(const char *s, size_t len)
Definition mem_utils.h:59

References as_span_of_bytes().

◆ as_span_of_bytes() [3/3]

std::span< const uint8_t > Botan::as_span_of_bytes ( std::string_view s)
inline

Definition at line 68 of file mem_utils.h.

68 {
69 return as_span_of_bytes(s.data(), s.size());
70}

References as_span_of_bytes().

◆ asn1_class_to_string()

std::string BOTAN_UNSTABLE_API Botan::asn1_class_to_string ( ASN1_Class type)

Definition at line 79 of file asn1_obj.cpp.

79 {
80 switch(type) {
81 case ASN1_Class::Universal:
82 return "UNIVERSAL";
83 case ASN1_Class::Constructed:
84 return "CONSTRUCTED";
85 case ASN1_Class::ContextSpecific:
86 return "CONTEXT_SPECIFIC";
87 case ASN1_Class::Application:
88 return "APPLICATION";
89 case ASN1_Class::Private:
90 return "PRIVATE";
91 case ASN1_Class::NoObject:
92 return "NO_OBJECT";
93 default:
94 return "CLASS(" + std::to_string(static_cast<size_t>(type)) + ")";
95 }
96}

References Application, Constructed, ContextSpecific, NoObject, Private, and Universal.

Referenced by Botan::BER_Object::assert_is_a().

◆ asn1_tag_to_string()

std::string BOTAN_UNSTABLE_API Botan::asn1_tag_to_string ( ASN1_Type type)

Definition at line 98 of file asn1_obj.cpp.

98 {
99 switch(type) {
100 case ASN1_Type::Sequence:
101 return "SEQUENCE";
102
103 case ASN1_Type::Set:
104 return "SET";
105
106 case ASN1_Type::PrintableString:
107 return "PRINTABLE STRING";
108
109 case ASN1_Type::NumericString:
110 return "NUMERIC STRING";
111
112 case ASN1_Type::Ia5String:
113 return "IA5 STRING";
114
115 case ASN1_Type::TeletexString:
116 return "T61 STRING";
117
118 case ASN1_Type::Utf8String:
119 return "UTF8 STRING";
120
121 case ASN1_Type::VisibleString:
122 return "VISIBLE STRING";
123
124 case ASN1_Type::BmpString:
125 return "BMP STRING";
126
127 case ASN1_Type::UniversalString:
128 return "UNIVERSAL STRING";
129
130 case ASN1_Type::UtcTime:
131 return "UTC TIME";
132
133 case ASN1_Type::GeneralizedTime:
134 return "GENERALIZED TIME";
135
136 case ASN1_Type::OctetString:
137 return "OCTET STRING";
138
139 case ASN1_Type::BitString:
140 return "BIT STRING";
141
142 case ASN1_Type::Enumerated:
143 return "ENUMERATED";
144
145 case ASN1_Type::Integer:
146 return "INTEGER";
147
148 case ASN1_Type::Null:
149 return "NULL";
150
151 case ASN1_Type::ObjectId:
152 return "OBJECT";
153
154 case ASN1_Type::Boolean:
155 return "BOOLEAN";
156
157 case ASN1_Type::NoObject:
158 return "NO_OBJECT";
159
160 default:
161 return "TAG(" + std::to_string(static_cast<uint32_t>(type)) + ")";
162 }
163}

References BitString, BmpString, Boolean, Enumerated, GeneralizedTime, Ia5String, Integer, NoObject, Null, NumericString, ObjectId, OctetString, PrintableString, Sequence, Set, TeletexString, UniversalString, UtcTime, Utf8String, and VisibleString.

Referenced by Botan::BER_Object::assert_is_a().

◆ assert_unreachable()

void BOTAN_UNSTABLE_API Botan::assert_unreachable ( const char * file,
int line )

Definition at line 61 of file assert.cpp.

61 {
62 const std::string msg = fmt("Codepath that was marked unreachable was reached @{}:{}", file, line);
63
64#if defined(BOTAN_TERMINATE_ON_ASSERTS)
65 std::cerr << msg << '\n';
66 std::abort();
67#else
68 throw Internal_Error(msg);
69#endif
70}
Botan::Internal_Error
Definition exceptn.h:322

References fmt().

◆ assertion_failure()

void Botan::assertion_failure ( const char * expr_str,
const char * assertion_made,
const char * func,
const char * file,
int line )

Called when an assertion fails Throws an Exception object

Definition at line 36 of file assert.cpp.

36 {
37 std::ostringstream format;
38
39 format << "False assertion ";
40
41 if(assertion_made != nullptr && assertion_made[0] != 0) {
42 format << "'" << assertion_made << "' (expression " << expr_str << ") ";
43 } else {
44 format << expr_str << " ";
45 }
46
47 if(func != nullptr) {
48 format << "in " << func << " ";
49 }
50
51 format << "@" << file << ":" << line;
52
53#if defined(BOTAN_TERMINATE_ON_ASSERTS)
54 std::cerr << format.str() << '\n';
55 std::abort();
56#else
57 throw Internal_Error(format.str());
58#endif
59}

◆ base32_decode() [1/5]

secure_vector< uint8_t > Botan::base32_decode ( const char input[],
size_t input_length,
bool ignore_ws = true )

Perform base32 decoding

Parameters
inputsome base32 input
input_lengththe length of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded base32 output

Definition at line 165 of file base32.cpp.

165 {
166 return base_decode_to_vec<secure_vector<uint8_t>>(Base32(), input, input_length, ignore_ws);
167}
Botan::base_decode_to_vec
Vector base_decode_to_vec(const Base &base, const char input[], size_t input_length, bool ignore_ws)
Definition codec_base.h:190

References base_decode_to_vec().

◆ base32_decode() [2/5]

secure_vector< uint8_t > Botan::base32_decode ( std::string_view input,
bool ignore_ws = true )

Perform base32 decoding

Parameters
inputsome base32 input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded base32 output

Definition at line 169 of file base32.cpp.

169 {
170 return base32_decode(input.data(), input.size(), ignore_ws);
171}
Botan::base32_decode
size_t base32_decode(uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
Definition base32.cpp:152

References base32_decode().

◆ base32_decode() [3/5]

size_t Botan::base32_decode ( uint8_t output[],
const char input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs,
bool ignore_ws = true )

Perform base32 decoding

Parameters
outputan array of at least base32_decode_max_output bytes
inputsome base32 input
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding is allowed
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 152 of file base32.cpp.

153 {
154 return base_decode(Base32(), out, in, input_length, input_consumed, final_inputs, ignore_ws);
155}
Botan::base_decode
size_t base_decode(const Base &base, uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws=true)
Definition codec_base.h:118

References base_decode().

Referenced by base32_decode(), and base32_decode().

◆ base32_decode() [4/5]

size_t Botan::base32_decode ( uint8_t output[],
const char input[],
size_t input_length,
bool ignore_ws = true )

Perform base32 decoding

Parameters
outputan array of at least base32_decode_max_output bytes
inputsome base32 input
input_lengthlength of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 157 of file base32.cpp.

157 {
158 return base_decode_full(Base32(), output, input, input_length, ignore_ws);
159}
Botan::base_decode_full
size_t base_decode_full(const Base &base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
Definition codec_base.h:178

References base_decode_full().

◆ base32_decode() [5/5]

size_t Botan::base32_decode ( uint8_t output[],
std::string_view input,
bool ignore_ws = true )

Perform base32 decoding

Parameters
outputan array of at least base32_decode_max_output bytes
inputsome base32 input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 161 of file base32.cpp.

161 {
162 return base32_decode(output, input.data(), input.length(), ignore_ws);
163}

References base32_decode().

◆ base32_decode_max_output()

size_t Botan::base32_decode_max_output ( size_t input_length)

Calculate the size of output buffer for base32_decode

Parameters
input_lengththe length of input in bytes
Returns
the size of output buffer in bytes

Definition at line 177 of file base32.cpp.

177 {
178 return Base32::decode_max_output(input_length);
179}

◆ base32_encode() [1/3]

size_t Botan::base32_encode ( char output[],
const uint8_t input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs )

Perform base32 encoding

Parameters
outputan array of at least base32_encode_max_output bytes
inputis some binary data
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding chars will be applied if needed
Returns
number of bytes written to output

Definition at line 144 of file base32.cpp.

144 {
145 return base_encode(Base32(), out, in, input_length, input_consumed, final_inputs);
146}
Botan::base_encode
size_t base_encode(const Base &base, char output[], const uint8_t input[], size_t input_length, size_t &input_consumed, bool final_inputs)
Definition codec_base.h:35

References base_encode().

Referenced by base32_encode().

◆ base32_encode() [2/3]

std::string Botan::base32_encode ( const uint8_t input[],
size_t input_length )

Perform base32 encoding

Parameters
inputsome input
input_lengthlength of input in bytes
Returns
base32 representation of input

Definition at line 148 of file base32.cpp.

148 {
149 return base_encode_to_string(Base32(), input, input_length);
150}
Botan::base_encode_to_string
std::string base_encode_to_string(const Base &base, const uint8_t input[], size_t input_length)
Definition codec_base.h:84

References base_encode_to_string().

◆ base32_encode() [3/3]

std::string Botan::base32_encode ( std::span< const uint8_t > input)
inline

Perform base32 encoding

Parameters
inputsome input
Returns
base32 representation of input

Definition at line 47 of file base32.h.

47 {
48 return base32_encode(input.data(), input.size());
49}
Botan::base32_encode
size_t base32_encode(char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
Definition base32.cpp:144

References base32_encode().

◆ base32_encode_max_output()

size_t Botan::base32_encode_max_output ( size_t input_length)

Calculate the size of output buffer for base32_encode

Parameters
input_lengththe length of input in bytes
Returns
the size of output buffer in bytes

Definition at line 173 of file base32.cpp.

173 {
174 return Base32::encode_max_output(input_length);
175}

◆ base58_check_decode() [1/2]

std::vector< uint8_t > Botan::base58_check_decode ( const char input[],
size_t input_length )

Perform base58 decoding with checksum

Definition at line 239 of file base58.cpp.

239 {
240 std::vector<uint8_t> dec = base58_decode(input, input_length);
241
242 if(dec.size() < 4) {
243 throw Decoding_Error("Invalid base58 too short for checksum");
244 }
245
246 const uint32_t computed_checksum = sha256_d_checksum(dec.data(), dec.size() - 4);
247 const uint32_t checksum = load_be<uint32_t>(&dec[dec.size() - 4], 0);
248
249 if(checksum != computed_checksum) {
250 throw Decoding_Error("Invalid base58 checksum");
251 }
252
253 dec.resize(dec.size() - 4);
254
255 return dec;
256}
Botan::Decoding_Error
Definition exceptn.h:192
Botan::base58_decode
std::vector< uint8_t > base58_decode(const char input[], size_t input_length)
Definition base58.cpp:193
Botan::load_be
constexpr auto load_be(ParamTs &&... params)
Definition loadstor.h:504

References base58_decode(), and load_be().

Referenced by base58_check_decode().

◆ base58_check_decode() [2/2]

std::vector< uint8_t > Botan::base58_check_decode ( std::string_view s)
inline

Definition at line 57 of file base58.h.

57 {
58 return base58_check_decode(s.data(), s.size());
59}
Botan::base58_check_decode
std::vector< uint8_t > base58_check_decode(const char input[], size_t input_length)
Definition base58.cpp:239

References base58_check_decode().

◆ base58_check_encode() [1/2]

std::string Botan::base58_check_encode ( const uint8_t input[],
size_t input_length )

Perform base58 encoding with checksum

Definition at line 186 of file base58.cpp.

186 {
187 BigInt v(input, input_length);
188 v <<= 32;
189 v += sha256_d_checksum(input, input_length);
190 return base58_encode(v, count_leading_zeros(input, input_length, 0));
191}
Botan::base58_encode
std::string base58_encode(const uint8_t input[], size_t input_length)
Definition base58.cpp:181

References base58_encode().

Referenced by base58_check_encode().

◆ base58_check_encode() [2/2]

std::string Botan::base58_check_encode ( std::span< const uint8_t > vec)
inline

Definition at line 49 of file base58.h.

49 {
50 return base58_check_encode(vec.data(), vec.size());
51}
Botan::base58_check_encode
std::string base58_check_encode(const uint8_t input[], size_t input_length)
Definition base58.cpp:186

References base58_check_encode().

◆ base58_decode() [1/2]

std::vector< uint8_t > Botan::base58_decode ( const char input[],
size_t input_length )

Perform base58 decoding

This is raw base58 encoding, without the checksum

Definition at line 193 of file base58.cpp.

193 {
194 const size_t leading_zeros = count_leading_zeros(input, input_length, '1');
195
196 std::vector<uint8_t> digits;
197
198 for(size_t i = leading_zeros; i != input_length; ++i) {
199 const char c = input[i];
200
201 if(c == ' ' || c == '\n') {
202 continue;
203 }
204
205 const uint8_t idx = base58_value_of(c);
206
207 if(idx == 0xFF) {
208 throw Decoding_Error("Invalid base58");
209 }
210
211 digits.push_back(idx);
212 }
213
214 BigInt v;
215
216 constexpr word radix1 = 58;
217 constexpr word radix2 = 58 * 58;
218 constexpr word radix3 = 58 * 58 * 58;
219 constexpr word radix4 = 58 * 58 * 58 * 58;
220
221 std::span<uint8_t> remaining{digits};
222
223 while(remaining.size() >= 4) {
224 const word accum = radix3 * remaining[0] + radix2 * remaining[1] + radix1 * remaining[2] + remaining[3];
225 v *= radix4;
226 v += accum;
227 remaining = remaining.subspan(4);
228 }
229
230 while(!remaining.empty()) {
231 v *= 58;
232 v += remaining[0];
233 remaining = remaining.subspan(1);
234 }
235
236 return v.serialize(v.bytes() + leading_zeros);
237}
Botan::word
std::conditional_t< HasNative64BitRegisters, std::uint64_t, uint32_t > word
Definition types.h:119

References Botan::BigInt::bytes(), and Botan::BigInt::serialize().

Referenced by base58_check_decode(), and base58_decode().

◆ base58_decode() [2/2]

std::vector< uint8_t > Botan::base58_decode ( std::string_view s)
inline

Definition at line 53 of file base58.h.

53 {
54 return base58_decode(s.data(), s.size());
55}

References base58_decode().

◆ base58_encode() [1/2]

std::string Botan::base58_encode ( const uint8_t input[],
size_t input_length )

Perform base58 encoding

This is raw base58 encoding, without the checksum

Definition at line 181 of file base58.cpp.

181 {
182 const BigInt v(input, input_length);
183 return base58_encode(v, count_leading_zeros(input, input_length, 0));
184}

References base58_encode().

Referenced by base58_check_encode(), base58_encode(), and base58_encode().

◆ base58_encode() [2/2]

std::string Botan::base58_encode ( std::span< const uint8_t > vec)
inline

Definition at line 45 of file base58.h.

45 {
46 return base58_encode(vec.data(), vec.size());
47}

References base58_encode().

◆ base64_decode() [1/6]

secure_vector< uint8_t > Botan::base64_decode ( const char input[],
size_t input_length,
bool ignore_ws = true )

Perform base64 decoding

Parameters
inputsome base64 input
input_lengththe length of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded base64 output

Definition at line 187 of file base64.cpp.

187 {
188 return base_decode_to_vec<secure_vector<uint8_t>>(Base64(), input, input_length, ignore_ws);
189}

References base_decode_to_vec().

◆ base64_decode() [2/6]

size_t Botan::base64_decode ( std::span< uint8_t > output,
std::string_view input,
bool ignore_ws = true )

Perform base64 decoding

Parameters
outputa contiguous byte buffer of at least base64_decode_max_output bytes
inputsome base64 input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 180 of file base64.cpp.

180 {
181 if(output.size() < base64_decode_max_output(input.size())) {
182 throw Invalid_Argument("base64_decode: output buffer is too short");
183 }
184 return base64_decode(output.data(), input.data(), input.length(), ignore_ws);
185}
Botan::Invalid_Argument
Definition exceptn.h:132

References base64_decode(), and base64_decode_max_output().

◆ base64_decode() [3/6]

secure_vector< uint8_t > Botan::base64_decode ( std::string_view input,
bool ignore_ws = true )

Perform base64 decoding

Parameters
inputsome base64 input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded base64 output

Definition at line 191 of file base64.cpp.

191 {
192 return base64_decode(input.data(), input.size(), ignore_ws);
193}

References base64_decode().

◆ base64_decode() [4/6]

size_t Botan::base64_decode ( uint8_t output[],
const char input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs,
bool ignore_ws = true )

Perform base64 decoding

Parameters
outputan array of at least base64_decode_max_output bytes
inputsome base64 input
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding is allowed
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 167 of file base64.cpp.

168 {
169 return base_decode(Base64(), out, in, input_length, input_consumed, final_inputs, ignore_ws);
170}

References base_decode().

Referenced by argon2_check_pwhash(), base64_decode(), base64_decode(), base64_decode(), botan_base64_decode(), Botan::Roughtime::Chain::Chain(), check_passhash9(), Botan::PEM_Code::decode(), Botan::Base64_Decoder::end_msg(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::list_names(), Botan::Roughtime::servers_from_str(), and Botan::Base64_Decoder::write().

◆ base64_decode() [5/6]

size_t Botan::base64_decode ( uint8_t output[],
const char input[],
size_t input_length,
bool ignore_ws = true )

Perform base64 decoding

Parameters
outputan array of at least base64_decode_max_output bytes
inputsome base64 input
input_lengthlength of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 172 of file base64.cpp.

172 {
173 return base_decode_full(Base64(), output, input, input_length, ignore_ws);
174}

References base_decode_full().

◆ base64_decode() [6/6]

size_t Botan::base64_decode ( uint8_t output[],
std::string_view input,
bool ignore_ws = true )

Perform base64 decoding

Parameters
outputan array of at least base64_decode_max_output bytes
inputsome base64 input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 176 of file base64.cpp.

176 {
177 return base64_decode(output, input.data(), input.length(), ignore_ws);
178}

References base64_decode().

◆ base64_decode_max_output()

size_t Botan::base64_decode_max_output ( size_t input_length)

Calculate the size of output buffer for base64_decode

Parameters
input_lengththe length of input in bytes
Returns
the size of output buffer in bytes

Definition at line 199 of file base64.cpp.

199 {
200 return Base64::decode_max_output(input_length);
201}

Referenced by argon2_check_pwhash(), base64_decode(), and botan_base64_decode().

◆ base64_encode() [1/3]

size_t Botan::base64_encode ( char output[],
const uint8_t input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs )

Perform base64 encoding

Parameters
outputan array of at least base64_encode_max_output bytes
inputis some binary data
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding chars will be applied if needed
Returns
number of bytes written to output

Definition at line 159 of file base64.cpp.

159 {
160 return base_encode(Base64(), out, in, input_length, input_consumed, final_inputs);
161}

References base_encode().

Referenced by argon2_generate_pwhash(), base64_encode(), Botan::OCSP::Request::base64_encode(), botan_base64_encode(), Botan::PEM_Code::encode(), generate_passhash9(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::remove(), Botan::Encrypted_PSK_Database::set(), and Botan::Roughtime::Chain::to_string().

◆ base64_encode() [2/3]

std::string Botan::base64_encode ( const uint8_t input[],
size_t input_length )

Perform base64 encoding

Parameters
inputsome input
input_lengthlength of input in bytes
Returns
base64adecimal representation of input

Definition at line 163 of file base64.cpp.

163 {
164 return base_encode_to_string(Base64(), input, input_length);
165}

References base_encode_to_string().

◆ base64_encode() [3/3]

std::string Botan::base64_encode ( std::span< const uint8_t > input)
inline

Perform base64 encoding

Parameters
inputsome input
Returns
base64adecimal representation of input

Definition at line 47 of file base64.h.

47 {
48 return base64_encode(input.data(), input.size());
49}

References base64_encode().

◆ base64_encode_max_output()

size_t Botan::base64_encode_max_output ( size_t input_length)

Calculate the size of output buffer for base64_encode

Parameters
input_lengththe length of input in bytes
Returns
the size of output buffer in bytes

Definition at line 195 of file base64.cpp.

195 {
196 return Base64::encode_max_output(input_length);
197}

◆ base_decode()

template<typename Base>
size_t Botan::base_decode ( const Base & base,
uint8_t output[],
const char input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs,
bool ignore_ws = true )

Perform decoding using the base provided

Parameters
baseobject giving access to the encodings specifications
outputan array of at least Base::decode_max_output bytes
inputsome base input
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding is allowed
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 118 of file codec_base.h.

124 {
125 // TODO(Botan4) Check if we can use just base. or Base:: here instead
126 constexpr size_t decoding_bytes_in = std::remove_reference_t<Base>::decoding_bytes_in();
127 constexpr size_t decoding_bytes_out = std::remove_reference_t<Base>::decoding_bytes_out();
128
129 uint8_t* out_ptr = output;
130 std::array<uint8_t, decoding_bytes_in> decode_buf{};
131 size_t decode_buf_pos = 0;
132 size_t final_truncate = 0;
133
134 clear_mem(output, base.decode_max_output(input_length));
135
136 for(size_t i = 0; i != input_length; ++i) {
137 const uint8_t bin = base.lookup_binary_value(input[i]);
138
139 // This call might throw Invalid_Argument
140 if(base.check_bad_char(bin, input[i], ignore_ws)) {
141 decode_buf[decode_buf_pos] = bin;
142 ++decode_buf_pos;
143 }
144
145 /*
146 * If we're at the end of the input, pad with 0s and truncate
147 */
148 if(final_inputs && (i == input_length - 1)) {
149 if(decode_buf_pos) {
150 for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) {
151 decode_buf[j] = 0;
152 }
153
154 final_truncate = decoding_bytes_in - decode_buf_pos;
155 decode_buf_pos = decoding_bytes_in;
156 }
157 }
158
159 if(decode_buf_pos == decoding_bytes_in) {
160 base.decode(out_ptr, decode_buf.data());
161
162 out_ptr += decoding_bytes_out;
163 decode_buf_pos = 0;
164 input_consumed = i + 1;
165 }
166 }
167
168 while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) {
169 ++input_consumed;
170 }
171
172 const size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate);
173
174 return written;
175}
Botan::out_ptr
constexpr auto out_ptr(T &outptr) noexcept
Definition stl_util.h:127
Botan::clear_mem
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:118

References clear_mem(), and out_ptr().

Referenced by base32_decode(), base64_decode(), and base_decode_full().

◆ base_decode_full()

template<typename Base>
size_t Botan::base_decode_full ( const Base & base,
uint8_t output[],
const char input[],
size_t input_length,
bool ignore_ws )

Definition at line 178 of file codec_base.h.

178 {
179 size_t consumed = 0;
180 const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws);
181
182 if(consumed != input_length) {
183 throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes");
184 }
185
186 return written;
187}

References base_decode().

Referenced by base32_decode(), base64_decode(), and base_decode_to_vec().

◆ base_decode_to_vec()

template<typename Vector, typename Base>
Vector Botan::base_decode_to_vec ( const Base & base,
const char input[],
size_t input_length,
bool ignore_ws )

Definition at line 190 of file codec_base.h.

190 {
191 const size_t output_length = base.decode_max_output(input_length);
192 Vector bin(output_length);
193
194 const size_t written = base_decode_full(base, bin.data(), input, input_length, ignore_ws);
195
196 bin.resize(written);
197 return bin;
198}

References base_decode_full().

Referenced by base32_decode(), and base64_decode().

◆ base_encode()

template<class Base>
size_t Botan::base_encode ( const Base & base,
char output[],
const uint8_t input[],
size_t input_length,
size_t & input_consumed,
bool final_inputs )

Perform encoding using the base provided

Parameters
baseobject giving access to the encodings specifications
outputan array of at least base.encode_max_output bytes
inputis some binary data
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputstrue iff this is the last input, in which case padding chars will be applied if needed
Returns
number of bytes written to output

Definition at line 35 of file codec_base.h.

40 {
41 input_consumed = 0;
42
43 // TODO(Botan4) Check if we can use just base. or Base:: here instead
44 constexpr size_t encoding_bytes_in = std::remove_reference_t<Base>::encoding_bytes_in();
45 constexpr size_t encoding_bytes_out = std::remove_reference_t<Base>::encoding_bytes_out();
46
47 size_t input_remaining = input_length;
48 size_t output_produced = 0;
49
50 while(input_remaining >= encoding_bytes_in) {
51 base.encode(output + output_produced, input + input_consumed);
52
53 input_consumed += encoding_bytes_in;
54 output_produced += encoding_bytes_out;
55 input_remaining -= encoding_bytes_in;
56 }
57
58 if(final_inputs && input_remaining) {
59 std::array<uint8_t, encoding_bytes_in> remainder{};
60 for(size_t i = 0; i != input_remaining; ++i) {
61 remainder[i] = input[input_consumed + i];
62 }
63
64 base.encode(output + output_produced, remainder.data());
65
66 const size_t bits_consumed = base.bits_consumed();
67 const size_t remaining_bits_before_padding = base.remaining_bits_before_padding();
68
69 size_t empty_bits = 8 * (encoding_bytes_in - input_remaining);
70 size_t index = output_produced + encoding_bytes_out - 1;
71 while(empty_bits >= remaining_bits_before_padding) {
72 output[index--] = '=';
73 empty_bits -= bits_consumed;
74 }
75
76 input_consumed += input_remaining;
77 output_produced += encoding_bytes_out;
78 }
79
80 return output_produced;
81}

Referenced by base32_encode(), base64_encode(), and base_encode_to_string().

◆ base_encode_to_string()

template<typename Base>
std::string Botan::base_encode_to_string ( const Base & base,
const uint8_t input[],
size_t input_length )

Definition at line 84 of file codec_base.h.

84 {
85 const size_t output_length = base.encode_max_output(input_length);
86 std::string output(output_length, 0);
87
88 size_t consumed = 0;
89 size_t produced = 0;
90
91 if(output_length > 0) {
92 produced = base_encode(base, &output.front(), input, input_length, consumed, true);
93 }
94
95 BOTAN_ASSERT_EQUAL(consumed, input_length, "Consumed the entire input");
96 BOTAN_ASSERT_EQUAL(produced, output.size(), "Produced expected size");
97
98 return output;
99}
BOTAN_ASSERT_EQUAL
#define BOTAN_ASSERT_EQUAL(expr1, expr2, assertion_made)
Definition assert.h:88

References base_encode(), and BOTAN_ASSERT_EQUAL.

Referenced by base32_encode(), and base64_encode().

◆ basecase_mul()

void Botan::basecase_mul ( word z[],
size_t z_size,
const word x[],
size_t x_size,
const word y[],
size_t y_size )

Basecase O(N^2) multiplication

Definition at line 20 of file mp_karat.cpp.

20 {
21 if(z_size < x_size + y_size) {
22 throw Invalid_Argument("basecase_mul z_size too small");
23 }
24
25 const size_t x_size_8 = x_size - (x_size % 8);
26
27 zeroize_buffer(z, z_size);
28
29 for(size_t i = 0; i != y_size; ++i) {
30 const word y_i = y[i];
31
32 word carry = 0;
33
34 for(size_t j = 0; j != x_size_8; j += 8) {
35 carry = word8_madd3(z + i + j, x + j, y_i, carry);
36 }
37
38 for(size_t j = x_size_8; j != x_size; ++j) {
39 z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
40 }
41
42 z[x_size + i] = carry;
43 }
44}
Botan::word8_madd3
constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W
Definition mp_asmi.h:423
Botan::zeroize_buffer
void zeroize_buffer(T buf[], size_t n)
Definition mem_utils.h:37
Botan::carry
void carry(int64_t &h0, int64_t &h1)
Definition ed25519_internal.h:27
Botan::word_madd3
constexpr auto word_madd3(W a, W b, W c, W *d) -> W
Definition mp_asmi.h:133

References carry(), word8_madd3(), word_madd3(), and zeroize_buffer().

Referenced by bigint_mul().

◆ basecase_sqr()

void Botan::basecase_sqr ( word z[],
size_t z_size,
const word x[],
size_t x_size )

Basecase O(N^2) squaring

Definition at line 46 of file mp_karat.cpp.

46 {
47 if(z_size < 2 * x_size) {
48 throw Invalid_Argument("basecase_sqr z_size too small");
49 }
50
51 const size_t x_size_8 = x_size - (x_size % 8);
52
53 zeroize_buffer(z, z_size);
54
55 for(size_t i = 0; i != x_size; ++i) {
56 const word x_i = x[i];
57
58 word carry = 0;
59
60 for(size_t j = 0; j != x_size_8; j += 8) {
61 carry = word8_madd3(z + i + j, x + j, x_i, carry);
62 }
63
64 for(size_t j = x_size_8; j != x_size; ++j) {
65 z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
66 }
67
68 z[x_size + i] = carry;
69 }
70}

References carry(), word8_madd3(), word_madd3(), and zeroize_buffer().

Referenced by bigint_sqr().

◆ basemul_booth_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint Botan::basemul_booth_exec ( std::span< const typename C::AffinePoint > table,
const BlindedScalar & scalar,
RandomNumberGenerator & rng )

Definition at line 306 of file pcurves_mul.h.

308 {
309 static constexpr size_t WindowElements = 1 << (WindowBits - 1);
310
311 const size_t windows = (scalar.bits() + WindowBits) / WindowBits;
312
313 auto accum = [&]() {
314 // First window: extract W bits, shift left 1 to insert implicit carry in of zero
315 const size_t w_bits = scalar.get_window(0) & ((1 << WindowBits) - 1);
316 const size_t raw = w_bits << 1;
317 const auto [tidx, tneg] = booth_recode<WindowBits>(raw);
318 const auto tbl_0 = table.first(WindowElements);
319
320 auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, tidx));
321 pt.conditional_assign(tneg, pt.negate());
322 CT::poison(pt);
323 pt.randomize_rep(rng);
324 return pt;
325 }();
326
327 for(size_t i = 1; i != windows; ++i) {
328 // Extract W+1 bits overlapping by 1 with the previous window
329 const size_t bit_pos = WindowBits * i - 1;
330 const size_t raw = scalar.get_window(bit_pos);
331 const auto [tidx, tneg] = booth_recode<WindowBits>(raw);
332
333 const auto tbl_i = table.subspan(WindowElements * i, WindowElements);
334
335 accum = C::ProjectivePoint::add_or_sub(accum, C::AffinePoint::ct_select(tbl_i, tidx), tneg);
336
337 // Conditional ok: loop iteration count is public
338 if(i <= 3) {
339 accum.randomize_rep(rng);
340 }
341 }
342
343 CT::unpoison(accum);
344 return accum;
345}
Botan::CT::unpoison
constexpr void unpoison(const T *p, size_t n)
Definition ct_utils.h:67
Botan::CT::poison
constexpr void poison(const T *p, size_t n)
Definition ct_utils.h:56
Botan::booth_recode
constexpr std::pair< size_t, CT::Choice > booth_recode(T x)
Definition pcurves_mul.h:294

References booth_recode(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by Botan::PrecomputedBaseMulTable< C, W >::mul().

◆ basemul_booth_setup()

template<typename C, size_t WindowBits>
std::vector< typename C::AffinePoint > Botan::basemul_booth_setup ( const typename C::AffinePoint & p,
size_t max_scalar_bits )

Definition at line 254 of file pcurves_mul.h.

254 {
255 static_assert(WindowBits >= 1 && WindowBits <= 8);
256
257 // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
258 constexpr size_t WindowElements = 1 << (WindowBits - 1);
259
260 const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
261
262 const size_t TableSize = Windows * WindowElements;
263
264 std::vector<typename C::ProjectivePoint> table;
265 table.reserve(TableSize);
266
267 auto accum = C::ProjectivePoint::from_affine(p);
268
269 for(size_t i = 0; i != TableSize; i += WindowElements) {
270 table.push_back(accum);
271
272 for(size_t j = 1; j != WindowElements; ++j) {
273 // Conditional ok: loop iteration count is public
274 if(j % 2 == 1) {
275 table.emplace_back(table[i + j / 2].dbl());
276 } else {
277 table.emplace_back(table[i + j - 1] + table[i]);
278 }
279 }
280
281 // Advance to next window's base: 2^W * current_base
282 // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
283 accum = table[i + WindowElements - 1].dbl();
284 }
285
286 // Variable time batch conversion is fine since generator is public
287 return to_affine_batch<C, true>(table);
288}
Botan::to_affine_batch
auto to_affine_batch(std::span< const typename C::ProjectivePoint > projective)
Definition pcurves_algos.h:107

References to_affine_batch().

Referenced by Botan::PrecomputedBaseMulTable< C, W >::PrecomputedBaseMulTable().

◆ basemul_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint Botan::basemul_exec ( std::span< const typename C::AffinePoint > table,
const BlindedScalar & scalar,
RandomNumberGenerator & rng )

Definition at line 200 of file pcurves_mul.h.

202 {
203 // 2^W elements, less the identity element
204 static constexpr size_t WindowElements = (1 << WindowBits) - 1;
205
206 // TODO: C++23 - use std::mdspan to access table?
207
208 auto accum = [&]() {
209 const size_t w_0 = scalar.get_window(0);
210 const auto tbl_0 = table.first(WindowElements);
211 auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, w_0));
212 CT::poison(pt);
213 pt.randomize_rep(rng);
214 return pt;
215 }();
216
217 const size_t windows = (scalar.bits() + WindowBits - 1) / WindowBits;
218
219 for(size_t i = 1; i != windows; ++i) {
220 const size_t w_i = scalar.get_window(WindowBits * i);
221 const auto tbl_i = table.subspan(WindowElements * i, WindowElements);
222
223 /*
224 None of these additions can be doublings, because in each iteration, the
225 discrete logarithms of the points we're selecting out of the table are
226 larger than the largest possible dlog of accum.
227 */
228 accum += C::AffinePoint::ct_select(tbl_i, w_i);
229
230 // Conditional ok: loop iteration count is public
231 if(i <= 3) {
232 accum.randomize_rep(rng);
233 }
234 }
235
236 CT::unpoison(accum);
237 return accum;
238}

References Botan::CT::poison(), and Botan::CT::unpoison().

◆ basemul_setup()

template<typename C, size_t WindowBits>
std::vector< typename C::AffinePoint > Botan::basemul_setup ( const typename C::AffinePoint & p,
size_t max_scalar_bits )

Definition at line 165 of file pcurves_mul.h.

165 {
166 static_assert(WindowBits >= 1 && WindowBits <= 8);
167
168 // 2^W elements, less the identity element
169 constexpr size_t WindowElements = (1 << WindowBits) - 1;
170
171 const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
172
173 const size_t TableSize = Windows * WindowElements;
174
175 std::vector<typename C::ProjectivePoint> table;
176 table.reserve(TableSize);
177
178 auto accum = C::ProjectivePoint::from_affine(p);
179
180 for(size_t i = 0; i != TableSize; i += WindowElements) {
181 table.push_back(accum);
182
183 for(size_t j = 1; j != WindowElements; ++j) {
184 // Conditional ok: loop iteration count is public
185 if(j % 2 == 1) {
186 table.emplace_back(table[i + j / 2].dbl());
187 } else {
188 table.emplace_back(table[i + j - 1] + table[i]);
189 }
190 }
191
192 accum = table[i + (WindowElements / 2)].dbl();
193 }
194
195 // Variable time batch conversion is fine since generator is public
196 return to_affine_batch<C, true>(table);
197}

References to_affine_batch().

◆ bcrypt_pbkdf()

void Botan::bcrypt_pbkdf ( uint8_t output[],
size_t output_len,
const char * password,
size_t password_len,
const uint8_t salt[],
size_t salt_len,
size_t rounds )
inline

Bcrypt PBKDF compatible with OpenBSD bcrypt_pbkdf

Definition at line 71 of file bcrypt_pbkdf.h.

77 {
78 auto pwdhash_fam = PasswordHashFamily::create_or_throw("Bcrypt-PBKDF");
79 auto pwdhash = pwdhash_fam->from_params(rounds);
80 pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len);
81}

References bcrypt_pbkdf(), and Botan::PasswordHashFamily::create_or_throw().

Referenced by bcrypt_pbkdf().

◆ bigint_add2()

template<WordType W>
auto Botan::bigint_add2 ( W x[],
size_t x_size,
const W y[],
size_t y_size )->W
inlineconstexpr

Two operand addition with carry out

Definition at line 94 of file mp_core.h.

94 {
95 W carry = 0;
96
97 BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
98
99 const size_t blocks = y_size - (y_size % 8);
100
101 for(size_t i = 0; i != blocks; i += 8) {
102 carry = word8_add2(x + i, y + i, carry);
103 }
104
105 for(size_t i = blocks; i != y_size; ++i) {
106 x[i] = word_add(x[i], y[i], &carry);
107 }
108
109 for(size_t i = y_size; i != x_size; ++i) {
110 x[i] = word_add(x[i], static_cast<W>(0), &carry);
111 }
112
113 return carry;
114}
BOTAN_ASSERT
#define BOTAN_ASSERT(expr, assertion_made)
Definition assert.h:62
Botan::word_add
constexpr auto word_add(W x, W y, W *carry) -> W
Definition mp_asmi.h:231
Botan::word8_add2
constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W
Definition mp_asmi.h:268

References BOTAN_ASSERT, carry(), word8_add2(), and word_add().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::_invert_vartime_div2_helper(), Botan::BigInt::add(), Botan::BlindedScalarBits< C, WindowBits+1 >::BlindedScalarBits(), p_div_2_plus_1(), and redc_crandall().

◆ bigint_add3()

template<WordType W>
auto Botan::bigint_add3 ( W z[],
const W x[],
size_t x_size,
const W y[],
size_t y_size )->W
inlineconstexpr

Three operand addition with carry out

Definition at line 120 of file mp_core.h.

120 {
121 if(x_size < y_size) {
122 return bigint_add3(z, y, y_size, x, x_size);
123 }
124
125 W carry = 0;
126
127 const size_t blocks = y_size - (y_size % 8);
128
129 for(size_t i = 0; i != blocks; i += 8) {
130 carry = word8_add3(z + i, x + i, y + i, carry);
131 }
132
133 for(size_t i = blocks; i != y_size; ++i) {
134 z[i] = word_add(x[i], y[i], &carry);
135 }
136
137 for(size_t i = y_size; i != x_size; ++i) {
138 z[i] = word_add(x[i], static_cast<W>(0), &carry);
139 }
140
141 return carry;
142}
Botan::bigint_add3
constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
Definition mp_core.h:120
Botan::word8_add3
constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W
Definition mp_asmi.h:294

References bigint_add3(), carry(), word8_add3(), and word_add().

Referenced by Botan::BigInt::add2(), bigint_add3(), Botan::BigInt::mod_add(), Botan::Montgomery_Int::operator+(), and p_plus_1_over_4().

◆ bigint_cmp()

template<WordType W>
int32_t Botan::bigint_cmp ( const W x[],
size_t x_size,
const W y[],
size_t y_size )
inlineconstexpr

Compare x and y Return -1 if x < y Return 0 if x == y Return 1 if x > y

Definition at line 426 of file mp_core.h.

426 {
427 static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption");
428
429 const W LT = static_cast<W>(-1);
430 const W EQ = 0;
431 const W GT = 1;
432
433 const size_t common_elems = std::min(x_size, y_size);
434
435 W result = EQ; // until found otherwise
436
437 for(size_t i = 0; i != common_elems; i++) {
438 const auto is_eq = CT::Mask<W>::is_equal(x[i], y[i]);
439 const auto is_lt = CT::Mask<W>::is_lt(x[i], y[i]);
440
441 result = is_eq.select(result, is_lt.select(LT, GT));
442 }
443
444 if(x_size < y_size) {
445 W mask = 0;
446 for(size_t i = x_size; i != y_size; i++) {
447 mask |= y[i];
448 }
449
450 // If any bits were set in high part of y, then x < y
451 result = CT::Mask<W>::is_zero(mask).select(result, LT);
452 } else if(y_size < x_size) {
453 W mask = 0;
454 for(size_t i = y_size; i != x_size; i++) {
455 mask |= x[i];
456 }
457
458 // If any bits were set in high part of x, then x > y
459 result = CT::Mask<W>::is_zero(mask).select(result, GT);
460 }
461
462 CT::unpoison(result);
463 BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
464 return static_cast<int32_t>(result);
465}
BOTAN_DEBUG_ASSERT
#define BOTAN_DEBUG_ASSERT(expr)
Definition assert.h:129
Botan::CT::Mask::is_equal
static constexpr Mask< T > is_equal(T x, T y)
Definition ct_utils.h:442
Botan::CT::Mask::is_lt
static constexpr Mask< T > is_lt(T x, T y)
Definition ct_utils.h:450
Botan::CT::Mask::is_zero
static constexpr Mask< T > is_zero(T x)
Definition ct_utils.h:437

References BOTAN_DEBUG_ASSERT, Botan::CT::Mask< T >::is_equal(), Botan::CT::Mask< T >::is_lt(), Botan::CT::Mask< T >::is_zero(), and Botan::CT::unpoison().

Referenced by Botan::BigInt::add(), Botan::BigInt::add2(), Botan::BigInt::cmp(), Botan::BigInt::cmp_word(), and gcd().

◆ bigint_cnd_abs()

template<WordType W>
void Botan::bigint_cnd_abs ( W cnd,
W x[],
size_t size )
inlineconstexpr

Definition at line 80 of file mp_core.h.

80 {
81 const auto mask = CT::Mask<W>::expand(cnd);
82
83 W carry = mask.if_set_return(1);
84 for(size_t i = 0; i != size; ++i) {
85 const W z = word_add(~x[i], static_cast<W>(0), &carry);
86 x[i] = mask.select(z, x[i]);
87 }
88}
Botan::CT::Mask::expand
static constexpr Mask< T > expand(T v)
Definition ct_utils.h:392

References carry(), Botan::CT::Mask< T >::expand(), and word_add().

◆ bigint_cnd_add()

template<WordType W>
W Botan::bigint_cnd_add ( W cnd,
W x[],
const W y[],
size_t size )
inlineconstexpr

Definition at line 45 of file mp_core.h.

45 {
46 const auto mask = CT::Mask<W>::expand(cnd).value();
47
48 W carry = 0;
49
50 for(size_t i = 0; i != size; ++i) {
51 x[i] = word_add(x[i], y[i] & mask, &carry);
52 }
53
54 return (mask & carry);
55}

References carry(), Botan::CT::Mask< T >::expand(), and word_add().

Referenced by Botan::BigInt::mod_sub(), and Botan::Montgomery_Int::operator-().

◆ bigint_cnd_sub()

template<WordType W>
auto Botan::bigint_cnd_sub ( W cnd,
W x[],
const W y[],
size_t size )->W
inlineconstexpr

Definition at line 62 of file mp_core.h.

62 {
63 const auto mask = CT::Mask<W>::expand(cnd).value();
64
65 W carry = 0;
66
67 for(size_t i = 0; i != size; ++i) {
68 x[i] = word_sub(x[i], y[i] & mask, &carry);
69 }
70
71 return (mask & carry);
72}
Botan::word_sub
constexpr auto word_sub(W x, W y, W *carry) -> W
Definition mp_asmi.h:320

References carry(), Botan::CT::Mask< T >::expand(), and word_sub().

◆ bigint_cnd_swap()

template<WordType W>
void Botan::bigint_cnd_swap ( W cnd,
W x[],
W y[],
size_t size )
inlineconstexpr

Definition at line 29 of file mp_core.h.

29 {
30 const auto mask = CT::Mask<W>::expand(cnd);
31
32 for(size_t i = 0; i != size; ++i) {
33 const W a = x[i];
34 const W b = y[i];
35 x[i] = mask.select(b, a);
36 y[i] = mask.select(a, b);
37 }
38}

References Botan::CT::Mask< T >::expand().

Referenced by Botan::BigInt::ct_cond_swap(), and ct_divide_pow2k().

◆ bigint_comba_mul16()

BOTAN_FUZZER_API void Botan::bigint_comba_mul16 ( word z[32],
const word x[16],
const word y[16] )

Definition at line 794 of file mp_comba.cpp.

794 {
795 word3<word> accum;
796
797 accum.mul(x[0], y[0]);
798 z[0] = accum.extract();
799 accum.mul(x[0], y[1]);
800 accum.mul(x[1], y[0]);
801 z[1] = accum.extract();
802 accum.mul(x[0], y[2]);
803 accum.mul(x[1], y[1]);
804 accum.mul(x[2], y[0]);
805 z[2] = accum.extract();
806 accum.mul(x[0], y[3]);
807 accum.mul(x[1], y[2]);
808 accum.mul(x[2], y[1]);
809 accum.mul(x[3], y[0]);
810 z[3] = accum.extract();
811 accum.mul(x[0], y[4]);
812 accum.mul(x[1], y[3]);
813 accum.mul(x[2], y[2]);
814 accum.mul(x[3], y[1]);
815 accum.mul(x[4], y[0]);
816 z[4] = accum.extract();
817 accum.mul(x[0], y[5]);
818 accum.mul(x[1], y[4]);
819 accum.mul(x[2], y[3]);
820 accum.mul(x[3], y[2]);
821 accum.mul(x[4], y[1]);
822 accum.mul(x[5], y[0]);
823 z[5] = accum.extract();
824 accum.mul(x[0], y[6]);
825 accum.mul(x[1], y[5]);
826 accum.mul(x[2], y[4]);
827 accum.mul(x[3], y[3]);
828 accum.mul(x[4], y[2]);
829 accum.mul(x[5], y[1]);
830 accum.mul(x[6], y[0]);
831 z[6] = accum.extract();
832 accum.mul(x[0], y[7]);
833 accum.mul(x[1], y[6]);
834 accum.mul(x[2], y[5]);
835 accum.mul(x[3], y[4]);
836 accum.mul(x[4], y[3]);
837 accum.mul(x[5], y[2]);
838 accum.mul(x[6], y[1]);
839 accum.mul(x[7], y[0]);
840 z[7] = accum.extract();
841 accum.mul(x[0], y[8]);
842 accum.mul(x[1], y[7]);
843 accum.mul(x[2], y[6]);
844 accum.mul(x[3], y[5]);
845 accum.mul(x[4], y[4]);
846 accum.mul(x[5], y[3]);
847 accum.mul(x[6], y[2]);
848 accum.mul(x[7], y[1]);
849 accum.mul(x[8], y[0]);
850 z[8] = accum.extract();
851 accum.mul(x[0], y[9]);
852 accum.mul(x[1], y[8]);
853 accum.mul(x[2], y[7]);
854 accum.mul(x[3], y[6]);
855 accum.mul(x[4], y[5]);
856 accum.mul(x[5], y[4]);
857 accum.mul(x[6], y[3]);
858 accum.mul(x[7], y[2]);
859 accum.mul(x[8], y[1]);
860 accum.mul(x[9], y[0]);
861 z[9] = accum.extract();
862 accum.mul(x[0], y[10]);
863 accum.mul(x[1], y[9]);
864 accum.mul(x[2], y[8]);
865 accum.mul(x[3], y[7]);
866 accum.mul(x[4], y[6]);
867 accum.mul(x[5], y[5]);
868 accum.mul(x[6], y[4]);
869 accum.mul(x[7], y[3]);
870 accum.mul(x[8], y[2]);
871 accum.mul(x[9], y[1]);
872 accum.mul(x[10], y[0]);
873 z[10] = accum.extract();
874 accum.mul(x[0], y[11]);
875 accum.mul(x[1], y[10]);
876 accum.mul(x[2], y[9]);
877 accum.mul(x[3], y[8]);
878 accum.mul(x[4], y[7]);
879 accum.mul(x[5], y[6]);
880 accum.mul(x[6], y[5]);
881 accum.mul(x[7], y[4]);
882 accum.mul(x[8], y[3]);
883 accum.mul(x[9], y[2]);
884 accum.mul(x[10], y[1]);
885 accum.mul(x[11], y[0]);
886 z[11] = accum.extract();
887 accum.mul(x[0], y[12]);
888 accum.mul(x[1], y[11]);
889 accum.mul(x[2], y[10]);
890 accum.mul(x[3], y[9]);
891 accum.mul(x[4], y[8]);
892 accum.mul(x[5], y[7]);
893 accum.mul(x[6], y[6]);
894 accum.mul(x[7], y[5]);
895 accum.mul(x[8], y[4]);
896 accum.mul(x[9], y[3]);
897 accum.mul(x[10], y[2]);
898 accum.mul(x[11], y[1]);
899 accum.mul(x[12], y[0]);
900 z[12] = accum.extract();
901 accum.mul(x[0], y[13]);
902 accum.mul(x[1], y[12]);
903 accum.mul(x[2], y[11]);
904 accum.mul(x[3], y[10]);
905 accum.mul(x[4], y[9]);
906 accum.mul(x[5], y[8]);
907 accum.mul(x[6], y[7]);
908 accum.mul(x[7], y[6]);
909 accum.mul(x[8], y[5]);
910 accum.mul(x[9], y[4]);
911 accum.mul(x[10], y[3]);
912 accum.mul(x[11], y[2]);
913 accum.mul(x[12], y[1]);
914 accum.mul(x[13], y[0]);
915 z[13] = accum.extract();
916 accum.mul(x[0], y[14]);
917 accum.mul(x[1], y[13]);
918 accum.mul(x[2], y[12]);
919 accum.mul(x[3], y[11]);
920 accum.mul(x[4], y[10]);
921 accum.mul(x[5], y[9]);
922 accum.mul(x[6], y[8]);
923 accum.mul(x[7], y[7]);
924 accum.mul(x[8], y[6]);
925 accum.mul(x[9], y[5]);
926 accum.mul(x[10], y[4]);
927 accum.mul(x[11], y[3]);
928 accum.mul(x[12], y[2]);
929 accum.mul(x[13], y[1]);
930 accum.mul(x[14], y[0]);
931 z[14] = accum.extract();
932 accum.mul(x[0], y[15]);
933 accum.mul(x[1], y[14]);
934 accum.mul(x[2], y[13]);
935 accum.mul(x[3], y[12]);
936 accum.mul(x[4], y[11]);
937 accum.mul(x[5], y[10]);
938 accum.mul(x[6], y[9]);
939 accum.mul(x[7], y[8]);
940 accum.mul(x[8], y[7]);
941 accum.mul(x[9], y[6]);
942 accum.mul(x[10], y[5]);
943 accum.mul(x[11], y[4]);
944 accum.mul(x[12], y[3]);
945 accum.mul(x[13], y[2]);
946 accum.mul(x[14], y[1]);
947 accum.mul(x[15], y[0]);
948 z[15] = accum.extract();
949 accum.mul(x[1], y[15]);
950 accum.mul(x[2], y[14]);
951 accum.mul(x[3], y[13]);
952 accum.mul(x[4], y[12]);
953 accum.mul(x[5], y[11]);
954 accum.mul(x[6], y[10]);
955 accum.mul(x[7], y[9]);
956 accum.mul(x[8], y[8]);
957 accum.mul(x[9], y[7]);
958 accum.mul(x[10], y[6]);
959 accum.mul(x[11], y[5]);
960 accum.mul(x[12], y[4]);
961 accum.mul(x[13], y[3]);
962 accum.mul(x[14], y[2]);
963 accum.mul(x[15], y[1]);
964 z[16] = accum.extract();
965 accum.mul(x[2], y[15]);
966 accum.mul(x[3], y[14]);
967 accum.mul(x[4], y[13]);
968 accum.mul(x[5], y[12]);
969 accum.mul(x[6], y[11]);
970 accum.mul(x[7], y[10]);
971 accum.mul(x[8], y[9]);
972 accum.mul(x[9], y[8]);
973 accum.mul(x[10], y[7]);
974 accum.mul(x[11], y[6]);
975 accum.mul(x[12], y[5]);
976 accum.mul(x[13], y[4]);
977 accum.mul(x[14], y[3]);
978 accum.mul(x[15], y[2]);
979 z[17] = accum.extract();
980 accum.mul(x[3], y[15]);
981 accum.mul(x[4], y[14]);
982 accum.mul(x[5], y[13]);
983 accum.mul(x[6], y[12]);
984 accum.mul(x[7], y[11]);
985 accum.mul(x[8], y[10]);
986 accum.mul(x[9], y[9]);
987 accum.mul(x[10], y[8]);
988 accum.mul(x[11], y[7]);
989 accum.mul(x[12], y[6]);
990 accum.mul(x[13], y[5]);
991 accum.mul(x[14], y[4]);
992 accum.mul(x[15], y[3]);
993 z[18] = accum.extract();
994 accum.mul(x[4], y[15]);
995 accum.mul(x[5], y[14]);
996 accum.mul(x[6], y[13]);
997 accum.mul(x[7], y[12]);
998 accum.mul(x[8], y[11]);
999 accum.mul(x[9], y[10]);
1000 accum.mul(x[10], y[9]);
1001 accum.mul(x[11], y[8]);
1002 accum.mul(x[12], y[7]);
1003 accum.mul(x[13], y[6]);
1004 accum.mul(x[14], y[5]);
1005 accum.mul(x[15], y[4]);
1006 z[19] = accum.extract();
1007 accum.mul(x[5], y[15]);
1008 accum.mul(x[6], y[14]);
1009 accum.mul(x[7], y[13]);
1010 accum.mul(x[8], y[12]);
1011 accum.mul(x[9], y[11]);
1012 accum.mul(x[10], y[10]);
1013 accum.mul(x[11], y[9]);
1014 accum.mul(x[12], y[8]);
1015 accum.mul(x[13], y[7]);
1016 accum.mul(x[14], y[6]);
1017 accum.mul(x[15], y[5]);
1018 z[20] = accum.extract();
1019 accum.mul(x[6], y[15]);
1020 accum.mul(x[7], y[14]);
1021 accum.mul(x[8], y[13]);
1022 accum.mul(x[9], y[12]);
1023 accum.mul(x[10], y[11]);
1024 accum.mul(x[11], y[10]);
1025 accum.mul(x[12], y[9]);
1026 accum.mul(x[13], y[8]);
1027 accum.mul(x[14], y[7]);
1028 accum.mul(x[15], y[6]);
1029 z[21] = accum.extract();
1030 accum.mul(x[7], y[15]);
1031 accum.mul(x[8], y[14]);
1032 accum.mul(x[9], y[13]);
1033 accum.mul(x[10], y[12]);
1034 accum.mul(x[11], y[11]);
1035 accum.mul(x[12], y[10]);
1036 accum.mul(x[13], y[9]);
1037 accum.mul(x[14], y[8]);
1038 accum.mul(x[15], y[7]);
1039 z[22] = accum.extract();
1040 accum.mul(x[8], y[15]);
1041 accum.mul(x[9], y[14]);
1042 accum.mul(x[10], y[13]);
1043 accum.mul(x[11], y[12]);
1044 accum.mul(x[12], y[11]);
1045 accum.mul(x[13], y[10]);
1046 accum.mul(x[14], y[9]);
1047 accum.mul(x[15], y[8]);
1048 z[23] = accum.extract();
1049 accum.mul(x[9], y[15]);
1050 accum.mul(x[10], y[14]);
1051 accum.mul(x[11], y[13]);
1052 accum.mul(x[12], y[12]);
1053 accum.mul(x[13], y[11]);
1054 accum.mul(x[14], y[10]);
1055 accum.mul(x[15], y[9]);
1056 z[24] = accum.extract();
1057 accum.mul(x[10], y[15]);
1058 accum.mul(x[11], y[14]);
1059 accum.mul(x[12], y[13]);
1060 accum.mul(x[13], y[12]);
1061 accum.mul(x[14], y[11]);
1062 accum.mul(x[15], y[10]);
1063 z[25] = accum.extract();
1064 accum.mul(x[11], y[15]);
1065 accum.mul(x[12], y[14]);
1066 accum.mul(x[13], y[13]);
1067 accum.mul(x[14], y[12]);
1068 accum.mul(x[15], y[11]);
1069 z[26] = accum.extract();
1070 accum.mul(x[12], y[15]);
1071 accum.mul(x[13], y[14]);
1072 accum.mul(x[14], y[13]);
1073 accum.mul(x[15], y[12]);
1074 z[27] = accum.extract();
1075 accum.mul(x[13], y[15]);
1076 accum.mul(x[14], y[14]);
1077 accum.mul(x[15], y[13]);
1078 z[28] = accum.extract();
1079 accum.mul(x[14], y[15]);
1080 accum.mul(x[15], y[14]);
1081 z[29] = accum.extract();
1082 accum.mul(x[15], y[15]);
1083 z[30] = accum.extract();
1084 z[31] = accum.extract();
1085}
Botan::word3::extract
constexpr W extract()
Definition mp_asmi.h:610
Botan::word3::mul
constexpr void mul(W x, W y)
Definition mp_asmi.h:495

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

◆ bigint_comba_mul24()

BOTAN_FUZZER_API void Botan::bigint_comba_mul24 ( word z[48],
const word x[24],
const word y[24] )

Definition at line 1446 of file mp_comba.cpp.

1446 {
1447 word3<word> accum;
1448
1449 accum.mul(x[0], y[0]);
1450 z[0] = accum.extract();
1451 accum.mul(x[0], y[1]);
1452 accum.mul(x[1], y[0]);
1453 z[1] = accum.extract();
1454 accum.mul(x[0], y[2]);
1455 accum.mul(x[1], y[1]);
1456 accum.mul(x[2], y[0]);
1457 z[2] = accum.extract();
1458 accum.mul(x[0], y[3]);
1459 accum.mul(x[1], y[2]);
1460 accum.mul(x[2], y[1]);
1461 accum.mul(x[3], y[0]);
1462 z[3] = accum.extract();
1463 accum.mul(x[0], y[4]);
1464 accum.mul(x[1], y[3]);
1465 accum.mul(x[2], y[2]);
1466 accum.mul(x[3], y[1]);
1467 accum.mul(x[4], y[0]);
1468 z[4] = accum.extract();
1469 accum.mul(x[0], y[5]);
1470 accum.mul(x[1], y[4]);
1471 accum.mul(x[2], y[3]);
1472 accum.mul(x[3], y[2]);
1473 accum.mul(x[4], y[1]);
1474 accum.mul(x[5], y[0]);
1475 z[5] = accum.extract();
1476 accum.mul(x[0], y[6]);
1477 accum.mul(x[1], y[5]);
1478 accum.mul(x[2], y[4]);
1479 accum.mul(x[3], y[3]);
1480 accum.mul(x[4], y[2]);
1481 accum.mul(x[5], y[1]);
1482 accum.mul(x[6], y[0]);
1483 z[6] = accum.extract();
1484 accum.mul(x[0], y[7]);
1485 accum.mul(x[1], y[6]);
1486 accum.mul(x[2], y[5]);
1487 accum.mul(x[3], y[4]);
1488 accum.mul(x[4], y[3]);
1489 accum.mul(x[5], y[2]);
1490 accum.mul(x[6], y[1]);
1491 accum.mul(x[7], y[0]);
1492 z[7] = accum.extract();
1493 accum.mul(x[0], y[8]);
1494 accum.mul(x[1], y[7]);
1495 accum.mul(x[2], y[6]);
1496 accum.mul(x[3], y[5]);
1497 accum.mul(x[4], y[4]);
1498 accum.mul(x[5], y[3]);
1499 accum.mul(x[6], y[2]);
1500 accum.mul(x[7], y[1]);
1501 accum.mul(x[8], y[0]);
1502 z[8] = accum.extract();
1503 accum.mul(x[0], y[9]);
1504 accum.mul(x[1], y[8]);
1505 accum.mul(x[2], y[7]);
1506 accum.mul(x[3], y[6]);
1507 accum.mul(x[4], y[5]);
1508 accum.mul(x[5], y[4]);
1509 accum.mul(x[6], y[3]);
1510 accum.mul(x[7], y[2]);
1511 accum.mul(x[8], y[1]);
1512 accum.mul(x[9], y[0]);
1513 z[9] = accum.extract();
1514 accum.mul(x[0], y[10]);
1515 accum.mul(x[1], y[9]);
1516 accum.mul(x[2], y[8]);
1517 accum.mul(x[3], y[7]);
1518 accum.mul(x[4], y[6]);
1519 accum.mul(x[5], y[5]);
1520 accum.mul(x[6], y[4]);
1521 accum.mul(x[7], y[3]);
1522 accum.mul(x[8], y[2]);
1523 accum.mul(x[9], y[1]);
1524 accum.mul(x[10], y[0]);
1525 z[10] = accum.extract();
1526 accum.mul(x[0], y[11]);
1527 accum.mul(x[1], y[10]);
1528 accum.mul(x[2], y[9]);
1529 accum.mul(x[3], y[8]);
1530 accum.mul(x[4], y[7]);
1531 accum.mul(x[5], y[6]);
1532 accum.mul(x[6], y[5]);
1533 accum.mul(x[7], y[4]);
1534 accum.mul(x[8], y[3]);
1535 accum.mul(x[9], y[2]);
1536 accum.mul(x[10], y[1]);
1537 accum.mul(x[11], y[0]);
1538 z[11] = accum.extract();
1539 accum.mul(x[0], y[12]);
1540 accum.mul(x[1], y[11]);
1541 accum.mul(x[2], y[10]);
1542 accum.mul(x[3], y[9]);
1543 accum.mul(x[4], y[8]);
1544 accum.mul(x[5], y[7]);
1545 accum.mul(x[6], y[6]);
1546 accum.mul(x[7], y[5]);
1547 accum.mul(x[8], y[4]);
1548 accum.mul(x[9], y[3]);
1549 accum.mul(x[10], y[2]);
1550 accum.mul(x[11], y[1]);
1551 accum.mul(x[12], y[0]);
1552 z[12] = accum.extract();
1553 accum.mul(x[0], y[13]);
1554 accum.mul(x[1], y[12]);
1555 accum.mul(x[2], y[11]);
1556 accum.mul(x[3], y[10]);
1557 accum.mul(x[4], y[9]);
1558 accum.mul(x[5], y[8]);
1559 accum.mul(x[6], y[7]);
1560 accum.mul(x[7], y[6]);
1561 accum.mul(x[8], y[5]);
1562 accum.mul(x[9], y[4]);
1563 accum.mul(x[10], y[3]);
1564 accum.mul(x[11], y[2]);
1565 accum.mul(x[12], y[1]);
1566 accum.mul(x[13], y[0]);
1567 z[13] = accum.extract();
1568 accum.mul(x[0], y[14]);
1569 accum.mul(x[1], y[13]);
1570 accum.mul(x[2], y[12]);
1571 accum.mul(x[3], y[11]);
1572 accum.mul(x[4], y[10]);
1573 accum.mul(x[5], y[9]);
1574 accum.mul(x[6], y[8]);
1575 accum.mul(x[7], y[7]);
1576 accum.mul(x[8], y[6]);
1577 accum.mul(x[9], y[5]);
1578 accum.mul(x[10], y[4]);
1579 accum.mul(x[11], y[3]);
1580 accum.mul(x[12], y[2]);
1581 accum.mul(x[13], y[1]);
1582 accum.mul(x[14], y[0]);
1583 z[14] = accum.extract();
1584 accum.mul(x[0], y[15]);
1585 accum.mul(x[1], y[14]);
1586 accum.mul(x[2], y[13]);
1587 accum.mul(x[3], y[12]);
1588 accum.mul(x[4], y[11]);
1589 accum.mul(x[5], y[10]);
1590 accum.mul(x[6], y[9]);
1591 accum.mul(x[7], y[8]);
1592 accum.mul(x[8], y[7]);
1593 accum.mul(x[9], y[6]);
1594 accum.mul(x[10], y[5]);
1595 accum.mul(x[11], y[4]);
1596 accum.mul(x[12], y[3]);
1597 accum.mul(x[13], y[2]);
1598 accum.mul(x[14], y[1]);
1599 accum.mul(x[15], y[0]);
1600 z[15] = accum.extract();
1601 accum.mul(x[0], y[16]);
1602 accum.mul(x[1], y[15]);
1603 accum.mul(x[2], y[14]);
1604 accum.mul(x[3], y[13]);
1605 accum.mul(x[4], y[12]);
1606 accum.mul(x[5], y[11]);
1607 accum.mul(x[6], y[10]);
1608 accum.mul(x[7], y[9]);
1609 accum.mul(x[8], y[8]);
1610 accum.mul(x[9], y[7]);
1611 accum.mul(x[10], y[6]);
1612 accum.mul(x[11], y[5]);
1613 accum.mul(x[12], y[4]);
1614 accum.mul(x[13], y[3]);
1615 accum.mul(x[14], y[2]);
1616 accum.mul(x[15], y[1]);
1617 accum.mul(x[16], y[0]);
1618 z[16] = accum.extract();
1619 accum.mul(x[0], y[17]);
1620 accum.mul(x[1], y[16]);
1621 accum.mul(x[2], y[15]);
1622 accum.mul(x[3], y[14]);
1623 accum.mul(x[4], y[13]);
1624 accum.mul(x[5], y[12]);
1625 accum.mul(x[6], y[11]);
1626 accum.mul(x[7], y[10]);
1627 accum.mul(x[8], y[9]);
1628 accum.mul(x[9], y[8]);
1629 accum.mul(x[10], y[7]);
1630 accum.mul(x[11], y[6]);
1631 accum.mul(x[12], y[5]);
1632 accum.mul(x[13], y[4]);
1633 accum.mul(x[14], y[3]);
1634 accum.mul(x[15], y[2]);
1635 accum.mul(x[16], y[1]);
1636 accum.mul(x[17], y[0]);
1637 z[17] = accum.extract();
1638 accum.mul(x[0], y[18]);
1639 accum.mul(x[1], y[17]);
1640 accum.mul(x[2], y[16]);
1641 accum.mul(x[3], y[15]);
1642 accum.mul(x[4], y[14]);
1643 accum.mul(x[5], y[13]);
1644 accum.mul(x[6], y[12]);
1645 accum.mul(x[7], y[11]);
1646 accum.mul(x[8], y[10]);
1647 accum.mul(x[9], y[9]);
1648 accum.mul(x[10], y[8]);
1649 accum.mul(x[11], y[7]);
1650 accum.mul(x[12], y[6]);
1651 accum.mul(x[13], y[5]);
1652 accum.mul(x[14], y[4]);
1653 accum.mul(x[15], y[3]);
1654 accum.mul(x[16], y[2]);
1655 accum.mul(x[17], y[1]);
1656 accum.mul(x[18], y[0]);
1657 z[18] = accum.extract();
1658 accum.mul(x[0], y[19]);
1659 accum.mul(x[1], y[18]);
1660 accum.mul(x[2], y[17]);
1661 accum.mul(x[3], y[16]);
1662 accum.mul(x[4], y[15]);
1663 accum.mul(x[5], y[14]);
1664 accum.mul(x[6], y[13]);
1665 accum.mul(x[7], y[12]);
1666 accum.mul(x[8], y[11]);
1667 accum.mul(x[9], y[10]);
1668 accum.mul(x[10], y[9]);
1669 accum.mul(x[11], y[8]);
1670 accum.mul(x[12], y[7]);
1671 accum.mul(x[13], y[6]);
1672 accum.mul(x[14], y[5]);
1673 accum.mul(x[15], y[4]);
1674 accum.mul(x[16], y[3]);
1675 accum.mul(x[17], y[2]);
1676 accum.mul(x[18], y[1]);
1677 accum.mul(x[19], y[0]);
1678 z[19] = accum.extract();
1679 accum.mul(x[0], y[20]);
1680 accum.mul(x[1], y[19]);
1681 accum.mul(x[2], y[18]);
1682 accum.mul(x[3], y[17]);
1683 accum.mul(x[4], y[16]);
1684 accum.mul(x[5], y[15]);
1685 accum.mul(x[6], y[14]);
1686 accum.mul(x[7], y[13]);
1687 accum.mul(x[8], y[12]);
1688 accum.mul(x[9], y[11]);
1689 accum.mul(x[10], y[10]);
1690 accum.mul(x[11], y[9]);
1691 accum.mul(x[12], y[8]);
1692 accum.mul(x[13], y[7]);
1693 accum.mul(x[14], y[6]);
1694 accum.mul(x[15], y[5]);
1695 accum.mul(x[16], y[4]);
1696 accum.mul(x[17], y[3]);
1697 accum.mul(x[18], y[2]);
1698 accum.mul(x[19], y[1]);
1699 accum.mul(x[20], y[0]);
1700 z[20] = accum.extract();
1701 accum.mul(x[0], y[21]);
1702 accum.mul(x[1], y[20]);
1703 accum.mul(x[2], y[19]);
1704 accum.mul(x[3], y[18]);
1705 accum.mul(x[4], y[17]);
1706 accum.mul(x[5], y[16]);
1707 accum.mul(x[6], y[15]);
1708 accum.mul(x[7], y[14]);
1709 accum.mul(x[8], y[13]);
1710 accum.mul(x[9], y[12]);
1711 accum.mul(x[10], y[11]);
1712 accum.mul(x[11], y[10]);
1713 accum.mul(x[12], y[9]);
1714 accum.mul(x[13], y[8]);
1715 accum.mul(x[14], y[7]);
1716 accum.mul(x[15], y[6]);
1717 accum.mul(x[16], y[5]);
1718 accum.mul(x[17], y[4]);
1719 accum.mul(x[18], y[3]);
1720 accum.mul(x[19], y[2]);
1721 accum.mul(x[20], y[1]);
1722 accum.mul(x[21], y[0]);
1723 z[21] = accum.extract();
1724 accum.mul(x[0], y[22]);
1725 accum.mul(x[1], y[21]);
1726 accum.mul(x[2], y[20]);
1727 accum.mul(x[3], y[19]);
1728 accum.mul(x[4], y[18]);
1729 accum.mul(x[5], y[17]);
1730 accum.mul(x[6], y[16]);
1731 accum.mul(x[7], y[15]);
1732 accum.mul(x[8], y[14]);
1733 accum.mul(x[9], y[13]);
1734 accum.mul(x[10], y[12]);
1735 accum.mul(x[11], y[11]);
1736 accum.mul(x[12], y[10]);
1737 accum.mul(x[13], y[9]);
1738 accum.mul(x[14], y[8]);
1739 accum.mul(x[15], y[7]);
1740 accum.mul(x[16], y[6]);
1741 accum.mul(x[17], y[5]);
1742 accum.mul(x[18], y[4]);
1743 accum.mul(x[19], y[3]);
1744 accum.mul(x[20], y[2]);
1745 accum.mul(x[21], y[1]);
1746 accum.mul(x[22], y[0]);
1747 z[22] = accum.extract();
1748 accum.mul(x[0], y[23]);
1749 accum.mul(x[1], y[22]);
1750 accum.mul(x[2], y[21]);
1751 accum.mul(x[3], y[20]);
1752 accum.mul(x[4], y[19]);
1753 accum.mul(x[5], y[18]);
1754 accum.mul(x[6], y[17]);
1755 accum.mul(x[7], y[16]);
1756 accum.mul(x[8], y[15]);
1757 accum.mul(x[9], y[14]);
1758 accum.mul(x[10], y[13]);
1759 accum.mul(x[11], y[12]);
1760 accum.mul(x[12], y[11]);
1761 accum.mul(x[13], y[10]);
1762 accum.mul(x[14], y[9]);
1763 accum.mul(x[15], y[8]);
1764 accum.mul(x[16], y[7]);
1765 accum.mul(x[17], y[6]);
1766 accum.mul(x[18], y[5]);
1767 accum.mul(x[19], y[4]);
1768 accum.mul(x[20], y[3]);
1769 accum.mul(x[21], y[2]);
1770 accum.mul(x[22], y[1]);
1771 accum.mul(x[23], y[0]);
1772 z[23] = accum.extract();
1773 accum.mul(x[1], y[23]);
1774 accum.mul(x[2], y[22]);
1775 accum.mul(x[3], y[21]);
1776 accum.mul(x[4], y[20]);
1777 accum.mul(x[5], y[19]);
1778 accum.mul(x[6], y[18]);
1779 accum.mul(x[7], y[17]);
1780 accum.mul(x[8], y[16]);
1781 accum.mul(x[9], y[15]);
1782 accum.mul(x[10], y[14]);
1783 accum.mul(x[11], y[13]);
1784 accum.mul(x[12], y[12]);
1785 accum.mul(x[13], y[11]);
1786 accum.mul(x[14], y[10]);
1787 accum.mul(x[15], y[9]);
1788 accum.mul(x[16], y[8]);
1789 accum.mul(x[17], y[7]);
1790 accum.mul(x[18], y[6]);
1791 accum.mul(x[19], y[5]);
1792 accum.mul(x[20], y[4]);
1793 accum.mul(x[21], y[3]);
1794 accum.mul(x[22], y[2]);
1795 accum.mul(x[23], y[1]);
1796 z[24] = accum.extract();
1797 accum.mul(x[2], y[23]);
1798 accum.mul(x[3], y[22]);
1799 accum.mul(x[4], y[21]);
1800 accum.mul(x[5], y[20]);
1801 accum.mul(x[6], y[19]);
1802 accum.mul(x[7], y[18]);
1803 accum.mul(x[8], y[17]);
1804 accum.mul(x[9], y[16]);
1805 accum.mul(x[10], y[15]);
1806 accum.mul(x[11], y[14]);
1807 accum.mul(x[12], y[13]);
1808 accum.mul(x[13], y[12]);
1809 accum.mul(x[14], y[11]);
1810 accum.mul(x[15], y[10]);
1811 accum.mul(x[16], y[9]);
1812 accum.mul(x[17], y[8]);
1813 accum.mul(x[18], y[7]);
1814 accum.mul(x[19], y[6]);
1815 accum.mul(x[20], y[5]);
1816 accum.mul(x[21], y[4]);
1817 accum.mul(x[22], y[3]);
1818 accum.mul(x[23], y[2]);
1819 z[25] = accum.extract();
1820 accum.mul(x[3], y[23]);
1821 accum.mul(x[4], y[22]);
1822 accum.mul(x[5], y[21]);
1823 accum.mul(x[6], y[20]);
1824 accum.mul(x[7], y[19]);
1825 accum.mul(x[8], y[18]);
1826 accum.mul(x[9], y[17]);
1827 accum.mul(x[10], y[16]);
1828 accum.mul(x[11], y[15]);
1829 accum.mul(x[12], y[14]);
1830 accum.mul(x[13], y[13]);
1831 accum.mul(x[14], y[12]);
1832 accum.mul(x[15], y[11]);
1833 accum.mul(x[16], y[10]);
1834 accum.mul(x[17], y[9]);
1835 accum.mul(x[18], y[8]);
1836 accum.mul(x[19], y[7]);
1837 accum.mul(x[20], y[6]);
1838 accum.mul(x[21], y[5]);
1839 accum.mul(x[22], y[4]);
1840 accum.mul(x[23], y[3]);
1841 z[26] = accum.extract();
1842 accum.mul(x[4], y[23]);
1843 accum.mul(x[5], y[22]);
1844 accum.mul(x[6], y[21]);
1845 accum.mul(x[7], y[20]);
1846 accum.mul(x[8], y[19]);
1847 accum.mul(x[9], y[18]);
1848 accum.mul(x[10], y[17]);
1849 accum.mul(x[11], y[16]);
1850 accum.mul(x[12], y[15]);
1851 accum.mul(x[13], y[14]);
1852 accum.mul(x[14], y[13]);
1853 accum.mul(x[15], y[12]);
1854 accum.mul(x[16], y[11]);
1855 accum.mul(x[17], y[10]);
1856 accum.mul(x[18], y[9]);
1857 accum.mul(x[19], y[8]);
1858 accum.mul(x[20], y[7]);
1859 accum.mul(x[21], y[6]);
1860 accum.mul(x[22], y[5]);
1861 accum.mul(x[23], y[4]);
1862 z[27] = accum.extract();
1863 accum.mul(x[5], y[23]);
1864 accum.mul(x[6], y[22]);
1865 accum.mul(x[7], y[21]);
1866 accum.mul(x[8], y[20]);
1867 accum.mul(x[9], y[19]);
1868 accum.mul(x[10], y[18]);
1869 accum.mul(x[11], y[17]);
1870 accum.mul(x[12], y[16]);
1871 accum.mul(x[13], y[15]);
1872 accum.mul(x[14], y[14]);
1873 accum.mul(x[15], y[13]);
1874 accum.mul(x[16], y[12]);
1875 accum.mul(x[17], y[11]);
1876 accum.mul(x[18], y[10]);
1877 accum.mul(x[19], y[9]);
1878 accum.mul(x[20], y[8]);
1879 accum.mul(x[21], y[7]);
1880 accum.mul(x[22], y[6]);
1881 accum.mul(x[23], y[5]);
1882 z[28] = accum.extract();
1883 accum.mul(x[6], y[23]);
1884 accum.mul(x[7], y[22]);
1885 accum.mul(x[8], y[21]);
1886 accum.mul(x[9], y[20]);
1887 accum.mul(x[10], y[19]);
1888 accum.mul(x[11], y[18]);
1889 accum.mul(x[12], y[17]);
1890 accum.mul(x[13], y[16]);
1891 accum.mul(x[14], y[15]);
1892 accum.mul(x[15], y[14]);
1893 accum.mul(x[16], y[13]);
1894 accum.mul(x[17], y[12]);
1895 accum.mul(x[18], y[11]);
1896 accum.mul(x[19], y[10]);
1897 accum.mul(x[20], y[9]);
1898 accum.mul(x[21], y[8]);
1899 accum.mul(x[22], y[7]);
1900 accum.mul(x[23], y[6]);
1901 z[29] = accum.extract();
1902 accum.mul(x[7], y[23]);
1903 accum.mul(x[8], y[22]);
1904 accum.mul(x[9], y[21]);
1905 accum.mul(x[10], y[20]);
1906 accum.mul(x[11], y[19]);
1907 accum.mul(x[12], y[18]);
1908 accum.mul(x[13], y[17]);
1909 accum.mul(x[14], y[16]);
1910 accum.mul(x[15], y[15]);
1911 accum.mul(x[16], y[14]);
1912 accum.mul(x[17], y[13]);
1913 accum.mul(x[18], y[12]);
1914 accum.mul(x[19], y[11]);
1915 accum.mul(x[20], y[10]);
1916 accum.mul(x[21], y[9]);
1917 accum.mul(x[22], y[8]);
1918 accum.mul(x[23], y[7]);
1919 z[30] = accum.extract();
1920 accum.mul(x[8], y[23]);
1921 accum.mul(x[9], y[22]);
1922 accum.mul(x[10], y[21]);
1923 accum.mul(x[11], y[20]);
1924 accum.mul(x[12], y[19]);
1925 accum.mul(x[13], y[18]);
1926 accum.mul(x[14], y[17]);
1927 accum.mul(x[15], y[16]);
1928 accum.mul(x[16], y[15]);
1929 accum.mul(x[17], y[14]);
1930 accum.mul(x[18], y[13]);
1931 accum.mul(x[19], y[12]);
1932 accum.mul(x[20], y[11]);
1933 accum.mul(x[21], y[10]);
1934 accum.mul(x[22], y[9]);
1935 accum.mul(x[23], y[8]);
1936 z[31] = accum.extract();
1937 accum.mul(x[9], y[23]);
1938 accum.mul(x[10], y[22]);
1939 accum.mul(x[11], y[21]);
1940 accum.mul(x[12], y[20]);
1941 accum.mul(x[13], y[19]);
1942 accum.mul(x[14], y[18]);
1943 accum.mul(x[15], y[17]);
1944 accum.mul(x[16], y[16]);
1945 accum.mul(x[17], y[15]);
1946 accum.mul(x[18], y[14]);
1947 accum.mul(x[19], y[13]);
1948 accum.mul(x[20], y[12]);
1949 accum.mul(x[21], y[11]);
1950 accum.mul(x[22], y[10]);
1951 accum.mul(x[23], y[9]);
1952 z[32] = accum.extract();
1953 accum.mul(x[10], y[23]);
1954 accum.mul(x[11], y[22]);
1955 accum.mul(x[12], y[21]);
1956 accum.mul(x[13], y[20]);
1957 accum.mul(x[14], y[19]);
1958 accum.mul(x[15], y[18]);
1959 accum.mul(x[16], y[17]);
1960 accum.mul(x[17], y[16]);
1961 accum.mul(x[18], y[15]);
1962 accum.mul(x[19], y[14]);
1963 accum.mul(x[20], y[13]);
1964 accum.mul(x[21], y[12]);
1965 accum.mul(x[22], y[11]);
1966 accum.mul(x[23], y[10]);
1967 z[33] = accum.extract();
1968 accum.mul(x[11], y[23]);
1969 accum.mul(x[12], y[22]);
1970 accum.mul(x[13], y[21]);
1971 accum.mul(x[14], y[20]);
1972 accum.mul(x[15], y[19]);
1973 accum.mul(x[16], y[18]);
1974 accum.mul(x[17], y[17]);
1975 accum.mul(x[18], y[16]);
1976 accum.mul(x[19], y[15]);
1977 accum.mul(x[20], y[14]);
1978 accum.mul(x[21], y[13]);
1979 accum.mul(x[22], y[12]);
1980 accum.mul(x[23], y[11]);
1981 z[34] = accum.extract();
1982 accum.mul(x[12], y[23]);
1983 accum.mul(x[13], y[22]);
1984 accum.mul(x[14], y[21]);
1985 accum.mul(x[15], y[20]);
1986 accum.mul(x[16], y[19]);
1987 accum.mul(x[17], y[18]);
1988 accum.mul(x[18], y[17]);
1989 accum.mul(x[19], y[16]);
1990 accum.mul(x[20], y[15]);
1991 accum.mul(x[21], y[14]);
1992 accum.mul(x[22], y[13]);
1993 accum.mul(x[23], y[12]);
1994 z[35] = accum.extract();
1995 accum.mul(x[13], y[23]);
1996 accum.mul(x[14], y[22]);
1997 accum.mul(x[15], y[21]);
1998 accum.mul(x[16], y[20]);
1999 accum.mul(x[17], y[19]);
2000 accum.mul(x[18], y[18]);
2001 accum.mul(x[19], y[17]);
2002 accum.mul(x[20], y[16]);
2003 accum.mul(x[21], y[15]);
2004 accum.mul(x[22], y[14]);
2005 accum.mul(x[23], y[13]);
2006 z[36] = accum.extract();
2007 accum.mul(x[14], y[23]);
2008 accum.mul(x[15], y[22]);
2009 accum.mul(x[16], y[21]);
2010 accum.mul(x[17], y[20]);
2011 accum.mul(x[18], y[19]);
2012 accum.mul(x[19], y[18]);
2013 accum.mul(x[20], y[17]);
2014 accum.mul(x[21], y[16]);
2015 accum.mul(x[22], y[15]);
2016 accum.mul(x[23], y[14]);
2017 z[37] = accum.extract();
2018 accum.mul(x[15], y[23]);
2019 accum.mul(x[16], y[22]);
2020 accum.mul(x[17], y[21]);
2021 accum.mul(x[18], y[20]);
2022 accum.mul(x[19], y[19]);
2023 accum.mul(x[20], y[18]);
2024 accum.mul(x[21], y[17]);
2025 accum.mul(x[22], y[16]);
2026 accum.mul(x[23], y[15]);
2027 z[38] = accum.extract();
2028 accum.mul(x[16], y[23]);
2029 accum.mul(x[17], y[22]);
2030 accum.mul(x[18], y[21]);
2031 accum.mul(x[19], y[20]);
2032 accum.mul(x[20], y[19]);
2033 accum.mul(x[21], y[18]);
2034 accum.mul(x[22], y[17]);
2035 accum.mul(x[23], y[16]);
2036 z[39] = accum.extract();
2037 accum.mul(x[17], y[23]);
2038 accum.mul(x[18], y[22]);
2039 accum.mul(x[19], y[21]);
2040 accum.mul(x[20], y[20]);
2041 accum.mul(x[21], y[19]);
2042 accum.mul(x[22], y[18]);
2043 accum.mul(x[23], y[17]);
2044 z[40] = accum.extract();
2045 accum.mul(x[18], y[23]);
2046 accum.mul(x[19], y[22]);
2047 accum.mul(x[20], y[21]);
2048 accum.mul(x[21], y[20]);
2049 accum.mul(x[22], y[19]);
2050 accum.mul(x[23], y[18]);
2051 z[41] = accum.extract();
2052 accum.mul(x[19], y[23]);
2053 accum.mul(x[20], y[22]);
2054 accum.mul(x[21], y[21]);
2055 accum.mul(x[22], y[20]);
2056 accum.mul(x[23], y[19]);
2057 z[42] = accum.extract();
2058 accum.mul(x[20], y[23]);
2059 accum.mul(x[21], y[22]);
2060 accum.mul(x[22], y[21]);
2061 accum.mul(x[23], y[20]);
2062 z[43] = accum.extract();
2063 accum.mul(x[21], y[23]);
2064 accum.mul(x[22], y[22]);
2065 accum.mul(x[23], y[21]);
2066 z[44] = accum.extract();
2067 accum.mul(x[22], y[23]);
2068 accum.mul(x[23], y[22]);
2069 z[45] = accum.extract();
2070 accum.mul(x[23], y[23]);
2071 z[46] = accum.extract();
2072 z[47] = accum.extract();
2073}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul().

◆ bigint_comba_mul4()

BOTAN_FUZZER_API void Botan::bigint_comba_mul4 ( word z[8],
const word x[4],
const word y[4] )

Definition at line 42 of file mp_comba.cpp.

42 {
43 word3<word> accum;
44
45 accum.mul(x[0], y[0]);
46 z[0] = accum.extract();
47 accum.mul(x[0], y[1]);
48 accum.mul(x[1], y[0]);
49 z[1] = accum.extract();
50 accum.mul(x[0], y[2]);
51 accum.mul(x[1], y[1]);
52 accum.mul(x[2], y[0]);
53 z[2] = accum.extract();
54 accum.mul(x[0], y[3]);
55 accum.mul(x[1], y[2]);
56 accum.mul(x[2], y[1]);
57 accum.mul(x[3], y[0]);
58 z[3] = accum.extract();
59 accum.mul(x[1], y[3]);
60 accum.mul(x[2], y[2]);
61 accum.mul(x[3], y[1]);
62 z[4] = accum.extract();
63 accum.mul(x[2], y[3]);
64 accum.mul(x[3], y[2]);
65 z[5] = accum.extract();
66 accum.mul(x[3], y[3]);
67 z[6] = accum.extract();
68 z[7] = accum.extract();
69}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

◆ bigint_comba_mul6()

BOTAN_FUZZER_API void Botan::bigint_comba_mul6 ( word z[12],
const word x[6],
const word y[6] )

Definition at line 115 of file mp_comba.cpp.

115 {
116 word3<word> accum;
117
118 accum.mul(x[0], y[0]);
119 z[0] = accum.extract();
120 accum.mul(x[0], y[1]);
121 accum.mul(x[1], y[0]);
122 z[1] = accum.extract();
123 accum.mul(x[0], y[2]);
124 accum.mul(x[1], y[1]);
125 accum.mul(x[2], y[0]);
126 z[2] = accum.extract();
127 accum.mul(x[0], y[3]);
128 accum.mul(x[1], y[2]);
129 accum.mul(x[2], y[1]);
130 accum.mul(x[3], y[0]);
131 z[3] = accum.extract();
132 accum.mul(x[0], y[4]);
133 accum.mul(x[1], y[3]);
134 accum.mul(x[2], y[2]);
135 accum.mul(x[3], y[1]);
136 accum.mul(x[4], y[0]);
137 z[4] = accum.extract();
138 accum.mul(x[0], y[5]);
139 accum.mul(x[1], y[4]);
140 accum.mul(x[2], y[3]);
141 accum.mul(x[3], y[2]);
142 accum.mul(x[4], y[1]);
143 accum.mul(x[5], y[0]);
144 z[5] = accum.extract();
145 accum.mul(x[1], y[5]);
146 accum.mul(x[2], y[4]);
147 accum.mul(x[3], y[3]);
148 accum.mul(x[4], y[2]);
149 accum.mul(x[5], y[1]);
150 z[6] = accum.extract();
151 accum.mul(x[2], y[5]);
152 accum.mul(x[3], y[4]);
153 accum.mul(x[4], y[3]);
154 accum.mul(x[5], y[2]);
155 z[7] = accum.extract();
156 accum.mul(x[3], y[5]);
157 accum.mul(x[4], y[4]);
158 accum.mul(x[5], y[3]);
159 z[8] = accum.extract();
160 accum.mul(x[4], y[5]);
161 accum.mul(x[5], y[4]);
162 z[9] = accum.extract();
163 accum.mul(x[5], y[5]);
164 z[10] = accum.extract();
165 z[11] = accum.extract();
166}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

◆ bigint_comba_mul7()

BOTAN_FUZZER_API void Botan::bigint_comba_mul7 ( word z[14],
const word x[7],
const word y[7] )

Definition at line 221 of file mp_comba.cpp.

221 {
222 word3<word> accum;
223
224 accum.mul(x[0], y[0]);
225 z[0] = accum.extract();
226 accum.mul(x[0], y[1]);
227 accum.mul(x[1], y[0]);
228 z[1] = accum.extract();
229 accum.mul(x[0], y[2]);
230 accum.mul(x[1], y[1]);
231 accum.mul(x[2], y[0]);
232 z[2] = accum.extract();
233 accum.mul(x[0], y[3]);
234 accum.mul(x[1], y[2]);
235 accum.mul(x[2], y[1]);
236 accum.mul(x[3], y[0]);
237 z[3] = accum.extract();
238 accum.mul(x[0], y[4]);
239 accum.mul(x[1], y[3]);
240 accum.mul(x[2], y[2]);
241 accum.mul(x[3], y[1]);
242 accum.mul(x[4], y[0]);
243 z[4] = accum.extract();
244 accum.mul(x[0], y[5]);
245 accum.mul(x[1], y[4]);
246 accum.mul(x[2], y[3]);
247 accum.mul(x[3], y[2]);
248 accum.mul(x[4], y[1]);
249 accum.mul(x[5], y[0]);
250 z[5] = accum.extract();
251 accum.mul(x[0], y[6]);
252 accum.mul(x[1], y[5]);
253 accum.mul(x[2], y[4]);
254 accum.mul(x[3], y[3]);
255 accum.mul(x[4], y[2]);
256 accum.mul(x[5], y[1]);
257 accum.mul(x[6], y[0]);
258 z[6] = accum.extract();
259 accum.mul(x[1], y[6]);
260 accum.mul(x[2], y[5]);
261 accum.mul(x[3], y[4]);
262 accum.mul(x[4], y[3]);
263 accum.mul(x[5], y[2]);
264 accum.mul(x[6], y[1]);
265 z[7] = accum.extract();
266 accum.mul(x[2], y[6]);
267 accum.mul(x[3], y[5]);
268 accum.mul(x[4], y[4]);
269 accum.mul(x[5], y[3]);
270 accum.mul(x[6], y[2]);
271 z[8] = accum.extract();
272 accum.mul(x[3], y[6]);
273 accum.mul(x[4], y[5]);
274 accum.mul(x[5], y[4]);
275 accum.mul(x[6], y[3]);
276 z[9] = accum.extract();
277 accum.mul(x[4], y[6]);
278 accum.mul(x[5], y[5]);
279 accum.mul(x[6], y[4]);
280 z[10] = accum.extract();
281 accum.mul(x[5], y[6]);
282 accum.mul(x[6], y[5]);
283 z[11] = accum.extract();
284 accum.mul(x[6], y[6]);
285 z[12] = accum.extract();
286 z[13] = accum.extract();
287}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by comba_mul().

◆ bigint_comba_mul8()

BOTAN_FUZZER_API void Botan::bigint_comba_mul8 ( word z[16],
const word x[8],
const word y[8] )

Definition at line 352 of file mp_comba.cpp.

352 {
353 word3<word> accum;
354
355 accum.mul(x[0], y[0]);
356 z[0] = accum.extract();
357 accum.mul(x[0], y[1]);
358 accum.mul(x[1], y[0]);
359 z[1] = accum.extract();
360 accum.mul(x[0], y[2]);
361 accum.mul(x[1], y[1]);
362 accum.mul(x[2], y[0]);
363 z[2] = accum.extract();
364 accum.mul(x[0], y[3]);
365 accum.mul(x[1], y[2]);
366 accum.mul(x[2], y[1]);
367 accum.mul(x[3], y[0]);
368 z[3] = accum.extract();
369 accum.mul(x[0], y[4]);
370 accum.mul(x[1], y[3]);
371 accum.mul(x[2], y[2]);
372 accum.mul(x[3], y[1]);
373 accum.mul(x[4], y[0]);
374 z[4] = accum.extract();
375 accum.mul(x[0], y[5]);
376 accum.mul(x[1], y[4]);
377 accum.mul(x[2], y[3]);
378 accum.mul(x[3], y[2]);
379 accum.mul(x[4], y[1]);
380 accum.mul(x[5], y[0]);
381 z[5] = accum.extract();
382 accum.mul(x[0], y[6]);
383 accum.mul(x[1], y[5]);
384 accum.mul(x[2], y[4]);
385 accum.mul(x[3], y[3]);
386 accum.mul(x[4], y[2]);
387 accum.mul(x[5], y[1]);
388 accum.mul(x[6], y[0]);
389 z[6] = accum.extract();
390 accum.mul(x[0], y[7]);
391 accum.mul(x[1], y[6]);
392 accum.mul(x[2], y[5]);
393 accum.mul(x[3], y[4]);
394 accum.mul(x[4], y[3]);
395 accum.mul(x[5], y[2]);
396 accum.mul(x[6], y[1]);
397 accum.mul(x[7], y[0]);
398 z[7] = accum.extract();
399 accum.mul(x[1], y[7]);
400 accum.mul(x[2], y[6]);
401 accum.mul(x[3], y[5]);
402 accum.mul(x[4], y[4]);
403 accum.mul(x[5], y[3]);
404 accum.mul(x[6], y[2]);
405 accum.mul(x[7], y[1]);
406 z[8] = accum.extract();
407 accum.mul(x[2], y[7]);
408 accum.mul(x[3], y[6]);
409 accum.mul(x[4], y[5]);
410 accum.mul(x[5], y[4]);
411 accum.mul(x[6], y[3]);
412 accum.mul(x[7], y[2]);
413 z[9] = accum.extract();
414 accum.mul(x[3], y[7]);
415 accum.mul(x[4], y[6]);
416 accum.mul(x[5], y[5]);
417 accum.mul(x[6], y[4]);
418 accum.mul(x[7], y[3]);
419 z[10] = accum.extract();
420 accum.mul(x[4], y[7]);
421 accum.mul(x[5], y[6]);
422 accum.mul(x[6], y[5]);
423 accum.mul(x[7], y[4]);
424 z[11] = accum.extract();
425 accum.mul(x[5], y[7]);
426 accum.mul(x[6], y[6]);
427 accum.mul(x[7], y[5]);
428 z[12] = accum.extract();
429 accum.mul(x[6], y[7]);
430 accum.mul(x[7], y[6]);
431 z[13] = accum.extract();
432 accum.mul(x[7], y[7]);
433 z[14] = accum.extract();
434 z[15] = accum.extract();
435}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

◆ bigint_comba_mul9()

BOTAN_FUZZER_API void Botan::bigint_comba_mul9 ( word z[18],
const word x[9],
const word y[9] )

Definition at line 511 of file mp_comba.cpp.

511 {
512 word3<word> accum;
513
514 accum.mul(x[0], y[0]);
515 z[0] = accum.extract();
516 accum.mul(x[0], y[1]);
517 accum.mul(x[1], y[0]);
518 z[1] = accum.extract();
519 accum.mul(x[0], y[2]);
520 accum.mul(x[1], y[1]);
521 accum.mul(x[2], y[0]);
522 z[2] = accum.extract();
523 accum.mul(x[0], y[3]);
524 accum.mul(x[1], y[2]);
525 accum.mul(x[2], y[1]);
526 accum.mul(x[3], y[0]);
527 z[3] = accum.extract();
528 accum.mul(x[0], y[4]);
529 accum.mul(x[1], y[3]);
530 accum.mul(x[2], y[2]);
531 accum.mul(x[3], y[1]);
532 accum.mul(x[4], y[0]);
533 z[4] = accum.extract();
534 accum.mul(x[0], y[5]);
535 accum.mul(x[1], y[4]);
536 accum.mul(x[2], y[3]);
537 accum.mul(x[3], y[2]);
538 accum.mul(x[4], y[1]);
539 accum.mul(x[5], y[0]);
540 z[5] = accum.extract();
541 accum.mul(x[0], y[6]);
542 accum.mul(x[1], y[5]);
543 accum.mul(x[2], y[4]);
544 accum.mul(x[3], y[3]);
545 accum.mul(x[4], y[2]);
546 accum.mul(x[5], y[1]);
547 accum.mul(x[6], y[0]);
548 z[6] = accum.extract();
549 accum.mul(x[0], y[7]);
550 accum.mul(x[1], y[6]);
551 accum.mul(x[2], y[5]);
552 accum.mul(x[3], y[4]);
553 accum.mul(x[4], y[3]);
554 accum.mul(x[5], y[2]);
555 accum.mul(x[6], y[1]);
556 accum.mul(x[7], y[0]);
557 z[7] = accum.extract();
558 accum.mul(x[0], y[8]);
559 accum.mul(x[1], y[7]);
560 accum.mul(x[2], y[6]);
561 accum.mul(x[3], y[5]);
562 accum.mul(x[4], y[4]);
563 accum.mul(x[5], y[3]);
564 accum.mul(x[6], y[2]);
565 accum.mul(x[7], y[1]);
566 accum.mul(x[8], y[0]);
567 z[8] = accum.extract();
568 accum.mul(x[1], y[8]);
569 accum.mul(x[2], y[7]);
570 accum.mul(x[3], y[6]);
571 accum.mul(x[4], y[5]);
572 accum.mul(x[5], y[4]);
573 accum.mul(x[6], y[3]);
574 accum.mul(x[7], y[2]);
575 accum.mul(x[8], y[1]);
576 z[9] = accum.extract();
577 accum.mul(x[2], y[8]);
578 accum.mul(x[3], y[7]);
579 accum.mul(x[4], y[6]);
580 accum.mul(x[5], y[5]);
581 accum.mul(x[6], y[4]);
582 accum.mul(x[7], y[3]);
583 accum.mul(x[8], y[2]);
584 z[10] = accum.extract();
585 accum.mul(x[3], y[8]);
586 accum.mul(x[4], y[7]);
587 accum.mul(x[5], y[6]);
588 accum.mul(x[6], y[5]);
589 accum.mul(x[7], y[4]);
590 accum.mul(x[8], y[3]);
591 z[11] = accum.extract();
592 accum.mul(x[4], y[8]);
593 accum.mul(x[5], y[7]);
594 accum.mul(x[6], y[6]);
595 accum.mul(x[7], y[5]);
596 accum.mul(x[8], y[4]);
597 z[12] = accum.extract();
598 accum.mul(x[5], y[8]);
599 accum.mul(x[6], y[7]);
600 accum.mul(x[7], y[6]);
601 accum.mul(x[8], y[5]);
602 z[13] = accum.extract();
603 accum.mul(x[6], y[8]);
604 accum.mul(x[7], y[7]);
605 accum.mul(x[8], y[6]);
606 z[14] = accum.extract();
607 accum.mul(x[7], y[8]);
608 accum.mul(x[8], y[7]);
609 z[15] = accum.extract();
610 accum.mul(x[8], y[8]);
611 z[16] = accum.extract();
612 z[17] = accum.extract();
613}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

◆ bigint_comba_sqr16()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr16 ( word z[32],
const word x[16] )

Definition at line 618 of file mp_comba.cpp.

618 {
619 word3<word> accum;
620
621 accum.mul(x[0], x[0]);
622 z[0] = accum.extract();
623 accum.mul_x2(x[0], x[1]);
624 z[1] = accum.extract();
625 accum.mul_x2(x[0], x[2]);
626 accum.mul(x[1], x[1]);
627 z[2] = accum.extract();
628 accum.mul_x2(x[0], x[3]);
629 accum.mul_x2(x[1], x[2]);
630 z[3] = accum.extract();
631 accum.mul_x2(x[0], x[4]);
632 accum.mul_x2(x[1], x[3]);
633 accum.mul(x[2], x[2]);
634 z[4] = accum.extract();
635 accum.mul_x2(x[0], x[5]);
636 accum.mul_x2(x[1], x[4]);
637 accum.mul_x2(x[2], x[3]);
638 z[5] = accum.extract();
639 accum.mul_x2(x[0], x[6]);
640 accum.mul_x2(x[1], x[5]);
641 accum.mul_x2(x[2], x[4]);
642 accum.mul(x[3], x[3]);
643 z[6] = accum.extract();
644 accum.mul_x2(x[0], x[7]);
645 accum.mul_x2(x[1], x[6]);
646 accum.mul_x2(x[2], x[5]);
647 accum.mul_x2(x[3], x[4]);
648 z[7] = accum.extract();
649 accum.mul_x2(x[0], x[8]);
650 accum.mul_x2(x[1], x[7]);
651 accum.mul_x2(x[2], x[6]);
652 accum.mul_x2(x[3], x[5]);
653 accum.mul(x[4], x[4]);
654 z[8] = accum.extract();
655 accum.mul_x2(x[0], x[9]);
656 accum.mul_x2(x[1], x[8]);
657 accum.mul_x2(x[2], x[7]);
658 accum.mul_x2(x[3], x[6]);
659 accum.mul_x2(x[4], x[5]);
660 z[9] = accum.extract();
661 accum.mul_x2(x[0], x[10]);
662 accum.mul_x2(x[1], x[9]);
663 accum.mul_x2(x[2], x[8]);
664 accum.mul_x2(x[3], x[7]);
665 accum.mul_x2(x[4], x[6]);
666 accum.mul(x[5], x[5]);
667 z[10] = accum.extract();
668 accum.mul_x2(x[0], x[11]);
669 accum.mul_x2(x[1], x[10]);
670 accum.mul_x2(x[2], x[9]);
671 accum.mul_x2(x[3], x[8]);
672 accum.mul_x2(x[4], x[7]);
673 accum.mul_x2(x[5], x[6]);
674 z[11] = accum.extract();
675 accum.mul_x2(x[0], x[12]);
676 accum.mul_x2(x[1], x[11]);
677 accum.mul_x2(x[2], x[10]);
678 accum.mul_x2(x[3], x[9]);
679 accum.mul_x2(x[4], x[8]);
680 accum.mul_x2(x[5], x[7]);
681 accum.mul(x[6], x[6]);
682 z[12] = accum.extract();
683 accum.mul_x2(x[0], x[13]);
684 accum.mul_x2(x[1], x[12]);
685 accum.mul_x2(x[2], x[11]);
686 accum.mul_x2(x[3], x[10]);
687 accum.mul_x2(x[4], x[9]);
688 accum.mul_x2(x[5], x[8]);
689 accum.mul_x2(x[6], x[7]);
690 z[13] = accum.extract();
691 accum.mul_x2(x[0], x[14]);
692 accum.mul_x2(x[1], x[13]);
693 accum.mul_x2(x[2], x[12]);
694 accum.mul_x2(x[3], x[11]);
695 accum.mul_x2(x[4], x[10]);
696 accum.mul_x2(x[5], x[9]);
697 accum.mul_x2(x[6], x[8]);
698 accum.mul(x[7], x[7]);
699 z[14] = accum.extract();
700 accum.mul_x2(x[0], x[15]);
701 accum.mul_x2(x[1], x[14]);
702 accum.mul_x2(x[2], x[13]);
703 accum.mul_x2(x[3], x[12]);
704 accum.mul_x2(x[4], x[11]);
705 accum.mul_x2(x[5], x[10]);
706 accum.mul_x2(x[6], x[9]);
707 accum.mul_x2(x[7], x[8]);
708 z[15] = accum.extract();
709 accum.mul_x2(x[1], x[15]);
710 accum.mul_x2(x[2], x[14]);
711 accum.mul_x2(x[3], x[13]);
712 accum.mul_x2(x[4], x[12]);
713 accum.mul_x2(x[5], x[11]);
714 accum.mul_x2(x[6], x[10]);
715 accum.mul_x2(x[7], x[9]);
716 accum.mul(x[8], x[8]);
717 z[16] = accum.extract();
718 accum.mul_x2(x[2], x[15]);
719 accum.mul_x2(x[3], x[14]);
720 accum.mul_x2(x[4], x[13]);
721 accum.mul_x2(x[5], x[12]);
722 accum.mul_x2(x[6], x[11]);
723 accum.mul_x2(x[7], x[10]);
724 accum.mul_x2(x[8], x[9]);
725 z[17] = accum.extract();
726 accum.mul_x2(x[3], x[15]);
727 accum.mul_x2(x[4], x[14]);
728 accum.mul_x2(x[5], x[13]);
729 accum.mul_x2(x[6], x[12]);
730 accum.mul_x2(x[7], x[11]);
731 accum.mul_x2(x[8], x[10]);
732 accum.mul(x[9], x[9]);
733 z[18] = accum.extract();
734 accum.mul_x2(x[4], x[15]);
735 accum.mul_x2(x[5], x[14]);
736 accum.mul_x2(x[6], x[13]);
737 accum.mul_x2(x[7], x[12]);
738 accum.mul_x2(x[8], x[11]);
739 accum.mul_x2(x[9], x[10]);
740 z[19] = accum.extract();
741 accum.mul_x2(x[5], x[15]);
742 accum.mul_x2(x[6], x[14]);
743 accum.mul_x2(x[7], x[13]);
744 accum.mul_x2(x[8], x[12]);
745 accum.mul_x2(x[9], x[11]);
746 accum.mul(x[10], x[10]);
747 z[20] = accum.extract();
748 accum.mul_x2(x[6], x[15]);
749 accum.mul_x2(x[7], x[14]);
750 accum.mul_x2(x[8], x[13]);
751 accum.mul_x2(x[9], x[12]);
752 accum.mul_x2(x[10], x[11]);
753 z[21] = accum.extract();
754 accum.mul_x2(x[7], x[15]);
755 accum.mul_x2(x[8], x[14]);
756 accum.mul_x2(x[9], x[13]);
757 accum.mul_x2(x[10], x[12]);
758 accum.mul(x[11], x[11]);
759 z[22] = accum.extract();
760 accum.mul_x2(x[8], x[15]);
761 accum.mul_x2(x[9], x[14]);
762 accum.mul_x2(x[10], x[13]);
763 accum.mul_x2(x[11], x[12]);
764 z[23] = accum.extract();
765 accum.mul_x2(x[9], x[15]);
766 accum.mul_x2(x[10], x[14]);
767 accum.mul_x2(x[11], x[13]);
768 accum.mul(x[12], x[12]);
769 z[24] = accum.extract();
770 accum.mul_x2(x[10], x[15]);
771 accum.mul_x2(x[11], x[14]);
772 accum.mul_x2(x[12], x[13]);
773 z[25] = accum.extract();
774 accum.mul_x2(x[11], x[15]);
775 accum.mul_x2(x[12], x[14]);
776 accum.mul(x[13], x[13]);
777 z[26] = accum.extract();
778 accum.mul_x2(x[12], x[15]);
779 accum.mul_x2(x[13], x[14]);
780 z[27] = accum.extract();
781 accum.mul_x2(x[13], x[15]);
782 accum.mul(x[14], x[14]);
783 z[28] = accum.extract();
784 accum.mul_x2(x[14], x[15]);
785 z[29] = accum.extract();
786 accum.mul(x[15], x[15]);
787 z[30] = accum.extract();
788 z[31] = accum.extract();
789}
Botan::word3::mul_x2
constexpr void mul_x2(W x, W y)
Definition mp_asmi.h:542

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

◆ bigint_comba_sqr24()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr24 ( word z[48],
const word x[24] )

Definition at line 1090 of file mp_comba.cpp.

1090 {
1091 word3<word> accum;
1092
1093 accum.mul(x[0], x[0]);
1094 z[0] = accum.extract();
1095 accum.mul_x2(x[0], x[1]);
1096 z[1] = accum.extract();
1097 accum.mul_x2(x[0], x[2]);
1098 accum.mul(x[1], x[1]);
1099 z[2] = accum.extract();
1100 accum.mul_x2(x[0], x[3]);
1101 accum.mul_x2(x[1], x[2]);
1102 z[3] = accum.extract();
1103 accum.mul_x2(x[0], x[4]);
1104 accum.mul_x2(x[1], x[3]);
1105 accum.mul(x[2], x[2]);
1106 z[4] = accum.extract();
1107 accum.mul_x2(x[0], x[5]);
1108 accum.mul_x2(x[1], x[4]);
1109 accum.mul_x2(x[2], x[3]);
1110 z[5] = accum.extract();
1111 accum.mul_x2(x[0], x[6]);
1112 accum.mul_x2(x[1], x[5]);
1113 accum.mul_x2(x[2], x[4]);
1114 accum.mul(x[3], x[3]);
1115 z[6] = accum.extract();
1116 accum.mul_x2(x[0], x[7]);
1117 accum.mul_x2(x[1], x[6]);
1118 accum.mul_x2(x[2], x[5]);
1119 accum.mul_x2(x[3], x[4]);
1120 z[7] = accum.extract();
1121 accum.mul_x2(x[0], x[8]);
1122 accum.mul_x2(x[1], x[7]);
1123 accum.mul_x2(x[2], x[6]);
1124 accum.mul_x2(x[3], x[5]);
1125 accum.mul(x[4], x[4]);
1126 z[8] = accum.extract();
1127 accum.mul_x2(x[0], x[9]);
1128 accum.mul_x2(x[1], x[8]);
1129 accum.mul_x2(x[2], x[7]);
1130 accum.mul_x2(x[3], x[6]);
1131 accum.mul_x2(x[4], x[5]);
1132 z[9] = accum.extract();
1133 accum.mul_x2(x[0], x[10]);
1134 accum.mul_x2(x[1], x[9]);
1135 accum.mul_x2(x[2], x[8]);
1136 accum.mul_x2(x[3], x[7]);
1137 accum.mul_x2(x[4], x[6]);
1138 accum.mul(x[5], x[5]);
1139 z[10] = accum.extract();
1140 accum.mul_x2(x[0], x[11]);
1141 accum.mul_x2(x[1], x[10]);
1142 accum.mul_x2(x[2], x[9]);
1143 accum.mul_x2(x[3], x[8]);
1144 accum.mul_x2(x[4], x[7]);
1145 accum.mul_x2(x[5], x[6]);
1146 z[11] = accum.extract();
1147 accum.mul_x2(x[0], x[12]);
1148 accum.mul_x2(x[1], x[11]);
1149 accum.mul_x2(x[2], x[10]);
1150 accum.mul_x2(x[3], x[9]);
1151 accum.mul_x2(x[4], x[8]);
1152 accum.mul_x2(x[5], x[7]);
1153 accum.mul(x[6], x[6]);
1154 z[12] = accum.extract();
1155 accum.mul_x2(x[0], x[13]);
1156 accum.mul_x2(x[1], x[12]);
1157 accum.mul_x2(x[2], x[11]);
1158 accum.mul_x2(x[3], x[10]);
1159 accum.mul_x2(x[4], x[9]);
1160 accum.mul_x2(x[5], x[8]);
1161 accum.mul_x2(x[6], x[7]);
1162 z[13] = accum.extract();
1163 accum.mul_x2(x[0], x[14]);
1164 accum.mul_x2(x[1], x[13]);
1165 accum.mul_x2(x[2], x[12]);
1166 accum.mul_x2(x[3], x[11]);
1167 accum.mul_x2(x[4], x[10]);
1168 accum.mul_x2(x[5], x[9]);
1169 accum.mul_x2(x[6], x[8]);
1170 accum.mul(x[7], x[7]);
1171 z[14] = accum.extract();
1172 accum.mul_x2(x[0], x[15]);
1173 accum.mul_x2(x[1], x[14]);
1174 accum.mul_x2(x[2], x[13]);
1175 accum.mul_x2(x[3], x[12]);
1176 accum.mul_x2(x[4], x[11]);
1177 accum.mul_x2(x[5], x[10]);
1178 accum.mul_x2(x[6], x[9]);
1179 accum.mul_x2(x[7], x[8]);
1180 z[15] = accum.extract();
1181 accum.mul_x2(x[0], x[16]);
1182 accum.mul_x2(x[1], x[15]);
1183 accum.mul_x2(x[2], x[14]);
1184 accum.mul_x2(x[3], x[13]);
1185 accum.mul_x2(x[4], x[12]);
1186 accum.mul_x2(x[5], x[11]);
1187 accum.mul_x2(x[6], x[10]);
1188 accum.mul_x2(x[7], x[9]);
1189 accum.mul(x[8], x[8]);
1190 z[16] = accum.extract();
1191 accum.mul_x2(x[0], x[17]);
1192 accum.mul_x2(x[1], x[16]);
1193 accum.mul_x2(x[2], x[15]);
1194 accum.mul_x2(x[3], x[14]);
1195 accum.mul_x2(x[4], x[13]);
1196 accum.mul_x2(x[5], x[12]);
1197 accum.mul_x2(x[6], x[11]);
1198 accum.mul_x2(x[7], x[10]);
1199 accum.mul_x2(x[8], x[9]);
1200 z[17] = accum.extract();
1201 accum.mul_x2(x[0], x[18]);
1202 accum.mul_x2(x[1], x[17]);
1203 accum.mul_x2(x[2], x[16]);
1204 accum.mul_x2(x[3], x[15]);
1205 accum.mul_x2(x[4], x[14]);
1206 accum.mul_x2(x[5], x[13]);
1207 accum.mul_x2(x[6], x[12]);
1208 accum.mul_x2(x[7], x[11]);
1209 accum.mul_x2(x[8], x[10]);
1210 accum.mul(x[9], x[9]);
1211 z[18] = accum.extract();
1212 accum.mul_x2(x[0], x[19]);
1213 accum.mul_x2(x[1], x[18]);
1214 accum.mul_x2(x[2], x[17]);
1215 accum.mul_x2(x[3], x[16]);
1216 accum.mul_x2(x[4], x[15]);
1217 accum.mul_x2(x[5], x[14]);
1218 accum.mul_x2(x[6], x[13]);
1219 accum.mul_x2(x[7], x[12]);
1220 accum.mul_x2(x[8], x[11]);
1221 accum.mul_x2(x[9], x[10]);
1222 z[19] = accum.extract();
1223 accum.mul_x2(x[0], x[20]);
1224 accum.mul_x2(x[1], x[19]);
1225 accum.mul_x2(x[2], x[18]);
1226 accum.mul_x2(x[3], x[17]);
1227 accum.mul_x2(x[4], x[16]);
1228 accum.mul_x2(x[5], x[15]);
1229 accum.mul_x2(x[6], x[14]);
1230 accum.mul_x2(x[7], x[13]);
1231 accum.mul_x2(x[8], x[12]);
1232 accum.mul_x2(x[9], x[11]);
1233 accum.mul(x[10], x[10]);
1234 z[20] = accum.extract();
1235 accum.mul_x2(x[0], x[21]);
1236 accum.mul_x2(x[1], x[20]);
1237 accum.mul_x2(x[2], x[19]);
1238 accum.mul_x2(x[3], x[18]);
1239 accum.mul_x2(x[4], x[17]);
1240 accum.mul_x2(x[5], x[16]);
1241 accum.mul_x2(x[6], x[15]);
1242 accum.mul_x2(x[7], x[14]);
1243 accum.mul_x2(x[8], x[13]);
1244 accum.mul_x2(x[9], x[12]);
1245 accum.mul_x2(x[10], x[11]);
1246 z[21] = accum.extract();
1247 accum.mul_x2(x[0], x[22]);
1248 accum.mul_x2(x[1], x[21]);
1249 accum.mul_x2(x[2], x[20]);
1250 accum.mul_x2(x[3], x[19]);
1251 accum.mul_x2(x[4], x[18]);
1252 accum.mul_x2(x[5], x[17]);
1253 accum.mul_x2(x[6], x[16]);
1254 accum.mul_x2(x[7], x[15]);
1255 accum.mul_x2(x[8], x[14]);
1256 accum.mul_x2(x[9], x[13]);
1257 accum.mul_x2(x[10], x[12]);
1258 accum.mul(x[11], x[11]);
1259 z[22] = accum.extract();
1260 accum.mul_x2(x[0], x[23]);
1261 accum.mul_x2(x[1], x[22]);
1262 accum.mul_x2(x[2], x[21]);
1263 accum.mul_x2(x[3], x[20]);
1264 accum.mul_x2(x[4], x[19]);
1265 accum.mul_x2(x[5], x[18]);
1266 accum.mul_x2(x[6], x[17]);
1267 accum.mul_x2(x[7], x[16]);
1268 accum.mul_x2(x[8], x[15]);
1269 accum.mul_x2(x[9], x[14]);
1270 accum.mul_x2(x[10], x[13]);
1271 accum.mul_x2(x[11], x[12]);
1272 z[23] = accum.extract();
1273 accum.mul_x2(x[1], x[23]);
1274 accum.mul_x2(x[2], x[22]);
1275 accum.mul_x2(x[3], x[21]);
1276 accum.mul_x2(x[4], x[20]);
1277 accum.mul_x2(x[5], x[19]);
1278 accum.mul_x2(x[6], x[18]);
1279 accum.mul_x2(x[7], x[17]);
1280 accum.mul_x2(x[8], x[16]);
1281 accum.mul_x2(x[9], x[15]);
1282 accum.mul_x2(x[10], x[14]);
1283 accum.mul_x2(x[11], x[13]);
1284 accum.mul(x[12], x[12]);
1285 z[24] = accum.extract();
1286 accum.mul_x2(x[2], x[23]);
1287 accum.mul_x2(x[3], x[22]);
1288 accum.mul_x2(x[4], x[21]);
1289 accum.mul_x2(x[5], x[20]);
1290 accum.mul_x2(x[6], x[19]);
1291 accum.mul_x2(x[7], x[18]);
1292 accum.mul_x2(x[8], x[17]);
1293 accum.mul_x2(x[9], x[16]);
1294 accum.mul_x2(x[10], x[15]);
1295 accum.mul_x2(x[11], x[14]);
1296 accum.mul_x2(x[12], x[13]);
1297 z[25] = accum.extract();
1298 accum.mul_x2(x[3], x[23]);
1299 accum.mul_x2(x[4], x[22]);
1300 accum.mul_x2(x[5], x[21]);
1301 accum.mul_x2(x[6], x[20]);
1302 accum.mul_x2(x[7], x[19]);
1303 accum.mul_x2(x[8], x[18]);
1304 accum.mul_x2(x[9], x[17]);
1305 accum.mul_x2(x[10], x[16]);
1306 accum.mul_x2(x[11], x[15]);
1307 accum.mul_x2(x[12], x[14]);
1308 accum.mul(x[13], x[13]);
1309 z[26] = accum.extract();
1310 accum.mul_x2(x[4], x[23]);
1311 accum.mul_x2(x[5], x[22]);
1312 accum.mul_x2(x[6], x[21]);
1313 accum.mul_x2(x[7], x[20]);
1314 accum.mul_x2(x[8], x[19]);
1315 accum.mul_x2(x[9], x[18]);
1316 accum.mul_x2(x[10], x[17]);
1317 accum.mul_x2(x[11], x[16]);
1318 accum.mul_x2(x[12], x[15]);
1319 accum.mul_x2(x[13], x[14]);
1320 z[27] = accum.extract();
1321 accum.mul_x2(x[5], x[23]);
1322 accum.mul_x2(x[6], x[22]);
1323 accum.mul_x2(x[7], x[21]);
1324 accum.mul_x2(x[8], x[20]);
1325 accum.mul_x2(x[9], x[19]);
1326 accum.mul_x2(x[10], x[18]);
1327 accum.mul_x2(x[11], x[17]);
1328 accum.mul_x2(x[12], x[16]);
1329 accum.mul_x2(x[13], x[15]);
1330 accum.mul(x[14], x[14]);
1331 z[28] = accum.extract();
1332 accum.mul_x2(x[6], x[23]);
1333 accum.mul_x2(x[7], x[22]);
1334 accum.mul_x2(x[8], x[21]);
1335 accum.mul_x2(x[9], x[20]);
1336 accum.mul_x2(x[10], x[19]);
1337 accum.mul_x2(x[11], x[18]);
1338 accum.mul_x2(x[12], x[17]);
1339 accum.mul_x2(x[13], x[16]);
1340 accum.mul_x2(x[14], x[15]);
1341 z[29] = accum.extract();
1342 accum.mul_x2(x[7], x[23]);
1343 accum.mul_x2(x[8], x[22]);
1344 accum.mul_x2(x[9], x[21]);
1345 accum.mul_x2(x[10], x[20]);
1346 accum.mul_x2(x[11], x[19]);
1347 accum.mul_x2(x[12], x[18]);
1348 accum.mul_x2(x[13], x[17]);
1349 accum.mul_x2(x[14], x[16]);
1350 accum.mul(x[15], x[15]);
1351 z[30] = accum.extract();
1352 accum.mul_x2(x[8], x[23]);
1353 accum.mul_x2(x[9], x[22]);
1354 accum.mul_x2(x[10], x[21]);
1355 accum.mul_x2(x[11], x[20]);
1356 accum.mul_x2(x[12], x[19]);
1357 accum.mul_x2(x[13], x[18]);
1358 accum.mul_x2(x[14], x[17]);
1359 accum.mul_x2(x[15], x[16]);
1360 z[31] = accum.extract();
1361 accum.mul_x2(x[9], x[23]);
1362 accum.mul_x2(x[10], x[22]);
1363 accum.mul_x2(x[11], x[21]);
1364 accum.mul_x2(x[12], x[20]);
1365 accum.mul_x2(x[13], x[19]);
1366 accum.mul_x2(x[14], x[18]);
1367 accum.mul_x2(x[15], x[17]);
1368 accum.mul(x[16], x[16]);
1369 z[32] = accum.extract();
1370 accum.mul_x2(x[10], x[23]);
1371 accum.mul_x2(x[11], x[22]);
1372 accum.mul_x2(x[12], x[21]);
1373 accum.mul_x2(x[13], x[20]);
1374 accum.mul_x2(x[14], x[19]);
1375 accum.mul_x2(x[15], x[18]);
1376 accum.mul_x2(x[16], x[17]);
1377 z[33] = accum.extract();
1378 accum.mul_x2(x[11], x[23]);
1379 accum.mul_x2(x[12], x[22]);
1380 accum.mul_x2(x[13], x[21]);
1381 accum.mul_x2(x[14], x[20]);
1382 accum.mul_x2(x[15], x[19]);
1383 accum.mul_x2(x[16], x[18]);
1384 accum.mul(x[17], x[17]);
1385 z[34] = accum.extract();
1386 accum.mul_x2(x[12], x[23]);
1387 accum.mul_x2(x[13], x[22]);
1388 accum.mul_x2(x[14], x[21]);
1389 accum.mul_x2(x[15], x[20]);
1390 accum.mul_x2(x[16], x[19]);
1391 accum.mul_x2(x[17], x[18]);
1392 z[35] = accum.extract();
1393 accum.mul_x2(x[13], x[23]);
1394 accum.mul_x2(x[14], x[22]);
1395 accum.mul_x2(x[15], x[21]);
1396 accum.mul_x2(x[16], x[20]);
1397 accum.mul_x2(x[17], x[19]);
1398 accum.mul(x[18], x[18]);
1399 z[36] = accum.extract();
1400 accum.mul_x2(x[14], x[23]);
1401 accum.mul_x2(x[15], x[22]);
1402 accum.mul_x2(x[16], x[21]);
1403 accum.mul_x2(x[17], x[20]);
1404 accum.mul_x2(x[18], x[19]);
1405 z[37] = accum.extract();
1406 accum.mul_x2(x[15], x[23]);
1407 accum.mul_x2(x[16], x[22]);
1408 accum.mul_x2(x[17], x[21]);
1409 accum.mul_x2(x[18], x[20]);
1410 accum.mul(x[19], x[19]);
1411 z[38] = accum.extract();
1412 accum.mul_x2(x[16], x[23]);
1413 accum.mul_x2(x[17], x[22]);
1414 accum.mul_x2(x[18], x[21]);
1415 accum.mul_x2(x[19], x[20]);
1416 z[39] = accum.extract();
1417 accum.mul_x2(x[17], x[23]);
1418 accum.mul_x2(x[18], x[22]);
1419 accum.mul_x2(x[19], x[21]);
1420 accum.mul(x[20], x[20]);
1421 z[40] = accum.extract();
1422 accum.mul_x2(x[18], x[23]);
1423 accum.mul_x2(x[19], x[22]);
1424 accum.mul_x2(x[20], x[21]);
1425 z[41] = accum.extract();
1426 accum.mul_x2(x[19], x[23]);
1427 accum.mul_x2(x[20], x[22]);
1428 accum.mul(x[21], x[21]);
1429 z[42] = accum.extract();
1430 accum.mul_x2(x[20], x[23]);
1431 accum.mul_x2(x[21], x[22]);
1432 z[43] = accum.extract();
1433 accum.mul_x2(x[21], x[23]);
1434 accum.mul(x[22], x[22]);
1435 z[44] = accum.extract();
1436 accum.mul_x2(x[22], x[23]);
1437 z[45] = accum.extract();
1438 accum.mul(x[23], x[23]);
1439 z[46] = accum.extract();
1440 z[47] = accum.extract();
1441}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr().

◆ bigint_comba_sqr4()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr4 ( word z[8],
const word x[4] )

Definition at line 16 of file mp_comba.cpp.

16 {
17 word3<word> accum;
18
19 accum.mul(x[0], x[0]);
20 z[0] = accum.extract();
21 accum.mul_x2(x[0], x[1]);
22 z[1] = accum.extract();
23 accum.mul_x2(x[0], x[2]);
24 accum.mul(x[1], x[1]);
25 z[2] = accum.extract();
26 accum.mul_x2(x[0], x[3]);
27 accum.mul_x2(x[1], x[2]);
28 z[3] = accum.extract();
29 accum.mul_x2(x[1], x[3]);
30 accum.mul(x[2], x[2]);
31 z[4] = accum.extract();
32 accum.mul_x2(x[2], x[3]);
33 z[5] = accum.extract();
34 accum.mul(x[3], x[3]);
35 z[6] = accum.extract();
36 z[7] = accum.extract();
37}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

◆ bigint_comba_sqr6()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr6 ( word z[12],
const word x[6] )

Definition at line 74 of file mp_comba.cpp.

74 {
75 word3<word> accum;
76
77 accum.mul(x[0], x[0]);
78 z[0] = accum.extract();
79 accum.mul_x2(x[0], x[1]);
80 z[1] = accum.extract();
81 accum.mul_x2(x[0], x[2]);
82 accum.mul(x[1], x[1]);
83 z[2] = accum.extract();
84 accum.mul_x2(x[0], x[3]);
85 accum.mul_x2(x[1], x[2]);
86 z[3] = accum.extract();
87 accum.mul_x2(x[0], x[4]);
88 accum.mul_x2(x[1], x[3]);
89 accum.mul(x[2], x[2]);
90 z[4] = accum.extract();
91 accum.mul_x2(x[0], x[5]);
92 accum.mul_x2(x[1], x[4]);
93 accum.mul_x2(x[2], x[3]);
94 z[5] = accum.extract();
95 accum.mul_x2(x[1], x[5]);
96 accum.mul_x2(x[2], x[4]);
97 accum.mul(x[3], x[3]);
98 z[6] = accum.extract();
99 accum.mul_x2(x[2], x[5]);
100 accum.mul_x2(x[3], x[4]);
101 z[7] = accum.extract();
102 accum.mul_x2(x[3], x[5]);
103 accum.mul(x[4], x[4]);
104 z[8] = accum.extract();
105 accum.mul_x2(x[4], x[5]);
106 z[9] = accum.extract();
107 accum.mul(x[5], x[5]);
108 z[10] = accum.extract();
109 z[11] = accum.extract();
110}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

◆ bigint_comba_sqr7()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr7 ( word z[14],
const word x[7] )

Definition at line 171 of file mp_comba.cpp.

171 {
172 word3<word> accum;
173
174 accum.mul(x[0], x[0]);
175 z[0] = accum.extract();
176 accum.mul_x2(x[0], x[1]);
177 z[1] = accum.extract();
178 accum.mul_x2(x[0], x[2]);
179 accum.mul(x[1], x[1]);
180 z[2] = accum.extract();
181 accum.mul_x2(x[0], x[3]);
182 accum.mul_x2(x[1], x[2]);
183 z[3] = accum.extract();
184 accum.mul_x2(x[0], x[4]);
185 accum.mul_x2(x[1], x[3]);
186 accum.mul(x[2], x[2]);
187 z[4] = accum.extract();
188 accum.mul_x2(x[0], x[5]);
189 accum.mul_x2(x[1], x[4]);
190 accum.mul_x2(x[2], x[3]);
191 z[5] = accum.extract();
192 accum.mul_x2(x[0], x[6]);
193 accum.mul_x2(x[1], x[5]);
194 accum.mul_x2(x[2], x[4]);
195 accum.mul(x[3], x[3]);
196 z[6] = accum.extract();
197 accum.mul_x2(x[1], x[6]);
198 accum.mul_x2(x[2], x[5]);
199 accum.mul_x2(x[3], x[4]);
200 z[7] = accum.extract();
201 accum.mul_x2(x[2], x[6]);
202 accum.mul_x2(x[3], x[5]);
203 accum.mul(x[4], x[4]);
204 z[8] = accum.extract();
205 accum.mul_x2(x[3], x[6]);
206 accum.mul_x2(x[4], x[5]);
207 z[9] = accum.extract();
208 accum.mul_x2(x[4], x[6]);
209 accum.mul(x[5], x[5]);
210 z[10] = accum.extract();
211 accum.mul_x2(x[5], x[6]);
212 z[11] = accum.extract();
213 accum.mul(x[6], x[6]);
214 z[12] = accum.extract();
215 z[13] = accum.extract();
216}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by comba_sqr().

◆ bigint_comba_sqr8()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr8 ( word z[16],
const word x[8] )

Definition at line 292 of file mp_comba.cpp.

292 {
293 word3<word> accum;
294
295 accum.mul(x[0], x[0]);
296 z[0] = accum.extract();
297 accum.mul_x2(x[0], x[1]);
298 z[1] = accum.extract();
299 accum.mul_x2(x[0], x[2]);
300 accum.mul(x[1], x[1]);
301 z[2] = accum.extract();
302 accum.mul_x2(x[0], x[3]);
303 accum.mul_x2(x[1], x[2]);
304 z[3] = accum.extract();
305 accum.mul_x2(x[0], x[4]);
306 accum.mul_x2(x[1], x[3]);
307 accum.mul(x[2], x[2]);
308 z[4] = accum.extract();
309 accum.mul_x2(x[0], x[5]);
310 accum.mul_x2(x[1], x[4]);
311 accum.mul_x2(x[2], x[3]);
312 z[5] = accum.extract();
313 accum.mul_x2(x[0], x[6]);
314 accum.mul_x2(x[1], x[5]);
315 accum.mul_x2(x[2], x[4]);
316 accum.mul(x[3], x[3]);
317 z[6] = accum.extract();
318 accum.mul_x2(x[0], x[7]);
319 accum.mul_x2(x[1], x[6]);
320 accum.mul_x2(x[2], x[5]);
321 accum.mul_x2(x[3], x[4]);
322 z[7] = accum.extract();
323 accum.mul_x2(x[1], x[7]);
324 accum.mul_x2(x[2], x[6]);
325 accum.mul_x2(x[3], x[5]);
326 accum.mul(x[4], x[4]);
327 z[8] = accum.extract();
328 accum.mul_x2(x[2], x[7]);
329 accum.mul_x2(x[3], x[6]);
330 accum.mul_x2(x[4], x[5]);
331 z[9] = accum.extract();
332 accum.mul_x2(x[3], x[7]);
333 accum.mul_x2(x[4], x[6]);
334 accum.mul(x[5], x[5]);
335 z[10] = accum.extract();
336 accum.mul_x2(x[4], x[7]);
337 accum.mul_x2(x[5], x[6]);
338 z[11] = accum.extract();
339 accum.mul_x2(x[5], x[7]);
340 accum.mul(x[6], x[6]);
341 z[12] = accum.extract();
342 accum.mul_x2(x[6], x[7]);
343 z[13] = accum.extract();
344 accum.mul(x[7], x[7]);
345 z[14] = accum.extract();
346 z[15] = accum.extract();
347}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

◆ bigint_comba_sqr9()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr9 ( word z[18],
const word x[9] )

Definition at line 440 of file mp_comba.cpp.

440 {
441 word3<word> accum;
442
443 accum.mul(x[0], x[0]);
444 z[0] = accum.extract();
445 accum.mul_x2(x[0], x[1]);
446 z[1] = accum.extract();
447 accum.mul_x2(x[0], x[2]);
448 accum.mul(x[1], x[1]);
449 z[2] = accum.extract();
450 accum.mul_x2(x[0], x[3]);
451 accum.mul_x2(x[1], x[2]);
452 z[3] = accum.extract();
453 accum.mul_x2(x[0], x[4]);
454 accum.mul_x2(x[1], x[3]);
455 accum.mul(x[2], x[2]);
456 z[4] = accum.extract();
457 accum.mul_x2(x[0], x[5]);
458 accum.mul_x2(x[1], x[4]);
459 accum.mul_x2(x[2], x[3]);
460 z[5] = accum.extract();
461 accum.mul_x2(x[0], x[6]);
462 accum.mul_x2(x[1], x[5]);
463 accum.mul_x2(x[2], x[4]);
464 accum.mul(x[3], x[3]);
465 z[6] = accum.extract();
466 accum.mul_x2(x[0], x[7]);
467 accum.mul_x2(x[1], x[6]);
468 accum.mul_x2(x[2], x[5]);
469 accum.mul_x2(x[3], x[4]);
470 z[7] = accum.extract();
471 accum.mul_x2(x[0], x[8]);
472 accum.mul_x2(x[1], x[7]);
473 accum.mul_x2(x[2], x[6]);
474 accum.mul_x2(x[3], x[5]);
475 accum.mul(x[4], x[4]);
476 z[8] = accum.extract();
477 accum.mul_x2(x[1], x[8]);
478 accum.mul_x2(x[2], x[7]);
479 accum.mul_x2(x[3], x[6]);
480 accum.mul_x2(x[4], x[5]);
481 z[9] = accum.extract();
482 accum.mul_x2(x[2], x[8]);
483 accum.mul_x2(x[3], x[7]);
484 accum.mul_x2(x[4], x[6]);
485 accum.mul(x[5], x[5]);
486 z[10] = accum.extract();
487 accum.mul_x2(x[3], x[8]);
488 accum.mul_x2(x[4], x[7]);
489 accum.mul_x2(x[5], x[6]);
490 z[11] = accum.extract();
491 accum.mul_x2(x[4], x[8]);
492 accum.mul_x2(x[5], x[7]);
493 accum.mul(x[6], x[6]);
494 z[12] = accum.extract();
495 accum.mul_x2(x[5], x[8]);
496 accum.mul_x2(x[6], x[7]);
497 z[13] = accum.extract();
498 accum.mul_x2(x[6], x[8]);
499 accum.mul(x[7], x[7]);
500 z[14] = accum.extract();
501 accum.mul_x2(x[7], x[8]);
502 z[15] = accum.extract();
503 accum.mul(x[8], x[8]);
504 z[16] = accum.extract();
505 z[17] = accum.extract();
506}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

◆ bigint_ct_is_eq()

template<WordType W>
auto Botan::bigint_ct_is_eq ( const W x[],
size_t x_size,
const W y[],
size_t y_size )->CT::Mask< W >
inlineconstexpr

Definition at line 506 of file mp_core.h.

506 {
507 const size_t common_elems = std::min(x_size, y_size);
508
509 W diff = 0;
510
511 for(size_t i = 0; i != common_elems; i++) {
512 diff |= (x[i] ^ y[i]);
513 }
514
515 // If any bits were set in high part of x/y, then they are not equal
516 if(x_size < y_size) {
517 for(size_t i = x_size; i != y_size; i++) {
518 diff |= y[i];
519 }
520 } else if(y_size < x_size) {
521 for(size_t i = y_size; i != x_size; i++) {
522 diff |= x[i];
523 }
524 }
525
526 return CT::Mask<W>::is_zero(diff);
527}

References Botan::CT::Mask< T >::is_zero().

Referenced by Botan::BigInt::is_equal().

◆ bigint_ct_is_lt()

template<WordType W>
auto Botan::bigint_ct_is_lt ( const W x[],
size_t x_size,
const W y[],
size_t y_size,
bool lt_or_equal = false )->CT::Mask< W >
inlineconstexpr

Compare x and y Returns a Mask: |1| if x[0:x_size] < y[0:y_size] or |0| otherwise If lt_or_equal is true, returns |1| also for x == y

Definition at line 473 of file mp_core.h.

474 {
475 const size_t common_elems = std::min(x_size, y_size);
476
477 auto is_lt = CT::Mask<W>::expand(lt_or_equal);
478
479 for(size_t i = 0; i != common_elems; i++) {
480 const auto eq = CT::Mask<W>::is_equal(x[i], y[i]);
481 const auto lt = CT::Mask<W>::is_lt(x[i], y[i]);
482 is_lt = eq.select_mask(is_lt, lt);
483 }
484
485 if(x_size < y_size) {
486 W mask = 0;
487 for(size_t i = x_size; i != y_size; i++) {
488 mask |= y[i];
489 }
490 // If any bits were set in high part of y, then is_lt should be forced true
491 is_lt |= CT::Mask<W>::expand(mask);
492 } else if(y_size < x_size) {
493 W mask = 0;
494 for(size_t i = y_size; i != x_size; i++) {
495 mask |= x[i];
496 }
497
498 // If any bits were set in high part of x, then is_lt should be false
499 is_lt &= CT::Mask<W>::is_zero(mask);
500 }
501
502 return is_lt;
503}

References Botan::CT::Mask< T >::expand(), Botan::CT::Mask< T >::is_equal(), Botan::CT::Mask< T >::is_lt(), and Botan::CT::Mask< T >::is_zero().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::deserialize(), Botan::BigInt::is_less_than(), Botan::PCurve::GenericPrimeOrderCurve::mul2_vartime_x_mod_order_eq(), and Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime_x_mod_order_eq().

◆ bigint_linmul2()

template<WordType W>
auto Botan::bigint_linmul2 ( W x[],
size_t x_size,
W y )->W
inlinenodiscardconstexpr

Definition at line 392 of file mp_core.h.

392 {
393 W carry = 0;
394
395 for(size_t i = 0; i != x_size; ++i) {
396 x[i] = word_madd2(x[i], y, &carry);
397 }
398
399 return carry;
400}
Botan::word_madd2
constexpr auto word_madd2(W a, W b, W *c) -> W
Definition mp_asmi.h:90

References carry(), and word_madd2().

Referenced by Botan::BigInt::operator*=().

◆ bigint_linmul3()

template<WordType W>
void Botan::bigint_linmul3 ( W z[],
const W x[],
size_t x_size,
W y )
inlineconstexpr

Definition at line 403 of file mp_core.h.

403 {
404 const size_t blocks = x_size - (x_size % 8);
405
406 W carry = 0;
407
408 for(size_t i = 0; i != blocks; i += 8) {
409 carry = word8_linmul3(z + i, x + i, y, carry);
410 }
411
412 for(size_t i = blocks; i != x_size; ++i) {
413 z[i] = word_madd2(x[i], y, &carry);
414 }
415
416 z[x_size] = carry;
417}
Botan::word8_linmul3
constexpr auto word8_linmul3(W z[8], const W x[8], W y, W carry) -> W
Definition mp_asmi.h:397

References carry(), word8_linmul3(), and word_madd2().

Referenced by bigint_mul(), bigint_sqr(), Botan::BigInt::mul(), operator*(), and operator*().

◆ bigint_monty_maybe_sub() [1/2]

template<WordType W>
void Botan::bigint_monty_maybe_sub ( size_t N,
W z[],
W x0,
const W x[],
const W p[] )
inlineconstexpr

Conditional subtraction for Montgomery reduction

This function assumes that (x0 || x) is less than 2*p

Computes z[0:N] = (x0 || x[0:N]) - p[0:N]

If z would be positive, returns z[0:N] Otherwise returns original input x

Definition at line 225 of file mp_core.h.

225 {
226 W borrow = 0;
227
228 const size_t blocks = N - (N % 8);
229
230 for(size_t i = 0; i != blocks; i += 8) {
231 borrow = word8_sub3(z + i, x + i, p + i, borrow);
232 }
233
234 for(size_t i = blocks; i != N; ++i) {
235 z[i] = word_sub(x[i], p[i], &borrow);
236 }
237
238 borrow = (x0 - borrow) > x0;
239
240 CT::conditional_assign_mem(borrow, z, x, N);
241}
Botan::CT::conditional_assign_mem
constexpr Mask< T > conditional_assign_mem(T cnd, T *dest, const T *src, size_t elems)
Definition ct_utils.h:749
Botan::word8_sub3
constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W
Definition mp_asmi.h:371

References Botan::CT::conditional_assign_mem(), word8_sub3(), and word_sub().

Referenced by bigint_monty_redc_12(), bigint_monty_redc_16(), bigint_monty_redc_24(), bigint_monty_redc_32(), bigint_monty_redc_4(), bigint_monty_redc_6(), bigint_monty_redc_8(), bigint_monty_redc_generic(), monty_redc(), monty_redc_pdash1(), Botan::IntMod< MontgomeryRep< ScalarParams > >::mul2(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator+, and Botan::Montgomery_Int::operator+().

◆ bigint_monty_maybe_sub() [2/2]

template<size_t N, WordType W>
void Botan::bigint_monty_maybe_sub ( W z[N],
W x0,
const W x[N],
const W y[N] )
inlineconstexpr

Conditional subtraction for Montgomery reduction

This function assumes that (x0 || x) is less than 2*p

Computes z[0:N] = (x0 || x[0:N]) - p[0:N]

If z would be positive, returns z[0:N] Otherwise returns original input x

Definition at line 254 of file mp_core.h.

254 {
255 W borrow = 0;
256
257 for(size_t i = 0; i != N; ++i) {
258 z[i] = word_sub(x[i], y[i], &borrow);
259 }
260
261 borrow = (x0 - borrow) > x0;
262
263 CT::conditional_assign_mem(borrow, z, x, N);
264}

References Botan::CT::conditional_assign_mem(), and word_sub().

◆ bigint_monty_redc()

void Botan::bigint_monty_redc ( word r[],
const word z[],
const word p[],
size_t p_size,
word p_dash,
word ws[],
size_t ws_size )
inline

Montgomery Reduction

Parameters
rresult of exactly p_size words
zinteger to reduce, of size exactly 2*p_size.
pmodulus
p_sizesize of p
p_dashMontgomery value
wsarray of at least p_size words
ws_sizesize of ws in words

It is allowed to set &r[0] == &z[0] however in this case note that only the first p_size words of r will be written to and the high p_size words of r/z will still hold the original inputs, these must be cleared after use. See bigint_monty_redc_inplace

Definition at line 906 of file mp_core.h.

907 {
908 const size_t z_size = 2 * p_size;
909
910 BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small");
911
912 if(p_size == 4) {
913 bigint_monty_redc_4(r, z, p, p_dash, ws);
914 } else if(p_size == 6) {
915 bigint_monty_redc_6(r, z, p, p_dash, ws);
916 } else if(p_size == 8) {
917 bigint_monty_redc_8(r, z, p, p_dash, ws);
918 } else if(p_size == 12) {
919 bigint_monty_redc_12(r, z, p, p_dash, ws);
920 } else if(p_size == 16) {
921 bigint_monty_redc_16(r, z, p, p_dash, ws);
922 } else if(p_size == 24) {
923 bigint_monty_redc_24(r, z, p, p_dash, ws);
924 } else if(p_size == 32) {
925 bigint_monty_redc_32(r, z, p, p_dash, ws);
926 } else {
927 bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws);
928 }
929}
BOTAN_ARG_CHECK
#define BOTAN_ARG_CHECK(expr, msg)
Definition assert.h:33
Botan::bigint_monty_redc_6
BOTAN_FUZZER_API void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6])
Definition mp_monty_n.cpp:46
Botan::bigint_monty_redc_24
BOTAN_FUZZER_API void bigint_monty_redc_24(word r[24], const word z[48], const word p[24], word p_dash, word ws[24])
Definition mp_monty_n.cpp:696
Botan::bigint_monty_redc_generic
BOTAN_FUZZER_API void bigint_monty_redc_generic(word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[])
Definition mp_monty.cpp:90
Botan::bigint_monty_redc_4
BOTAN_FUZZER_API void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4])
Definition mp_monty_n.cpp:12
Botan::bigint_monty_redc_12
BOTAN_FUZZER_API void bigint_monty_redc_12(word r[12], const word z[24], const word p[12], word p_dash, word ws[12])
Definition mp_monty_n.cpp:200
Botan::bigint_monty_redc_16
BOTAN_FUZZER_API void bigint_monty_redc_16(word r[16], const word z[32], const word p[16], word p_dash, word ws[16])
Definition mp_monty_n.cpp:386
Botan::bigint_monty_redc_8
BOTAN_FUZZER_API void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8])
Definition mp_monty_n.cpp:106
Botan::bigint_monty_redc_32
BOTAN_FUZZER_API void bigint_monty_redc_32(word r[32], const word z[64], const word p[32], word p_dash, word ws[32])
Definition mp_monty_n.cpp:1350

References bigint_monty_redc_12(), bigint_monty_redc_16(), bigint_monty_redc_24(), bigint_monty_redc_32(), bigint_monty_redc_4(), bigint_monty_redc_6(), bigint_monty_redc_8(), bigint_monty_redc_generic(), and BOTAN_ARG_CHECK.

Referenced by bigint_monty_redc_inplace().

◆ bigint_monty_redc_12()

void Botan::bigint_monty_redc_12 ( word r[12],
const word z[24],
const word p[12],
word p_dash,
word ws[12] )

Definition at line 200 of file mp_monty_n.cpp.

200 {
201 word3<word> accum;
202 accum.add(z[0]);
203 ws[0] = accum.monty_step(p[0], p_dash);
204 accum.mul(ws[0], p[1]);
205 accum.add(z[1]);
206 ws[1] = accum.monty_step(p[0], p_dash);
207 accum.mul(ws[0], p[2]);
208 accum.mul(ws[1], p[1]);
209 accum.add(z[2]);
210 ws[2] = accum.monty_step(p[0], p_dash);
211 accum.mul(ws[0], p[3]);
212 accum.mul(ws[1], p[2]);
213 accum.mul(ws[2], p[1]);
214 accum.add(z[3]);
215 ws[3] = accum.monty_step(p[0], p_dash);
216 accum.mul(ws[0], p[4]);
217 accum.mul(ws[1], p[3]);
218 accum.mul(ws[2], p[2]);
219 accum.mul(ws[3], p[1]);
220 accum.add(z[4]);
221 ws[4] = accum.monty_step(p[0], p_dash);
222 accum.mul(ws[0], p[5]);
223 accum.mul(ws[1], p[4]);
224 accum.mul(ws[2], p[3]);
225 accum.mul(ws[3], p[2]);
226 accum.mul(ws[4], p[1]);
227 accum.add(z[5]);
228 ws[5] = accum.monty_step(p[0], p_dash);
229 accum.mul(ws[0], p[6]);
230 accum.mul(ws[1], p[5]);
231 accum.mul(ws[2], p[4]);
232 accum.mul(ws[3], p[3]);
233 accum.mul(ws[4], p[2]);
234 accum.mul(ws[5], p[1]);
235 accum.add(z[6]);
236 ws[6] = accum.monty_step(p[0], p_dash);
237 accum.mul(ws[0], p[7]);
238 accum.mul(ws[1], p[6]);
239 accum.mul(ws[2], p[5]);
240 accum.mul(ws[3], p[4]);
241 accum.mul(ws[4], p[3]);
242 accum.mul(ws[5], p[2]);
243 accum.mul(ws[6], p[1]);
244 accum.add(z[7]);
245 ws[7] = accum.monty_step(p[0], p_dash);
246 accum.mul(ws[0], p[8]);
247 accum.mul(ws[1], p[7]);
248 accum.mul(ws[2], p[6]);
249 accum.mul(ws[3], p[5]);
250 accum.mul(ws[4], p[4]);
251 accum.mul(ws[5], p[3]);
252 accum.mul(ws[6], p[2]);
253 accum.mul(ws[7], p[1]);
254 accum.add(z[8]);
255 ws[8] = accum.monty_step(p[0], p_dash);
256 accum.mul(ws[0], p[9]);
257 accum.mul(ws[1], p[8]);
258 accum.mul(ws[2], p[7]);
259 accum.mul(ws[3], p[6]);
260 accum.mul(ws[4], p[5]);
261 accum.mul(ws[5], p[4]);
262 accum.mul(ws[6], p[3]);
263 accum.mul(ws[7], p[2]);
264 accum.mul(ws[8], p[1]);
265 accum.add(z[9]);
266 ws[9] = accum.monty_step(p[0], p_dash);
267 accum.mul(ws[0], p[10]);
268 accum.mul(ws[1], p[9]);
269 accum.mul(ws[2], p[8]);
270 accum.mul(ws[3], p[7]);
271 accum.mul(ws[4], p[6]);
272 accum.mul(ws[5], p[5]);
273 accum.mul(ws[6], p[4]);
274 accum.mul(ws[7], p[3]);
275 accum.mul(ws[8], p[2]);
276 accum.mul(ws[9], p[1]);
277 accum.add(z[10]);
278 ws[10] = accum.monty_step(p[0], p_dash);
279 accum.mul(ws[0], p[11]);
280 accum.mul(ws[1], p[10]);
281 accum.mul(ws[2], p[9]);
282 accum.mul(ws[3], p[8]);
283 accum.mul(ws[4], p[7]);
284 accum.mul(ws[5], p[6]);
285 accum.mul(ws[6], p[5]);
286 accum.mul(ws[7], p[4]);
287 accum.mul(ws[8], p[3]);
288 accum.mul(ws[9], p[2]);
289 accum.mul(ws[10], p[1]);
290 accum.add(z[11]);
291 ws[11] = accum.monty_step(p[0], p_dash);
292 accum.mul(ws[1], p[11]);
293 accum.mul(ws[2], p[10]);
294 accum.mul(ws[3], p[9]);
295 accum.mul(ws[4], p[8]);
296 accum.mul(ws[5], p[7]);
297 accum.mul(ws[6], p[6]);
298 accum.mul(ws[7], p[5]);
299 accum.mul(ws[8], p[4]);
300 accum.mul(ws[9], p[3]);
301 accum.mul(ws[10], p[2]);
302 accum.mul(ws[11], p[1]);
303 accum.add(z[12]);
304 ws[0] = accum.extract();
305 accum.mul(ws[2], p[11]);
306 accum.mul(ws[3], p[10]);
307 accum.mul(ws[4], p[9]);
308 accum.mul(ws[5], p[8]);
309 accum.mul(ws[6], p[7]);
310 accum.mul(ws[7], p[6]);
311 accum.mul(ws[8], p[5]);
312 accum.mul(ws[9], p[4]);
313 accum.mul(ws[10], p[3]);
314 accum.mul(ws[11], p[2]);
315 accum.add(z[13]);
316 ws[1] = accum.extract();
317 accum.mul(ws[3], p[11]);
318 accum.mul(ws[4], p[10]);
319 accum.mul(ws[5], p[9]);
320 accum.mul(ws[6], p[8]);
321 accum.mul(ws[7], p[7]);
322 accum.mul(ws[8], p[6]);
323 accum.mul(ws[9], p[5]);
324 accum.mul(ws[10], p[4]);
325 accum.mul(ws[11], p[3]);
326 accum.add(z[14]);
327 ws[2] = accum.extract();
328 accum.mul(ws[4], p[11]);
329 accum.mul(ws[5], p[10]);
330 accum.mul(ws[6], p[9]);
331 accum.mul(ws[7], p[8]);
332 accum.mul(ws[8], p[7]);
333 accum.mul(ws[9], p[6]);
334 accum.mul(ws[10], p[5]);
335 accum.mul(ws[11], p[4]);
336 accum.add(z[15]);
337 ws[3] = accum.extract();
338 accum.mul(ws[5], p[11]);
339 accum.mul(ws[6], p[10]);
340 accum.mul(ws[7], p[9]);
341 accum.mul(ws[8], p[8]);
342 accum.mul(ws[9], p[7]);
343 accum.mul(ws[10], p[6]);
344 accum.mul(ws[11], p[5]);
345 accum.add(z[16]);
346 ws[4] = accum.extract();
347 accum.mul(ws[6], p[11]);
348 accum.mul(ws[7], p[10]);
349 accum.mul(ws[8], p[9]);
350 accum.mul(ws[9], p[8]);
351 accum.mul(ws[10], p[7]);
352 accum.mul(ws[11], p[6]);
353 accum.add(z[17]);
354 ws[5] = accum.extract();
355 accum.mul(ws[7], p[11]);
356 accum.mul(ws[8], p[10]);
357 accum.mul(ws[9], p[9]);
358 accum.mul(ws[10], p[8]);
359 accum.mul(ws[11], p[7]);
360 accum.add(z[18]);
361 ws[6] = accum.extract();
362 accum.mul(ws[8], p[11]);
363 accum.mul(ws[9], p[10]);
364 accum.mul(ws[10], p[9]);
365 accum.mul(ws[11], p[8]);
366 accum.add(z[19]);
367 ws[7] = accum.extract();
368 accum.mul(ws[9], p[11]);
369 accum.mul(ws[10], p[10]);
370 accum.mul(ws[11], p[9]);
371 accum.add(z[20]);
372 ws[8] = accum.extract();
373 accum.mul(ws[10], p[11]);
374 accum.mul(ws[11], p[10]);
375 accum.add(z[21]);
376 ws[9] = accum.extract();
377 accum.mul(ws[11], p[11]);
378 accum.add(z[22]);
379 ws[10] = accum.extract();
380 accum.add(z[23]);
381 ws[11] = accum.extract();
382 const word w1 = accum.extract();
383 bigint_monty_maybe_sub<12>(r, w1, ws, p);
384}
Botan::word3::add
constexpr void add(W x)
Definition mp_asmi.h:601
Botan::word3::monty_step
constexpr W monty_step(W p0, W p_dash)
Definition mp_asmi.h:618
Botan::bigint_monty_maybe_sub
constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[])
Definition mp_core.h:225

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc(), and monty_redc().

◆ bigint_monty_redc_16()

void Botan::bigint_monty_redc_16 ( word r[16],
const word z[32],
const word p[16],
word p_dash,
word ws[16] )

Definition at line 386 of file mp_monty_n.cpp.

386 {
387 word3<word> accum;
388 accum.add(z[0]);
389 ws[0] = accum.monty_step(p[0], p_dash);
390 accum.mul(ws[0], p[1]);
391 accum.add(z[1]);
392 ws[1] = accum.monty_step(p[0], p_dash);
393 accum.mul(ws[0], p[2]);
394 accum.mul(ws[1], p[1]);
395 accum.add(z[2]);
396 ws[2] = accum.monty_step(p[0], p_dash);
397 accum.mul(ws[0], p[3]);
398 accum.mul(ws[1], p[2]);
399 accum.mul(ws[2], p[1]);
400 accum.add(z[3]);
401 ws[3] = accum.monty_step(p[0], p_dash);
402 accum.mul(ws[0], p[4]);
403 accum.mul(ws[1], p[3]);
404 accum.mul(ws[2], p[2]);
405 accum.mul(ws[3], p[1]);
406 accum.add(z[4]);
407 ws[4] = accum.monty_step(p[0], p_dash);
408 accum.mul(ws[0], p[5]);
409 accum.mul(ws[1], p[4]);
410 accum.mul(ws[2], p[3]);
411 accum.mul(ws[3], p[2]);
412 accum.mul(ws[4], p[1]);
413 accum.add(z[5]);
414 ws[5] = accum.monty_step(p[0], p_dash);
415 accum.mul(ws[0], p[6]);
416 accum.mul(ws[1], p[5]);
417 accum.mul(ws[2], p[4]);
418 accum.mul(ws[3], p[3]);
419 accum.mul(ws[4], p[2]);
420 accum.mul(ws[5], p[1]);
421 accum.add(z[6]);
422 ws[6] = accum.monty_step(p[0], p_dash);
423 accum.mul(ws[0], p[7]);
424 accum.mul(ws[1], p[6]);
425 accum.mul(ws[2], p[5]);
426 accum.mul(ws[3], p[4]);
427 accum.mul(ws[4], p[3]);
428 accum.mul(ws[5], p[2]);
429 accum.mul(ws[6], p[1]);
430 accum.add(z[7]);
431 ws[7] = accum.monty_step(p[0], p_dash);
432 accum.mul(ws[0], p[8]);
433 accum.mul(ws[1], p[7]);
434 accum.mul(ws[2], p[6]);
435 accum.mul(ws[3], p[5]);
436 accum.mul(ws[4], p[4]);
437 accum.mul(ws[5], p[3]);
438 accum.mul(ws[6], p[2]);
439 accum.mul(ws[7], p[1]);
440 accum.add(z[8]);
441 ws[8] = accum.monty_step(p[0], p_dash);
442 accum.mul(ws[0], p[9]);
443 accum.mul(ws[1], p[8]);
444 accum.mul(ws[2], p[7]);
445 accum.mul(ws[3], p[6]);
446 accum.mul(ws[4], p[5]);
447 accum.mul(ws[5], p[4]);
448 accum.mul(ws[6], p[3]);
449 accum.mul(ws[7], p[2]);
450 accum.mul(ws[8], p[1]);
451 accum.add(z[9]);
452 ws[9] = accum.monty_step(p[0], p_dash);
453 accum.mul(ws[0], p[10]);
454 accum.mul(ws[1], p[9]);
455 accum.mul(ws[2], p[8]);
456 accum.mul(ws[3], p[7]);
457 accum.mul(ws[4], p[6]);
458 accum.mul(ws[5], p[5]);
459 accum.mul(ws[6], p[4]);
460 accum.mul(ws[7], p[3]);
461 accum.mul(ws[8], p[2]);
462 accum.mul(ws[9], p[1]);
463 accum.add(z[10]);
464 ws[10] = accum.monty_step(p[0], p_dash);
465 accum.mul(ws[0], p[11]);
466 accum.mul(ws[1], p[10]);
467 accum.mul(ws[2], p[9]);
468 accum.mul(ws[3], p[8]);
469 accum.mul(ws[4], p[7]);
470 accum.mul(ws[5], p[6]);
471 accum.mul(ws[6], p[5]);
472 accum.mul(ws[7], p[4]);
473 accum.mul(ws[8], p[3]);
474 accum.mul(ws[9], p[2]);
475 accum.mul(ws[10], p[1]);
476 accum.add(z[11]);
477 ws[11] = accum.monty_step(p[0], p_dash);
478 accum.mul(ws[0], p[12]);
479 accum.mul(ws[1], p[11]);
480 accum.mul(ws[2], p[10]);
481 accum.mul(ws[3], p[9]);
482 accum.mul(ws[4], p[8]);
483 accum.mul(ws[5], p[7]);
484 accum.mul(ws[6], p[6]);
485 accum.mul(ws[7], p[5]);
486 accum.mul(ws[8], p[4]);
487 accum.mul(ws[9], p[3]);
488 accum.mul(ws[10], p[2]);
489 accum.mul(ws[11], p[1]);
490 accum.add(z[12]);
491 ws[12] = accum.monty_step(p[0], p_dash);
492 accum.mul(ws[0], p[13]);
493 accum.mul(ws[1], p[12]);
494 accum.mul(ws[2], p[11]);
495 accum.mul(ws[3], p[10]);
496 accum.mul(ws[4], p[9]);
497 accum.mul(ws[5], p[8]);
498 accum.mul(ws[6], p[7]);
499 accum.mul(ws[7], p[6]);
500 accum.mul(ws[8], p[5]);
501 accum.mul(ws[9], p[4]);
502 accum.mul(ws[10], p[3]);
503 accum.mul(ws[11], p[2]);
504 accum.mul(ws[12], p[1]);
505 accum.add(z[13]);
506 ws[13] = accum.monty_step(p[0], p_dash);
507 accum.mul(ws[0], p[14]);
508 accum.mul(ws[1], p[13]);
509 accum.mul(ws[2], p[12]);
510 accum.mul(ws[3], p[11]);
511 accum.mul(ws[4], p[10]);
512 accum.mul(ws[5], p[9]);
513 accum.mul(ws[6], p[8]);
514 accum.mul(ws[7], p[7]);
515 accum.mul(ws[8], p[6]);
516 accum.mul(ws[9], p[5]);
517 accum.mul(ws[10], p[4]);
518 accum.mul(ws[11], p[3]);
519 accum.mul(ws[12], p[2]);
520 accum.mul(ws[13], p[1]);
521 accum.add(z[14]);
522 ws[14] = accum.monty_step(p[0], p_dash);
523 accum.mul(ws[0], p[15]);
524 accum.mul(ws[1], p[14]);
525 accum.mul(ws[2], p[13]);
526 accum.mul(ws[3], p[12]);
527 accum.mul(ws[4], p[11]);
528 accum.mul(ws[5], p[10]);
529 accum.mul(ws[6], p[9]);
530 accum.mul(ws[7], p[8]);
531 accum.mul(ws[8], p[7]);
532 accum.mul(ws[9], p[6]);
533 accum.mul(ws[10], p[5]);
534 accum.mul(ws[11], p[4]);
535 accum.mul(ws[12], p[3]);
536 accum.mul(ws[13], p[2]);
537 accum.mul(ws[14], p[1]);
538 accum.add(z[15]);
539 ws[15] = accum.monty_step(p[0], p_dash);
540 accum.mul(ws[1], p[15]);
541 accum.mul(ws[2], p[14]);
542 accum.mul(ws[3], p[13]);
543 accum.mul(ws[4], p[12]);
544 accum.mul(ws[5], p[11]);
545 accum.mul(ws[6], p[10]);
546 accum.mul(ws[7], p[9]);
547 accum.mul(ws[8], p[8]);
548 accum.mul(ws[9], p[7]);
549 accum.mul(ws[10], p[6]);
550 accum.mul(ws[11], p[5]);
551 accum.mul(ws[12], p[4]);
552 accum.mul(ws[13], p[3]);
553 accum.mul(ws[14], p[2]);
554 accum.mul(ws[15], p[1]);
555 accum.add(z[16]);
556 ws[0] = accum.extract();
557 accum.mul(ws[2], p[15]);
558 accum.mul(ws[3], p[14]);
559 accum.mul(ws[4], p[13]);
560 accum.mul(ws[5], p[12]);
561 accum.mul(ws[6], p[11]);
562 accum.mul(ws[7], p[10]);
563 accum.mul(ws[8], p[9]);
564 accum.mul(ws[9], p[8]);
565 accum.mul(ws[10], p[7]);
566 accum.mul(ws[11], p[6]);
567 accum.mul(ws[12], p[5]);
568 accum.mul(ws[13], p[4]);
569 accum.mul(ws[14], p[3]);
570 accum.mul(ws[15], p[2]);
571 accum.add(z[17]);
572 ws[1] = accum.extract();
573 accum.mul(ws[3], p[15]);
574 accum.mul(ws[4], p[14]);
575 accum.mul(ws[5], p[13]);
576 accum.mul(ws[6], p[12]);
577 accum.mul(ws[7], p[11]);
578 accum.mul(ws[8], p[10]);
579 accum.mul(ws[9], p[9]);
580 accum.mul(ws[10], p[8]);
581 accum.mul(ws[11], p[7]);
582 accum.mul(ws[12], p[6]);
583 accum.mul(ws[13], p[5]);
584 accum.mul(ws[14], p[4]);
585 accum.mul(ws[15], p[3]);
586 accum.add(z[18]);
587 ws[2] = accum.extract();
588 accum.mul(ws[4], p[15]);
589 accum.mul(ws[5], p[14]);
590 accum.mul(ws[6], p[13]);
591 accum.mul(ws[7], p[12]);
592 accum.mul(ws[8], p[11]);
593 accum.mul(ws[9], p[10]);
594 accum.mul(ws[10], p[9]);
595 accum.mul(ws[11], p[8]);
596 accum.mul(ws[12], p[7]);
597 accum.mul(ws[13], p[6]);
598 accum.mul(ws[14], p[5]);
599 accum.mul(ws[15], p[4]);
600 accum.add(z[19]);
601 ws[3] = accum.extract();
602 accum.mul(ws[5], p[15]);
603 accum.mul(ws[6], p[14]);
604 accum.mul(ws[7], p[13]);
605 accum.mul(ws[8], p[12]);
606 accum.mul(ws[9], p[11]);
607 accum.mul(ws[10], p[10]);
608 accum.mul(ws[11], p[9]);
609 accum.mul(ws[12], p[8]);
610 accum.mul(ws[13], p[7]);
611 accum.mul(ws[14], p[6]);
612 accum.mul(ws[15], p[5]);
613 accum.add(z[20]);
614 ws[4] = accum.extract();
615 accum.mul(ws[6], p[15]);
616 accum.mul(ws[7], p[14]);
617 accum.mul(ws[8], p[13]);
618 accum.mul(ws[9], p[12]);
619 accum.mul(ws[10], p[11]);
620 accum.mul(ws[11], p[10]);
621 accum.mul(ws[12], p[9]);
622 accum.mul(ws[13], p[8]);
623 accum.mul(ws[14], p[7]);
624 accum.mul(ws[15], p[6]);
625 accum.add(z[21]);
626 ws[5] = accum.extract();
627 accum.mul(ws[7], p[15]);
628 accum.mul(ws[8], p[14]);
629 accum.mul(ws[9], p[13]);
630 accum.mul(ws[10], p[12]);
631 accum.mul(ws[11], p[11]);
632 accum.mul(ws[12], p[10]);
633 accum.mul(ws[13], p[9]);
634 accum.mul(ws[14], p[8]);
635 accum.mul(ws[15], p[7]);
636 accum.add(z[22]);
637 ws[6] = accum.extract();
638 accum.mul(ws[8], p[15]);
639 accum.mul(ws[9], p[14]);
640 accum.mul(ws[10], p[13]);
641 accum.mul(ws[11], p[12]);
642 accum.mul(ws[12], p[11]);
643 accum.mul(ws[13], p[10]);
644 accum.mul(ws[14], p[9]);
645 accum.mul(ws[15], p[8]);
646 accum.add(z[23]);
647 ws[7] = accum.extract();
648 accum.mul(ws[9], p[15]);
649 accum.mul(ws[10], p[14]);
650 accum.mul(ws[11], p[13]);
651 accum.mul(ws[12], p[12]);
652 accum.mul(ws[13], p[11]);
653 accum.mul(ws[14], p[10]);
654 accum.mul(ws[15], p[9]);
655 accum.add(z[24]);
656 ws[8] = accum.extract();
657 accum.mul(ws[10], p[15]);
658 accum.mul(ws[11], p[14]);
659 accum.mul(ws[12], p[13]);
660 accum.mul(ws[13], p[12]);
661 accum.mul(ws[14], p[11]);
662 accum.mul(ws[15], p[10]);
663 accum.add(z[25]);
664 ws[9] = accum.extract();
665 accum.mul(ws[11], p[15]);
666 accum.mul(ws[12], p[14]);
667 accum.mul(ws[13], p[13]);
668 accum.mul(ws[14], p[12]);
669 accum.mul(ws[15], p[11]);
670 accum.add(z[26]);
671 ws[10] = accum.extract();
672 accum.mul(ws[12], p[15]);
673 accum.mul(ws[13], p[14]);
674 accum.mul(ws[14], p[13]);
675 accum.mul(ws[15], p[12]);
676 accum.add(z[27]);
677 ws[11] = accum.extract();
678 accum.mul(ws[13], p[15]);
679 accum.mul(ws[14], p[14]);
680 accum.mul(ws[15], p[13]);
681 accum.add(z[28]);
682 ws[12] = accum.extract();
683 accum.mul(ws[14], p[15]);
684 accum.mul(ws[15], p[14]);
685 accum.add(z[29]);
686 ws[13] = accum.extract();
687 accum.mul(ws[15], p[15]);
688 accum.add(z[30]);
689 ws[14] = accum.extract();
690 accum.add(z[31]);
691 ws[15] = accum.extract();
692 const word w1 = accum.extract();
693 bigint_monty_maybe_sub<16>(r, w1, ws, p);
694}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc(), and monty_redc().

◆ bigint_monty_redc_24()

void Botan::bigint_monty_redc_24 ( word r[24],
const word z[48],
const word p[24],
word p_dash,
word ws[24] )

Definition at line 696 of file mp_monty_n.cpp.

696 {
697 word3<word> accum;
698 accum.add(z[0]);
699 ws[0] = accum.monty_step(p[0], p_dash);
700 accum.mul(ws[0], p[1]);
701 accum.add(z[1]);
702 ws[1] = accum.monty_step(p[0], p_dash);
703 accum.mul(ws[0], p[2]);
704 accum.mul(ws[1], p[1]);
705 accum.add(z[2]);
706 ws[2] = accum.monty_step(p[0], p_dash);
707 accum.mul(ws[0], p[3]);
708 accum.mul(ws[1], p[2]);
709 accum.mul(ws[2], p[1]);
710 accum.add(z[3]);
711 ws[3] = accum.monty_step(p[0], p_dash);
712 accum.mul(ws[0], p[4]);
713 accum.mul(ws[1], p[3]);
714 accum.mul(ws[2], p[2]);
715 accum.mul(ws[3], p[1]);
716 accum.add(z[4]);
717 ws[4] = accum.monty_step(p[0], p_dash);
718 accum.mul(ws[0], p[5]);
719 accum.mul(ws[1], p[4]);
720 accum.mul(ws[2], p[3]);
721 accum.mul(ws[3], p[2]);
722 accum.mul(ws[4], p[1]);
723 accum.add(z[5]);
724 ws[5] = accum.monty_step(p[0], p_dash);
725 accum.mul(ws[0], p[6]);
726 accum.mul(ws[1], p[5]);
727 accum.mul(ws[2], p[4]);
728 accum.mul(ws[3], p[3]);
729 accum.mul(ws[4], p[2]);
730 accum.mul(ws[5], p[1]);
731 accum.add(z[6]);
732 ws[6] = accum.monty_step(p[0], p_dash);
733 accum.mul(ws[0], p[7]);
734 accum.mul(ws[1], p[6]);
735 accum.mul(ws[2], p[5]);
736 accum.mul(ws[3], p[4]);
737 accum.mul(ws[4], p[3]);
738 accum.mul(ws[5], p[2]);
739 accum.mul(ws[6], p[1]);
740 accum.add(z[7]);
741 ws[7] = accum.monty_step(p[0], p_dash);
742 accum.mul(ws[0], p[8]);
743 accum.mul(ws[1], p[7]);
744 accum.mul(ws[2], p[6]);
745 accum.mul(ws[3], p[5]);
746 accum.mul(ws[4], p[4]);
747 accum.mul(ws[5], p[3]);
748 accum.mul(ws[6], p[2]);
749 accum.mul(ws[7], p[1]);
750 accum.add(z[8]);
751 ws[8] = accum.monty_step(p[0], p_dash);
752 accum.mul(ws[0], p[9]);
753 accum.mul(ws[1], p[8]);
754 accum.mul(ws[2], p[7]);
755 accum.mul(ws[3], p[6]);
756 accum.mul(ws[4], p[5]);
757 accum.mul(ws[5], p[4]);
758 accum.mul(ws[6], p[3]);
759 accum.mul(ws[7], p[2]);
760 accum.mul(ws[8], p[1]);
761 accum.add(z[9]);
762 ws[9] = accum.monty_step(p[0], p_dash);
763 accum.mul(ws[0], p[10]);
764 accum.mul(ws[1], p[9]);
765 accum.mul(ws[2], p[8]);
766 accum.mul(ws[3], p[7]);
767 accum.mul(ws[4], p[6]);
768 accum.mul(ws[5], p[5]);
769 accum.mul(ws[6], p[4]);
770 accum.mul(ws[7], p[3]);
771 accum.mul(ws[8], p[2]);
772 accum.mul(ws[9], p[1]);
773 accum.add(z[10]);
774 ws[10] = accum.monty_step(p[0], p_dash);
775 accum.mul(ws[0], p[11]);
776 accum.mul(ws[1], p[10]);
777 accum.mul(ws[2], p[9]);
778 accum.mul(ws[3], p[8]);
779 accum.mul(ws[4], p[7]);
780 accum.mul(ws[5], p[6]);
781 accum.mul(ws[6], p[5]);
782 accum.mul(ws[7], p[4]);
783 accum.mul(ws[8], p[3]);
784 accum.mul(ws[9], p[2]);
785 accum.mul(ws[10], p[1]);
786 accum.add(z[11]);
787 ws[11] = accum.monty_step(p[0], p_dash);
788 accum.mul(ws[0], p[12]);
789 accum.mul(ws[1], p[11]);
790 accum.mul(ws[2], p[10]);
791 accum.mul(ws[3], p[9]);
792 accum.mul(ws[4], p[8]);
793 accum.mul(ws[5], p[7]);
794 accum.mul(ws[6], p[6]);
795 accum.mul(ws[7], p[5]);
796 accum.mul(ws[8], p[4]);
797 accum.mul(ws[9], p[3]);
798 accum.mul(ws[10], p[2]);
799 accum.mul(ws[11], p[1]);
800 accum.add(z[12]);
801 ws[12] = accum.monty_step(p[0], p_dash);
802 accum.mul(ws[0], p[13]);
803 accum.mul(ws[1], p[12]);
804 accum.mul(ws[2], p[11]);
805 accum.mul(ws[3], p[10]);
806 accum.mul(ws[4], p[9]);
807 accum.mul(ws[5], p[8]);
808 accum.mul(ws[6], p[7]);
809 accum.mul(ws[7], p[6]);
810 accum.mul(ws[8], p[5]);
811 accum.mul(ws[9], p[4]);
812 accum.mul(ws[10], p[3]);
813 accum.mul(ws[11], p[2]);
814 accum.mul(ws[12], p[1]);
815 accum.add(z[13]);
816 ws[13] = accum.monty_step(p[0], p_dash);
817 accum.mul(ws[0], p[14]);
818 accum.mul(ws[1], p[13]);
819 accum.mul(ws[2], p[12]);
820 accum.mul(ws[3], p[11]);
821 accum.mul(ws[4], p[10]);
822 accum.mul(ws[5], p[9]);
823 accum.mul(ws[6], p[8]);
824 accum.mul(ws[7], p[7]);
825 accum.mul(ws[8], p[6]);
826 accum.mul(ws[9], p[5]);
827 accum.mul(ws[10], p[4]);
828 accum.mul(ws[11], p[3]);
829 accum.mul(ws[12], p[2]);
830 accum.mul(ws[13], p[1]);
831 accum.add(z[14]);
832 ws[14] = accum.monty_step(p[0], p_dash);
833 accum.mul(ws[0], p[15]);
834 accum.mul(ws[1], p[14]);
835 accum.mul(ws[2], p[13]);
836 accum.mul(ws[3], p[12]);
837 accum.mul(ws[4], p[11]);
838 accum.mul(ws[5], p[10]);
839 accum.mul(ws[6], p[9]);
840 accum.mul(ws[7], p[8]);
841 accum.mul(ws[8], p[7]);
842 accum.mul(ws[9], p[6]);
843 accum.mul(ws[10], p[5]);
844 accum.mul(ws[11], p[4]);
845 accum.mul(ws[12], p[3]);
846 accum.mul(ws[13], p[2]);
847 accum.mul(ws[14], p[1]);
848 accum.add(z[15]);
849 ws[15] = accum.monty_step(p[0], p_dash);
850 accum.mul(ws[0], p[16]);
851 accum.mul(ws[1], p[15]);
852 accum.mul(ws[2], p[14]);
853 accum.mul(ws[3], p[13]);
854 accum.mul(ws[4], p[12]);
855 accum.mul(ws[5], p[11]);
856 accum.mul(ws[6], p[10]);
857 accum.mul(ws[7], p[9]);
858 accum.mul(ws[8], p[8]);
859 accum.mul(ws[9], p[7]);
860 accum.mul(ws[10], p[6]);
861 accum.mul(ws[11], p[5]);
862 accum.mul(ws[12], p[4]);
863 accum.mul(ws[13], p[3]);
864 accum.mul(ws[14], p[2]);
865 accum.mul(ws[15], p[1]);
866 accum.add(z[16]);
867 ws[16] = accum.monty_step(p[0], p_dash);
868 accum.mul(ws[0], p[17]);
869 accum.mul(ws[1], p[16]);
870 accum.mul(ws[2], p[15]);
871 accum.mul(ws[3], p[14]);
872 accum.mul(ws[4], p[13]);
873 accum.mul(ws[5], p[12]);
874 accum.mul(ws[6], p[11]);
875 accum.mul(ws[7], p[10]);
876 accum.mul(ws[8], p[9]);
877 accum.mul(ws[9], p[8]);
878 accum.mul(ws[10], p[7]);
879 accum.mul(ws[11], p[6]);
880 accum.mul(ws[12], p[5]);
881 accum.mul(ws[13], p[4]);
882 accum.mul(ws[14], p[3]);
883 accum.mul(ws[15], p[2]);
884 accum.mul(ws[16], p[1]);
885 accum.add(z[17]);
886 ws[17] = accum.monty_step(p[0], p_dash);
887 accum.mul(ws[0], p[18]);
888 accum.mul(ws[1], p[17]);
889 accum.mul(ws[2], p[16]);
890 accum.mul(ws[3], p[15]);
891 accum.mul(ws[4], p[14]);
892 accum.mul(ws[5], p[13]);
893 accum.mul(ws[6], p[12]);
894 accum.mul(ws[7], p[11]);
895 accum.mul(ws[8], p[10]);
896 accum.mul(ws[9], p[9]);
897 accum.mul(ws[10], p[8]);
898 accum.mul(ws[11], p[7]);
899 accum.mul(ws[12], p[6]);
900 accum.mul(ws[13], p[5]);
901 accum.mul(ws[14], p[4]);
902 accum.mul(ws[15], p[3]);
903 accum.mul(ws[16], p[2]);
904 accum.mul(ws[17], p[1]);
905 accum.add(z[18]);
906 ws[18] = accum.monty_step(p[0], p_dash);
907 accum.mul(ws[0], p[19]);
908 accum.mul(ws[1], p[18]);
909 accum.mul(ws[2], p[17]);
910 accum.mul(ws[3], p[16]);
911 accum.mul(ws[4], p[15]);
912 accum.mul(ws[5], p[14]);
913 accum.mul(ws[6], p[13]);
914 accum.mul(ws[7], p[12]);
915 accum.mul(ws[8], p[11]);
916 accum.mul(ws[9], p[10]);
917 accum.mul(ws[10], p[9]);
918 accum.mul(ws[11], p[8]);
919 accum.mul(ws[12], p[7]);
920 accum.mul(ws[13], p[6]);
921 accum.mul(ws[14], p[5]);
922 accum.mul(ws[15], p[4]);
923 accum.mul(ws[16], p[3]);
924 accum.mul(ws[17], p[2]);
925 accum.mul(ws[18], p[1]);
926 accum.add(z[19]);
927 ws[19] = accum.monty_step(p[0], p_dash);
928 accum.mul(ws[0], p[20]);
929 accum.mul(ws[1], p[19]);
930 accum.mul(ws[2], p[18]);
931 accum.mul(ws[3], p[17]);
932 accum.mul(ws[4], p[16]);
933 accum.mul(ws[5], p[15]);
934 accum.mul(ws[6], p[14]);
935 accum.mul(ws[7], p[13]);
936 accum.mul(ws[8], p[12]);
937 accum.mul(ws[9], p[11]);
938 accum.mul(ws[10], p[10]);
939 accum.mul(ws[11], p[9]);
940 accum.mul(ws[12], p[8]);
941 accum.mul(ws[13], p[7]);
942 accum.mul(ws[14], p[6]);
943 accum.mul(ws[15], p[5]);
944 accum.mul(ws[16], p[4]);
945 accum.mul(ws[17], p[3]);
946 accum.mul(ws[18], p[2]);
947 accum.mul(ws[19], p[1]);
948 accum.add(z[20]);
949 ws[20] = accum.monty_step(p[0], p_dash);
950 accum.mul(ws[0], p[21]);
951 accum.mul(ws[1], p[20]);
952 accum.mul(ws[2], p[19]);
953 accum.mul(ws[3], p[18]);
954 accum.mul(ws[4], p[17]);
955 accum.mul(ws[5], p[16]);
956 accum.mul(ws[6], p[15]);
957 accum.mul(ws[7], p[14]);
958 accum.mul(ws[8], p[13]);
959 accum.mul(ws[9], p[12]);
960 accum.mul(ws[10], p[11]);
961 accum.mul(ws[11], p[10]);
962 accum.mul(ws[12], p[9]);
963 accum.mul(ws[13], p[8]);
964 accum.mul(ws[14], p[7]);
965 accum.mul(ws[15], p[6]);
966 accum.mul(ws[16], p[5]);
967 accum.mul(ws[17], p[4]);
968 accum.mul(ws[18], p[3]);
969 accum.mul(ws[19], p[2]);
970 accum.mul(ws[20], p[1]);
971 accum.add(z[21]);
972 ws[21] = accum.monty_step(p[0], p_dash);
973 accum.mul(ws[0], p[22]);
974 accum.mul(ws[1], p[21]);
975 accum.mul(ws[2], p[20]);
976 accum.mul(ws[3], p[19]);
977 accum.mul(ws[4], p[18]);
978 accum.mul(ws[5], p[17]);
979 accum.mul(ws[6], p[16]);
980 accum.mul(ws[7], p[15]);
981 accum.mul(ws[8], p[14]);
982 accum.mul(ws[9], p[13]);
983 accum.mul(ws[10], p[12]);
984 accum.mul(ws[11], p[11]);
985 accum.mul(ws[12], p[10]);
986 accum.mul(ws[13], p[9]);
987 accum.mul(ws[14], p[8]);
988 accum.mul(ws[15], p[7]);
989 accum.mul(ws[16], p[6]);
990 accum.mul(ws[17], p[5]);
991 accum.mul(ws[18], p[4]);
992 accum.mul(ws[19], p[3]);
993 accum.mul(ws[20], p[2]);
994 accum.mul(ws[21], p[1]);
995 accum.add(z[22]);
996 ws[22] = accum.monty_step(p[0], p_dash);
997 accum.mul(ws[0], p[23]);
998 accum.mul(ws[1], p[22]);
999 accum.mul(ws[2], p[21]);
1000 accum.mul(ws[3], p[20]);
1001 accum.mul(ws[4], p[19]);
1002 accum.mul(ws[5], p[18]);
1003 accum.mul(ws[6], p[17]);
1004 accum.mul(ws[7], p[16]);
1005 accum.mul(ws[8], p[15]);
1006 accum.mul(ws[9], p[14]);
1007 accum.mul(ws[10], p[13]);
1008 accum.mul(ws[11], p[12]);
1009 accum.mul(ws[12], p[11]);
1010 accum.mul(ws[13], p[10]);
1011 accum.mul(ws[14], p[9]);
1012 accum.mul(ws[15], p[8]);
1013 accum.mul(ws[16], p[7]);
1014 accum.mul(ws[17], p[6]);
1015 accum.mul(ws[18], p[5]);
1016 accum.mul(ws[19], p[4]);
1017 accum.mul(ws[20], p[3]);
1018 accum.mul(ws[21], p[2]);
1019 accum.mul(ws[22], p[1]);
1020 accum.add(z[23]);
1021 ws[23] = accum.monty_step(p[0], p_dash);
1022 accum.mul(ws[1], p[23]);
1023 accum.mul(ws[2], p[22]);
1024 accum.mul(ws[3], p[21]);
1025 accum.mul(ws[4], p[20]);
1026 accum.mul(ws[5], p[19]);
1027 accum.mul(ws[6], p[18]);
1028 accum.mul(ws[7], p[17]);
1029 accum.mul(ws[8], p[16]);
1030 accum.mul(ws[9], p[15]);
1031 accum.mul(ws[10], p[14]);
1032 accum.mul(ws[11], p[13]);
1033 accum.mul(ws[12], p[12]);
1034 accum.mul(ws[13], p[11]);
1035 accum.mul(ws[14], p[10]);
1036 accum.mul(ws[15], p[9]);
1037 accum.mul(ws[16], p[8]);
1038 accum.mul(ws[17], p[7]);
1039 accum.mul(ws[18], p[6]);
1040 accum.mul(ws[19], p[5]);
1041 accum.mul(ws[20], p[4]);
1042 accum.mul(ws[21], p[3]);
1043 accum.mul(ws[22], p[2]);
1044 accum.mul(ws[23], p[1]);
1045 accum.add(z[24]);
1046 ws[0] = accum.extract();
1047 accum.mul(ws[2], p[23]);
1048 accum.mul(ws[3], p[22]);
1049 accum.mul(ws[4], p[21]);
1050 accum.mul(ws[5], p[20]);
1051 accum.mul(ws[6], p[19]);
1052 accum.mul(ws[7], p[18]);
1053 accum.mul(ws[8], p[17]);
1054 accum.mul(ws[9], p[16]);
1055 accum.mul(ws[10], p[15]);
1056 accum.mul(ws[11], p[14]);
1057 accum.mul(ws[12], p[13]);
1058 accum.mul(ws[13], p[12]);
1059 accum.mul(ws[14], p[11]);
1060 accum.mul(ws[15], p[10]);
1061 accum.mul(ws[16], p[9]);
1062 accum.mul(ws[17], p[8]);
1063 accum.mul(ws[18], p[7]);
1064 accum.mul(ws[19], p[6]);
1065 accum.mul(ws[20], p[5]);
1066 accum.mul(ws[21], p[4]);
1067 accum.mul(ws[22], p[3]);
1068 accum.mul(ws[23], p[2]);
1069 accum.add(z[25]);
1070 ws[1] = accum.extract();
1071 accum.mul(ws[3], p[23]);
1072 accum.mul(ws[4], p[22]);
1073 accum.mul(ws[5], p[21]);
1074 accum.mul(ws[6], p[20]);
1075 accum.mul(ws[7], p[19]);
1076 accum.mul(ws[8], p[18]);
1077 accum.mul(ws[9], p[17]);
1078 accum.mul(ws[10], p[16]);
1079 accum.mul(ws[11], p[15]);
1080 accum.mul(ws[12], p[14]);
1081 accum.mul(ws[13], p[13]);
1082 accum.mul(ws[14], p[12]);
1083 accum.mul(ws[15], p[11]);
1084 accum.mul(ws[16], p[10]);
1085 accum.mul(ws[17], p[9]);
1086 accum.mul(ws[18], p[8]);
1087 accum.mul(ws[19], p[7]);
1088 accum.mul(ws[20], p[6]);
1089 accum.mul(ws[21], p[5]);
1090 accum.mul(ws[22], p[4]);
1091 accum.mul(ws[23], p[3]);
1092 accum.add(z[26]);
1093 ws[2] = accum.extract();
1094 accum.mul(ws[4], p[23]);
1095 accum.mul(ws[5], p[22]);
1096 accum.mul(ws[6], p[21]);
1097 accum.mul(ws[7], p[20]);
1098 accum.mul(ws[8], p[19]);
1099 accum.mul(ws[9], p[18]);
1100 accum.mul(ws[10], p[17]);
1101 accum.mul(ws[11], p[16]);
1102 accum.mul(ws[12], p[15]);
1103 accum.mul(ws[13], p[14]);
1104 accum.mul(ws[14], p[13]);
1105 accum.mul(ws[15], p[12]);
1106 accum.mul(ws[16], p[11]);
1107 accum.mul(ws[17], p[10]);
1108 accum.mul(ws[18], p[9]);
1109 accum.mul(ws[19], p[8]);
1110 accum.mul(ws[20], p[7]);
1111 accum.mul(ws[21], p[6]);
1112 accum.mul(ws[22], p[5]);
1113 accum.mul(ws[23], p[4]);
1114 accum.add(z[27]);
1115 ws[3] = accum.extract();
1116 accum.mul(ws[5], p[23]);
1117 accum.mul(ws[6], p[22]);
1118 accum.mul(ws[7], p[21]);
1119 accum.mul(ws[8], p[20]);
1120 accum.mul(ws[9], p[19]);
1121 accum.mul(ws[10], p[18]);
1122 accum.mul(ws[11], p[17]);
1123 accum.mul(ws[12], p[16]);
1124 accum.mul(ws[13], p[15]);
1125 accum.mul(ws[14], p[14]);
1126 accum.mul(ws[15], p[13]);
1127 accum.mul(ws[16], p[12]);
1128 accum.mul(ws[17], p[11]);
1129 accum.mul(ws[18], p[10]);
1130 accum.mul(ws[19], p[9]);
1131 accum.mul(ws[20], p[8]);
1132 accum.mul(ws[21], p[7]);
1133 accum.mul(ws[22], p[6]);
1134 accum.mul(ws[23], p[5]);
1135 accum.add(z[28]);
1136 ws[4] = accum.extract();
1137 accum.mul(ws[6], p[23]);
1138 accum.mul(ws[7], p[22]);
1139 accum.mul(ws[8], p[21]);
1140 accum.mul(ws[9], p[20]);
1141 accum.mul(ws[10], p[19]);
1142 accum.mul(ws[11], p[18]);
1143 accum.mul(ws[12], p[17]);
1144 accum.mul(ws[13], p[16]);
1145 accum.mul(ws[14], p[15]);
1146 accum.mul(ws[15], p[14]);
1147 accum.mul(ws[16], p[13]);
1148 accum.mul(ws[17], p[12]);
1149 accum.mul(ws[18], p[11]);
1150 accum.mul(ws[19], p[10]);
1151 accum.mul(ws[20], p[9]);
1152 accum.mul(ws[21], p[8]);
1153 accum.mul(ws[22], p[7]);
1154 accum.mul(ws[23], p[6]);
1155 accum.add(z[29]);
1156 ws[5] = accum.extract();
1157 accum.mul(ws[7], p[23]);
1158 accum.mul(ws[8], p[22]);
1159 accum.mul(ws[9], p[21]);
1160 accum.mul(ws[10], p[20]);
1161 accum.mul(ws[11], p[19]);
1162 accum.mul(ws[12], p[18]);
1163 accum.mul(ws[13], p[17]);
1164 accum.mul(ws[14], p[16]);
1165 accum.mul(ws[15], p[15]);
1166 accum.mul(ws[16], p[14]);
1167 accum.mul(ws[17], p[13]);
1168 accum.mul(ws[18], p[12]);
1169 accum.mul(ws[19], p[11]);
1170 accum.mul(ws[20], p[10]);
1171 accum.mul(ws[21], p[9]);
1172 accum.mul(ws[22], p[8]);
1173 accum.mul(ws[23], p[7]);
1174 accum.add(z[30]);
1175 ws[6] = accum.extract();
1176 accum.mul(ws[8], p[23]);
1177 accum.mul(ws[9], p[22]);
1178 accum.mul(ws[10], p[21]);
1179 accum.mul(ws[11], p[20]);
1180 accum.mul(ws[12], p[19]);
1181 accum.mul(ws[13], p[18]);
1182 accum.mul(ws[14], p[17]);
1183 accum.mul(ws[15], p[16]);
1184 accum.mul(ws[16], p[15]);
1185 accum.mul(ws[17], p[14]);
1186 accum.mul(ws[18], p[13]);
1187 accum.mul(ws[19], p[12]);
1188 accum.mul(ws[20], p[11]);
1189 accum.mul(ws[21], p[10]);
1190 accum.mul(ws[22], p[9]);
1191 accum.mul(ws[23], p[8]);
1192 accum.add(z[31]);
1193 ws[7] = accum.extract();
1194 accum.mul(ws[9], p[23]);
1195 accum.mul(ws[10], p[22]);
1196 accum.mul(ws[11], p[21]);
1197 accum.mul(ws[12], p[20]);
1198 accum.mul(ws[13], p[19]);
1199 accum.mul(ws[14], p[18]);
1200 accum.mul(ws[15], p[17]);
1201 accum.mul(ws[16], p[16]);
1202 accum.mul(ws[17], p[15]);
1203 accum.mul(ws[18], p[14]);
1204 accum.mul(ws[19], p[13]);
1205 accum.mul(ws[20], p[12]);
1206 accum.mul(ws[21], p[11]);
1207 accum.mul(ws[22], p[10]);
1208 accum.mul(ws[23], p[9]);
1209 accum.add(z[32]);
1210 ws[8] = accum.extract();
1211 accum.mul(ws[10], p[23]);
1212 accum.mul(ws[11], p[22]);
1213 accum.mul(ws[12], p[21]);
1214 accum.mul(ws[13], p[20]);
1215 accum.mul(ws[14], p[19]);
1216 accum.mul(ws[15], p[18]);
1217 accum.mul(ws[16], p[17]);
1218 accum.mul(ws[17], p[16]);
1219 accum.mul(ws[18], p[15]);
1220 accum.mul(ws[19], p[14]);
1221 accum.mul(ws[20], p[13]);
1222 accum.mul(ws[21], p[12]);
1223 accum.mul(ws[22], p[11]);
1224 accum.mul(ws[23], p[10]);
1225 accum.add(z[33]);
1226 ws[9] = accum.extract();
1227 accum.mul(ws[11], p[23]);
1228 accum.mul(ws[12], p[22]);
1229 accum.mul(ws[13], p[21]);
1230 accum.mul(ws[14], p[20]);
1231 accum.mul(ws[15], p[19]);
1232 accum.mul(ws[16], p[18]);
1233 accum.mul(ws[17], p[17]);
1234 accum.mul(ws[18], p[16]);
1235 accum.mul(ws[19], p[15]);
1236 accum.mul(ws[20], p[14]);
1237 accum.mul(ws[21], p[13]);
1238 accum.mul(ws[22], p[12]);
1239 accum.mul(ws[23], p[11]);
1240 accum.add(z[34]);
1241 ws[10] = accum.extract();
1242 accum.mul(ws[12], p[23]);
1243 accum.mul(ws[13], p[22]);
1244 accum.mul(ws[14], p[21]);
1245 accum.mul(ws[15], p[20]);
1246 accum.mul(ws[16], p[19]);
1247 accum.mul(ws[17], p[18]);
1248 accum.mul(ws[18], p[17]);
1249 accum.mul(ws[19], p[16]);
1250 accum.mul(ws[20], p[15]);
1251 accum.mul(ws[21], p[14]);
1252 accum.mul(ws[22], p[13]);
1253 accum.mul(ws[23], p[12]);
1254 accum.add(z[35]);
1255 ws[11] = accum.extract();
1256 accum.mul(ws[13], p[23]);
1257 accum.mul(ws[14], p[22]);
1258 accum.mul(ws[15], p[21]);
1259 accum.mul(ws[16], p[20]);
1260 accum.mul(ws[17], p[19]);
1261 accum.mul(ws[18], p[18]);
1262 accum.mul(ws[19], p[17]);
1263 accum.mul(ws[20], p[16]);
1264 accum.mul(ws[21], p[15]);
1265 accum.mul(ws[22], p[14]);
1266 accum.mul(ws[23], p[13]);
1267 accum.add(z[36]);
1268 ws[12] = accum.extract();
1269 accum.mul(ws[14], p[23]);
1270 accum.mul(ws[15], p[22]);
1271 accum.mul(ws[16], p[21]);
1272 accum.mul(ws[17], p[20]);
1273 accum.mul(ws[18], p[19]);
1274 accum.mul(ws[19], p[18]);
1275 accum.mul(ws[20], p[17]);
1276 accum.mul(ws[21], p[16]);
1277 accum.mul(ws[22], p[15]);
1278 accum.mul(ws[23], p[14]);
1279 accum.add(z[37]);
1280 ws[13] = accum.extract();
1281 accum.mul(ws[15], p[23]);
1282 accum.mul(ws[16], p[22]);
1283 accum.mul(ws[17], p[21]);
1284 accum.mul(ws[18], p[20]);
1285 accum.mul(ws[19], p[19]);
1286 accum.mul(ws[20], p[18]);
1287 accum.mul(ws[21], p[17]);
1288 accum.mul(ws[22], p[16]);
1289 accum.mul(ws[23], p[15]);
1290 accum.add(z[38]);
1291 ws[14] = accum.extract();
1292 accum.mul(ws[16], p[23]);
1293 accum.mul(ws[17], p[22]);
1294 accum.mul(ws[18], p[21]);
1295 accum.mul(ws[19], p[20]);
1296 accum.mul(ws[20], p[19]);
1297 accum.mul(ws[21], p[18]);
1298 accum.mul(ws[22], p[17]);
1299 accum.mul(ws[23], p[16]);
1300 accum.add(z[39]);
1301 ws[15] = accum.extract();
1302 accum.mul(ws[17], p[23]);
1303 accum.mul(ws[18], p[22]);
1304 accum.mul(ws[19], p[21]);
1305 accum.mul(ws[20], p[20]);
1306 accum.mul(ws[21], p[19]);
1307 accum.mul(ws[22], p[18]);
1308 accum.mul(ws[23], p[17]);
1309 accum.add(z[40]);
1310 ws[16] = accum.extract();
1311 accum.mul(ws[18], p[23]);
1312 accum.mul(ws[19], p[22]);
1313 accum.mul(ws[20], p[21]);
1314 accum.mul(ws[21], p[20]);
1315 accum.mul(ws[22], p[19]);
1316 accum.mul(ws[23], p[18]);
1317 accum.add(z[41]);
1318 ws[17] = accum.extract();
1319 accum.mul(ws[19], p[23]);
1320 accum.mul(ws[20], p[22]);
1321 accum.mul(ws[21], p[21]);
1322 accum.mul(ws[22], p[20]);
1323 accum.mul(ws[23], p[19]);
1324 accum.add(z[42]);
1325 ws[18] = accum.extract();
1326 accum.mul(ws[20], p[23]);
1327 accum.mul(ws[21], p[22]);
1328 accum.mul(ws[22], p[21]);
1329 accum.mul(ws[23], p[20]);
1330 accum.add(z[43]);
1331 ws[19] = accum.extract();
1332 accum.mul(ws[21], p[23]);
1333 accum.mul(ws[22], p[22]);
1334 accum.mul(ws[23], p[21]);
1335 accum.add(z[44]);
1336 ws[20] = accum.extract();
1337 accum.mul(ws[22], p[23]);
1338 accum.mul(ws[23], p[22]);
1339 accum.add(z[45]);
1340 ws[21] = accum.extract();
1341 accum.mul(ws[23], p[23]);
1342 accum.add(z[46]);
1343 ws[22] = accum.extract();
1344 accum.add(z[47]);
1345 ws[23] = accum.extract();
1346 const word w1 = accum.extract();
1347 bigint_monty_maybe_sub<24>(r, w1, ws, p);
1348}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

◆ bigint_monty_redc_32()

void Botan::bigint_monty_redc_32 ( word r[32],
const word z[64],
const word p[32],
word p_dash,
word ws[32] )

Definition at line 1350 of file mp_monty_n.cpp.

1350 {
1351 word3<word> accum;
1352 accum.add(z[0]);
1353 ws[0] = accum.monty_step(p[0], p_dash);
1354 accum.mul(ws[0], p[1]);
1355 accum.add(z[1]);
1356 ws[1] = accum.monty_step(p[0], p_dash);
1357 accum.mul(ws[0], p[2]);
1358 accum.mul(ws[1], p[1]);
1359 accum.add(z[2]);
1360 ws[2] = accum.monty_step(p[0], p_dash);
1361 accum.mul(ws[0], p[3]);
1362 accum.mul(ws[1], p[2]);
1363 accum.mul(ws[2], p[1]);
1364 accum.add(z[3]);
1365 ws[3] = accum.monty_step(p[0], p_dash);
1366 accum.mul(ws[0], p[4]);
1367 accum.mul(ws[1], p[3]);
1368 accum.mul(ws[2], p[2]);
1369 accum.mul(ws[3], p[1]);
1370 accum.add(z[4]);
1371 ws[4] = accum.monty_step(p[0], p_dash);
1372 accum.mul(ws[0], p[5]);
1373 accum.mul(ws[1], p[4]);
1374 accum.mul(ws[2], p[3]);
1375 accum.mul(ws[3], p[2]);
1376 accum.mul(ws[4], p[1]);
1377 accum.add(z[5]);
1378 ws[5] = accum.monty_step(p[0], p_dash);
1379 accum.mul(ws[0], p[6]);
1380 accum.mul(ws[1], p[5]);
1381 accum.mul(ws[2], p[4]);
1382 accum.mul(ws[3], p[3]);
1383 accum.mul(ws[4], p[2]);
1384 accum.mul(ws[5], p[1]);
1385 accum.add(z[6]);
1386 ws[6] = accum.monty_step(p[0], p_dash);
1387 accum.mul(ws[0], p[7]);
1388 accum.mul(ws[1], p[6]);
1389 accum.mul(ws[2], p[5]);
1390 accum.mul(ws[3], p[4]);
1391 accum.mul(ws[4], p[3]);
1392 accum.mul(ws[5], p[2]);
1393 accum.mul(ws[6], p[1]);
1394 accum.add(z[7]);
1395 ws[7] = accum.monty_step(p[0], p_dash);
1396 accum.mul(ws[0], p[8]);
1397 accum.mul(ws[1], p[7]);
1398 accum.mul(ws[2], p[6]);
1399 accum.mul(ws[3], p[5]);
1400 accum.mul(ws[4], p[4]);
1401 accum.mul(ws[5], p[3]);
1402 accum.mul(ws[6], p[2]);
1403 accum.mul(ws[7], p[1]);
1404 accum.add(z[8]);
1405 ws[8] = accum.monty_step(p[0], p_dash);
1406 accum.mul(ws[0], p[9]);
1407 accum.mul(ws[1], p[8]);
1408 accum.mul(ws[2], p[7]);
1409 accum.mul(ws[3], p[6]);
1410 accum.mul(ws[4], p[5]);
1411 accum.mul(ws[5], p[4]);
1412 accum.mul(ws[6], p[3]);
1413 accum.mul(ws[7], p[2]);
1414 accum.mul(ws[8], p[1]);
1415 accum.add(z[9]);
1416 ws[9] = accum.monty_step(p[0], p_dash);
1417 accum.mul(ws[0], p[10]);
1418 accum.mul(ws[1], p[9]);
1419 accum.mul(ws[2], p[8]);
1420 accum.mul(ws[3], p[7]);
1421 accum.mul(ws[4], p[6]);
1422 accum.mul(ws[5], p[5]);
1423 accum.mul(ws[6], p[4]);
1424 accum.mul(ws[7], p[3]);
1425 accum.mul(ws[8], p[2]);
1426 accum.mul(ws[9], p[1]);
1427 accum.add(z[10]);
1428 ws[10] = accum.monty_step(p[0], p_dash);
1429 accum.mul(ws[0], p[11]);
1430 accum.mul(ws[1], p[10]);
1431 accum.mul(ws[2], p[9]);
1432 accum.mul(ws[3], p[8]);
1433 accum.mul(ws[4], p[7]);
1434 accum.mul(ws[5], p[6]);
1435 accum.mul(ws[6], p[5]);
1436 accum.mul(ws[7], p[4]);
1437 accum.mul(ws[8], p[3]);
1438 accum.mul(ws[9], p[2]);
1439 accum.mul(ws[10], p[1]);
1440 accum.add(z[11]);
1441 ws[11] = accum.monty_step(p[0], p_dash);
1442 accum.mul(ws[0], p[12]);
1443 accum.mul(ws[1], p[11]);
1444 accum.mul(ws[2], p[10]);
1445 accum.mul(ws[3], p[9]);
1446 accum.mul(ws[4], p[8]);
1447 accum.mul(ws[5], p[7]);
1448 accum.mul(ws[6], p[6]);
1449 accum.mul(ws[7], p[5]);
1450 accum.mul(ws[8], p[4]);
1451 accum.mul(ws[9], p[3]);
1452 accum.mul(ws[10], p[2]);
1453 accum.mul(ws[11], p[1]);
1454 accum.add(z[12]);
1455 ws[12] = accum.monty_step(p[0], p_dash);
1456 accum.mul(ws[0], p[13]);
1457 accum.mul(ws[1], p[12]);
1458 accum.mul(ws[2], p[11]);
1459 accum.mul(ws[3], p[10]);
1460 accum.mul(ws[4], p[9]);
1461 accum.mul(ws[5], p[8]);
1462 accum.mul(ws[6], p[7]);
1463 accum.mul(ws[7], p[6]);
1464 accum.mul(ws[8], p[5]);
1465 accum.mul(ws[9], p[4]);
1466 accum.mul(ws[10], p[3]);
1467 accum.mul(ws[11], p[2]);
1468 accum.mul(ws[12], p[1]);
1469 accum.add(z[13]);
1470 ws[13] = accum.monty_step(p[0], p_dash);
1471 accum.mul(ws[0], p[14]);
1472 accum.mul(ws[1], p[13]);
1473 accum.mul(ws[2], p[12]);
1474 accum.mul(ws[3], p[11]);
1475 accum.mul(ws[4], p[10]);
1476 accum.mul(ws[5], p[9]);
1477 accum.mul(ws[6], p[8]);
1478 accum.mul(ws[7], p[7]);
1479 accum.mul(ws[8], p[6]);
1480 accum.mul(ws[9], p[5]);
1481 accum.mul(ws[10], p[4]);
1482 accum.mul(ws[11], p[3]);
1483 accum.mul(ws[12], p[2]);
1484 accum.mul(ws[13], p[1]);
1485 accum.add(z[14]);
1486 ws[14] = accum.monty_step(p[0], p_dash);
1487 accum.mul(ws[0], p[15]);
1488 accum.mul(ws[1], p[14]);
1489 accum.mul(ws[2], p[13]);
1490 accum.mul(ws[3], p[12]);
1491 accum.mul(ws[4], p[11]);
1492 accum.mul(ws[5], p[10]);
1493 accum.mul(ws[6], p[9]);
1494 accum.mul(ws[7], p[8]);
1495 accum.mul(ws[8], p[7]);
1496 accum.mul(ws[9], p[6]);
1497 accum.mul(ws[10], p[5]);
1498 accum.mul(ws[11], p[4]);
1499 accum.mul(ws[12], p[3]);
1500 accum.mul(ws[13], p[2]);
1501 accum.mul(ws[14], p[1]);
1502 accum.add(z[15]);
1503 ws[15] = accum.monty_step(p[0], p_dash);
1504 accum.mul(ws[0], p[16]);
1505 accum.mul(ws[1], p[15]);
1506 accum.mul(ws[2], p[14]);
1507 accum.mul(ws[3], p[13]);
1508 accum.mul(ws[4], p[12]);
1509 accum.mul(ws[5], p[11]);
1510 accum.mul(ws[6], p[10]);
1511 accum.mul(ws[7], p[9]);
1512 accum.mul(ws[8], p[8]);
1513 accum.mul(ws[9], p[7]);
1514 accum.mul(ws[10], p[6]);
1515 accum.mul(ws[11], p[5]);
1516 accum.mul(ws[12], p[4]);
1517 accum.mul(ws[13], p[3]);
1518 accum.mul(ws[14], p[2]);
1519 accum.mul(ws[15], p[1]);
1520 accum.add(z[16]);
1521 ws[16] = accum.monty_step(p[0], p_dash);
1522 accum.mul(ws[0], p[17]);
1523 accum.mul(ws[1], p[16]);
1524 accum.mul(ws[2], p[15]);
1525 accum.mul(ws[3], p[14]);
1526 accum.mul(ws[4], p[13]);
1527 accum.mul(ws[5], p[12]);
1528 accum.mul(ws[6], p[11]);
1529 accum.mul(ws[7], p[10]);
1530 accum.mul(ws[8], p[9]);
1531 accum.mul(ws[9], p[8]);
1532 accum.mul(ws[10], p[7]);
1533 accum.mul(ws[11], p[6]);
1534 accum.mul(ws[12], p[5]);
1535 accum.mul(ws[13], p[4]);
1536 accum.mul(ws[14], p[3]);
1537 accum.mul(ws[15], p[2]);
1538 accum.mul(ws[16], p[1]);
1539 accum.add(z[17]);
1540 ws[17] = accum.monty_step(p[0], p_dash);
1541 accum.mul(ws[0], p[18]);
1542 accum.mul(ws[1], p[17]);
1543 accum.mul(ws[2], p[16]);
1544 accum.mul(ws[3], p[15]);
1545 accum.mul(ws[4], p[14]);
1546 accum.mul(ws[5], p[13]);
1547 accum.mul(ws[6], p[12]);
1548 accum.mul(ws[7], p[11]);
1549 accum.mul(ws[8], p[10]);
1550 accum.mul(ws[9], p[9]);
1551 accum.mul(ws[10], p[8]);
1552 accum.mul(ws[11], p[7]);
1553 accum.mul(ws[12], p[6]);
1554 accum.mul(ws[13], p[5]);
1555 accum.mul(ws[14], p[4]);
1556 accum.mul(ws[15], p[3]);
1557 accum.mul(ws[16], p[2]);
1558 accum.mul(ws[17], p[1]);
1559 accum.add(z[18]);
1560 ws[18] = accum.monty_step(p[0], p_dash);
1561 accum.mul(ws[0], p[19]);
1562 accum.mul(ws[1], p[18]);
1563 accum.mul(ws[2], p[17]);
1564 accum.mul(ws[3], p[16]);
1565 accum.mul(ws[4], p[15]);
1566 accum.mul(ws[5], p[14]);
1567 accum.mul(ws[6], p[13]);
1568 accum.mul(ws[7], p[12]);
1569 accum.mul(ws[8], p[11]);
1570 accum.mul(ws[9], p[10]);
1571 accum.mul(ws[10], p[9]);
1572 accum.mul(ws[11], p[8]);
1573 accum.mul(ws[12], p[7]);
1574 accum.mul(ws[13], p[6]);
1575 accum.mul(ws[14], p[5]);
1576 accum.mul(ws[15], p[4]);
1577 accum.mul(ws[16], p[3]);
1578 accum.mul(ws[17], p[2]);
1579 accum.mul(ws[18], p[1]);
1580 accum.add(z[19]);
1581 ws[19] = accum.monty_step(p[0], p_dash);
1582 accum.mul(ws[0], p[20]);
1583 accum.mul(ws[1], p[19]);
1584 accum.mul(ws[2], p[18]);
1585 accum.mul(ws[3], p[17]);
1586 accum.mul(ws[4], p[16]);
1587 accum.mul(ws[5], p[15]);
1588 accum.mul(ws[6], p[14]);
1589 accum.mul(ws[7], p[13]);
1590 accum.mul(ws[8], p[12]);
1591 accum.mul(ws[9], p[11]);
1592 accum.mul(ws[10], p[10]);
1593 accum.mul(ws[11], p[9]);
1594 accum.mul(ws[12], p[8]);
1595 accum.mul(ws[13], p[7]);
1596 accum.mul(ws[14], p[6]);
1597 accum.mul(ws[15], p[5]);
1598 accum.mul(ws[16], p[4]);
1599 accum.mul(ws[17], p[3]);
1600 accum.mul(ws[18], p[2]);
1601 accum.mul(ws[19], p[1]);
1602 accum.add(z[20]);
1603 ws[20] = accum.monty_step(p[0], p_dash);
1604 accum.mul(ws[0], p[21]);
1605 accum.mul(ws[1], p[20]);
1606 accum.mul(ws[2], p[19]);
1607 accum.mul(ws[3], p[18]);
1608 accum.mul(ws[4], p[17]);
1609 accum.mul(ws[5], p[16]);
1610 accum.mul(ws[6], p[15]);
1611 accum.mul(ws[7], p[14]);
1612 accum.mul(ws[8], p[13]);
1613 accum.mul(ws[9], p[12]);
1614 accum.mul(ws[10], p[11]);
1615 accum.mul(ws[11], p[10]);
1616 accum.mul(ws[12], p[9]);
1617 accum.mul(ws[13], p[8]);
1618 accum.mul(ws[14], p[7]);
1619 accum.mul(ws[15], p[6]);
1620 accum.mul(ws[16], p[5]);
1621 accum.mul(ws[17], p[4]);
1622 accum.mul(ws[18], p[3]);
1623 accum.mul(ws[19], p[2]);
1624 accum.mul(ws[20], p[1]);
1625 accum.add(z[21]);
1626 ws[21] = accum.monty_step(p[0], p_dash);
1627 accum.mul(ws[0], p[22]);
1628 accum.mul(ws[1], p[21]);
1629 accum.mul(ws[2], p[20]);
1630 accum.mul(ws[3], p[19]);
1631 accum.mul(ws[4], p[18]);
1632 accum.mul(ws[5], p[17]);
1633 accum.mul(ws[6], p[16]);
1634 accum.mul(ws[7], p[15]);
1635 accum.mul(ws[8], p[14]);
1636 accum.mul(ws[9], p[13]);
1637 accum.mul(ws[10], p[12]);
1638 accum.mul(ws[11], p[11]);
1639 accum.mul(ws[12], p[10]);
1640 accum.mul(ws[13], p[9]);
1641 accum.mul(ws[14], p[8]);
1642 accum.mul(ws[15], p[7]);
1643 accum.mul(ws[16], p[6]);
1644 accum.mul(ws[17], p[5]);
1645 accum.mul(ws[18], p[4]);
1646 accum.mul(ws[19], p[3]);
1647 accum.mul(ws[20], p[2]);
1648 accum.mul(ws[21], p[1]);
1649 accum.add(z[22]);
1650 ws[22] = accum.monty_step(p[0], p_dash);
1651 accum.mul(ws[0], p[23]);
1652 accum.mul(ws[1], p[22]);
1653 accum.mul(ws[2], p[21]);
1654 accum.mul(ws[3], p[20]);
1655 accum.mul(ws[4], p[19]);
1656 accum.mul(ws[5], p[18]);
1657 accum.mul(ws[6], p[17]);
1658 accum.mul(ws[7], p[16]);
1659 accum.mul(ws[8], p[15]);
1660 accum.mul(ws[9], p[14]);
1661 accum.mul(ws[10], p[13]);
1662 accum.mul(ws[11], p[12]);
1663 accum.mul(ws[12], p[11]);
1664 accum.mul(ws[13], p[10]);
1665 accum.mul(ws[14], p[9]);
1666 accum.mul(ws[15], p[8]);
1667 accum.mul(ws[16], p[7]);
1668 accum.mul(ws[17], p[6]);
1669 accum.mul(ws[18], p[5]);
1670 accum.mul(ws[19], p[4]);
1671 accum.mul(ws[20], p[3]);
1672 accum.mul(ws[21], p[2]);
1673 accum.mul(ws[22], p[1]);
1674 accum.add(z[23]);
1675 ws[23] = accum.monty_step(p[0], p_dash);
1676 accum.mul(ws[0], p[24]);
1677 accum.mul(ws[1], p[23]);
1678 accum.mul(ws[2], p[22]);
1679 accum.mul(ws[3], p[21]);
1680 accum.mul(ws[4], p[20]);
1681 accum.mul(ws[5], p[19]);
1682 accum.mul(ws[6], p[18]);
1683 accum.mul(ws[7], p[17]);
1684 accum.mul(ws[8], p[16]);
1685 accum.mul(ws[9], p[15]);
1686 accum.mul(ws[10], p[14]);
1687 accum.mul(ws[11], p[13]);
1688 accum.mul(ws[12], p[12]);
1689 accum.mul(ws[13], p[11]);
1690 accum.mul(ws[14], p[10]);
1691 accum.mul(ws[15], p[9]);
1692 accum.mul(ws[16], p[8]);
1693 accum.mul(ws[17], p[7]);
1694 accum.mul(ws[18], p[6]);
1695 accum.mul(ws[19], p[5]);
1696 accum.mul(ws[20], p[4]);
1697 accum.mul(ws[21], p[3]);
1698 accum.mul(ws[22], p[2]);
1699 accum.mul(ws[23], p[1]);
1700 accum.add(z[24]);
1701 ws[24] = accum.monty_step(p[0], p_dash);
1702 accum.mul(ws[0], p[25]);
1703 accum.mul(ws[1], p[24]);
1704 accum.mul(ws[2], p[23]);
1705 accum.mul(ws[3], p[22]);
1706 accum.mul(ws[4], p[21]);
1707 accum.mul(ws[5], p[20]);
1708 accum.mul(ws[6], p[19]);
1709 accum.mul(ws[7], p[18]);
1710 accum.mul(ws[8], p[17]);
1711 accum.mul(ws[9], p[16]);
1712 accum.mul(ws[10], p[15]);
1713 accum.mul(ws[11], p[14]);
1714 accum.mul(ws[12], p[13]);
1715 accum.mul(ws[13], p[12]);
1716 accum.mul(ws[14], p[11]);
1717 accum.mul(ws[15], p[10]);
1718 accum.mul(ws[16], p[9]);
1719 accum.mul(ws[17], p[8]);
1720 accum.mul(ws[18], p[7]);
1721 accum.mul(ws[19], p[6]);
1722 accum.mul(ws[20], p[5]);
1723 accum.mul(ws[21], p[4]);
1724 accum.mul(ws[22], p[3]);
1725 accum.mul(ws[23], p[2]);
1726 accum.mul(ws[24], p[1]);
1727 accum.add(z[25]);
1728 ws[25] = accum.monty_step(p[0], p_dash);
1729 accum.mul(ws[0], p[26]);
1730 accum.mul(ws[1], p[25]);
1731 accum.mul(ws[2], p[24]);
1732 accum.mul(ws[3], p[23]);
1733 accum.mul(ws[4], p[22]);
1734 accum.mul(ws[5], p[21]);
1735 accum.mul(ws[6], p[20]);
1736 accum.mul(ws[7], p[19]);
1737 accum.mul(ws[8], p[18]);
1738 accum.mul(ws[9], p[17]);
1739 accum.mul(ws[10], p[16]);
1740 accum.mul(ws[11], p[15]);
1741 accum.mul(ws[12], p[14]);
1742 accum.mul(ws[13], p[13]);
1743 accum.mul(ws[14], p[12]);
1744 accum.mul(ws[15], p[11]);
1745 accum.mul(ws[16], p[10]);
1746 accum.mul(ws[17], p[9]);
1747 accum.mul(ws[18], p[8]);
1748 accum.mul(ws[19], p[7]);
1749 accum.mul(ws[20], p[6]);
1750 accum.mul(ws[21], p[5]);
1751 accum.mul(ws[22], p[4]);
1752 accum.mul(ws[23], p[3]);
1753 accum.mul(ws[24], p[2]);
1754 accum.mul(ws[25], p[1]);
1755 accum.add(z[26]);
1756 ws[26] = accum.monty_step(p[0], p_dash);
1757 accum.mul(ws[0], p[27]);
1758 accum.mul(ws[1], p[26]);
1759 accum.mul(ws[2], p[25]);
1760 accum.mul(ws[3], p[24]);
1761 accum.mul(ws[4], p[23]);
1762 accum.mul(ws[5], p[22]);
1763 accum.mul(ws[6], p[21]);
1764 accum.mul(ws[7], p[20]);
1765 accum.mul(ws[8], p[19]);
1766 accum.mul(ws[9], p[18]);
1767 accum.mul(ws[10], p[17]);
1768 accum.mul(ws[11], p[16]);
1769 accum.mul(ws[12], p[15]);
1770 accum.mul(ws[13], p[14]);
1771 accum.mul(ws[14], p[13]);
1772 accum.mul(ws[15], p[12]);
1773 accum.mul(ws[16], p[11]);
1774 accum.mul(ws[17], p[10]);
1775 accum.mul(ws[18], p[9]);
1776 accum.mul(ws[19], p[8]);
1777 accum.mul(ws[20], p[7]);
1778 accum.mul(ws[21], p[6]);
1779 accum.mul(ws[22], p[5]);
1780 accum.mul(ws[23], p[4]);
1781 accum.mul(ws[24], p[3]);
1782 accum.mul(ws[25], p[2]);
1783 accum.mul(ws[26], p[1]);
1784 accum.add(z[27]);
1785 ws[27] = accum.monty_step(p[0], p_dash);
1786 accum.mul(ws[0], p[28]);
1787 accum.mul(ws[1], p[27]);
1788 accum.mul(ws[2], p[26]);
1789 accum.mul(ws[3], p[25]);
1790 accum.mul(ws[4], p[24]);
1791 accum.mul(ws[5], p[23]);
1792 accum.mul(ws[6], p[22]);
1793 accum.mul(ws[7], p[21]);
1794 accum.mul(ws[8], p[20]);
1795 accum.mul(ws[9], p[19]);
1796 accum.mul(ws[10], p[18]);
1797 accum.mul(ws[11], p[17]);
1798 accum.mul(ws[12], p[16]);
1799 accum.mul(ws[13], p[15]);
1800 accum.mul(ws[14], p[14]);
1801 accum.mul(ws[15], p[13]);
1802 accum.mul(ws[16], p[12]);
1803 accum.mul(ws[17], p[11]);
1804 accum.mul(ws[18], p[10]);
1805 accum.mul(ws[19], p[9]);
1806 accum.mul(ws[20], p[8]);
1807 accum.mul(ws[21], p[7]);
1808 accum.mul(ws[22], p[6]);
1809 accum.mul(ws[23], p[5]);
1810 accum.mul(ws[24], p[4]);
1811 accum.mul(ws[25], p[3]);
1812 accum.mul(ws[26], p[2]);
1813 accum.mul(ws[27], p[1]);
1814 accum.add(z[28]);
1815 ws[28] = accum.monty_step(p[0], p_dash);
1816 accum.mul(ws[0], p[29]);
1817 accum.mul(ws[1], p[28]);
1818 accum.mul(ws[2], p[27]);
1819 accum.mul(ws[3], p[26]);
1820 accum.mul(ws[4], p[25]);
1821 accum.mul(ws[5], p[24]);
1822 accum.mul(ws[6], p[23]);
1823 accum.mul(ws[7], p[22]);
1824 accum.mul(ws[8], p[21]);
1825 accum.mul(ws[9], p[20]);
1826 accum.mul(ws[10], p[19]);
1827 accum.mul(ws[11], p[18]);
1828 accum.mul(ws[12], p[17]);
1829 accum.mul(ws[13], p[16]);
1830 accum.mul(ws[14], p[15]);
1831 accum.mul(ws[15], p[14]);
1832 accum.mul(ws[16], p[13]);
1833 accum.mul(ws[17], p[12]);
1834 accum.mul(ws[18], p[11]);
1835 accum.mul(ws[19], p[10]);
1836 accum.mul(ws[20], p[9]);
1837 accum.mul(ws[21], p[8]);
1838 accum.mul(ws[22], p[7]);
1839 accum.mul(ws[23], p[6]);
1840 accum.mul(ws[24], p[5]);
1841 accum.mul(ws[25], p[4]);
1842 accum.mul(ws[26], p[3]);
1843 accum.mul(ws[27], p[2]);
1844 accum.mul(ws[28], p[1]);
1845 accum.add(z[29]);
1846 ws[29] = accum.monty_step(p[0], p_dash);
1847 accum.mul(ws[0], p[30]);
1848 accum.mul(ws[1], p[29]);
1849 accum.mul(ws[2], p[28]);
1850 accum.mul(ws[3], p[27]);
1851 accum.mul(ws[4], p[26]);
1852 accum.mul(ws[5], p[25]);
1853 accum.mul(ws[6], p[24]);
1854 accum.mul(ws[7], p[23]);
1855 accum.mul(ws[8], p[22]);
1856 accum.mul(ws[9], p[21]);
1857 accum.mul(ws[10], p[20]);
1858 accum.mul(ws[11], p[19]);
1859 accum.mul(ws[12], p[18]);
1860 accum.mul(ws[13], p[17]);
1861 accum.mul(ws[14], p[16]);
1862 accum.mul(ws[15], p[15]);
1863 accum.mul(ws[16], p[14]);
1864 accum.mul(ws[17], p[13]);
1865 accum.mul(ws[18], p[12]);
1866 accum.mul(ws[19], p[11]);
1867 accum.mul(ws[20], p[10]);
1868 accum.mul(ws[21], p[9]);
1869 accum.mul(ws[22], p[8]);
1870 accum.mul(ws[23], p[7]);
1871 accum.mul(ws[24], p[6]);
1872 accum.mul(ws[25], p[5]);
1873 accum.mul(ws[26], p[4]);
1874 accum.mul(ws[27], p[3]);
1875 accum.mul(ws[28], p[2]);
1876 accum.mul(ws[29], p[1]);
1877 accum.add(z[30]);
1878 ws[30] = accum.monty_step(p[0], p_dash);
1879 accum.mul(ws[0], p[31]);
1880 accum.mul(ws[1], p[30]);
1881 accum.mul(ws[2], p[29]);
1882 accum.mul(ws[3], p[28]);
1883 accum.mul(ws[4], p[27]);
1884 accum.mul(ws[5], p[26]);
1885 accum.mul(ws[6], p[25]);
1886 accum.mul(ws[7], p[24]);
1887 accum.mul(ws[8], p[23]);
1888 accum.mul(ws[9], p[22]);
1889 accum.mul(ws[10], p[21]);
1890 accum.mul(ws[11], p[20]);
1891 accum.mul(ws[12], p[19]);
1892 accum.mul(ws[13], p[18]);
1893 accum.mul(ws[14], p[17]);
1894 accum.mul(ws[15], p[16]);
1895 accum.mul(ws[16], p[15]);
1896 accum.mul(ws[17], p[14]);
1897 accum.mul(ws[18], p[13]);
1898 accum.mul(ws[19], p[12]);
1899 accum.mul(ws[20], p[11]);
1900 accum.mul(ws[21], p[10]);
1901 accum.mul(ws[22], p[9]);
1902 accum.mul(ws[23], p[8]);
1903 accum.mul(ws[24], p[7]);
1904 accum.mul(ws[25], p[6]);
1905 accum.mul(ws[26], p[5]);
1906 accum.mul(ws[27], p[4]);
1907 accum.mul(ws[28], p[3]);
1908 accum.mul(ws[29], p[2]);
1909 accum.mul(ws[30], p[1]);
1910 accum.add(z[31]);
1911 ws[31] = accum.monty_step(p[0], p_dash);
1912 accum.mul(ws[1], p[31]);
1913 accum.mul(ws[2], p[30]);
1914 accum.mul(ws[3], p[29]);
1915 accum.mul(ws[4], p[28]);
1916 accum.mul(ws[5], p[27]);
1917 accum.mul(ws[6], p[26]);
1918 accum.mul(ws[7], p[25]);
1919 accum.mul(ws[8], p[24]);
1920 accum.mul(ws[9], p[23]);
1921 accum.mul(ws[10], p[22]);
1922 accum.mul(ws[11], p[21]);
1923 accum.mul(ws[12], p[20]);
1924 accum.mul(ws[13], p[19]);
1925 accum.mul(ws[14], p[18]);
1926 accum.mul(ws[15], p[17]);
1927 accum.mul(ws[16], p[16]);
1928 accum.mul(ws[17], p[15]);
1929 accum.mul(ws[18], p[14]);
1930 accum.mul(ws[19], p[13]);
1931 accum.mul(ws[20], p[12]);
1932 accum.mul(ws[21], p[11]);
1933 accum.mul(ws[22], p[10]);
1934 accum.mul(ws[23], p[9]);
1935 accum.mul(ws[24], p[8]);
1936 accum.mul(ws[25], p[7]);
1937 accum.mul(ws[26], p[6]);
1938 accum.mul(ws[27], p[5]);
1939 accum.mul(ws[28], p[4]);
1940 accum.mul(ws[29], p[3]);
1941 accum.mul(ws[30], p[2]);
1942 accum.mul(ws[31], p[1]);
1943 accum.add(z[32]);
1944 ws[0] = accum.extract();
1945 accum.mul(ws[2], p[31]);
1946 accum.mul(ws[3], p[30]);
1947 accum.mul(ws[4], p[29]);
1948 accum.mul(ws[5], p[28]);
1949 accum.mul(ws[6], p[27]);
1950 accum.mul(ws[7], p[26]);
1951 accum.mul(ws[8], p[25]);
1952 accum.mul(ws[9], p[24]);
1953 accum.mul(ws[10], p[23]);
1954 accum.mul(ws[11], p[22]);
1955 accum.mul(ws[12], p[21]);
1956 accum.mul(ws[13], p[20]);
1957 accum.mul(ws[14], p[19]);
1958 accum.mul(ws[15], p[18]);
1959 accum.mul(ws[16], p[17]);
1960 accum.mul(ws[17], p[16]);
1961 accum.mul(ws[18], p[15]);
1962 accum.mul(ws[19], p[14]);
1963 accum.mul(ws[20], p[13]);
1964 accum.mul(ws[21], p[12]);
1965 accum.mul(ws[22], p[11]);
1966 accum.mul(ws[23], p[10]);
1967 accum.mul(ws[24], p[9]);
1968 accum.mul(ws[25], p[8]);
1969 accum.mul(ws[26], p[7]);
1970 accum.mul(ws[27], p[6]);
1971 accum.mul(ws[28], p[5]);
1972 accum.mul(ws[29], p[4]);
1973 accum.mul(ws[30], p[3]);
1974 accum.mul(ws[31], p[2]);
1975 accum.add(z[33]);
1976 ws[1] = accum.extract();
1977 accum.mul(ws[3], p[31]);
1978 accum.mul(ws[4], p[30]);
1979 accum.mul(ws[5], p[29]);
1980 accum.mul(ws[6], p[28]);
1981 accum.mul(ws[7], p[27]);
1982 accum.mul(ws[8], p[26]);
1983 accum.mul(ws[9], p[25]);
1984 accum.mul(ws[10], p[24]);
1985 accum.mul(ws[11], p[23]);
1986 accum.mul(ws[12], p[22]);
1987 accum.mul(ws[13], p[21]);
1988 accum.mul(ws[14], p[20]);
1989 accum.mul(ws[15], p[19]);
1990 accum.mul(ws[16], p[18]);
1991 accum.mul(ws[17], p[17]);
1992 accum.mul(ws[18], p[16]);
1993 accum.mul(ws[19], p[15]);
1994 accum.mul(ws[20], p[14]);
1995 accum.mul(ws[21], p[13]);
1996 accum.mul(ws[22], p[12]);
1997 accum.mul(ws[23], p[11]);
1998 accum.mul(ws[24], p[10]);
1999 accum.mul(ws[25], p[9]);
2000 accum.mul(ws[26], p[8]);
2001 accum.mul(ws[27], p[7]);
2002 accum.mul(ws[28], p[6]);
2003 accum.mul(ws[29], p[5]);
2004 accum.mul(ws[30], p[4]);
2005 accum.mul(ws[31], p[3]);
2006 accum.add(z[34]);
2007 ws[2] = accum.extract();
2008 accum.mul(ws[4], p[31]);
2009 accum.mul(ws[5], p[30]);
2010 accum.mul(ws[6], p[29]);
2011 accum.mul(ws[7], p[28]);
2012 accum.mul(ws[8], p[27]);
2013 accum.mul(ws[9], p[26]);
2014 accum.mul(ws[10], p[25]);
2015 accum.mul(ws[11], p[24]);
2016 accum.mul(ws[12], p[23]);
2017 accum.mul(ws[13], p[22]);
2018 accum.mul(ws[14], p[21]);
2019 accum.mul(ws[15], p[20]);
2020 accum.mul(ws[16], p[19]);
2021 accum.mul(ws[17], p[18]);
2022 accum.mul(ws[18], p[17]);
2023 accum.mul(ws[19], p[16]);
2024 accum.mul(ws[20], p[15]);
2025 accum.mul(ws[21], p[14]);
2026 accum.mul(ws[22], p[13]);
2027 accum.mul(ws[23], p[12]);
2028 accum.mul(ws[24], p[11]);
2029 accum.mul(ws[25], p[10]);
2030 accum.mul(ws[26], p[9]);
2031 accum.mul(ws[27], p[8]);
2032 accum.mul(ws[28], p[7]);
2033 accum.mul(ws[29], p[6]);
2034 accum.mul(ws[30], p[5]);
2035 accum.mul(ws[31], p[4]);
2036 accum.add(z[35]);
2037 ws[3] = accum.extract();
2038 accum.mul(ws[5], p[31]);
2039 accum.mul(ws[6], p[30]);
2040 accum.mul(ws[7], p[29]);
2041 accum.mul(ws[8], p[28]);
2042 accum.mul(ws[9], p[27]);
2043 accum.mul(ws[10], p[26]);
2044 accum.mul(ws[11], p[25]);
2045 accum.mul(ws[12], p[24]);
2046 accum.mul(ws[13], p[23]);
2047 accum.mul(ws[14], p[22]);
2048 accum.mul(ws[15], p[21]);
2049 accum.mul(ws[16], p[20]);
2050 accum.mul(ws[17], p[19]);
2051 accum.mul(ws[18], p[18]);
2052 accum.mul(ws[19], p[17]);
2053 accum.mul(ws[20], p[16]);
2054 accum.mul(ws[21], p[15]);
2055 accum.mul(ws[22], p[14]);
2056 accum.mul(ws[23], p[13]);
2057 accum.mul(ws[24], p[12]);
2058 accum.mul(ws[25], p[11]);
2059 accum.mul(ws[26], p[10]);
2060 accum.mul(ws[27], p[9]);
2061 accum.mul(ws[28], p[8]);
2062 accum.mul(ws[29], p[7]);
2063 accum.mul(ws[30], p[6]);
2064 accum.mul(ws[31], p[5]);
2065 accum.add(z[36]);
2066 ws[4] = accum.extract();
2067 accum.mul(ws[6], p[31]);
2068 accum.mul(ws[7], p[30]);
2069 accum.mul(ws[8], p[29]);
2070 accum.mul(ws[9], p[28]);
2071 accum.mul(ws[10], p[27]);
2072 accum.mul(ws[11], p[26]);
2073 accum.mul(ws[12], p[25]);
2074 accum.mul(ws[13], p[24]);
2075 accum.mul(ws[14], p[23]);
2076 accum.mul(ws[15], p[22]);
2077 accum.mul(ws[16], p[21]);
2078 accum.mul(ws[17], p[20]);
2079 accum.mul(ws[18], p[19]);
2080 accum.mul(ws[19], p[18]);
2081 accum.mul(ws[20], p[17]);
2082 accum.mul(ws[21], p[16]);
2083 accum.mul(ws[22], p[15]);
2084 accum.mul(ws[23], p[14]);
2085 accum.mul(ws[24], p[13]);
2086 accum.mul(ws[25], p[12]);
2087 accum.mul(ws[26], p[11]);
2088 accum.mul(ws[27], p[10]);
2089 accum.mul(ws[28], p[9]);
2090 accum.mul(ws[29], p[8]);
2091 accum.mul(ws[30], p[7]);
2092 accum.mul(ws[31], p[6]);
2093 accum.add(z[37]);
2094 ws[5] = accum.extract();
2095 accum.mul(ws[7], p[31]);
2096 accum.mul(ws[8], p[30]);
2097 accum.mul(ws[9], p[29]);
2098 accum.mul(ws[10], p[28]);
2099 accum.mul(ws[11], p[27]);
2100 accum.mul(ws[12], p[26]);
2101 accum.mul(ws[13], p[25]);
2102 accum.mul(ws[14], p[24]);
2103 accum.mul(ws[15], p[23]);
2104 accum.mul(ws[16], p[22]);
2105 accum.mul(ws[17], p[21]);
2106 accum.mul(ws[18], p[20]);
2107 accum.mul(ws[19], p[19]);
2108 accum.mul(ws[20], p[18]);
2109 accum.mul(ws[21], p[17]);
2110 accum.mul(ws[22], p[16]);
2111 accum.mul(ws[23], p[15]);
2112 accum.mul(ws[24], p[14]);
2113 accum.mul(ws[25], p[13]);
2114 accum.mul(ws[26], p[12]);
2115 accum.mul(ws[27], p[11]);
2116 accum.mul(ws[28], p[10]);
2117 accum.mul(ws[29], p[9]);
2118 accum.mul(ws[30], p[8]);
2119 accum.mul(ws[31], p[7]);
2120 accum.add(z[38]);
2121 ws[6] = accum.extract();
2122 accum.mul(ws[8], p[31]);
2123 accum.mul(ws[9], p[30]);
2124 accum.mul(ws[10], p[29]);
2125 accum.mul(ws[11], p[28]);
2126 accum.mul(ws[12], p[27]);
2127 accum.mul(ws[13], p[26]);
2128 accum.mul(ws[14], p[25]);
2129 accum.mul(ws[15], p[24]);
2130 accum.mul(ws[16], p[23]);
2131 accum.mul(ws[17], p[22]);
2132 accum.mul(ws[18], p[21]);
2133 accum.mul(ws[19], p[20]);
2134 accum.mul(ws[20], p[19]);
2135 accum.mul(ws[21], p[18]);
2136 accum.mul(ws[22], p[17]);
2137 accum.mul(ws[23], p[16]);
2138 accum.mul(ws[24], p[15]);
2139 accum.mul(ws[25], p[14]);
2140 accum.mul(ws[26], p[13]);
2141 accum.mul(ws[27], p[12]);
2142 accum.mul(ws[28], p[11]);
2143 accum.mul(ws[29], p[10]);
2144 accum.mul(ws[30], p[9]);
2145 accum.mul(ws[31], p[8]);
2146 accum.add(z[39]);
2147 ws[7] = accum.extract();
2148 accum.mul(ws[9], p[31]);
2149 accum.mul(ws[10], p[30]);
2150 accum.mul(ws[11], p[29]);
2151 accum.mul(ws[12], p[28]);
2152 accum.mul(ws[13], p[27]);
2153 accum.mul(ws[14], p[26]);
2154 accum.mul(ws[15], p[25]);
2155 accum.mul(ws[16], p[24]);
2156 accum.mul(ws[17], p[23]);
2157 accum.mul(ws[18], p[22]);
2158 accum.mul(ws[19], p[21]);
2159 accum.mul(ws[20], p[20]);
2160 accum.mul(ws[21], p[19]);
2161 accum.mul(ws[22], p[18]);
2162 accum.mul(ws[23], p[17]);
2163 accum.mul(ws[24], p[16]);
2164 accum.mul(ws[25], p[15]);
2165 accum.mul(ws[26], p[14]);
2166 accum.mul(ws[27], p[13]);
2167 accum.mul(ws[28], p[12]);
2168 accum.mul(ws[29], p[11]);
2169 accum.mul(ws[30], p[10]);
2170 accum.mul(ws[31], p[9]);
2171 accum.add(z[40]);
2172 ws[8] = accum.extract();
2173 accum.mul(ws[10], p[31]);
2174 accum.mul(ws[11], p[30]);
2175 accum.mul(ws[12], p[29]);
2176 accum.mul(ws[13], p[28]);
2177 accum.mul(ws[14], p[27]);
2178 accum.mul(ws[15], p[26]);
2179 accum.mul(ws[16], p[25]);
2180 accum.mul(ws[17], p[24]);
2181 accum.mul(ws[18], p[23]);
2182 accum.mul(ws[19], p[22]);
2183 accum.mul(ws[20], p[21]);
2184 accum.mul(ws[21], p[20]);
2185 accum.mul(ws[22], p[19]);
2186 accum.mul(ws[23], p[18]);
2187 accum.mul(ws[24], p[17]);
2188 accum.mul(ws[25], p[16]);
2189 accum.mul(ws[26], p[15]);
2190 accum.mul(ws[27], p[14]);
2191 accum.mul(ws[28], p[13]);
2192 accum.mul(ws[29], p[12]);
2193 accum.mul(ws[30], p[11]);
2194 accum.mul(ws[31], p[10]);
2195 accum.add(z[41]);
2196 ws[9] = accum.extract();
2197 accum.mul(ws[11], p[31]);
2198 accum.mul(ws[12], p[30]);
2199 accum.mul(ws[13], p[29]);
2200 accum.mul(ws[14], p[28]);
2201 accum.mul(ws[15], p[27]);
2202 accum.mul(ws[16], p[26]);
2203 accum.mul(ws[17], p[25]);
2204 accum.mul(ws[18], p[24]);
2205 accum.mul(ws[19], p[23]);
2206 accum.mul(ws[20], p[22]);
2207 accum.mul(ws[21], p[21]);
2208 accum.mul(ws[22], p[20]);
2209 accum.mul(ws[23], p[19]);
2210 accum.mul(ws[24], p[18]);
2211 accum.mul(ws[25], p[17]);
2212 accum.mul(ws[26], p[16]);
2213 accum.mul(ws[27], p[15]);
2214 accum.mul(ws[28], p[14]);
2215 accum.mul(ws[29], p[13]);
2216 accum.mul(ws[30], p[12]);
2217 accum.mul(ws[31], p[11]);
2218 accum.add(z[42]);
2219 ws[10] = accum.extract();
2220 accum.mul(ws[12], p[31]);
2221 accum.mul(ws[13], p[30]);
2222 accum.mul(ws[14], p[29]);
2223 accum.mul(ws[15], p[28]);
2224 accum.mul(ws[16], p[27]);
2225 accum.mul(ws[17], p[26]);
2226 accum.mul(ws[18], p[25]);
2227 accum.mul(ws[19], p[24]);
2228 accum.mul(ws[20], p[23]);
2229 accum.mul(ws[21], p[22]);
2230 accum.mul(ws[22], p[21]);
2231 accum.mul(ws[23], p[20]);
2232 accum.mul(ws[24], p[19]);
2233 accum.mul(ws[25], p[18]);
2234 accum.mul(ws[26], p[17]);
2235 accum.mul(ws[27], p[16]);
2236 accum.mul(ws[28], p[15]);
2237 accum.mul(ws[29], p[14]);
2238 accum.mul(ws[30], p[13]);
2239 accum.mul(ws[31], p[12]);
2240 accum.add(z[43]);
2241 ws[11] = accum.extract();
2242 accum.mul(ws[13], p[31]);
2243 accum.mul(ws[14], p[30]);
2244 accum.mul(ws[15], p[29]);
2245 accum.mul(ws[16], p[28]);
2246 accum.mul(ws[17], p[27]);
2247 accum.mul(ws[18], p[26]);
2248 accum.mul(ws[19], p[25]);
2249 accum.mul(ws[20], p[24]);
2250 accum.mul(ws[21], p[23]);
2251 accum.mul(ws[22], p[22]);
2252 accum.mul(ws[23], p[21]);
2253 accum.mul(ws[24], p[20]);
2254 accum.mul(ws[25], p[19]);
2255 accum.mul(ws[26], p[18]);
2256 accum.mul(ws[27], p[17]);
2257 accum.mul(ws[28], p[16]);
2258 accum.mul(ws[29], p[15]);
2259 accum.mul(ws[30], p[14]);
2260 accum.mul(ws[31], p[13]);
2261 accum.add(z[44]);
2262 ws[12] = accum.extract();
2263 accum.mul(ws[14], p[31]);
2264 accum.mul(ws[15], p[30]);
2265 accum.mul(ws[16], p[29]);
2266 accum.mul(ws[17], p[28]);
2267 accum.mul(ws[18], p[27]);
2268 accum.mul(ws[19], p[26]);
2269 accum.mul(ws[20], p[25]);
2270 accum.mul(ws[21], p[24]);
2271 accum.mul(ws[22], p[23]);
2272 accum.mul(ws[23], p[22]);
2273 accum.mul(ws[24], p[21]);
2274 accum.mul(ws[25], p[20]);
2275 accum.mul(ws[26], p[19]);
2276 accum.mul(ws[27], p[18]);
2277 accum.mul(ws[28], p[17]);
2278 accum.mul(ws[29], p[16]);
2279 accum.mul(ws[30], p[15]);
2280 accum.mul(ws[31], p[14]);
2281 accum.add(z[45]);
2282 ws[13] = accum.extract();
2283 accum.mul(ws[15], p[31]);
2284 accum.mul(ws[16], p[30]);
2285 accum.mul(ws[17], p[29]);
2286 accum.mul(ws[18], p[28]);
2287 accum.mul(ws[19], p[27]);
2288 accum.mul(ws[20], p[26]);
2289 accum.mul(ws[21], p[25]);
2290 accum.mul(ws[22], p[24]);
2291 accum.mul(ws[23], p[23]);
2292 accum.mul(ws[24], p[22]);
2293 accum.mul(ws[25], p[21]);
2294 accum.mul(ws[26], p[20]);
2295 accum.mul(ws[27], p[19]);
2296 accum.mul(ws[28], p[18]);
2297 accum.mul(ws[29], p[17]);
2298 accum.mul(ws[30], p[16]);
2299 accum.mul(ws[31], p[15]);
2300 accum.add(z[46]);
2301 ws[14] = accum.extract();
2302 accum.mul(ws[16], p[31]);
2303 accum.mul(ws[17], p[30]);
2304 accum.mul(ws[18], p[29]);
2305 accum.mul(ws[19], p[28]);
2306 accum.mul(ws[20], p[27]);
2307 accum.mul(ws[21], p[26]);
2308 accum.mul(ws[22], p[25]);
2309 accum.mul(ws[23], p[24]);
2310 accum.mul(ws[24], p[23]);
2311 accum.mul(ws[25], p[22]);
2312 accum.mul(ws[26], p[21]);
2313 accum.mul(ws[27], p[20]);
2314 accum.mul(ws[28], p[19]);
2315 accum.mul(ws[29], p[18]);
2316 accum.mul(ws[30], p[17]);
2317 accum.mul(ws[31], p[16]);
2318 accum.add(z[47]);
2319 ws[15] = accum.extract();
2320 accum.mul(ws[17], p[31]);
2321 accum.mul(ws[18], p[30]);
2322 accum.mul(ws[19], p[29]);
2323 accum.mul(ws[20], p[28]);
2324 accum.mul(ws[21], p[27]);
2325 accum.mul(ws[22], p[26]);
2326 accum.mul(ws[23], p[25]);
2327 accum.mul(ws[24], p[24]);
2328 accum.mul(ws[25], p[23]);
2329 accum.mul(ws[26], p[22]);
2330 accum.mul(ws[27], p[21]);
2331 accum.mul(ws[28], p[20]);
2332 accum.mul(ws[29], p[19]);
2333 accum.mul(ws[30], p[18]);
2334 accum.mul(ws[31], p[17]);
2335 accum.add(z[48]);
2336 ws[16] = accum.extract();
2337 accum.mul(ws[18], p[31]);
2338 accum.mul(ws[19], p[30]);
2339 accum.mul(ws[20], p[29]);
2340 accum.mul(ws[21], p[28]);
2341 accum.mul(ws[22], p[27]);
2342 accum.mul(ws[23], p[26]);
2343 accum.mul(ws[24], p[25]);
2344 accum.mul(ws[25], p[24]);
2345 accum.mul(ws[26], p[23]);
2346 accum.mul(ws[27], p[22]);
2347 accum.mul(ws[28], p[21]);
2348 accum.mul(ws[29], p[20]);
2349 accum.mul(ws[30], p[19]);
2350 accum.mul(ws[31], p[18]);
2351 accum.add(z[49]);
2352 ws[17] = accum.extract();
2353 accum.mul(ws[19], p[31]);
2354 accum.mul(ws[20], p[30]);
2355 accum.mul(ws[21], p[29]);
2356 accum.mul(ws[22], p[28]);
2357 accum.mul(ws[23], p[27]);
2358 accum.mul(ws[24], p[26]);
2359 accum.mul(ws[25], p[25]);
2360 accum.mul(ws[26], p[24]);
2361 accum.mul(ws[27], p[23]);
2362 accum.mul(ws[28], p[22]);
2363 accum.mul(ws[29], p[21]);
2364 accum.mul(ws[30], p[20]);
2365 accum.mul(ws[31], p[19]);
2366 accum.add(z[50]);
2367 ws[18] = accum.extract();
2368 accum.mul(ws[20], p[31]);
2369 accum.mul(ws[21], p[30]);
2370 accum.mul(ws[22], p[29]);
2371 accum.mul(ws[23], p[28]);
2372 accum.mul(ws[24], p[27]);
2373 accum.mul(ws[25], p[26]);
2374 accum.mul(ws[26], p[25]);
2375 accum.mul(ws[27], p[24]);
2376 accum.mul(ws[28], p[23]);
2377 accum.mul(ws[29], p[22]);
2378 accum.mul(ws[30], p[21]);
2379 accum.mul(ws[31], p[20]);
2380 accum.add(z[51]);
2381 ws[19] = accum.extract();
2382 accum.mul(ws[21], p[31]);
2383 accum.mul(ws[22], p[30]);
2384 accum.mul(ws[23], p[29]);
2385 accum.mul(ws[24], p[28]);
2386 accum.mul(ws[25], p[27]);
2387 accum.mul(ws[26], p[26]);
2388 accum.mul(ws[27], p[25]);
2389 accum.mul(ws[28], p[24]);
2390 accum.mul(ws[29], p[23]);
2391 accum.mul(ws[30], p[22]);
2392 accum.mul(ws[31], p[21]);
2393 accum.add(z[52]);
2394 ws[20] = accum.extract();
2395 accum.mul(ws[22], p[31]);
2396 accum.mul(ws[23], p[30]);
2397 accum.mul(ws[24], p[29]);
2398 accum.mul(ws[25], p[28]);
2399 accum.mul(ws[26], p[27]);
2400 accum.mul(ws[27], p[26]);
2401 accum.mul(ws[28], p[25]);
2402 accum.mul(ws[29], p[24]);
2403 accum.mul(ws[30], p[23]);
2404 accum.mul(ws[31], p[22]);
2405 accum.add(z[53]);
2406 ws[21] = accum.extract();
2407 accum.mul(ws[23], p[31]);
2408 accum.mul(ws[24], p[30]);
2409 accum.mul(ws[25], p[29]);
2410 accum.mul(ws[26], p[28]);
2411 accum.mul(ws[27], p[27]);
2412 accum.mul(ws[28], p[26]);
2413 accum.mul(ws[29], p[25]);
2414 accum.mul(ws[30], p[24]);
2415 accum.mul(ws[31], p[23]);
2416 accum.add(z[54]);
2417 ws[22] = accum.extract();
2418 accum.mul(ws[24], p[31]);
2419 accum.mul(ws[25], p[30]);
2420 accum.mul(ws[26], p[29]);
2421 accum.mul(ws[27], p[28]);
2422 accum.mul(ws[28], p[27]);
2423 accum.mul(ws[29], p[26]);
2424 accum.mul(ws[30], p[25]);
2425 accum.mul(ws[31], p[24]);
2426 accum.add(z[55]);
2427 ws[23] = accum.extract();
2428 accum.mul(ws[25], p[31]);
2429 accum.mul(ws[26], p[30]);
2430 accum.mul(ws[27], p[29]);
2431 accum.mul(ws[28], p[28]);
2432 accum.mul(ws[29], p[27]);
2433 accum.mul(ws[30], p[26]);
2434 accum.mul(ws[31], p[25]);
2435 accum.add(z[56]);
2436 ws[24] = accum.extract();
2437 accum.mul(ws[26], p[31]);
2438 accum.mul(ws[27], p[30]);
2439 accum.mul(ws[28], p[29]);
2440 accum.mul(ws[29], p[28]);
2441 accum.mul(ws[30], p[27]);
2442 accum.mul(ws[31], p[26]);
2443 accum.add(z[57]);
2444 ws[25] = accum.extract();
2445 accum.mul(ws[27], p[31]);
2446 accum.mul(ws[28], p[30]);
2447 accum.mul(ws[29], p[29]);
2448 accum.mul(ws[30], p[28]);
2449 accum.mul(ws[31], p[27]);
2450 accum.add(z[58]);
2451 ws[26] = accum.extract();
2452 accum.mul(ws[28], p[31]);
2453 accum.mul(ws[29], p[30]);
2454 accum.mul(ws[30], p[29]);
2455 accum.mul(ws[31], p[28]);
2456 accum.add(z[59]);
2457 ws[27] = accum.extract();
2458 accum.mul(ws[29], p[31]);
2459 accum.mul(ws[30], p[30]);
2460 accum.mul(ws[31], p[29]);
2461 accum.add(z[60]);
2462 ws[28] = accum.extract();
2463 accum.mul(ws[30], p[31]);
2464 accum.mul(ws[31], p[30]);
2465 accum.add(z[61]);
2466 ws[29] = accum.extract();
2467 accum.mul(ws[31], p[31]);
2468 accum.add(z[62]);
2469 ws[30] = accum.extract();
2470 accum.add(z[63]);
2471 ws[31] = accum.extract();
2472 const word w1 = accum.extract();
2473 bigint_monty_maybe_sub<32>(r, w1, ws, p);
2474}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

◆ bigint_monty_redc_4()

void Botan::bigint_monty_redc_4 ( word r[4],
const word z[8],
const word p[4],
word p_dash,
word ws[4] )

Definition at line 12 of file mp_monty_n.cpp.

12 {
13 word3<word> accum;
14 accum.add(z[0]);
15 ws[0] = accum.monty_step(p[0], p_dash);
16 accum.mul(ws[0], p[1]);
17 accum.add(z[1]);
18 ws[1] = accum.monty_step(p[0], p_dash);
19 accum.mul(ws[0], p[2]);
20 accum.mul(ws[1], p[1]);
21 accum.add(z[2]);
22 ws[2] = accum.monty_step(p[0], p_dash);
23 accum.mul(ws[0], p[3]);
24 accum.mul(ws[1], p[2]);
25 accum.mul(ws[2], p[1]);
26 accum.add(z[3]);
27 ws[3] = accum.monty_step(p[0], p_dash);
28 accum.mul(ws[1], p[3]);
29 accum.mul(ws[2], p[2]);
30 accum.mul(ws[3], p[1]);
31 accum.add(z[4]);
32 ws[0] = accum.extract();
33 accum.mul(ws[2], p[3]);
34 accum.mul(ws[3], p[2]);
35 accum.add(z[5]);
36 ws[1] = accum.extract();
37 accum.mul(ws[3], p[3]);
38 accum.add(z[6]);
39 ws[2] = accum.extract();
40 accum.add(z[7]);
41 ws[3] = accum.extract();
42 const word w1 = accum.extract();
43 bigint_monty_maybe_sub<4>(r, w1, ws, p);
44}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc(), and monty_redc().

◆ bigint_monty_redc_6()

void Botan::bigint_monty_redc_6 ( word r[6],
const word z[12],
const word p[6],
word p_dash,
word ws[6] )

Definition at line 46 of file mp_monty_n.cpp.

46 {
47 word3<word> accum;
48 accum.add(z[0]);
49 ws[0] = accum.monty_step(p[0], p_dash);
50 accum.mul(ws[0], p[1]);
51 accum.add(z[1]);
52 ws[1] = accum.monty_step(p[0], p_dash);
53 accum.mul(ws[0], p[2]);
54 accum.mul(ws[1], p[1]);
55 accum.add(z[2]);
56 ws[2] = accum.monty_step(p[0], p_dash);
57 accum.mul(ws[0], p[3]);
58 accum.mul(ws[1], p[2]);
59 accum.mul(ws[2], p[1]);
60 accum.add(z[3]);
61 ws[3] = accum.monty_step(p[0], p_dash);
62 accum.mul(ws[0], p[4]);
63 accum.mul(ws[1], p[3]);
64 accum.mul(ws[2], p[2]);
65 accum.mul(ws[3], p[1]);
66 accum.add(z[4]);
67 ws[4] = accum.monty_step(p[0], p_dash);
68 accum.mul(ws[0], p[5]);
69 accum.mul(ws[1], p[4]);
70 accum.mul(ws[2], p[3]);
71 accum.mul(ws[3], p[2]);
72 accum.mul(ws[4], p[1]);
73 accum.add(z[5]);
74 ws[5] = accum.monty_step(p[0], p_dash);
75 accum.mul(ws[1], p[5]);
76 accum.mul(ws[2], p[4]);
77 accum.mul(ws[3], p[3]);
78 accum.mul(ws[4], p[2]);
79 accum.mul(ws[5], p[1]);
80 accum.add(z[6]);
81 ws[0] = accum.extract();
82 accum.mul(ws[2], p[5]);
83 accum.mul(ws[3], p[4]);
84 accum.mul(ws[4], p[3]);
85 accum.mul(ws[5], p[2]);
86 accum.add(z[7]);
87 ws[1] = accum.extract();
88 accum.mul(ws[3], p[5]);
89 accum.mul(ws[4], p[4]);
90 accum.mul(ws[5], p[3]);
91 accum.add(z[8]);
92 ws[2] = accum.extract();
93 accum.mul(ws[4], p[5]);
94 accum.mul(ws[5], p[4]);
95 accum.add(z[9]);
96 ws[3] = accum.extract();
97 accum.mul(ws[5], p[5]);
98 accum.add(z[10]);
99 ws[4] = accum.extract();
100 accum.add(z[11]);
101 ws[5] = accum.extract();
102 const word w1 = accum.extract();
103 bigint_monty_maybe_sub<6>(r, w1, ws, p);
104}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc(), and monty_redc().

◆ bigint_monty_redc_8()

void Botan::bigint_monty_redc_8 ( word r[8],
const word z[16],
const word p[8],
word p_dash,
word ws[8] )

Definition at line 106 of file mp_monty_n.cpp.

106 {
107 word3<word> accum;
108 accum.add(z[0]);
109 ws[0] = accum.monty_step(p[0], p_dash);
110 accum.mul(ws[0], p[1]);
111 accum.add(z[1]);
112 ws[1] = accum.monty_step(p[0], p_dash);
113 accum.mul(ws[0], p[2]);
114 accum.mul(ws[1], p[1]);
115 accum.add(z[2]);
116 ws[2] = accum.monty_step(p[0], p_dash);
117 accum.mul(ws[0], p[3]);
118 accum.mul(ws[1], p[2]);
119 accum.mul(ws[2], p[1]);
120 accum.add(z[3]);
121 ws[3] = accum.monty_step(p[0], p_dash);
122 accum.mul(ws[0], p[4]);
123 accum.mul(ws[1], p[3]);
124 accum.mul(ws[2], p[2]);
125 accum.mul(ws[3], p[1]);
126 accum.add(z[4]);
127 ws[4] = accum.monty_step(p[0], p_dash);
128 accum.mul(ws[0], p[5]);
129 accum.mul(ws[1], p[4]);
130 accum.mul(ws[2], p[3]);
131 accum.mul(ws[3], p[2]);
132 accum.mul(ws[4], p[1]);
133 accum.add(z[5]);
134 ws[5] = accum.monty_step(p[0], p_dash);
135 accum.mul(ws[0], p[6]);
136 accum.mul(ws[1], p[5]);
137 accum.mul(ws[2], p[4]);
138 accum.mul(ws[3], p[3]);
139 accum.mul(ws[4], p[2]);
140 accum.mul(ws[5], p[1]);
141 accum.add(z[6]);
142 ws[6] = accum.monty_step(p[0], p_dash);
143 accum.mul(ws[0], p[7]);
144 accum.mul(ws[1], p[6]);
145 accum.mul(ws[2], p[5]);
146 accum.mul(ws[3], p[4]);
147 accum.mul(ws[4], p[3]);
148 accum.mul(ws[5], p[2]);
149 accum.mul(ws[6], p[1]);
150 accum.add(z[7]);
151 ws[7] = accum.monty_step(p[0], p_dash);
152 accum.mul(ws[1], p[7]);
153 accum.mul(ws[2], p[6]);
154 accum.mul(ws[3], p[5]);
155 accum.mul(ws[4], p[4]);
156 accum.mul(ws[5], p[3]);
157 accum.mul(ws[6], p[2]);
158 accum.mul(ws[7], p[1]);
159 accum.add(z[8]);
160 ws[0] = accum.extract();
161 accum.mul(ws[2], p[7]);
162 accum.mul(ws[3], p[6]);
163 accum.mul(ws[4], p[5]);
164 accum.mul(ws[5], p[4]);
165 accum.mul(ws[6], p[3]);
166 accum.mul(ws[7], p[2]);
167 accum.add(z[9]);
168 ws[1] = accum.extract();
169 accum.mul(ws[3], p[7]);
170 accum.mul(ws[4], p[6]);
171 accum.mul(ws[5], p[5]);
172 accum.mul(ws[6], p[4]);
173 accum.mul(ws[7], p[3]);
174 accum.add(z[10]);
175 ws[2] = accum.extract();
176 accum.mul(ws[4], p[7]);
177 accum.mul(ws[5], p[6]);
178 accum.mul(ws[6], p[5]);
179 accum.mul(ws[7], p[4]);
180 accum.add(z[11]);
181 ws[3] = accum.extract();
182 accum.mul(ws[5], p[7]);
183 accum.mul(ws[6], p[6]);
184 accum.mul(ws[7], p[5]);
185 accum.add(z[12]);
186 ws[4] = accum.extract();
187 accum.mul(ws[6], p[7]);
188 accum.mul(ws[7], p[6]);
189 accum.add(z[13]);
190 ws[5] = accum.extract();
191 accum.mul(ws[7], p[7]);
192 accum.add(z[14]);
193 ws[6] = accum.extract();
194 accum.add(z[15]);
195 ws[7] = accum.extract();
196 const word w1 = accum.extract();
197 bigint_monty_maybe_sub<8>(r, w1, ws, p);
198}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc(), and monty_redc().

◆ bigint_monty_redc_generic()

void Botan::bigint_monty_redc_generic ( word r[],
const word z[],
size_t z_size,
const word p[],
size_t p_size,
word p_dash,
word ws[] )

Definition at line 90 of file mp_monty.cpp.

91 {
92 BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
93
94 word3<word> accum;
95
96 accum.add(z[0]);
97
98 ws[0] = accum.monty_step(p[0], p_dash);
99
100 for(size_t i = 1; i != p_size; ++i) {
101 mul_rev_range(accum, ws, p, i);
102 accum.add(z[i]);
103 ws[i] = accum.monty_step(p[0], p_dash);
104 }
105
106 for(size_t i = 0; i != p_size - 1; ++i) {
107 mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1));
108 accum.add(z[p_size + i]);
109 ws[i] = accum.extract();
110 }
111
112 accum.add(z[2 * p_size - 1]);
113
114 ws[p_size - 1] = accum.extract();
115 // w1 is the final part, which is not stored in the workspace
116 const word w1 = accum.extract();
117
118 /*
119 * The result might need to be reduced mod p. To avoid a timing
120 * channel, always perform the subtraction. If in the computation
121 * of x - p a borrow is required then x was already < p.
122 *
123 * x starts at ws[0] and is p_size bytes long plus a possible high
124 * digit left over in w1.
125 *
126 * x - p starts at z[0] and is also p_size bytes long
127 *
128 * If borrow was set after the subtraction, then x was already less
129 * than p and the subtraction was not needed. In that case overwrite
130 * z[0:p_size] with the original x in ws[0:p_size].
131 *
132 * We only copy out p_size in the final step because we know
133 * the Montgomery result is < P
134 */
135
136 bigint_monty_maybe_sub(p_size, r, w1, ws, p);
137}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), BOTAN_ARG_CHECK, Botan::word3< W >::extract(), and Botan::word3< W >::monty_step().

Referenced by bigint_monty_redc().

◆ bigint_monty_redc_inplace()

void Botan::bigint_monty_redc_inplace ( word z[],
const word p[],
size_t p_size,
word p_dash,
word ws[],
size_t ws_size )
inline

Definition at line 931 of file mp_core.h.

931 {
932 bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size);
933 zeroize_buffer(z + p_size, p_size);
934}
Botan::bigint_monty_redc
void bigint_monty_redc(word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size)
Definition mp_core.h:906

References bigint_monty_redc(), and zeroize_buffer().

Referenced by Botan::Montgomery_Int::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Int::mul_by(), Botan::Montgomery_Params::mul_by(), Botan::Montgomery_Params::redc(), Botan::Montgomery_Params::sqr(), Botan::Montgomery_Int::square_this_n_times(), and Botan::Montgomery_Int::value().

◆ bigint_mul()

void Botan::bigint_mul ( word z[],
size_t z_size,
const word x[],
size_t x_size,
size_t x_sw,
const word y[],
size_t y_size,
size_t y_sw,
word workspace[],
size_t ws_size )

Definition at line 283 of file mp_karat.cpp.

292 {
293 zeroize_buffer(z, z_size);
294
295 if(x_sw == 1) {
296 bigint_linmul3(z, y, y_sw, x[0]);
297 } else if(y_sw == 1) {
298 bigint_linmul3(z, x, x_sw, y[0]);
299 } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
300 bigint_comba_mul4(z, x, y);
301 } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
302 bigint_comba_mul6(z, x, y);
303 } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
304 bigint_comba_mul8(z, x, y);
305 } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
306 bigint_comba_mul9(z, x, y);
307 } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
308 bigint_comba_mul16(z, x, y);
309 } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
310 bigint_comba_mul24(z, x, y);
311 } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) {
312 basecase_mul(z, z_size, x, x_sw, y, y_sw);
313 } else {
314 const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
315
316 if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
317 karatsuba_mul(z, x, y, N, workspace);
318 } else {
319 basecase_mul(z, z_size, x, x_sw, y, y_sw);
320 }
321 }
322}
Botan::bigint_linmul3
constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y)
Definition mp_core.h:403
Botan::bigint_comba_mul4
void bigint_comba_mul4(word z[8], const word x[4], const word y[4])
Definition mp_comba.cpp:42
Botan::bigint_comba_mul16
void bigint_comba_mul16(word z[32], const word x[16], const word y[16])
Definition mp_comba.cpp:794
Botan::bigint_comba_mul6
void bigint_comba_mul6(word z[12], const word x[6], const word y[6])
Definition mp_comba.cpp:115
Botan::bigint_comba_mul9
void bigint_comba_mul9(word z[18], const word x[9], const word y[9])
Definition mp_comba.cpp:511
Botan::bigint_comba_mul24
void bigint_comba_mul24(word z[48], const word x[24], const word y[24])
Definition mp_comba.cpp:1446
Botan::basecase_mul
BOTAN_FUZZER_API void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size)
Definition mp_karat.cpp:20
Botan::bigint_comba_mul8
void bigint_comba_mul8(word z[16], const word x[8], const word y[8])
Definition mp_comba.cpp:352

References basecase_mul(), bigint_comba_mul16(), bigint_comba_mul24(), bigint_comba_mul4(), bigint_comba_mul6(), bigint_comba_mul8(), bigint_comba_mul9(), bigint_linmul3(), and zeroize_buffer().

Referenced by Botan::BigInt::mul(), Botan::Montgomery_Int::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Int::mul_by(), Botan::Montgomery_Params::mul_by(), Botan::Barrett_Reduction::multiply(), operator*(), and Botan::Scalar448::operator*().

◆ bigint_shl1()

template<WordType W>
void Botan::bigint_shl1 ( W x[],
size_t x_size,
size_t x_words,
size_t shift )
inlineconstexpr

Definition at line 307 of file mp_core.h.

307 {
308 const size_t word_shift = shift / WordInfo<W>::bits;
309 const size_t bit_shift = shift % WordInfo<W>::bits;
310
311 unchecked_copy_memory(x + word_shift, x, x_words);
312 zeroize_buffer(x, word_shift);
313
314 const auto carry_mask = CT::Mask<W>::expand(bit_shift);
315 const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
316
317 W carry = 0;
318 for(size_t i = word_shift; i != x_size; ++i) {
319 const W w = x[i];
320 x[i] = (w << bit_shift) | carry;
321 carry = carry_mask.if_set_return(w >> carry_shift);
322 }
323}
Botan::carry_shift
constexpr uint64_t carry_shift(const donna128 &a, size_t shift)
Definition donna128.h:129
Botan::unchecked_copy_memory
void unchecked_copy_memory(T *out, const T *in, size_t n)
Definition mem_utils.h:44

References carry(), carry_shift(), Botan::CT::Mask< T >::expand(), unchecked_copy_memory(), and zeroize_buffer().

Referenced by ct_divide_pow2k(), and Botan::BigInt::operator<<=().

◆ bigint_shl2()

template<WordType W>
void Botan::bigint_shl2 ( W y[],
const W x[],
size_t x_size,
size_t shift )
inlineconstexpr

Definition at line 350 of file mp_core.h.

350 {
351 const size_t word_shift = shift / WordInfo<W>::bits;
352 const size_t bit_shift = shift % WordInfo<W>::bits;
353
354 unchecked_copy_memory(y + word_shift, x, x_size);
355
356 const auto carry_mask = CT::Mask<W>::expand(bit_shift);
357 const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
358
359 W carry = 0;
360 for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) {
361 const W w = y[i];
362 y[i] = (w << bit_shift) | carry;
363 carry = carry_mask.if_set_return(w >> carry_shift);
364 }
365}

References carry(), carry_shift(), Botan::CT::Mask< T >::expand(), and unchecked_copy_memory().

Referenced by Botan::BigInt::ct_shift_left(), and operator<<().

◆ bigint_shr1()

template<WordType W>
void Botan::bigint_shr1 ( W x[],
size_t x_size,
size_t shift )
inlineconstexpr

Definition at line 326 of file mp_core.h.

326 {
327 const size_t word_shift = shift / WordInfo<W>::bits;
328 const size_t bit_shift = shift % WordInfo<W>::bits;
329
330 const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
331
332 if(top > 0) {
333 unchecked_copy_memory(x, x + word_shift, top);
334 }
335 zeroize_buffer(x + top, std::min(word_shift, x_size));
336
337 const auto carry_mask = CT::Mask<W>::expand(bit_shift);
338 const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
339
340 W carry = 0;
341
342 for(size_t i = 0; i != top; ++i) {
343 const W w = x[top - i - 1];
344 x[top - i - 1] = (w >> bit_shift) | carry;
345 carry = carry_mask.if_set_return(w << carry_shift);
346 }
347}

References carry(), carry_shift(), Botan::CT::Mask< T >::expand(), unchecked_copy_memory(), and zeroize_buffer().

Referenced by Botan::BigInt::operator>>=().

◆ bigint_shr2()

template<WordType W>
void Botan::bigint_shr2 ( W y[],
const W x[],
size_t x_size,
size_t shift )
inlineconstexpr

Definition at line 368 of file mp_core.h.

368 {
369 const size_t word_shift = shift / WordInfo<W>::bits;
370 const size_t bit_shift = shift % WordInfo<W>::bits;
371 const size_t new_size = x_size < word_shift ? 0 : (x_size - word_shift);
372
373 if(new_size > 0) {
374 unchecked_copy_memory(y, x + word_shift, new_size);
375 }
376
377 const auto carry_mask = CT::Mask<W>::expand(bit_shift);
378 const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
379
380 W carry = 0;
381 for(size_t i = new_size; i > 0; --i) {
382 W w = y[i - 1];
383 y[i - 1] = (w >> bit_shift) | carry;
384 carry = carry_mask.if_set_return(w << carry_shift);
385 }
386}

References carry(), carry_shift(), Botan::CT::Mask< T >::expand(), and unchecked_copy_memory().

Referenced by gcd(), and operator>>().

◆ bigint_sqr()

void Botan::bigint_sqr ( word z[],
size_t z_size,
const word x[],
size_t x_size,
size_t x_sw,
word workspace[],
size_t ws_size )

Definition at line 327 of file mp_karat.cpp.

327 {
328 zeroize_buffer(z, z_size);
329
330 BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
331
332 if(x_sw == 1) {
333 bigint_linmul3(z, x, x_sw, x[0]);
334 } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
335 bigint_comba_sqr4(z, x);
336 } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
337 bigint_comba_sqr6(z, x);
338 } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
339 bigint_comba_sqr8(z, x);
340 } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
341 bigint_comba_sqr9(z, x);
342 } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
343 bigint_comba_sqr16(z, x);
344 } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
345 bigint_comba_sqr24(z, x);
346 } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) {
347 basecase_sqr(z, z_size, x, x_sw);
348 } else {
349 const size_t N = karatsuba_size(z_size, x_size, x_sw);
350
351 if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
352 karatsuba_sqr(z, x, N, workspace);
353 } else {
354 basecase_sqr(z, z_size, x, x_sw);
355 }
356 }
357}
Botan::basecase_sqr
BOTAN_FUZZER_API void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size)
Definition mp_karat.cpp:46
Botan::bigint_comba_sqr4
void bigint_comba_sqr4(word z[8], const word x[4])
Definition mp_comba.cpp:16
Botan::bigint_comba_sqr6
void bigint_comba_sqr6(word z[12], const word x[6])
Definition mp_comba.cpp:74
Botan::bigint_comba_sqr8
void bigint_comba_sqr8(word z[16], const word x[8])
Definition mp_comba.cpp:292
Botan::bigint_comba_sqr16
void bigint_comba_sqr16(word z[32], const word x[16])
Definition mp_comba.cpp:618
Botan::bigint_comba_sqr9
void bigint_comba_sqr9(word z[18], const word x[9])
Definition mp_comba.cpp:440
Botan::bigint_comba_sqr24
void bigint_comba_sqr24(word z[48], const word x[24])
Definition mp_comba.cpp:1090

References basecase_sqr(), bigint_comba_sqr16(), bigint_comba_sqr24(), bigint_comba_sqr4(), bigint_comba_sqr6(), bigint_comba_sqr8(), bigint_comba_sqr9(), bigint_linmul3(), BOTAN_ASSERT, and zeroize_buffer().

Referenced by Botan::Montgomery_Params::sqr(), Botan::Barrett_Reduction::square(), Botan::BigInt::square(), and Botan::Montgomery_Int::square_this_n_times().

◆ bigint_sub2()

template<WordType W>
auto Botan::bigint_sub2 ( W x[],
size_t x_size,
const W y[],
size_t y_size )->W
inlineconstexpr

Two operand subtraction

Definition at line 148 of file mp_core.h.

148 {
149 W borrow = 0;
150
151 BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
152
153 const size_t blocks = y_size - (y_size % 8);
154
155 for(size_t i = 0; i != blocks; i += 8) {
156 borrow = word8_sub2(x + i, y + i, borrow);
157 }
158
159 for(size_t i = blocks; i != y_size; ++i) {
160 x[i] = word_sub(x[i], y[i], &borrow);
161 }
162
163 for(size_t i = y_size; i != x_size; ++i) {
164 x[i] = word_sub(x[i], static_cast<W>(0), &borrow);
165 }
166
167 return borrow;
168}
Botan::word8_sub2
constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W
Definition mp_asmi.h:345

References BOTAN_ASSERT, word8_sub2(), and word_sub().

Referenced by Botan::BigInt::add().

◆ bigint_sub2_rev()

template<WordType W>
void Botan::bigint_sub2_rev ( W x[],
const W y[],
size_t y_size )
inlineconstexpr

Two operand subtraction, x = y - x; assumes y >= x

Definition at line 174 of file mp_core.h.

174 {
175 W borrow = 0;
176
177 for(size_t i = 0; i != y_size; ++i) {
178 x[i] = word_sub(y[i], x[i], &borrow);
179 }
180
181 BOTAN_ASSERT(borrow == 0, "y must be greater than x");
182}

References BOTAN_ASSERT, and word_sub().

Referenced by Botan::BigInt::add().

◆ bigint_sub3()

template<WordType W>
auto Botan::bigint_sub3 ( W z[],
const W x[],
size_t x_size,
const W y[],
size_t y_size )->W
inlineconstexpr

Three operand subtraction

Expects that x_size >= y_size

Writes to z[0:x_size] and returns borrow

Definition at line 192 of file mp_core.h.

192 {
193 W borrow = 0;
194
195 BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
196
197 const size_t blocks = y_size - (y_size % 8);
198
199 for(size_t i = 0; i != blocks; i += 8) {
200 borrow = word8_sub3(z + i, x + i, y + i, borrow);
201 }
202
203 for(size_t i = blocks; i != y_size; ++i) {
204 z[i] = word_sub(x[i], y[i], &borrow);
205 }
206
207 for(size_t i = y_size; i != x_size; ++i) {
208 z[i] = word_sub(x[i], static_cast<W>(0), &borrow);
209 }
210
211 return borrow;
212}

References BOTAN_ASSERT, word8_sub3(), and word_sub().

Referenced by Botan::BigInt::add2(), ct_divide(), ct_divide_pow2k(), ct_modulo(), Botan::BigInt::ct_reduce_below(), Botan::IntMod< MontgomeryRep< ScalarParams > >::invert_vartime(), Botan::BigInt::mod_add(), Botan::BigInt::mod_sub(), Botan::Montgomery_Int::operator-(), p_minus(), p_minus_1_over_2(), Botan::BigInt::reduce_below(), and reduce_mod().

◆ bigint_sub_abs()

template<WordType W>
auto Botan::bigint_sub_abs ( W z[],
const W x[],
const W y[],
size_t N,
W ws[] )->CT::Mask< W >
inlineconstexpr

Return abs(x-y), ie if x >= y, then compute z = x - y Otherwise compute z = y - x No borrow is possible since the result is always >= 0

Returns a Mask: |1| if x >= y or |0| if x < y

Parameters
zoutput array of at least N words
xinput array of N words
yinput array of N words
Nlength of x and y
wsarray of at least 2*N words

Definition at line 279 of file mp_core.h.

279 {
280 // Subtract in both direction then conditional copy out the result
281
282 W* ws0 = ws;
283 W* ws1 = ws + N;
284
285 W borrow0 = 0;
286 W borrow1 = 0;
287
288 const size_t blocks = N - (N % 8);
289
290 for(size_t i = 0; i != blocks; i += 8) {
291 borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
292 borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
293 }
294
295 for(size_t i = blocks; i != N; ++i) {
296 ws0[i] = word_sub(x[i], y[i], &borrow0);
297 ws1[i] = word_sub(y[i], x[i], &borrow1);
298 }
299
300 return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
301}
Botan::CT::conditional_copy_mem
constexpr Mask< T > conditional_copy_mem(Mask< T > mask, T *dest, const T *if_set, const T *if_unset, size_t elems)
Definition ct_utils.h:732

References Botan::CT::conditional_copy_mem(), word8_sub3(), and word_sub().

Referenced by gcd().

◆ bit_permute_step()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::bit_permute_step ( T x,
T mask,
size_t shift )
constexpr

Definition at line 192 of file bit_ops.h.

192 {
193 /*
194 See https://reflectionsonsecurity.wordpress.com/2014/05/11/efficient-bit-permutation-using-delta-swaps/
195 and http://programming.sirrida.de/bit_perm.html
196 */
197 const T swap = ((x >> shift) ^ x) & mask;
198 return (x ^ swap) ^ (swap << shift);
199}

References BOTAN_FORCE_INLINE.

◆ bit_size_to_32bit_size()

size_t Botan::bit_size_to_32bit_size ( size_t bit_size)
inline

Definition at line 46 of file code_based_util.h.

46 {
47 return (bit_size - 1) / 32 + 1;
48}

Referenced by generate_mceliece_key(), mceliece_decrypt(), and Botan::McEliece_PrivateKey::McEliece_PrivateKey().

◆ bit_size_to_byte_size()

size_t Botan::bit_size_to_byte_size ( size_t bit_size)
inline

Definition at line 42 of file code_based_util.h.

42 {
43 return (bit_size - 1) / 8 + 1;
44}

Referenced by mceliece_decrypt().

◆ bitlen()

auto Botan::bitlen ( size_t x)
constexpr

Definition at line 101 of file pqcrystals_helpers.h.

101 {
102 return ceil_log2(x + 1);
103}
Botan::ceil_log2
constexpr uint8_t ceil_log2(T x)
Definition bit_ops.h:140

References ceil_log2().

Referenced by Botan::DilithiumConstants::DilithiumConstants(), Botan::KyberConstants::KyberConstants(), and Botan::bitvector_base< secure_allocator >::subvector().

◆ booth_recode()

template<size_t WindowBits, std::unsigned_integral T>
std::pair< size_t, CT::Choice > Botan::booth_recode ( T x)
constexpr

Definition at line 294 of file pcurves_mul.h.

294 {
295 static_assert(WindowBits >= 1 && WindowBits <= 8);
296
297 auto s_mask = CT::Mask<T>::expand(x >> WindowBits);
298 const T neg_x = (1 << (WindowBits + 1)) - x - 1;
299 T d = s_mask.select(neg_x, x);
300 d = (d >> 1) + (d & 1);
301
302 return std::make_pair(static_cast<size_t>(d), s_mask.as_choice());
303}

References Botan::CT::Mask< T >::expand().

Referenced by basemul_booth_exec(), and Botan::WindowedBoothMulTable< C, W >::mul().

◆ buffer_insert() [1/2]

template<typename T, typename Alloc, typename Alloc2>
size_t Botan::buffer_insert ( std::vector< T, Alloc > & buf,
size_t buf_offset,
const std::vector< T, Alloc2 > & input )

Definition at line 325 of file mem_ops.h.

325 {
326 BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
327 const size_t to_copy = std::min(input.size(), buf.size() - buf_offset);
328 if(to_copy > 0) {
329 copy_mem(&buf[buf_offset], input.data(), to_copy);
330 }
331 return to_copy;
332}
Botan::copy_mem
constexpr void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:144

References BOTAN_ASSERT_NOMSG, buffer_insert(), and copy_mem().

◆ buffer_insert() [2/2]

template<typename T, typename Alloc>
size_t Botan::buffer_insert ( std::vector< T, Alloc > & buf,
size_t buf_offset,
const T input[],
size_t input_length )

Definition at line 314 of file mem_ops.h.

314 {
315 BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
316 const size_t to_copy = std::min(input_length, buf.size() - buf_offset);
317 if(to_copy > 0) {
318 copy_mem(&buf[buf_offset], input, to_copy);
319 }
320 return to_copy;
321}

References BOTAN_ASSERT_NOMSG, buffer_insert(), and copy_mem().

Referenced by buffer_insert(), and buffer_insert().

◆ bytes_to_string()

std::string Botan::bytes_to_string ( std::span< const uint8_t > bytes)
inline

Definition at line 76 of file mem_utils.h.

76 {
77 return std::string(reinterpret_cast<const char*>(bytes.data()), bytes.size());
78}

Referenced by Botan::CryptoBox::decrypt(), Botan::PSK_Database::get_str(), Botan::TLS::TLS_Data_Reader::get_string(), Botan::TLS::PskIdentity::identity_as_string(), Botan::Encrypted_PSK_Database::list_names(), and Botan::ASN1::to_string().

◆ bytes_to_words()

template<WordType W, size_t N, size_t L>
auto Botan::bytes_to_words ( std::span< const uint8_t, L > bytes)
inlineconstexpr

Definition at line 287 of file pcurves_util.h.

287 {
288 static_assert(L <= WordInfo<W>::bytes * N);
289
290 std::array<W, N> r = {};
291
292 constexpr size_t full_words = L / WordInfo<W>::bytes;
293 constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
294
295 static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
296
297 for(size_t i = 0; i != full_words; ++i) {
298 r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
299 }
300
301 if constexpr(extra_bytes > 0) {
302 constexpr size_t shift = extra_bytes * 8;
303 shift_left<shift>(r);
304
305 for(size_t i = 0; i != extra_bytes; ++i) {
306 const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
307 r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
308 }
309 }
310
311 return r;
312}
Botan::shift_left
constexpr W shift_left(std::array< W, N > &x)
Definition mp_core.h:712

References load_be(), and shift_left().

Referenced by Botan::Scalar448::bytes_are_reduced(), Botan::IntMod< MontgomeryRep< ScalarParams > >::deserialize(), Botan::IntMod< MontgomeryRep< ScalarParams > >::from_wide_bytes(), Botan::IntMod< MontgomeryRep< ScalarParams > >::from_wide_bytes_varlen(), and Botan::Scalar448::Scalar448().

◆ carry()

template<size_t S, int64_t MUL = 1>
requires (S > 0 && S < 64)
void Botan::carry ( int64_t & h0,
int64_t & h1 )
inline

Definition at line 27 of file ed25519_internal.h.

29{
30 const int64_t X1 = (static_cast<int64_t>(1) << S);
31 const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));
32 const int64_t c = (h0 + X2) >> S;
33 h1 += c * MUL;
34 h0 -= c * X1;
35}

Referenced by Botan::BigInt::add(), Botan::word3< W >::add(), Botan::BigInt::add2(), basecase_mul(), basecase_sqr(), bigint_add2(), bigint_add3(), bigint_cnd_abs(), bigint_cnd_add(), bigint_cnd_sub(), bigint_linmul2(), bigint_linmul3(), bigint_shl1(), bigint_shl2(), bigint_shr1(), bigint_shr2(), Botan::Streebog::compress_64(), Botan::BigInt::ct_cond_add(), Botan::Ed25519_FieldElement::deserialize(), Botan::IntMod< MontgomeryRep< ScalarParams > >::div2(), ed25519_basepoint_mul(), Botan::IntMod< MontgomeryRep< ScalarParams > >::invert_vartime(), Botan::Ed25519_FieldElement::mul(), Botan::word3< W >::mul(), Botan::IntMod< MontgomeryRep< ScalarParams > >::mul2(), Botan::word3< W >::mul_x2(), Botan::IntMod< MontgomeryRep< ScalarParams > >::negate(), Botan::BigInt::operator*=(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator+, Botan::Montgomery_Int::operator+(), Botan::donna128::operator+=(), Botan::donna128::operator+=(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator-, Botan::donna128::operator<<, Botan::donna128::operator>>, poly_mul(), redc_crandall(), reduce_mod(), sc_muladd(), sc_reduce(), Botan::EC_Group_Data::scalar_from_bytes_with_trunc(), shift_left(), shift_right(), Botan::Sodium::sodium_add(), Botan::Sodium::sodium_increment(), solinas_correct_redc(), Botan::Ed25519_FieldElement::sqr2(), Botan::Ed25519_FieldElement::sqr_iter(), Botan::divide_precomp< W >::vartime_mod_2to1(), word8_add2(), word8_add3(), word8_linmul3(), word8_madd3(), word8_sub2(), word8_sub3(), word_add(), word_madd2(), word_madd3(), word_sub(), and xts_compute_tweak_block().

◆ carry0() [1/2]

template<size_t S>
requires (S > 0 && S < 32)
void Botan::carry0 ( int32_t & h0,
int32_t & h1 )
inline

Definition at line 48 of file ed25519_internal.h.

50{
51 const int32_t X1 = (static_cast<int64_t>(1) << S);
52 const int32_t c = h0 >> S;
53 h1 += c;
54 h0 -= c * X1;
55}

◆ carry0() [2/2]

template<size_t S>
requires (S > 0 && S < 64)
void Botan::carry0 ( int64_t & h0,
int64_t & h1 )
inline

Definition at line 38 of file ed25519_internal.h.

40{
41 const int64_t X1 = (static_cast<int64_t>(1) << S);
42 const int64_t c = h0 >> S;
43 h1 += c;
44 h0 -= c * X1;
45}

Referenced by sc_muladd(), sc_reduce(), and Botan::Ed25519_FieldElement::serialize_to().

◆ carry_shift()

uint64_t Botan::carry_shift ( const donna128 & a,
size_t shift )
inlineconstexpr

Definition at line 129 of file donna128.h.

129 {
130 return (a >> shift).lo();
131}

Referenced by bigint_shl1(), bigint_shl2(), bigint_shr1(), and bigint_shr2().

◆ cast_char_ptr_to_uint8() [1/2]

uint8_t * Botan::cast_char_ptr_to_uint8 ( char * s)
inline

Definition at line 276 of file mem_ops.h.

276 {
277 return reinterpret_cast<uint8_t*>(s);
278}

◆ cast_char_ptr_to_uint8() [2/2]

const uint8_t * Botan::cast_char_ptr_to_uint8 ( const char * s)
inline

Definition at line 272 of file mem_ops.h.

272 {
273 return reinterpret_cast<const uint8_t*>(s);
274}

◆ cast_uint8_ptr_to_char() [1/2]

const char * Botan::cast_uint8_ptr_to_char ( const uint8_t * b)
inline

Definition at line 281 of file mem_ops.h.

281 {
282 return reinterpret_cast<const char*>(b);
283}

Referenced by Botan::BigInt::decode(), Botan::Base64_Decoder::end_msg(), Botan::Hex_Decoder::end_msg(), Botan::HTTP::http_sync(), Botan::TPM2::Context::manufacturer(), Botan::HTTP::operator<<(), operator<<(), operator>>(), Botan::DataSource_Stream::peek(), Botan::DataSource_Stream::read(), Botan::Pipe::read_all_as_string(), Botan::TPM2::Context::vendor(), Botan::Base64_Decoder::write(), Botan::DataSink_Stream::write(), and Botan::Hex_Decoder::write().

◆ cast_uint8_ptr_to_char() [2/2]

char * Botan::cast_uint8_ptr_to_char ( uint8_t * b)
inline

Definition at line 285 of file mem_ops.h.

285 {
286 return reinterpret_cast<char*>(b);
287}

◆ ceil_division()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::ceil_division ( T a,
T b )
constexpr

Ceil of an unsigned integer division. b must not be zero.

Parameters
adivident
bdivisor
Returns
ceil(a/b)

Definition at line 167 of file bit_ops.h.

167 {
168 return (a + b - 1) / b;
169}

References BOTAN_FORCE_INLINE.

Referenced by Botan::Classic_McEliece_Parameters::encode_out_size().

◆ ceil_log2()

template<std::unsigned_integral T>
requires (sizeof(T) < 32)
uint8_t Botan::ceil_log2 ( T x)
constexpr

Definition at line 140 of file bit_ops.h.

142{
143 if(x >> (sizeof(T) * 8 - 1)) {
144 return sizeof(T) * 8;
145 }
146
147 uint8_t result = 0;
148 T compare = 1;
149
150 while(compare < x) {
151 compare <<= 1;
152 result++;
153 }
154
155 return result;
156}

Referenced by bitlen(), Botan::BigInt::ct_shift_left(), Botan::McEliece_PublicKey::get_message_word_bit_length(), Botan::McEliece_PrivateKey::McEliece_PrivateKey(), Botan::McEliece_PrivateKey::McEliece_PrivateKey(), and mceliece_work_factor().

◆ ceil_tobytes()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::ceil_tobytes ( T bits)
constexpr

Return the number of bytes necessary to contain bits bits.

Definition at line 175 of file bit_ops.h.

175 {
176 return (bits + 7) / 8;
177}

References BOTAN_FORCE_INLINE.

Referenced by Botan::Classic_McEliece_Encryptor::raw_kem_encrypt(), Botan::bitvector_base< secure_allocator >::to_bytes(), Botan::bitvector_base< secure_allocator >::to_bytes(), and Botan::FrodoMatrix::unpack().

◆ chain_lengths()

BOTAN_TEST_API std::vector< WotsHashIndex > Botan::chain_lengths ( const SphincsTreeNode & msg,
const Sphincs_Parameters & params )

Given a msg construct the lengths (amount of hashes for signature) for each WOTS+ chain, including the checksum.

Corresponds to FIPS 205, Algorithm 7 or 8, Step 1-7

Definition at line 92 of file sp_wots.cpp.

92 {
93 std::vector<WotsHashIndex> result(params.wots_len_1() + params.wots_len_2());
94
95 auto msg_base_w = std::span(result).first(params.wots_len_1());
96 auto checksum_base_w = std::span(result).last(params.wots_len_2());
97
98 base_2_b(msg_base_w, msg.get(), params);
99 wots_checksum(checksum_base_w, msg_base_w, params);
100
101 return result;
102}
Botan::Sphincs_Parameters::wots_len_2
uint32_t wots_len_2() const
Definition sp_parameters.h:160
Botan::Sphincs_Parameters::wots_len_1
uint32_t wots_len_1() const
Definition sp_parameters.h:155
Botan::detail::Strong_Base::get
constexpr T & get() &
Definition strong_type.h:85

References Botan::detail::Strong_Base< T >::get(), Botan::Sphincs_Parameters::wots_len_1(), and Botan::Sphincs_Parameters::wots_len_2().

Referenced by wots_public_key_from_signature(), and xmss_sign_and_pkgen().

◆ check_and_canonicalize_dns_name()

BOTAN_TEST_API std::string Botan::check_and_canonicalize_dns_name ( std::string_view name)

If name is a valid DNS name, return it canonicalized

Otherwise throws Decoding_Error

Definition at line 369 of file parsing.cpp.

369 {
370 if(name.size() > 255) {
371 throw Decoding_Error("DNS name exceeds maximum allowed length");
372 }
373
374 if(name.empty()) {
375 throw Decoding_Error("DNS name cannot be empty");
376 }
377
378 if(name.starts_with(".") || name.ends_with(".")) {
379 throw Decoding_Error("DNS name cannot start or end with a dot");
380 }
381
382 /*
383 * Table mapping uppercase to lowercase and only including values for valid DNS names
384 * namely A-Z, a-z, 0-9, hyphen, and dot, plus '*' for wildcarding. (RFC 1035)
385 */
386 // clang-format off
387 constexpr uint8_t DNS_CHAR_MAPPING[128] = {
388 '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0',
389 '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0',
390 '\0', '\0', '\0', '\0', '*', '\0', '\0', '-', '.', '\0', '0', '1', '2', '3', '4', '5', '6', '7', '8',
391 '9', '\0', '\0', '\0', '\0', '\0', '\0', '\0', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k',
392 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '\0', '\0', '\0', '\0',
393 '\0', '\0', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q',
394 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '\0', '\0', '\0', '\0', '\0',
395 };
396 // clang-format on
397
398 std::string canon;
399 canon.reserve(name.size());
400
401 // RFC 1035: DNS labels must not exceed 63 characters
402 size_t current_label_length = 0;
403
404 for(size_t i = 0; i != name.size(); ++i) {
405 const char c = name[i];
406
407 if(c == '.') {
408 if(i > 0 && name[i - 1] == '.') {
409 throw Decoding_Error("DNS name contains sequential period chars");
410 }
411
412 if(current_label_length == 0) {
413 throw Decoding_Error("DNS name contains empty label");
414 }
415 current_label_length = 0; // Reset for next label
416 } else {
417 current_label_length++;
418
419 if(current_label_length > 63) { // RFC 1035 Maximum DNS label length
420 throw Decoding_Error("DNS name label exceeds maximum length of 63 characters");
421 }
422 }
423
424 const uint8_t cu = static_cast<uint8_t>(c);
425 if(cu >= 128) {
426 throw Decoding_Error("DNS name must not contain any extended ASCII code points");
427 }
428 const uint8_t mapped = DNS_CHAR_MAPPING[cu];
429 if(mapped == 0) {
430 throw Decoding_Error("DNS name includes invalid character");
431 }
432
433 if(mapped == '-') {
434 if(i == 0 || (i > 0 && name[i - 1] == '.')) {
435 throw Decoding_Error("DNS name has label with leading hyphen");
436 } else if(i == name.size() - 1 || (i < name.size() - 1 && name[i + 1] == '.')) {
437 throw Decoding_Error("DNS name has label with trailing hyphen");
438 }
439 }
440 canon.push_back(static_cast<char>(mapped));
441 }
442
443 if(current_label_length == 0) {
444 throw Decoding_Error("DNS name contains empty label");
445 }
446 return canon;
447}

Referenced by Botan::AlternativeName::decode_from().

◆ check_bcrypt()

bool Botan::check_bcrypt ( std::string_view password,
std::string_view hash )

Check a previously created password hash

Takes a password and a bcrypt hash and returns true if the password is the same as the one that was used to generate the bcrypt hash.

Parameters
passwordthe password to check against
hashthe stored hash to check against

Definition at line 161 of file bcrypt.cpp.

161 {
162 if(hash.size() != 60 || hash[0] != '$' || hash[1] != '2' || hash[3] != '$' || hash[6] != '$') {
163 return false;
164 }
165
166 const char bcrypt_version = hash[2];
167
168 if(bcrypt_version != 'a' && bcrypt_version != 'b' && bcrypt_version != 'y') {
169 return false;
170 }
171
172 const uint16_t workfactor = to_uint16(hash.substr(4, 2));
173
174 const std::vector<uint8_t> salt = bcrypt_base64_decode(hash.substr(7, 22));
175 if(salt.size() != 16) {
176 return false;
177 }
178
179 const std::string compare = make_bcrypt(pass, salt, workfactor, bcrypt_version);
180
181 return CT::is_equal(as_span_of_bytes(hash), as_span_of_bytes(compare)).as_bool();
182}
Botan::to_uint16
uint16_t to_uint16(std::string_view str)
Definition parsing.cpp:22

References as_span_of_bytes(), Botan::CT::is_equal(), and to_uint16().

Referenced by botan_bcrypt_is_valid().

◆ check_passhash9()

bool Botan::check_passhash9 ( std::string_view password,
std::string_view hash )

Check a previously created password hash

Parameters
passwordthe password to check against
hashthe stored hash to check against

Definition at line 76 of file passhash9.cpp.

76 {
77 const size_t BINARY_LENGTH = ALGID_BYTES + WORKFACTOR_BYTES + PASSHASH9_PBKDF_OUTPUT_LEN + SALT_BYTES;
78
79 const size_t BASE64_LENGTH = MAGIC_PREFIX.size() + (BINARY_LENGTH * 8) / 6;
80
81 if(hash.size() != BASE64_LENGTH) {
82 return false;
83 }
84
85 for(size_t i = 0; i != MAGIC_PREFIX.size(); ++i) {
86 if(hash[i] != MAGIC_PREFIX[i]) {
87 return false;
88 }
89 }
90
91 secure_vector<uint8_t> bin = base64_decode(hash.data() + MAGIC_PREFIX.size());
92
93 if(bin.size() != BINARY_LENGTH) {
94 return false;
95 }
96
97 const uint8_t alg_id = bin[0];
98
99 const size_t work_factor = load_be<uint16_t>(&bin[ALGID_BYTES], 0);
100
101 // Bug in the format, bad states shouldn't be representable, but are...
102 if(work_factor == 0) {
103 return false;
104 }
105
106 if(work_factor > 512) {
107 throw Invalid_Argument("Requested passhash9 work factor " + std::to_string(work_factor) + " is too large");
108 }
109
110 const size_t kdf_iterations = WORK_FACTOR_SCALE * work_factor;
111
112 auto pbkdf_prf = get_pbkdf_prf(alg_id);
113
114 if(!pbkdf_prf) {
115 return false; // unknown algorithm, reject
116 }
117
118 const PKCS5_PBKDF2 kdf(std::move(pbkdf_prf));
119
120 secure_vector<uint8_t> cmp =
121 kdf.derive_key(PASSHASH9_PBKDF_OUTPUT_LEN, pass, &bin[ALGID_BYTES + WORKFACTOR_BYTES], SALT_BYTES, kdf_iterations)
122 .bits_of();
123
124 const uint8_t* hashbytes = &bin[ALGID_BYTES + WORKFACTOR_BYTES + SALT_BYTES];
125
126 return CT::is_equal(cmp.data(), hashbytes, PASSHASH9_PBKDF_OUTPUT_LEN).as_bool();
127}
Botan::PKCS5_PBKDF2
Definition pbkdf2.h:100
Botan::secure_vector
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:68

References base64_decode(), Botan::OctetString::bits_of(), Botan::PBKDF::derive_key(), Botan::CT::is_equal(), and load_be().

◆ checked_add() [1/2]

template<std::unsigned_integral T>
std::optional< T > Botan::checked_add ( T a,
T b )
inlineconstexpr

Definition at line 19 of file int_utils.h.

19 {
20 const T r = a + b;
21 if(r < a || r < b) {
22 return {};
23 }
24 return r;
25}

Referenced by checked_add(), Botan::AlternativeName::count(), and Botan::OID::encode_into().

◆ checked_add() [2/2]

template<std::unsigned_integral T, std::unsigned_integral... Ts>
requires all_same_v<T, Ts...>
std::optional< T > Botan::checked_add ( T a,
T b,
Ts... rest )
inlineconstexpr

Definition at line 37 of file int_utils.h.

37 {
38 if(auto r = checked_add(a, b)) {
39 return checked_add(r.value(), rest...);
40 } else {
41 return {};
42 }
43}
Botan::checked_add
constexpr std::optional< T > checked_add(T a, T b)
Definition int_utils.h:19

References checked_add().

◆ checked_cast_to()

template<typename RT, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
RT Botan::checked_cast_to ( AT i)
constexpr

Definition at line 74 of file int_utils.h.

74 {
75 return checked_cast_to_or_throw<RT, Internal_Error>(i, "Error during integer conversion");
76}
Botan::checked_cast_to_or_throw
constexpr RT checked_cast_to_or_throw(AT i, std::string_view error_msg_on_fail)
Definition int_utils.h:61

References checked_cast_to_or_throw().

Referenced by Botan::Cert_Extension::ASBlocks::ASIdOrRange::decode_from(), Botan::HSS_LMS_Params::L(), Botan::XMSS_PrivateKey::remaining_signatures(), Botan::ML_DSA_MessageHash::start(), and Botan::HSS_LMS_PublicKeyInternal::verify_signature().

◆ checked_cast_to_or_throw()

template<typename RT, typename ExceptionType, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
RT Botan::checked_cast_to_or_throw ( AT i,
std::string_view error_msg_on_fail )
constexpr

Definition at line 61 of file int_utils.h.

61 {
62 const auto unwrapped_input = unwrap_strong_type(i);
63
64 const auto unwrapped_result = static_cast<strong_type_wrapped_type<RT>>(unwrapped_input);
65 if(unwrapped_input != static_cast<strong_type_wrapped_type<AT>>(unwrapped_result)) [[unlikely]] {
66 throw ExceptionType(error_msg_on_fail);
67 }
68
69 return wrap_strong_type<RT>(unwrapped_result);
70}
Botan::unwrap_strong_type
constexpr decltype(auto) unwrap_strong_type(T &&t)
Generically unwraps a strong type to its underlying type.
Definition strong_type.h:243
Botan::strong_type_wrapped_type
typename detail::wrapped_type_helper< std::remove_cvref_t< T > >::type strong_type_wrapped_type
Extracts the wrapped type from a strong type.
Definition strong_type.h:307
Botan::wrap_strong_type
constexpr decltype(auto) wrap_strong_type(ParamT &&t)
Wraps a value into a caller-defined (strong) type.
Definition strong_type.h:268

References unwrap_strong_type(), and wrap_strong_type().

Referenced by checked_cast_to(), and Botan::HSS_LMS_Params::HSS_LMS_Params().

◆ checked_mul()

template<std::unsigned_integral T>
std::optional< T > Botan::checked_mul ( T a,
T b )
inlineconstexpr

Definition at line 46 of file int_utils.h.

46 {
47 // Multiplication by 1U is a hack to work around C's insane
48 // integer promotion rules.
49 // https://stackoverflow.com/questions/24795651
50 const T r = (1U * a) * b;
51 // If a == 0 then the multiply certainly did not overflow
52 // Otherwise r / a == b unless overflow occurred
53 if(a != 0 && r / a != b) {
54 return {};
55 }
56 return r;
57}

Referenced by Botan::mlock_allocator::allocate(), allocate_memory(), and Botan::mlock_allocator::deallocate().

◆ checked_sub()

template<std::unsigned_integral T>
std::optional< T > Botan::checked_sub ( T a,
T b )
constexpr

Definition at line 28 of file int_utils.h.

28 {
29 if(b > a) {
30 return {};
31 }
32 return a - b;
33}

◆ choose()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::choose ( T mask,
T a,
T b )
constexpr

Bitwise selection

If mask is |1| returns a If mask is |0| returns b If mask is some other value returns a or b depending on the bit

Definition at line 216 of file bit_ops.h.

216 {
217 //return (mask & a) | (~mask & b);
218 return (b ^ (mask & (a ^ b)));
219}

References BOTAN_FORCE_INLINE.

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::conditional_assign(), Botan::IntMod< MontgomeryRep< ScalarParams > >::conditional_assign(), Botan::IntMod< MontgomeryRep< ScalarParams > >::conditional_assign(), Botan::IntMod< MontgomeryRep< ScalarParams > >::conditional_swap(), Botan::SHA1_F::F1(), majority(), R2(), Botan::CT::Mask< T >::select(), Botan::CT::Mask< T >::select_n(), SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

◆ clear_bytes()

void Botan::clear_bytes ( void * ptr,
size_t bytes )
inlineconstexpr

Zero out some bytes. Warning: use secure_scrub_memory instead if the memory is about to be freed or otherwise the compiler thinks it can elide the writes.

Parameters
ptra pointer to memory to zero
bytesthe number of bytes to zero in ptr

Definition at line 101 of file mem_ops.h.

101 {
102 if(bytes > 0) {
103 std::memset(ptr, 0, bytes);
104 }
105}

Referenced by clear_mem(), clear_mem(), Botan::TPM2::init_with_size(), and Botan::Memory_Pool::Memory_Pool().

◆ clear_mem() [1/2]

template<ranges::contiguous_output_range R>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<R>>
void Botan::clear_mem ( R && mem)
inlineconstexpr

Zero memory before use. This simply calls memset and should not be used in cases where the compiler cannot see the call as a side-effecting operation.

Parameters
mema contiguous range of Ts to zero

Definition at line 130 of file mem_ops.h.

132{
133 clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem));
134}
Botan::ranges::size_bytes
constexpr size_t size_bytes(const spanable_range auto &r)
Definition range_concepts.h:59
Botan::clear_bytes
constexpr void clear_bytes(void *ptr, size_t bytes)
Definition mem_ops.h:101

References clear_bytes(), and Botan::ranges::size_bytes().

◆ clear_mem() [2/2]

template<typename T>
void Botan::clear_mem ( T * ptr,
size_t n )
inlineconstexpr

Zero memory before use. This simply calls memset and should not be used in cases where the compiler cannot see the call as a side-effecting operation (for example, if calling clear_mem before deallocating memory, the compiler would be allowed to omit the call to memset entirely under the as-if rule.)

Parameters
ptra pointer to an array of Ts to zero
nthe number of Ts pointed to by ptr

Definition at line 118 of file mem_ops.h.

118 {
119 clear_bytes(ptr, sizeof(T) * n);
120}

References clear_bytes().

Referenced by base_decode(), Botan_FFI::botan_view_bin_bounce_fn(), Botan::CT::copy_output(), create_aes_row_generator(), Botan::Sodium::crypto_secretbox_xsalsa20poly1305(), Botan::Sodium::crypto_secretbox_xsalsa20poly1305_open(), Botan::BigInt::ct_reduce_below(), Botan::BigInt::ct_shift_left(), Botan::Bcrypt_PBKDF::derive_key(), Botan::ZFEC::encode_shares(), Botan::BigInt::encode_words(), Botan::StreamCipher::generate_keystream(), Botan::Gf448Elem::Gf448Elem(), hex_decode(), Botan::BLAKE2b::key_schedule(), Botan::EC_Point_Var_Point_Precompute::mul(), pbkdf2(), Botan::CRYSTALS::Trait_Base< ConstantsT, DerivedT >::polyvec_pointwise_acc_montgomery(), Botan::BigInt::reduce_below(), Botan::polyn_gf2m::set_to_zero(), Botan::polyn_gf2m::sqmod_init(), Botan::bitvector_base< secure_allocator >::to_bytes(), Botan::Zlib_Style_Stream< Stream, ByteType, StreamLenType >::Zlib_Style_Stream(), and Botan::Zlib_Style_Stream< Stream, ByteType, StreamLenType >::~Zlib_Style_Stream().

◆ clmul()

template<int M>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 Botan::clmul ( const SIMD_4x32 & H,
const SIMD_4x32 & x )

Definition at line 31 of file polyval_fn.h.

31 {
32 static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode");
33
34#if defined(BOTAN_SIMD_USE_SSSE3)
35 return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M));
36#elif defined(BOTAN_SIMD_USE_NEON)
37 const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01);
38 const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4);
39
40 #if defined(BOTAN_BUILD_COMPILER_IS_MSVC)
41 __n64 a1 = {a}, b1 = {b};
42 return SIMD_4x32(vmull_p64(a1, b1));
43 #else
44 return SIMD_4x32(reinterpret_cast<uint32x4_t>(vmull_p64(a, b)));
45 #endif
46
47#elif defined(BOTAN_SIMD_USE_ALTIVEC)
48 const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF);
49 constexpr uint8_t flip = (std::endian::native == std::endian::big) ? 0x11 : 0x00;
50
51 SIMD_4x32 i1 = x;
52 SIMD_4x32 i2 = H;
53
54 if constexpr(std::endian::native == std::endian::big) {
55 i1 = reverse_vector(i1).bswap();
56 i2 = reverse_vector(i2).bswap();
57 }
58
59 if constexpr(M == (0x11 ^ flip)) {
60 i1 &= mask_lo;
61 i2 &= mask_lo;
62 } else if constexpr(M == (0x10 ^ flip)) {
63 i1 = i1.shift_elems_left<2>();
64 } else if constexpr(M == (0x01 ^ flip)) {
65 i2 = i2.shift_elems_left<2>();
66 } else if constexpr(M == (0x00 ^ flip)) {
67 i1 = mask_lo.andc(i1);
68 i2 = mask_lo.andc(i2);
69 }
70
71 auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw());
72 auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw());
73
74 #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd)
75 auto rv = __builtin_crypto_vpmsumd(i1v, i2v);
76 #else
77 auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v);
78 #endif
79
80 auto z = SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv));
81
82 if constexpr(std::endian::native == std::endian::big) {
83 z = reverse_vector(z).bswap();
84 }
85
86 return z;
87#endif
88}
Botan::SIMD_4x32
Definition simd_4x32.h:61
Botan::SIMD_4x32::raw
native_simd_type BOTAN_FN_ISA_SIMD_4X32 raw() const noexcept
Definition simd_4x32.h:916
Botan::SIMD_4x32::bswap
BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 bswap() const noexcept
Definition simd_4x32.h:576
Botan::reverse_vector
BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 reverse_vector(const SIMD_4x32 &in)
Definition polyval_fn.h:16

References Botan::SIMD_4x32::andc(), BOTAN_FORCE_INLINE, Botan::SIMD_4x32::bswap(), Botan::SIMD_4x32::raw(), reverse_vector(), and Botan::SIMD_4x32::shift_elems_left().

Referenced by polyval_multiply(), and polyval_reduce().

◆ comba_mul()

template<size_t N, WordType W>
void Botan::comba_mul ( W z[2 *N],
const W x[N],
const W y[N] )
inlineconstexpr

Definition at line 801 of file mp_core.h.

801 {
802 if(!std::is_constant_evaluated()) {
803 if constexpr(std::same_as<W, word> && N == 4) {
804 return bigint_comba_mul4(z, x, y);
805 }
806 if constexpr(std::same_as<W, word> && N == 6) {
807 return bigint_comba_mul6(z, x, y);
808 }
809 if constexpr(std::same_as<W, word> && N == 7) {
810 return bigint_comba_mul7(z, x, y);
811 }
812 if constexpr(std::same_as<W, word> && N == 8) {
813 return bigint_comba_mul8(z, x, y);
814 }
815 if constexpr(std::same_as<W, word> && N == 9) {
816 return bigint_comba_mul9(z, x, y);
817 }
818 if constexpr(std::same_as<W, word> && N == 16) {
819 return bigint_comba_mul16(z, x, y);
820 }
821 }
822
823 word3<W> accum;
824
825 for(size_t i = 0; i != 2 * N; ++i) {
826 const size_t start = i + 1 < N ? 0 : i + 1 - N;
827 const size_t end = std::min(N, i + 1);
828
829 for(size_t j = start; j != end; ++j) {
830 accum.mul(x[j], y[i - j]);
831 }
832 z[i] = accum.extract();
833 }
834}
Botan::bigint_comba_mul7
void bigint_comba_mul7(word z[14], const word x[7], const word y[7])
Definition mp_comba.cpp:221

References bigint_comba_mul16(), bigint_comba_mul4(), bigint_comba_mul6(), bigint_comba_mul7(), bigint_comba_mul8(), bigint_comba_mul9(), Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by Botan::BlindedScalarBits< C, WindowBits+1 >::BlindedScalarBits(), mul_mod(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator*, Botan::IntMod< MontgomeryRep< ScalarParams > >::operator*=(), Botan::MontgomeryRep< Params >::to_rep(), and Botan::MontgomeryRep< Params >::wide_to_rep().

◆ comba_sqr()

template<size_t N, WordType W>
void Botan::comba_sqr ( W z[2 *N],
const W x[N] )
inlineconstexpr

Definition at line 837 of file mp_core.h.

837 {
838 if(!std::is_constant_evaluated()) {
839 if constexpr(std::same_as<W, word> && N == 4) {
840 return bigint_comba_sqr4(z, x);
841 }
842 if constexpr(std::same_as<W, word> && N == 6) {
843 return bigint_comba_sqr6(z, x);
844 }
845 if constexpr(std::same_as<W, word> && N == 7) {
846 return bigint_comba_sqr7(z, x);
847 }
848 if constexpr(std::same_as<W, word> && N == 8) {
849 return bigint_comba_sqr8(z, x);
850 }
851 if constexpr(std::same_as<W, word> && N == 9) {
852 return bigint_comba_sqr9(z, x);
853 }
854 if constexpr(std::same_as<W, word> && N == 16) {
855 return bigint_comba_sqr16(z, x);
856 }
857 }
858
859 word3<W> accum;
860
861 for(size_t i = 0; i != 2 * N; ++i) {
862 const size_t start = i + 1 < N ? 0 : i + 1 - N;
863 const size_t end = std::min(N, i + 1);
864
865 for(size_t j = start; j != end; ++j) {
866 accum.mul(x[j], x[i - j]);
867 }
868 z[i] = accum.extract();
869 }
870}
Botan::bigint_comba_sqr7
void bigint_comba_sqr7(word z[14], const word x[7])
Definition mp_comba.cpp:171

References bigint_comba_sqr16(), bigint_comba_sqr4(), bigint_comba_sqr6(), bigint_comba_sqr7(), bigint_comba_sqr8(), bigint_comba_sqr9(), Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::square(), and Botan::IntMod< MontgomeryRep< ScalarParams > >::square_n().

◆ combine_lower()

uint64_t Botan::combine_lower ( const donna128 & a,
size_t s1,
const donna128 & b,
size_t s2 )
inlineconstexpr

Definition at line 133 of file donna128.h.

133 {
134 const donna128 z = (a >> s1) | (b << s2);
135 return z.lo();
136}
Botan::donna128::lo
constexpr uint64_t lo() const
Definition donna128.h:83

References Botan::donna128::lo().

◆ commoncrypto_adjust_key_size()

void Botan::commoncrypto_adjust_key_size ( const uint8_t key[],
size_t length,
const CommonCryptor_Opts & opts,
secure_vector< uint8_t > & full_key )

Definition at line 134 of file commoncrypto_utils.cpp.

137 {
138 if(opts.algo == kCCAlgorithmBlowfish && length < 8) {
139 size_t repeat;
140 switch(length) {
141 case 1:
142 repeat = 8;
143 break;
144 case 2:
145 repeat = 4;
146 break;
147 case 3:
148 repeat = 3;
149 break;
150 default:
151 repeat = 2;
152 break;
153 }
154
155 full_key.resize(length * repeat);
156 for(size_t i = 0; i < repeat; i++) {
157 copy_mem(full_key.data() + i * length, key, length);
158 }
159 } else if(opts.algo == kCCAlgorithm3DES && length == 16) {
160 full_key += std::make_pair(key, 8);
161 }
162}
Botan::CommonCryptor_Opts::algo
CCAlgorithm algo
Definition commoncrypto_utils.h:18

References Botan::CommonCryptor_Opts::algo, and copy_mem().

◆ commoncrypto_opts_from_algo()

CommonCryptor_Opts Botan::commoncrypto_opts_from_algo ( std::string_view algo)

Definition at line 96 of file commoncrypto_utils.cpp.

96 {
97 SCAN_Name spec(algo);
98
99 std::string algo_name = spec.algo_name();
100 std::string cipher_mode = spec.cipher_mode();
101 std::string cipher_mode_padding = spec.cipher_mode_pad();
102
103 CommonCryptor_Opts opts = commoncrypto_opts_from_algo_name(algo_name);
104
105 //TODO add CFB and XTS support
106 if(cipher_mode.empty() || cipher_mode == "ECB") {
107 opts.mode = kCCModeECB;
108 } else if(cipher_mode == "CBC") {
109 opts.mode = kCCModeCBC;
110 } else if(cipher_mode == "CTR") {
111 opts.mode = kCCModeCTR;
112 } else if(cipher_mode == "OFB") {
113 opts.mode = kCCModeOFB;
114 } else {
115 throw CommonCrypto_Error("Unsupported cipher mode!");
116 }
117
118 if(cipher_mode_padding == "NoPadding") {
119 opts.padding = ccNoPadding;
120 }
121 /*
122 else if(cipher_mode_padding.empty() || cipher_mode_padding == "PKCS7")
123 {
124 opts.padding = ccPKCS7Padding;
125 }
126 */
127 else {
128 throw CommonCrypto_Error("Unsupported cipher mode padding!");
129 }
130
131 return opts;
132}
Botan::CommonCrypto_Error
Definition commoncrypto.h:26
Botan::SCAN_Name
Definition scan_name.h:22
Botan::commoncrypto_opts_from_algo_name
CommonCryptor_Opts commoncrypto_opts_from_algo_name(std::string_view algo_name)
Definition commoncrypto_utils.cpp:56
Botan::CommonCryptor_Opts
Definition commoncrypto_utils.h:17
Botan::CommonCryptor_Opts::mode
CCMode mode
Definition commoncrypto_utils.h:19
Botan::CommonCryptor_Opts::padding
CCPadding padding
Definition commoncrypto_utils.h:20

References Botan::SCAN_Name::algo_name(), Botan::SCAN_Name::cipher_mode(), Botan::SCAN_Name::cipher_mode_pad(), commoncrypto_opts_from_algo_name(), Botan::CommonCryptor_Opts::mode, and Botan::CommonCryptor_Opts::padding.

Referenced by make_commoncrypto_cipher_mode().

◆ commoncrypto_opts_from_algo_name()

CommonCryptor_Opts Botan::commoncrypto_opts_from_algo_name ( std::string_view algo_name)

Definition at line 56 of file commoncrypto_utils.cpp.

56 {
57 CommonCryptor_Opts opts;
58
59 if(algo_name.compare(0, 3, "AES") == 0) {
60 opts.algo = kCCAlgorithmAES;
61 opts.block_size = kCCBlockSizeAES128;
62 if(algo_name == "AES-128") {
63 opts.key_spec = Key_Length_Specification(kCCKeySizeAES128);
64 } else if(algo_name == "AES-192") {
65 opts.key_spec = Key_Length_Specification(kCCKeySizeAES192);
66 } else if(algo_name == "AES-256") {
67 opts.key_spec = Key_Length_Specification(kCCKeySizeAES256);
68 } else {
69 throw CommonCrypto_Error("Unknown AES algorithm");
70 }
71 } else if(algo_name == "DES") {
72 opts.algo = kCCAlgorithmDES;
73 opts.block_size = kCCBlockSizeDES;
74 opts.key_spec = Key_Length_Specification(kCCKeySizeDES);
75 } else if(algo_name == "TripleDES") {
76 opts.algo = kCCAlgorithm3DES;
77 opts.block_size = kCCBlockSize3DES;
78 opts.key_spec = Key_Length_Specification(16, kCCKeySize3DES, 8);
79 } else if(algo_name == "Blowfish") {
80 opts.algo = kCCAlgorithmBlowfish;
81 opts.block_size = kCCBlockSizeBlowfish;
82 opts.key_spec = Key_Length_Specification(1, kCCKeySizeMaxBlowfish, 1);
83 } else if(algo_name == "CAST-128") {
84 opts.algo = kCCAlgorithmCAST;
85 opts.block_size = kCCBlockSizeCAST;
86 // Botan's base implementation of CAST does not support shorter keys
87 // so we limit its minimum key size to 11 here.
88 opts.key_spec = Key_Length_Specification(11, kCCKeySizeMaxCAST, 1);
89 } else {
90 throw CommonCrypto_Error("Unsupported cipher");
91 }
92
93 return opts;
94}
Botan::Key_Length_Specification
Definition sym_algo.h:22
Botan::CommonCryptor_Opts::key_spec
Key_Length_Specification key_spec
Definition commoncrypto_utils.h:22
Botan::CommonCryptor_Opts::block_size
size_t block_size
Definition commoncrypto_utils.h:21

References Botan::CommonCryptor_Opts::algo, Botan::CommonCryptor_Opts::block_size, and Botan::CommonCryptor_Opts::key_spec.

Referenced by commoncrypto_opts_from_algo(), and make_commoncrypto_block_cipher().

◆ compute_root() [1/2]

BOTAN_TEST_API void Botan::compute_root ( StrongSpan< SphincsTreeNode > out,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes,
const SphincsTreeNode & leaf,
TreeNodeIndex leaf_idx,
uint32_t idx_offset,
StrongSpan< const SphincsAuthenticationPath > authentication_path,
uint32_t tree_height,
Sphincs_Address & tree_address )

Using a leaf node and the authentication path (neighbor nodes on the way from leaf to root), computes the the root node of the respective tree. This function is generic and used by FORS and XMSS in the SLH-DSA verification logic.

Definition at line 102 of file sp_treehash.cpp.

110 {
111 BOTAN_ASSERT_NOMSG(out.size() == params.n());
112 BOTAN_ASSERT_NOMSG(authentication_path.size() == params.n() * total_tree_height);
113 BOTAN_ASSERT_NOMSG(leaf.size() == params.n());
114
115 // Use the `out` parameter as intermediate buffer for left/right nodes
116 // while traversing the tree.
117 copy_mem(out, leaf);
118
119 // Views into either `auth_path` or `out` depending on the tree location.
120 StrongSpan<const SphincsTreeNode> left;
121 StrongSpan<const SphincsTreeNode> right;
122
123 BufferSlicer auth_path(authentication_path);
124
125 // The leaf is put in the left or right buffer, depending on its indexes parity.
126 // Same for the first node of the authentication path
127
128 for(TreeLayerIndex i(0); i < total_tree_height; i++) {
129 // The input of the hash function takes the current node and the node
130 // given in the authentication path. If the current node is a right node
131 // in the tree (i.e. its leaf index is uneven) the hash function inputs
132 // must be swapped.
133 left = out;
134 right = auth_path.take<SphincsTreeNode>(params.n());
135
136 if((leaf_idx & 1) == 1U) {
137 std::swap(left, right);
138 }
139
140 leaf_idx /= 2;
141 idx_offset /= 2;
142 tree_address.set_tree_height(i + 1).set_tree_index(leaf_idx + idx_offset);
143
144 hashes.T(out, tree_address, left, right);
145 }
146
147 BOTAN_ASSERT_NOMSG(auth_path.empty());
148}
Botan::Sphincs_Address::set_tree_height
Sphincs_Address & set_tree_height(TreeLayerIndex tree_height)
Definition sp_address.h:86
Botan::Sphincs_Address::set_tree_index
Sphincs_Address & set_tree_index(TreeNodeIndex tree_index)
Definition sp_address.h:96
Botan::Sphincs_Hash_Functions::T
void T(std::span< uint8_t > out, const Sphincs_Address &address, const BufferTs &... in)
Definition sp_hash.h:57
Botan::Sphincs_Parameters::n
size_t n() const
Definition sp_parameters.h:96
Botan::StrongSpan::size
decltype(auto) size() const noexcept(noexcept(this->m_span.size()))
Definition strong_type.h:714
Botan::detail::Container_Strong_Adapter_Base::size
size_type size() const noexcept(noexcept(this->get().size()))
Definition strong_type.h:141
Botan::SphincsTreeNode
Strong< std::vector< uint8_t >, struct SphincsTreeNode_ > SphincsTreeNode
Either an XMSS or FORS tree node or leaf.
Definition sp_types.h:70
Botan::TreeLayerIndex
Strong< uint32_t, struct TreeLayerIndex_, EnableArithmeticWithPlainNumber > TreeLayerIndex
Index of the layer within a FORS/XMSS tree.
Definition sp_types.h:83

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::BufferSlicer::empty(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_tree_height(), Botan::Sphincs_Address::set_tree_index(), Botan::detail::Container_Strong_Adapter_Base< T >::size(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), and Botan::BufferSlicer::take().

Referenced by fors_public_key_from_signature(), and ht_verify().

◆ compute_root() [2/2]

template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void Botan::compute_root ( StrongSpan< TreeNode > out_root,
AuthPathSS authentication_path,
TreeNodeIndex leaf_idx,
StrongSpan< const TreeNode > leaf,
size_t node_size,
TreeLayerIndex total_tree_height,
uint32_t idx_offset,
concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash,
Address & tree_address )
inline

Uses an authentication path and a leaf node to reconstruct the root node of a merkle tree.

Parameters
out_rootA output buffer for the root node of the merkle tree.
authentication_pathThe authentication path in one buffer (concatenated nodes).
leaf_idxThe index of the leaf used to sig in the bottom layer beginning with 0.
leafThe leaf node used to sig.
node_sizeThe size of each node in the tree.
total_tree_heightThe height of the merkle tree to construct.
idx_offsetIf we compute a subtree this marks the index of the leftmost leaf node in the bottom layer.
node_pair_hashThe function to process two child nodes to compute their parent node.
tree_addressThe address that is passed to node_pair hash. This function will update the address accordings to the currently processed node. This object may contain further algorithm specific information, like the position of this merkle tree in a hypertree.

Definition at line 210 of file tree_hash.h.

219 {
220 BOTAN_ASSERT_NOMSG(out_root.size() == node_size);
221 BOTAN_ASSERT_NOMSG(authentication_path.size() == node_size * static_cast<size_t>(total_tree_height.get()));
222 BOTAN_ASSERT_NOMSG(leaf.size() == node_size);
223
224 // Use the `out` parameter as intermediate buffer for left/right nodes
225 // while traversing the tree.
226 copy_mem(out_root, leaf);
227
228 // Views into either `auth_path` or `out` depending on the tree location.
229 StrongSpan<const TreeNode> left;
230 StrongSpan<const TreeNode> right;
231
232 BufferSlicer auth_path(authentication_path);
233
234 // The leaf is put in the left or right buffer, depending on its indexes parity.
235 // Same for the first node of the authentication path
236
237 for(TreeLayerIndex i(0); i < total_tree_height; i++) {
238 // The input of the hash function takes the current node and the node
239 // given in the authentication path. If the current node is a right node
240 // in the tree (i.e. its leaf index is uneven) the hash function inputs
241 // must be swapped.
242 left = out_root;
243 right = auth_path.take<TreeNode>(node_size);
244
245 if((leaf_idx & 1) == 1U) {
246 std::swap(left, right);
247 }
248
249 leaf_idx /= 2;
250 idx_offset /= 2;
251 tree_address.set_address(i + 1, leaf_idx + idx_offset);
252
253 node_pair_hash(out_root, tree_address, left, right);
254 }
255
256 BOTAN_ASSERT_NOMSG(auth_path.empty());
257}

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::BufferSlicer::empty(), Botan::detail::Strong_Base< T >::get(), Botan::StrongSpan< T >::size(), and Botan::BufferSlicer::take().

◆ compute_rsa_secret_exponent()

BigInt BOTAN_TEST_API Botan::compute_rsa_secret_exponent ( const BigInt & e,
const BigInt & phi_n,
const BigInt & p,
const BigInt & q )

Compute the RSA private exponent d

This algorithm is constant time with respect to phi_n, p, and q, aside from leaking their lengths. It may leak the public exponent e.

Parameters
ethe public exponent
phi_nis lcm(p-1, q-1)
pis the first secret prime
qis the second secret prime
Returns
d inverse of e modulo phi_n

Definition at line 332 of file mod_inv.cpp.

332 {
333 /*
334 * Both p - 1 and q - 1 are chosen to be relatively prime to e. Thus
335 * phi(n), the least common multiple of p - 1 and q - 1, is also
336 * relatively prime to e.
337 */
338 BOTAN_DEBUG_ASSERT(gcd(e, phi_n) == 1);
339
340 if(e == 65537) {
341 /*
342 Arazi's algorithm for inversion of prime x modulo a non-prime
343
344 "GCD-Free Algorithms for Computing Modular Inverses"
345 Marc Joye and Pascal Paillier, CHES 2003 (LNCS 2779)
346 https://marcjoye.github.io/papers/JP03gcdfree.pdf
347
348 This could be extended to cover other cases such as e=3 or e=17 but
349 these days 65537 is the standard RSA public exponent
350 */
351
352 constexpr word e_w = 65537;
353
354 const word phi_mod_e = ct_mod_word(phi_n, e_w);
355 const word inv_phi_mod_e = inverse_mod_65537(phi_mod_e);
356 BOTAN_DEBUG_ASSERT((inv_phi_mod_e * phi_mod_e) % e_w == 1);
357 const word neg_inv_phi_mod_e = (e_w - inv_phi_mod_e);
358 return ct_divide_word((phi_n * neg_inv_phi_mod_e) + 1, e_w);
359 } else {
360 // TODO possibly do something else taking advantage of the special structure here
361
362 BOTAN_UNUSED(p, q);
363 if(auto d = inverse_mod_general(e, phi_n)) {
364 return *d;
365 } else {
366 throw Internal_Error("Failed to compute RSA secret exponent");
367 }
368 }
369}
BOTAN_UNUSED
#define BOTAN_UNUSED
Definition assert.h:144
Botan::ct_mod_word
word ct_mod_word(const BigInt &x, word y)
Definition divide.cpp:168
Botan::ct_divide_word
void ct_divide_word(const BigInt &x, word y, BigInt &q_out, word &r_out)
Definition divide.cpp:123
Botan::inverse_mod_general
std::optional< BigInt > inverse_mod_general(const BigInt &x, const BigInt &mod)
Definition mod_inv.cpp:179
Botan::gcd
BigInt gcd(const BigInt &a, const BigInt &b)
Definition numthry.cpp:220

References BOTAN_DEBUG_ASSERT, BOTAN_UNUSED, ct_divide_word(), ct_mod_word(), gcd(), and inverse_mod_general().

Referenced by Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

◆ concat()

template<typename OutR = detail::AutoDetect, ranges::spanable_range... Rs>
requires (all_same_v<std::ranges::range_value_t<Rs>...>)
auto Botan::concat ( Rs &&... ranges)
constexpr

Concatenate an arbitrary number of buffers. Performs range-checks as needed.

The output type can be auto-detected based on the input ranges, or explicitly specified by the caller. If all input ranges have a static extent, the total size is calculated at compile time and a statically sized std::array<> is used. Otherwise this tries to use the type of the first input range as output type.

Alternatively, the output container type can be specified explicitly.

Definition at line 90 of file concat_util.h.

92{
93 if constexpr(std::same_as<detail::AutoDetect, OutR>) {
94 // Try to auto-detect a reasonable output type given the input ranges
95 static_assert(sizeof...(Rs) > 0, "Cannot auto-detect the output type if not a single input range is provided.");
96 using candidate_result_t = std::remove_cvref_t<std::tuple_element_t<0, std::tuple<Rs...>>>;
97 using result_range_value_t = std::remove_cvref_t<std::ranges::range_value_t<candidate_result_t>>;
98
99 if constexpr((ranges::statically_spanable_range<Rs> && ...)) {
100 // If all input ranges have a static extent, we can calculate the total size at compile time
101 // and therefore can use a statically sized output container. This is constexpr.
102 constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0);
103 using out_array_t = std::array<result_range_value_t, total_size>;
104 return detail::concatenate<out_array_t>(std::forward<Rs>(ranges)...);
105 } else {
106 // If at least one input range has a dynamic extent, we must use a dynamically allocated output container.
107 // We assume that the user wants to use the first input range's container type as output type.
108 static_assert(
109 concepts::reservable_container<candidate_result_t>,
110 "First input range has static extent, but a dynamically allocated output range is required. Please explicitly specify a dynamically allocatable output type.");
111 return detail::concatenate<candidate_result_t>(std::forward<Rs>(ranges)...);
112 }
113 } else {
114 // The caller has explicitly specified the output type
115 return detail::concatenate<OutR>(std::forward<Rs>(ranges)...);
116 }
117}
Botan::concepts::reservable_container
Definition concepts.h:78
Botan::ranges::statically_spanable_range
Definition range_concepts.h:51
Botan::detail::concatenate
constexpr OutR concatenate(Rs &&... ranges)
Definition concat_util.h:31

References Botan::detail::concatenate().

Referenced by Botan::GeneralName::binary_name(), Botan::Classic_McEliece_Polynomial_Ring::compute_minimal_polynomial(), Botan::Expanded_Keypair_Codec::encode_keypair(), Botan::Seed_Expanding_Keypair_Codec::encode_keypair(), hkdf_expand_label(), Botan::Kyber_PublicKeyInternal::Kyber_PublicKeyInternal(), Botan::SphincsPlus_PrivateKey::private_key_bits(), Botan::FrodoKEM_PrivateKey::raw_private_key_bits(), Botan::FrodoKEM_PublicKey::raw_public_key_bits(), Botan::Hybrid_PublicKey::raw_public_key_bits(), Botan::TLS::Hybrid_KEM_PublicKey::raw_public_key_bits(), Botan::XMSS_PublicKey::raw_public_key_bits(), Botan::Classic_McEliece_PrivateKeyInternal::serialize(), Botan::Ascon_AEAD128_Mode::start_msg(), Botan::HSS_LMS_PublicKeyInternal::to_bytes(), and Botan::LMS_PublicKey::to_bytes().

◆ constant_time_compare() [1/2]

bool Botan::constant_time_compare ( const uint8_t x[],
const uint8_t y[],
size_t len )
inline

Memory comparison, input insensitive

Parameters
xa pointer to an array
ya pointer to another array
lenthe number of Ts in x and y
Returns
true iff x[i] == y[i] forall i in [0...n)

Definition at line 88 of file mem_ops.h.

88 {
89 // simply assumes that *x and *y point to len allocated bytes at least
90 return constant_time_compare({x, len}, {y, len});
91}
Botan::constant_time_compare
bool constant_time_compare(std::span< const uint8_t > x, std::span< const uint8_t > y)
Definition mem_ops.cpp:17

References constant_time_compare().

◆ constant_time_compare() [2/2]

bool Botan::constant_time_compare ( std::span< const uint8_t > x,
std::span< const uint8_t > y )

Memory comparison, input insensitive

Parameters
xa range of bytes
yanother range of bytes
Returns
true iff x and y have equal lengths and x[i] == y[i] forall i in [0...n)

Definition at line 17 of file mem_ops.cpp.

17 {
18 const auto min_size = CT::Mask<size_t>::is_lte(x.size(), y.size()).select(x.size(), y.size());
19 const auto equal_size = CT::Mask<size_t>::is_equal(x.size(), y.size());
20 const auto equal_content = CT::Mask<size_t>::expand(CT::is_equal(x.data(), y.data(), min_size));
21 return (equal_content & equal_size).as_bool();
22}
Botan::CT::Mask::is_lte
static constexpr Mask< T > is_lte(T x, T y)
Definition ct_utils.h:463

References Botan::CT::Mask< T >::expand(), Botan::CT::is_equal(), Botan::CT::Mask< T >::is_equal(), and Botan::CT::Mask< T >::is_lte().

Referenced by constant_time_compare(), Botan::PKCS1v15_Raw_SignaturePaddingScheme::verify(), and Botan::PKCS1v15_SignaturePaddingScheme::verify().

◆ copy_mem() [1/2]

template<ranges::contiguous_output_range OutR, ranges::contiguous_range InR>
requires std::is_same_v<std::ranges::range_value_t<OutR>, std::ranges::range_value_t<InR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<InR>>
void Botan::copy_mem ( OutR && out,
const InR & in )
inlineconstexpr

Copy memory

Parameters
outthe destination array
inthe source array

Definition at line 160 of file mem_ops.h.

160 {
161 ranges::assert_equal_byte_lengths(out, in);
162 if(std::is_constant_evaluated()) {
163 std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
164 } else if(ranges::size_bytes(out) > 0) {
165 std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
166 }
167}
Botan::ranges::assert_equal_byte_lengths
constexpr void assert_equal_byte_lengths(const R0 &r0, const Rs &... rs)
Definition range_concepts.h:98

References Botan::ranges::assert_equal_byte_lengths(), and Botan::ranges::size_bytes().

◆ copy_mem() [2/2]

template<typename T>
requires std::is_trivial_v<std::decay_t<T>>
void Botan::copy_mem ( T * out,
const T * in,
size_t n )
inlineconstexpr

Copy memory

Parameters
outthe destination array
inthe source array
nthe number of elements of in/out

Definition at line 144 of file mem_ops.h.

144 {
145 BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
146
147 if(in != nullptr && out != nullptr && n > 0) {
148 std::memmove(out, in, sizeof(T) * n);
149 }
150}
BOTAN_ASSERT_IMPLICATION
#define BOTAN_ASSERT_IMPLICATION(expr1, expr2, msg)
Definition assert.h:101

References BOTAN_ASSERT_IMPLICATION.

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::Argon2::blamka(), botan_cipher_update(), botan_privkey_ed25519_get_privkey(), botan_privkey_ed448_get_privkey(), botan_privkey_x25519_get_privkey(), botan_privkey_x448_get_privkey(), botan_pubkey_ed25519_get_pubkey(), botan_pubkey_ed448_get_pubkey(), botan_pubkey_x25519_get_pubkey(), botan_pubkey_x448_get_pubkey(), Botan_FFI::botan_view_bin_bounce_fn(), buffer_insert(), buffer_insert(), Botan::Ed25519_PublicKey::check_key(), Botan::CRYSTALS::Polynomial< DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT >::clone(), Botan::CRYSTALS::PolynomialVector< DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT >::clone(), commoncrypto_adjust_key_size(), Botan::Streebog::compress_64(), compute_root(), compute_root(), Botan::TPM2::copy_into(), Botan::TPM2::copy_into(), Botan::Sodium::crypto_auth_hmacsha512256(), Botan::Sodium::crypto_box_curve25519xsalsa20poly1305_seed_keypair(), curve25519_donna(), ed25519_gen_keypair(), Botan::Ed448_PublicKey::Ed448_PublicKey(), Botan::ML_KEM_Encryptor::encapsulate(), Botan::BigInt::encode_words(), Botan::CryptoBox::encrypt(), expand_message_xmd(), Botan::RawHashFunction::final_result(), Botan::TLS::Stream_Handshake_IO::format(), Botan::CCM_Mode::format_b0(), Botan::CCM_Mode::format_c0(), Botan::MontgomeryRep< Params >::from_rep(), Botan::IntMod< MontgomeryRep< ScalarParams > >::from_wide_bytes(), Botan::IntMod< MontgomeryRep< ScalarParams > >::from_wide_bytes_varlen(), Botan::IntMod< MontgomeryRep< ScalarParams > >::from_words(), Botan::TPM_Context::gen_random(), Botan::Gf448Elem::Gf448Elem(), Botan::BLAKE2b::key_schedule(), mceliece_decrypt(), Botan::Montgomery_Int::Montgomery_Int(), Botan::Montgomery_Int::mul_by(), Botan::Montgomery_Params::mul_by(), nist_key_unwrap(), nist_key_unwrap_padded(), nist_key_wrap(), nist_key_wrap_padded(), operator^(), Botan::DataSource_Memory::peek(), Botan::PseudorandomKeyGeneration::PseudorandomKeyGeneration(), Botan::DataSource_Memory::read(), reduce_mod(), Botan::Blowfish::salted_set_key(), Botan::Scalar448::Scalar448(), Botan::CTR_BE::seek(), Botan::IntMod< MontgomeryRep< ScalarParams > >::serialize_to(), Botan::EC_AffinePoint_Data_PC::serialize_uncompressed_to(), Botan::EC_AffinePoint_Data_BN::serialize_x_to(), Botan::EC_AffinePoint_Data_PC::serialize_x_to(), Botan::EC_AffinePoint_Data_BN::serialize_xy_to(), Botan::EC_AffinePoint_Data_PC::serialize_xy_to(), Botan::EC_AffinePoint_Data_BN::serialize_y_to(), Botan::EC_AffinePoint_Data_PC::serialize_y_to(), Botan::TLS::Session_Keys::Session_Keys(), Botan::CFB_Mode::shift_register(), Botan::HSS_LMS_PrivateKeyInternal::sign(), Botan::RTSS_Share::split(), Botan::polyn_gf2m::sqmod_init(), Botan::Montgomery_Int::square_this_n_times(), Botan::GHASH::start(), Botan::bitvector_base< secure_allocator >::subvector(), treehash(), treehash(), Botan::XTS_Mode::update_tweak(), Botan::Base64_Decoder::write(), Botan::Base64_Encoder::write(), Botan::Buffered_Filter::write(), Botan::Hex_Decoder::write(), Botan::Hex_Encoder::write(), and Botan::X448_PublicKey::X448_PublicKey().

◆ copy_out_be()

template<ranges::spanable_range InR>
void Botan::copy_out_be ( std::span< uint8_t > out,
const InR & in )
inline

Partially copy a subset of in into out using big-endian byte order.

Definition at line 773 of file loadstor.h.

773 {
774 using T = std::ranges::range_value_t<InR>;
775 std::span<const T> in_s{in};
776 const auto remaining_bytes = detail::copy_out_any_word_aligned_portion<std::endian::big>(out, in_s);
777
778 // copy remaining bytes as a partial word
779 for(size_t i = 0; i < remaining_bytes; ++i) {
780 out[i] = get_byte_var(i, in_s.front());
781 }
782}
Botan::detail::copy_out_any_word_aligned_portion
size_t copy_out_any_word_aligned_portion(std::span< uint8_t > &out, std::span< const T > &in)
Definition loadstor.h:752
Botan::get_byte_var
constexpr uint8_t get_byte_var(size_t byte_num, T input)
Definition loadstor.h:69

References Botan::detail::copy_out_any_word_aligned_portion(), and get_byte_var().

◆ copy_out_le()

template<ranges::spanable_range InR>
void Botan::copy_out_le ( std::span< uint8_t > out,
const InR & in )
inline

Partially copy a subset of in into out using little-endian byte order.

Definition at line 789 of file loadstor.h.

789 {
790 using T = std::ranges::range_value_t<InR>;
791 std::span<const T> in_s{in};
792 const auto remaining_bytes = detail::copy_out_any_word_aligned_portion<std::endian::little>(out, in_s);
793
794 // copy remaining bytes as a partial word
795 for(size_t i = 0; i < remaining_bytes; ++i) {
796 out[i] = get_byte_var(sizeof(T) - 1 - i, in_s.front());
797 }
798}

References Botan::detail::copy_out_any_word_aligned_portion(), and get_byte_var().

Referenced by Botan::BLAKE2b::final_result(), and xts_compute_tweak_block().

◆ count_bits()

template<WordType W, size_t N>
size_t Botan::count_bits ( const std::array< W, N > & p)
inlineconsteval

Definition at line 269 of file pcurves_util.h.

269 {
270 auto get_bit = [&](size_t i) {
271 const size_t w = i / WordInfo<W>::bits;
272 const size_t b = i % WordInfo<W>::bits;
273 return static_cast<uint8_t>((p[w] >> b) & 0x01);
274 };
275
276 size_t b = WordInfo<W>::bits * N;
277
278 // Conditional ok: this function is consteval
279 while(get_bit(b - 1) == 0) {
280 b -= 1;
281 }
282
283 return b;
284}

◆ create_aes_row_generator()

auto Botan::create_aes_row_generator ( const FrodoKEMConstants & constants,
StrongSpan< const FrodoSeedA > seed_a )
inline

Definition at line 23 of file frodo_aes_generator.h.

23 {
24 BOTAN_ASSERT_NOMSG(constants.mode().is_aes());
25
26 auto setup_aes = [](StrongSpan<const FrodoSeedA> seed) {
27 AES_128 aes;
28 aes.set_key(seed);
29 return aes;
30 };
31
32 return [n = static_cast<uint16_t>(constants.n()), aes = setup_aes(seed_a)](std::span<uint8_t> out, uint16_t i) {
33 BufferStuffer out_bs(out);
34
35 BOTAN_DEBUG_ASSERT(out_bs.remaining_capacity() % AES_128::BLOCK_SIZE == 0);
36
37 for(uint16_t j = 0; j < n; j += AES_128::BLOCK_SIZE / 2) {
38 // set up the to-be-encrypted 'b' value in the out variable
39 // for in-place encryption of the block cipher
40 // b = i || j || 0000...
41 out_bs.append(store_le(i, j));
42 clear_mem(out_bs.next<AES_128::BLOCK_SIZE - sizeof(i) - sizeof(j)>());
43 }
44
45 BOTAN_DEBUG_ASSERT(out_bs.full());
46
47 aes.encrypt(out);
48 };
49}
Botan::AES_128
Definition aes.h:19
Botan::BlockCipher::encrypt
void encrypt(const uint8_t in[], uint8_t out[]) const
Definition block_cipher.h:82
Botan::Block_Cipher_Fixed_Params< 16, 16 >::BLOCK_SIZE
@ BLOCK_SIZE
Definition block_cipher.h:212
Botan::FrodoKEMConstants::mode
FrodoKEMMode mode() const
Definition frodo_constants.h:37
Botan::FrodoKEMMode::is_aes
bool is_aes() const
Definition frodo_mode.h:63
Botan::SymmetricAlgorithm::set_key
void set_key(const OctetString &key)
Definition sym_algo.cpp:14
Botan::store_le
constexpr auto store_le(ParamTs &&... params)
Definition loadstor.h:736

References Botan::BufferStuffer::append(), Botan::Block_Cipher_Fixed_Params< 16, 16 >::BLOCK_SIZE, BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, clear_mem(), Botan::BufferStuffer::full(), Botan::FrodoKEMMode::is_aes(), Botan::FrodoKEMConstants::mode(), Botan::FrodoKEMConstants::n(), Botan::BufferStuffer::next(), Botan::BufferStuffer::remaining_capacity(), Botan::SymmetricAlgorithm::set_key(), and store_le().

◆ create_ec_private_key()

std::unique_ptr< Private_Key > Botan::create_ec_private_key ( std::string_view algo_name,
const EC_Group & group,
RandomNumberGenerator & rng )

Create a new ECC key

Definition at line 448 of file pk_algs.cpp.

450 {
451 // Potentially unused if all EC algorithms are disabled
452 BOTAN_UNUSED(alg_name, ec_group, rng);
453
454#if defined(BOTAN_HAS_ECDSA)
455 if(alg_name == "ECDSA") {
456 return std::make_unique<ECDSA_PrivateKey>(rng, ec_group);
457 }
458#endif
459
460#if defined(BOTAN_HAS_ECDH)
461 if(alg_name == "ECDH") {
462 return std::make_unique<ECDH_PrivateKey>(rng, ec_group);
463 }
464#endif
465
466#if defined(BOTAN_HAS_ECKCDSA)
467 if(alg_name == "ECKCDSA") {
468 return std::make_unique<ECKCDSA_PrivateKey>(rng, ec_group);
469 }
470#endif
471
472#if defined(BOTAN_HAS_GOST_34_10_2001)
473 if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
474 return std::make_unique<GOST_3410_PrivateKey>(rng, ec_group);
475 }
476#endif
477
478#if defined(BOTAN_HAS_SM2)
479 if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
480 return std::make_unique<SM2_PrivateKey>(rng, ec_group);
481 }
482#endif
483
484#if defined(BOTAN_HAS_ECGDSA)
485 if(alg_name == "ECGDSA") {
486 return std::make_unique<ECGDSA_PrivateKey>(rng, ec_group);
487 }
488#endif
489
490 return nullptr;
491}

References BOTAN_UNUSED.

Referenced by botan_ec_privkey_create(), and create_private_key().

◆ create_hex_fingerprint() [1/2]

std::string Botan::create_hex_fingerprint ( const uint8_t bits[],
size_t bits_len,
std::string_view hash_name )

Definition at line 38 of file pk_keys.cpp.

38 {
39 auto hash_fn = HashFunction::create_or_throw(hash_name);
40 const std::string hex_hash = hex_encode(hash_fn->process(bits, bits_len));
41
42 std::string fprint;
43
44 for(size_t i = 0; i != hex_hash.size(); i += 2) {
45 if(i != 0) {
46 fprint.push_back(':');
47 }
48
49 fprint.push_back(hex_hash[i]);
50 fprint.push_back(hex_hash[i + 1]);
51 }
52
53 return fprint;
54}
Botan::HashFunction::create_or_throw
static std::unique_ptr< HashFunction > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition hash.cpp:308
Botan::hex_encode
void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase)
Definition hex.cpp:34

References Botan::HashFunction::create_or_throw(), and hex_encode().

Referenced by create_hex_fingerprint(), Botan::X509_Certificate::fingerprint(), Botan::Private_Key::fingerprint_private(), and Botan::Public_Key::fingerprint_public().

◆ create_hex_fingerprint() [2/2]

std::string Botan::create_hex_fingerprint ( std::span< const uint8_t > vec,
std::string_view hash_name )
inline

Definition at line 428 of file pk_keys.h.

428 {
429 return create_hex_fingerprint(vec.data(), vec.size(), hash_name);
430}
Botan::create_hex_fingerprint
std::string create_hex_fingerprint(const uint8_t bits[], size_t bits_len, std::string_view hash_name)
Definition pk_keys.cpp:38

References create_hex_fingerprint().

◆ create_pk_from_sk()

BOTAN_TEST_API std::array< uint8_t, ED448_LEN > Botan::create_pk_from_sk ( std::span< const uint8_t, ED448_LEN > sk)

Create a public key point from a secret key (RFC 8032 5.2.5).

Definition at line 369 of file ed448_internal.cpp.

369 {
370 // 5.2.5. Key Generation
371 // The 57-byte public key is generated by the following steps:
372 auto shake_xof = XOF::create_or_throw("SHAKE-256");
373 shake_xof->update(sk);
374
375 const Scalar448 s = scalar_from_xof(*shake_xof);
376 // 3. Interpret the buffer as the little-endian integer, forming a
377 // secret scalar s. Perform a known-base-point scalar
378 // multiplication [s]B.
379 return Ed448Point::base_point_mul(s).encode();
380}
Botan::Ed448Point::base_point_mul
static Ed448Point base_point_mul(const Scalar448 &scalar)
Fixed base point scalar multiplication (precomputed table, no doublings).
Definition ed448_internal.cpp:242
Botan::Ed448Point::encode
std::array< uint8_t, ED448_LEN > encode() const
Encode the point to its 57-byte representation (RFC 8032 5.2.2).
Definition ed448_internal.cpp:140
Botan::Scalar448
Representation of a scalar for X448.
Definition curve448_scalar.h:34
Botan::XOF::create_or_throw
static std::unique_ptr< XOF > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition xof.cpp:54

References Botan::Ed448Point::base_point_mul(), Botan::XOF::create_or_throw(), and Botan::Ed448Point::encode().

Referenced by Botan::Ed448_PrivateKey::Ed448_PrivateKey(), and Botan::Ed448_PrivateKey::Ed448_PrivateKey().

◆ create_private_key()

std::unique_ptr< Private_Key > Botan::create_private_key ( std::string_view algo_name,
RandomNumberGenerator & rng,
std::string_view algo_params = "",
std::string_view provider = "" )

Create a new key For ECC keys, algo_params specifies EC group (eg, "secp256r1") For DH/DSA/ElGamal keys, algo_params is DL group (eg, "modp/ietf/2048") For RSA, algo_params is integer keylength For McEliece, algo_params is n,t If algo_params is left empty, suitable default parameters are chosen.

Definition at line 493 of file pk_algs.cpp.

496 {
497 /*
498 * Default parameters are chosen for work factor > 2**128 where possible
499 */
500
501#if defined(BOTAN_HAS_X25519)
502 if(alg_name == "X25519" || alg_name == "Curve25519") {
503 return std::make_unique<X25519_PrivateKey>(rng);
504 }
505#endif
506
507#if defined(BOTAN_HAS_X448)
508 if(alg_name == "X448") {
509 return std::make_unique<X448_PrivateKey>(rng);
510 }
511#endif
512
513#if defined(BOTAN_HAS_RSA)
514 if(alg_name == "RSA") {
515 const size_t modulus_bits = params.empty() ? 3072 : to_u32bit(params);
516 return std::make_unique<RSA_PrivateKey>(rng, modulus_bits);
517 }
518#endif
519
520#if defined(BOTAN_HAS_MCELIECE)
521 if(alg_name == "McEliece") {
522 const auto [n, t] = [&]() -> std::pair<size_t, size_t> {
523 if(params.empty()) {
524 return {2960, 57};
525 }
526
527 const auto mce_params = split_on(params, ',');
528
529 if(mce_params.size() != 2) {
530 throw Invalid_Argument(fmt("create_private_key: invalid McEliece parameters '{}'", params));
531 }
532
533 const size_t mce_n = to_u32bit(mce_params[0]);
534 const size_t mce_t = to_u32bit(mce_params[1]);
535 return {mce_n, mce_t};
536 }();
537
538 return std::make_unique<McEliece_PrivateKey>(rng, n, t);
539 }
540#endif
541#if defined(BOTAN_HAS_CLASSICMCELIECE)
542 if(alg_name == "ClassicMcEliece") {
543 auto cmce_params_set = params.empty() ? Classic_McEliece_Parameter_Set::ClassicMcEliece_6960119f
544 : Classic_McEliece_Parameter_Set::from_string(params);
545 return std::make_unique<Classic_McEliece_PrivateKey>(rng, cmce_params_set);
546 }
547#endif
548
549#if defined(BOTAN_HAS_FRODOKEM)
550 if(alg_name == "FrodoKEM") {
551 const auto mode = params.empty() ? FrodoKEMMode::FrodoKEM976_SHAKE : FrodoKEMMode(params);
552 return std::make_unique<FrodoKEM_PrivateKey>(rng, mode);
553 }
554#endif
555
556#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
557 if(alg_name == "Kyber") {
558 const auto mode = [&]() -> KyberMode {
559 if(params.empty()) {
560 return KyberMode::Kyber1024_R3;
561 }
562 return KyberMode(params);
563 }();
564
565 return std::make_unique<Kyber_PrivateKey>(rng, mode);
566 }
567#endif
568
569#if defined(BOTAN_HAS_ML_KEM)
570 if(alg_name == "ML-KEM") {
571 const auto mode = [&]() -> ML_KEM_Mode {
572 if(params.empty()) {
573 return ML_KEM_Mode::ML_KEM_768;
574 }
575 return ML_KEM_Mode(params);
576 }();
577
578 return std::make_unique<ML_KEM_PrivateKey>(rng, mode);
579 }
580#endif
581
582#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
583 if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
584 const auto mode = [&]() -> DilithiumMode {
585 if(params.empty()) {
586 return DilithiumMode::Dilithium6x5;
587 }
588 return DilithiumMode(params);
589 }();
590
591 return std::make_unique<Dilithium_PrivateKey>(rng, mode);
592 }
593#endif
594
595#if defined(BOTAN_HAS_ML_DSA)
596 if(alg_name == "ML-DSA") {
597 const auto mode = [&]() -> ML_DSA_Mode {
598 if(params.empty()) {
599 return ML_DSA_Mode::ML_DSA_6x5;
600 }
601 return ML_DSA_Mode(params);
602 }();
603
604 return std::make_unique<ML_DSA_PrivateKey>(rng, mode);
605 }
606#endif
607
608#if defined(BOTAN_HAS_HSS_LMS)
609 if(alg_name == "HSS-LMS") {
610 const auto hss_params = [&]() -> std::string {
611 if(params.empty()) {
612 return "SHA-256,HW(10,1)";
613 } else {
614 return std::string(params);
615 }
616 }();
617 return std::make_unique<HSS_LMS_PrivateKey>(rng, hss_params);
618 }
619#endif
620
621#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
622 if(alg_name == "SPHINCS+" || alg_name == "SphincsPlus") {
623 auto sphincs_params = Sphincs_Parameters::create(params);
624
625 return std::make_unique<SphincsPlus_PrivateKey>(rng, sphincs_params);
626 }
627#endif
628
629#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
630 if(alg_name == "SLH-DSA") {
631 auto slh_dsa_params = SLH_DSA_Parameters::create(params);
632
633 return std::make_unique<SLH_DSA_PrivateKey>(rng, slh_dsa_params);
634 }
635#endif
636
637#if defined(BOTAN_HAS_XMSS_RFC8391)
638 if(alg_name == "XMSS") {
639 const auto xmss_oid = [&]() -> XMSS_Parameters::xmss_algorithm_t {
640 if(params.empty()) {
641 return XMSS_Parameters::XMSS_SHA2_10_512;
642 }
643 return XMSS_Parameters(params).oid();
644 }();
645
646 return std::make_unique<XMSS_PrivateKey>(xmss_oid, rng);
647 }
648#endif
649
650#if defined(BOTAN_HAS_ED25519)
651 if(alg_name == "Ed25519") {
652 return std::make_unique<Ed25519_PrivateKey>(rng);
653 }
654#endif
655
656#if defined(BOTAN_HAS_ED448)
657 if(alg_name == "Ed448") {
658 return std::make_unique<Ed448_PrivateKey>(rng);
659 }
660#endif
661
662 // ECC crypto
663#if defined(BOTAN_HAS_ECC_PUBLIC_KEY_CRYPTO)
664
665 if(alg_name == "ECDSA" || alg_name == "ECDH" || alg_name == "ECKCDSA" || alg_name == "ECGDSA" || alg_name == "SM2" ||
666 alg_name == "SM2_Sig" || alg_name == "SM2_Enc" || alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" ||
667 alg_name == "GOST-34.10-2012-512") {
668 const std::string group_id = [&]() -> std::string {
669 if(!params.empty()) {
670 return std::string(params);
671 }
672 if(alg_name == "SM2" || alg_name == "SM2_Enc" || alg_name == "SM2_Sig") {
673 return "sm2p256v1";
674 }
675 if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256") {
676 return "gost_256A";
677 }
678 if(alg_name == "GOST-34.10-2012-512") {
679 return "gost_512A";
680 }
681 if(alg_name == "ECGDSA") {
682 return "brainpool256r1";
683 }
684 return "secp256r1";
685 }();
686
687 if(EC_Group::supports_named_group(group_id)) {
688 auto ec_group = EC_Group::from_name(group_id);
689 return create_ec_private_key(alg_name, ec_group, rng);
690 } else {
691 return {};
692 }
693 }
694#endif
695
696 // DL crypto
697#if defined(BOTAN_HAS_DL_GROUP)
698 if(alg_name == "DH" || alg_name == "DSA" || alg_name == "ElGamal") {
699 const std::string group_id = [&]() -> std::string {
700 if(!params.empty()) {
701 return std::string(params);
702 }
703 if(alg_name == "DSA") {
704 return "dsa/botan/2048";
705 }
706 return "modp/ietf/2048";
707 }();
708
709 auto modp_group = DL_Group::from_name(group_id);
710
711 #if defined(BOTAN_HAS_DIFFIE_HELLMAN)
712 if(alg_name == "DH") {
713 return std::make_unique<DH_PrivateKey>(rng, modp_group);
714 }
715 #endif
716
717 #if defined(BOTAN_HAS_DSA)
718 if(alg_name == "DSA") {
719 return std::make_unique<DSA_PrivateKey>(rng, modp_group);
720 }
721 #endif
722
723 #if defined(BOTAN_HAS_ELGAMAL)
724 if(alg_name == "ElGamal") {
725 return std::make_unique<ElGamal_PrivateKey>(rng, modp_group);
726 }
727 #endif
728 }
729#endif
730
731 BOTAN_UNUSED(alg_name, rng, params, provider);
732
733 return std::unique_ptr<Private_Key>();
734}
Botan::Classic_McEliece_Parameter_Set::from_string
static Classic_McEliece_Parameter_Set from_string(std::string_view param_name)
Get the parameter set for a given parameter set name.
Definition cmce_parameter_set.cpp:16
Botan::Classic_McEliece_Parameter_Set::Code::ClassicMcEliece_6960119f
@ ClassicMcEliece_6960119f
Definition cmce_parameter_set.h:41
Botan::DL_Group::from_name
static DL_Group from_name(std::string_view name)
Definition dl_group.cpp:217
Botan::EC_Group::from_name
static EC_Group from_name(std::string_view name)
Definition ec_group.cpp:438
Botan::EC_Group::supports_named_group
static bool supports_named_group(std::string_view name)
Definition ec_group.cpp:404
Botan::Sphincs_Parameters::create
static Sphincs_Parameters create(Sphincs_Parameter_Set set, Sphincs_Hash_Type hash)
Definition sp_parameters.cpp:347
Botan::XMSS_Parameters
Definition xmss_parameters.h:130
Botan::XMSS_Parameters::oid
xmss_algorithm_t oid() const
Definition xmss_parameters.h:213
Botan::XMSS_Parameters::xmss_algorithm_t
xmss_algorithm_t
Definition xmss_parameters.h:132
Botan::XMSS_Parameters::XMSS_SHA2_10_512
@ XMSS_SHA2_10_512
Definition xmss_parameters.h:140
Botan::ML_DSA_Mode
DilithiumMode ML_DSA_Mode
Definition ml_dsa.h:21
Botan::ML_KEM_Mode
KyberMode ML_KEM_Mode
Definition ml_kem.h:21
Botan::create_ec_private_key
std::unique_ptr< Private_Key > create_ec_private_key(std::string_view alg_name, const EC_Group &ec_group, RandomNumberGenerator &rng)
Definition pk_algs.cpp:448

References BOTAN_UNUSED, Botan::Classic_McEliece_Parameter_Set::ClassicMcEliece_6960119f, Botan::Sphincs_Parameters::create(), create_ec_private_key(), Botan::DilithiumMode::Dilithium6x5, fmt(), Botan::FrodoKEMMode::FrodoKEM976_SHAKE, Botan::DL_Group::from_name(), Botan::EC_Group::from_name(), Botan::Classic_McEliece_Parameter_Set::from_string(), Botan::KyberMode::Kyber1024_R3, Botan::DilithiumMode::ML_DSA_6x5, Botan::KyberMode::ML_KEM_768, Botan::XMSS_Parameters::oid(), split_on(), Botan::EC_Group::supports_named_group(), to_u32bit(), and Botan::XMSS_Parameters::XMSS_SHA2_10_512.

Referenced by botan_privkey_create(), and Botan::TLS::Hybrid_KEM_PrivateKey::generate_from_group().

◆ create_shake_row_generator()

auto Botan::create_shake_row_generator ( const FrodoKEMConstants & constants,
StrongSpan< const FrodoSeedA > seed_a )
inline

Definition at line 23 of file frodo_shake_generator.h.

23 {
24 BOTAN_ASSERT_NOMSG(constants.mode().is_shake());
25
26 return [xof = SHAKE_128_XOF(), a = FrodoSeedA(seed_a)](std::span<uint8_t> out, uint16_t i) mutable {
27 xof.clear();
28 xof.update(store_le(i));
29 xof.update(a);
30 xof.output(out);
31 };
32}
Botan::FrodoKEMMode::is_shake
bool is_shake() const
Definition frodo_mode.h:58
Botan::SHAKE_128_XOF
Definition shake_xof.h:50
Botan::FrodoSeedA
Strong< std::vector< uint8_t >, struct FrodoSeedA_ > FrodoSeedA
Definition frodo_types.h:23

References BOTAN_ASSERT_NOMSG, Botan::FrodoKEMMode::is_shake(), Botan::FrodoKEMConstants::mode(), and store_le().

◆ cstr_as_span_of_bytes()

std::span< const uint8_t > Botan::cstr_as_span_of_bytes ( const char * s)
inline

Definition at line 72 of file mem_utils.h.

72 {
73 return as_span_of_bytes(s, std::strlen(s));
74}

References as_span_of_bytes().

◆ ct_compare_u8()

uint8_t Botan::ct_compare_u8 ( const uint8_t x[],
const uint8_t y[],
size_t len )

Memory comparison, input insensitive

Parameters
xa pointer to an array
ya pointer to another array
lenthe number of Ts in x and y
Returns
0xFF iff x[i] == y[i] forall i in [0...n) or 0x00 otherwise

Definition at line 13 of file mem_ops.cpp.

13 {
14 return CT::is_equal(x, y, len).value();
15}

References Botan::CT::is_equal().

◆ ct_divide() [1/2]

BigInt Botan::ct_divide ( const BigInt & x,
const BigInt & y )
inline

BigInt division, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leak the sizes of x and y.

Parameters
xan integer
ya non-zero integer
Returns
x/y with remainder discarded

Definition at line 77 of file divide.h.

77 {
78 BigInt q;
79 BigInt r;
80 ct_divide(x, y, q, r);
81 return q;
82}
Botan::ct_divide
void ct_divide(const BigInt &x, const BigInt &y, BigInt &q_out, BigInt &r_out)
Definition divide.cpp:51

References ct_divide().

◆ ct_divide() [2/2]

BOTAN_TEST_API void Botan::ct_divide ( const BigInt & x,
const BigInt & y,
BigInt & q,
BigInt & r )

BigInt division, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leak the sizes of x and y.

Parameters
xan integer
ya non-zero integer
qwill be set to x / y
rwill be set to x % y

Definition at line 51 of file divide.cpp.

51 {
52 if(y.is_zero()) {
53 throw Invalid_Argument("ct_divide: cannot divide by zero");
54 }
55
56 const size_t x_words = x.sig_words();
57 const size_t y_words = y.sig_words();
58
59 const size_t x_bits = x.bits();
60
61 BigInt q = BigInt::with_capacity(x_words);
62 BigInt r = BigInt::with_capacity(y_words);
63 BigInt t = BigInt::with_capacity(y_words); // a temporary
64
65 for(size_t i = 0; i != x_bits; ++i) {
66 const size_t b = x_bits - 1 - i;
67 const bool x_b = x.get_bit(b);
68
69 r <<= 1;
70 r.conditionally_set_bit(0, x_b);
71
72 const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
73
74 q.conditionally_set_bit(b, r_gte_y);
75 r.ct_cond_swap(r_gte_y, t);
76 }
77
78 sign_fixup(x, y, q, r);
79 r_out = r;
80 q_out = q;
81}
Botan::BigInt::sig_words
size_t sig_words() const
Definition bigint.h:631
Botan::BigInt::bits
size_t bits() const
Definition bigint.cpp:307
Botan::BigInt::_data
const word * _data() const
Definition bigint.h:952
Botan::BigInt::is_zero
bool is_zero() const
Definition bigint.h:473
Botan::BigInt::get_bit
bool get_bit(size_t n) const
Definition bigint.h:512
Botan::BigInt::with_capacity
static BigInt with_capacity(size_t n)
Definition bigint.cpp:51
Botan::bigint_sub3
constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
Definition mp_core.h:192

References Botan::BigInt::_data(), bigint_sub3(), Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::BigInt::ct_cond_swap(), Botan::BigInt::get_bit(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::size(), and Botan::BigInt::with_capacity().

Referenced by ct_divide(), Botan::FPE_FE1::decrypt(), Botan::FPE_FE1::encrypt(), and lcm().

◆ ct_divide_pow2k()

BOTAN_TEST_API BigInt Botan::ct_divide_pow2k ( size_t k,
const BigInt & y )

BigInt division, const time variant, 2^k variant

This runs with control flow independent of the value of y. This function leaks the value of k and the length of y. If k < bits(y) this returns zero

Parameters
kan integer
ya positive integer
Returns
q equal to 2**k / y

Definition at line 83 of file divide.cpp.

83 {
84 BOTAN_ARG_CHECK(!y.is_zero(), "Cannot divide by zero");
85 BOTAN_ARG_CHECK(!y.is_negative(), "Negative divisor not supported");
86 BOTAN_ARG_CHECK(k > 1, "Invalid k");
87
88 const size_t x_bits = k + 1;
89 const size_t y_bits = y.bits();
90
91 if(x_bits < y_bits) {
92 return BigInt::zero();
93 }
94
95 BOTAN_ASSERT_NOMSG(y_bits >= 1);
96 const size_t x_words = (x_bits + WordInfo<word>::bits - 1) / WordInfo<word>::bits;
97 const size_t y_words = y.sig_words();
98
99 BigInt q = BigInt::with_capacity(x_words);
100 BigInt r = BigInt::with_capacity(y_words + 1);
101 BigInt t = BigInt::with_capacity(y_words + 1); // a temporary
102
103 r.set_bit(y_bits - 1);
104 for(size_t i = y_bits - 1; i != x_bits; ++i) {
105 const size_t b = x_bits - 1 - i;
106
107 if(i >= y_bits) {
108 bigint_shl1(r.mutable_data(), r.size(), r.size(), 1);
109 }
110
111 const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
112
113 q.conditionally_set_bit(b, r_gte_y);
114
115 bigint_cnd_swap(static_cast<word>(r_gte_y), r.mutable_data(), t.mutable_data(), y_words + 1);
116 }
117
118 // No need for sign fixup
119
120 return q;
121}
Botan::BigInt::zero
static BigInt zero()
Definition bigint.h:50
Botan::BigInt::is_negative
bool is_negative() const
Definition bigint.h:575
Botan::bigint_cnd_swap
constexpr void bigint_cnd_swap(W cnd, W x[], W y[], size_t size)
Definition mp_core.h:29
Botan::bigint_shl1
constexpr void bigint_shl1(W x[], size_t x_size, size_t x_words, size_t shift)
Definition mp_core.h:307

References Botan::BigInt::_data(), bigint_cnd_swap(), bigint_shl1(), bigint_sub3(), Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::BigInt::conditionally_set_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::set_bit(), Botan::BigInt::sig_words(), Botan::BigInt::size(), Botan::BigInt::with_capacity(), and Botan::BigInt::zero().

Referenced by Botan::Barrett_Reduction::for_secret_modulus().

◆ ct_divide_word() [1/2]

BigInt Botan::ct_divide_word ( const BigInt & x,
word y )

Constant time division

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters
xan integer
ya non-zero word
Returns
quotient floor(x / y)

Definition at line 160 of file divide.cpp.

160 {
161 BigInt q;
162 word r = 0;
163 ct_divide_word(x, y, q, r);
164 BOTAN_UNUSED(r);
165 return q;
166}

References BOTAN_UNUSED, and ct_divide_word().

◆ ct_divide_word() [2/2]

BOTAN_TEST_API void Botan::ct_divide_word ( const BigInt & x,
word y,
BigInt & q,
word & r )

Constant time division

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters
xan integer
ya non-zero integer
qwill be set to x / y
rwill be set to x % y

Definition at line 123 of file divide.cpp.

123 {
124 if(y == 0) {
125 throw Invalid_Argument("ct_divide_word: cannot divide by zero");
126 }
127
128 const size_t x_words = x.sig_words();
129 const size_t x_bits = x.bits();
130
131 BigInt q = BigInt::with_capacity(x_words);
132 word r = 0;
133
134 for(size_t i = 0; i != x_bits; ++i) {
135 const size_t b = x_bits - 1 - i;
136 const bool x_b = x.get_bit(b);
137
138 const auto r_carry = CT::Mask<word>::expand_top_bit(r);
139
140 r <<= 1;
141 r += static_cast<word>(x_b);
142
143 const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
144 q.conditionally_set_bit(b, r_gte_y.as_bool());
145 r = r_gte_y.select(r - y, r);
146 }
147
148 if(x.is_negative()) {
149 q.flip_sign();
150 if(r != 0) {
151 --q;
152 r = y - r;
153 }
154 }
155
156 r_out = r;
157 q_out = q;
158}
Botan::CT::Mask::is_gte
static constexpr Mask< T > is_gte(T x, T y)
Definition ct_utils.h:468
Botan::CT::Mask::expand_top_bit
static constexpr Mask< T > expand_top_bit(T v)
Definition ct_utils.h:415

References Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::CT::Mask< T >::expand_top_bit(), Botan::BigInt::flip_sign(), Botan::BigInt::get_bit(), Botan::CT::Mask< T >::is_gte(), Botan::BigInt::is_negative(), Botan::BigInt::sig_words(), and Botan::BigInt::with_capacity().

Referenced by compute_rsa_secret_exponent(), ct_divide_word(), operator/(), and Botan::BigInt::to_dec_string().

◆ ct_expand_top_bit()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::ct_expand_top_bit ( T a)
constexpr

If top bit of arg is set, return |1| (all bits set). Otherwise return |0| (all bits unset)

Definition at line 28 of file bit_ops.h.

28 {
29 const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
30 return static_cast<T>(0) - top;
31}
Botan::CT::value_barrier
constexpr T value_barrier(T x)
Definition value_barrier.h:43

References BOTAN_FORCE_INLINE, and Botan::CT::value_barrier().

Referenced by ct_is_zero(), and Botan::CT::Mask< T >::expand_top_bit().

◆ ct_if_is_zero_ret()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t Botan::ct_if_is_zero_ret ( T x,
size_t s )
constexpr

If arg is zero, return the size_t s. Otherwise return the size_t zero.

Definition at line 45 of file bit_ops.h.

45 {
46 /*
47 Similar to `return ct_is_zero(x) & s` but has to account for possibility that
48 sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking
49 */
50 const T a = ~x & (x - 1);
51 const size_t a_top = static_cast<size_t>(CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1)));
52 const size_t mask = static_cast<size_t>(0) - a_top;
53 return mask & s;
54}

References BOTAN_FORCE_INLINE, and Botan::CT::value_barrier().

Referenced by ctz(), high_bit(), and significant_bytes().

◆ ct_is_zero()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::ct_is_zero ( T x)
constexpr

If arg is zero, return |1|. Otherwise return |0|

Definition at line 37 of file bit_ops.h.

37 {
38 return ct_expand_top_bit<T>(~x & (x - 1));
39}
Botan::ct_expand_top_bit
BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a)
Definition bit_ops.h:28

References BOTAN_FORCE_INLINE, and ct_expand_top_bit().

Referenced by Botan::CT::Choice::from_int(), Botan::CT::Choice::into_bitmask(), Botan::CT::Mask< T >::is_zero(), and prefetch_array_raw().

◆ ct_mod_word()

BOTAN_TEST_API word Botan::ct_mod_word ( const BigInt & x,
word y )

BigInt word modulo, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters
xa positive integer
ya non-zero word
Returns
r the remainder of x divided by y

Definition at line 168 of file divide.cpp.

168 {
169 BOTAN_ARG_CHECK(x.is_positive(), "The argument x must be positive");
170 BOTAN_ARG_CHECK(y != 0, "Cannot divide by zero");
171
172 const size_t x_bits = x.bits();
173
174 word r = 0;
175
176 for(size_t i = 0; i != x_bits; ++i) {
177 const size_t b = x_bits - 1 - i;
178 const bool x_b = x.get_bit(b);
179
180 const auto r_carry = CT::Mask<word>::expand_top_bit(r);
181
182 r <<= 1;
183 r += static_cast<word>(x_b);
184
185 const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
186 r = r_gte_y.select(r - y, r);
187 }
188
189 return r;
190}
Botan::BigInt::is_positive
bool is_positive() const
Definition bigint.h:581

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, Botan::CT::Mask< T >::expand_top_bit(), Botan::BigInt::get_bit(), Botan::CT::Mask< T >::is_gte(), and Botan::BigInt::is_positive().

Referenced by compute_rsa_secret_exponent().

◆ ct_modulo()

BOTAN_TEST_API BigInt Botan::ct_modulo ( const BigInt & x,
const BigInt & modulo )

BigInt modulo, const time variant

Using this function is (slightly) cheaper than calling ct_divide and using only the remainder.

Parameters
xa non-negative integer
moduloa positive integer
Returns
result x % modulo

Definition at line 192 of file divide.cpp.

192 {
193 if(y.is_negative() || y.is_zero()) {
194 throw Invalid_Argument("ct_modulo requires y > 0");
195 }
196
197 const size_t y_words = y.sig_words();
198
199 const size_t x_bits = x.bits();
200
201 BigInt r = BigInt::with_capacity(y_words);
202 BigInt t = BigInt::with_capacity(y_words);
203
204 for(size_t i = 0; i != x_bits; ++i) {
205 const size_t b = x_bits - 1 - i;
206 const bool x_b = x.get_bit(b);
207
208 r <<= 1;
209 r.conditionally_set_bit(0, x_b);
210
211 const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
212
213 r.ct_cond_swap(r_gte_y, t);
214 }
215
216 if(x.is_negative()) {
217 if(r.is_nonzero()) {
218 r = y - r;
219 }
220 }
221
222 return r;
223}

References Botan::BigInt::_data(), bigint_sub3(), Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::BigInt::ct_cond_swap(), Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_nonzero(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::size(), and Botan::BigInt::with_capacity().

Referenced by Botan::RSA_PrivateKey::check_key(), Botan::FPE_FE1::decrypt(), Botan::FPE_FE1::encrypt(), inverse_mod(), inverse_mod_general(), power_mod(), Botan::Modular_Reducer::reduce(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

◆ ct_popcount()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr uint8_t Botan::ct_popcount ( T x)
constexpr

Calculates the number of 1-bits in an unsigned integer in constant-time. This operation is also known as "population count" or hamming weight.

Modern compilers will recognize this pattern and replace it by a hardware instruction, if available. This is the SWAR (SIMD within a register) algorithm. See: https://nimrod.blog/posts/algorithms-behind-popcount/#swar-algorithm

Note: C++20 provides std::popcount(), but there's no guarantee that this is implemented in constant-time.

Parameters
xan unsigned integer
Returns
the number of 1-bits in the provided value

Definition at line 273 of file bit_ops.h.

273 {
274 constexpr size_t s = sizeof(T);
275 static_assert(s <= 8, "T is not a suitable unsigned integer value");
276 if constexpr(s == 8) {
277 x = x - ((x >> 1) & 0x5555555555555555);
278 x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333);
279 x = (x + (x >> 4)) & 0xF0F0F0F0F0F0F0F;
280 return (x * 0x101010101010101) >> 56;
281 } else if constexpr(s == 4) {
282 x = x - ((x >> 1) & 0x55555555);
283 x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
284 x = (x + (x >> 4)) & 0x0F0F0F0F;
285 return (x * 0x01010101) >> 24;
286 } else {
287 // s < 4
288 return ct_popcount(static_cast<uint32_t>(x));
289 }
290}
Botan::ct_popcount
BOTAN_FORCE_INLINE constexpr uint8_t ct_popcount(T x)
Definition bit_ops.h:273

References BOTAN_FORCE_INLINE, and ct_popcount().

Referenced by ct_popcount(), and Botan::bitvector_base< secure_allocator >::hamming_weight().

◆ ct_reverse_bits()

template<std::unsigned_integral T>
T Botan::ct_reverse_bits ( T b)
inlineconstexpr
Returns
the reversed bits in b.

Definition at line 239 of file bit_ops.h.

239 {
240 auto extend = [](uint8_t m) -> T {
241 T mask = 0;
242 for(size_t i = 0; i < sizeof(T); ++i) {
243 mask |= T(m) << i * 8;
244 }
245 return mask;
246 };
247
248 // First reverse bits in each byte...
249 // From: https://stackoverflow.com/a/2602885
250 b = (b & extend(0xF0)) >> 4 | (b & extend(0x0F)) << 4;
251 b = (b & extend(0xCC)) >> 2 | (b & extend(0x33)) << 2;
252 b = (b & extend(0xAA)) >> 1 | (b & extend(0x55)) << 1;
253
254 // ... then swap the bytes
255 return reverse_bytes(b);
256}
Botan::reverse_bytes
constexpr T reverse_bytes(T x)
Definition bswap.h:27

References reverse_bytes().

◆ ctz()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t Botan::ctz ( T n)
constexpr

Count the trailing zero bits in n

Parameters
nan integer value
Returns
maximum x st 2^x divides n

Definition at line 115 of file bit_ops.h.

115 {
116 /*
117 * If n == 0 then this function will compute 8*sizeof(T)-1, so
118 * initialize lb to 1 if n == 0 to produce the expected result.
119 */
120 size_t lb = ct_if_is_zero_ret<T>(n, 1);
121
122 for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
123 const T range = (static_cast<T>(1) << s) - 1;
124 // Equivalent to: ((n & range) == 0) ? s : 0;
125 const size_t z = ct_if_is_zero_ret<T>(n & range, s);
126 lb += z;
127 n >>= z;
128 }
129
130 return lb;
131}
Botan::ct_if_is_zero_ret
BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s)
Definition bit_ops.h:45

References BOTAN_FORCE_INLINE, and ct_if_is_zero_ret().

Referenced by low_zero_bits(), and var_ctz32().

◆ curve25519_basepoint()

void Botan::curve25519_basepoint ( uint8_t mypublic[32],
const uint8_t secret[32] )

Exponentiate by the x25519 base point

Parameters
mypublicoutput value
secretrandom scalar

Definition at line 19 of file x25519.cpp.

19 {
20 const uint8_t basepoint[32] = {9};
21 curve25519_donna(mypublic, secret, basepoint);
22}
Botan::curve25519_donna
void curve25519_donna(uint8_t mypublic[32], const uint8_t secret[32], const uint8_t basepoint[32])
Definition donna.cpp:453

References curve25519_donna().

Referenced by Botan::X25519_PrivateKey::check_key(), Botan::Sodium::crypto_scalarmult_curve25519_base(), Botan::X25519_PrivateKey::X25519_PrivateKey(), Botan::X25519_PrivateKey::X25519_PrivateKey(), and Botan::X25519_PrivateKey::X25519_PrivateKey().

◆ curve25519_donna()

void Botan::curve25519_donna ( uint8_t mypublic[32],
const uint8_t secret[32],
const uint8_t basepoint[32] )

Definition at line 453 of file donna.cpp.

453 {
454 CT::poison(secret, 32);
455 CT::poison(basepoint, 32);
456
457 uint64_t bp[5];
458 uint64_t x[5];
459 uint64_t z[5];
460 uint64_t zmone[5];
461 uint8_t e[32];
462
463 copy_mem(e, secret, 32);
464 e[0] &= 248;
465 e[31] &= 127;
466 e[31] |= 64;
467
468 fexpand(bp, basepoint);
469 cmult(x, z, e, bp);
470 crecip(zmone, z);
471 fmul(z, x, zmone);
472 fcontract(mypublic, z);
473
474 CT::unpoison(secret, 32);
475 CT::unpoison(basepoint, 32);
476 CT::unpoison(mypublic, 32);
477}

References copy_mem(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by Botan::Sodium::crypto_scalarmult_curve25519(), and curve25519_basepoint().

◆ dbl_a_minus_3()

template<typename ProjectivePoint>
ProjectivePoint Botan::dbl_a_minus_3 ( const ProjectivePoint & pt)
inlineconstexpr

Definition at line 362 of file pcurves_algos.h.

362 {
363 /*
364 if a == -3 then
365 3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
366 */
367 const auto z2 = pt.z().square();
368 const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
369
370 // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
371 const auto y2 = pt.y().square();
372 const auto s = pt.x().mul4() * y2;
373 const auto nx = m.square() - s.mul2();
374 const auto ny = m * (s - nx) - y2.square().mul8();
375 const auto nz = pt.y().mul2() * pt.z();
376
377 return ProjectivePoint(nx, ny, nz);
378}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl().

◆ dbl_a_zero()

template<typename ProjectivePoint>
ProjectivePoint Botan::dbl_a_zero ( const ProjectivePoint & pt)
inlineconstexpr

Definition at line 381 of file pcurves_algos.h.

381 {
382 // If a == 0 then 3*x^2 + a*z^4 == 3*x^2
383 // Cost: 1S + 1*3
384 const auto m = pt.x().square().mul3();
385
386 // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
387 const auto y2 = pt.y().square();
388 const auto s = pt.x().mul4() * y2;
389 const auto nx = m.square() - s.mul2();
390 const auto ny = m * (s - nx) - y2.square().mul8();
391 const auto nz = pt.y().mul2() * pt.z();
392
393 return ProjectivePoint(nx, ny, nz);
394}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl().

◆ dbl_generic()

template<typename ProjectivePoint, typename FieldElement>
ProjectivePoint Botan::dbl_generic ( const ProjectivePoint & pt,
const FieldElement & A )
inlineconstexpr

Definition at line 397 of file pcurves_algos.h.

397 {
398 // Cost: 1M + 3S + 1A + 1*3
399 const auto z2 = pt.z().square();
400 const auto m = pt.x().square().mul3() + A * z2.square();
401
402 // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
403 const auto y2 = pt.y().square();
404 const auto s = pt.x().mul4() * y2;
405 const auto nx = m.square() - s.mul2();
406 const auto ny = m * (s - nx) - y2.square().mul8();
407 const auto nz = pt.y().mul2() * pt.z();
408
409 return ProjectivePoint(nx, ny, nz);
410}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl().

◆ dbl_n_a_minus_3()

template<typename ProjectivePoint>
ProjectivePoint Botan::dbl_n_a_minus_3 ( const ProjectivePoint & pt,
size_t n )
inlineconstexpr

Definition at line 432 of file pcurves_algos.h.

432 {
433 auto nx = pt.x();
434 auto ny = pt.y().mul2();
435 auto nz = pt.z();
436 auto w = nz.square().square();
437
438 // Conditional ok: loop iteration count is public
439 while(n > 0) {
440 const auto ny2 = ny.square();
441 const auto ny4 = ny2.square();
442 const auto t1 = (nx.square() - w).mul3();
443 const auto t2 = nx * ny2;
444 nx = t1.square() - t2.mul2();
445 nz *= ny;
446 ny = t1 * (t2 - nx).mul2() - ny4;
447 n--;
448 // Conditional ok: loop iteration count is public
449 if(n > 0) {
450 w *= ny4;
451 }
452 }
453 return ProjectivePoint(nx, ny.div2(), nz);
454}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl_n().

◆ dbl_n_a_zero()

template<typename ProjectivePoint>
ProjectivePoint Botan::dbl_n_a_zero ( const ProjectivePoint & pt,
size_t n )
inlineconstexpr

Definition at line 457 of file pcurves_algos.h.

457 {
458 auto nx = pt.x();
459 auto ny = pt.y().mul2();
460 auto nz = pt.z();
461
462 // Conditional ok: loop iteration count is public
463 while(n > 0) {
464 const auto ny2 = ny.square();
465 const auto ny4 = ny2.square();
466 const auto t1 = nx.square().mul3();
467 const auto t2 = nx * ny2;
468 nx = t1.square() - t2.mul2();
469 nz *= ny;
470 ny = t1 * (t2 - nx).mul2() - ny4;
471 n--;
472 }
473 return ProjectivePoint(nx, ny.div2(), nz);
474}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl_n().

◆ dbl_n_generic()

template<typename ProjectivePoint, typename FieldElement>
ProjectivePoint Botan::dbl_n_generic ( const ProjectivePoint & pt,
const FieldElement & A,
size_t n )
inlineconstexpr

Definition at line 477 of file pcurves_algos.h.

477 {
478 auto nx = pt.x();
479 auto ny = pt.y().mul2();
480 auto nz = pt.z();
481 auto w = nz.square().square() * A;
482
483 // Conditional ok: loop iteration count is public
484 while(n > 0) {
485 const auto ny2 = ny.square();
486 const auto ny4 = ny2.square();
487 const auto t1 = nx.square().mul3() + w;
488 const auto t2 = nx * ny2;
489 nx = t1.square() - t2.mul2();
490 nz *= ny;
491 ny = t1 * (t2 - nx).mul2() - ny4;
492 n--;
493 // Conditional ok: loop iteration count is public
494 if(n > 0) {
495 w *= ny4;
496 }
497 }
498 return ProjectivePoint(nx, ny.div2(), nz);
499}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::dbl_n().

◆ deallocate_memory()

void Botan::deallocate_memory ( void * p,
size_t elems,
size_t elem_size )

Free a pointer returned by allocate_memory

Parameters
pthe pointer returned by allocate_memory
elemsthe number of elements, as passed to allocate_memory
elem_sizethe size of each element, as passed to allocate_memory

Definition at line 50 of file allocator.cpp.

50 {
51 if(p == nullptr) {
52 [[unlikely]] return;
53 }
54
55 secure_scrub_memory(p, elems * elem_size);
56
57#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
58 if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
59 return;
60 }
61#endif
62
63 std::free(p); // NOLINT(*-no-malloc,*-owning-memory)
64}
Botan::secure_scrub_memory
void secure_scrub_memory(void *ptr, size_t n)
Definition mem_utils.cpp:25

References Botan::mlock_allocator::instance(), and secure_scrub_memory().

Referenced by Botan::secure_allocator< T >::deallocate().

◆ decode_gf2m()

gf2m Botan::decode_gf2m ( const uint8_t * mem)

Definition at line 102 of file gf2m_small_m.cpp.

102 {
103 gf2m result = mem[0] << 8;
104 result |= mem[1];
105 return result;
106}
Botan::gf2m
uint16_t gf2m
Definition gf2m_small_m.h:20

Referenced by Botan::polyn_gf2m::polyn_gf2m().

◆ decode_point()

Point448 Botan::decode_point ( std::span< const uint8_t > p_bytes)

Decode a point from a byte array. RFC 7748 Section 5 (decodeUCoordinate).

Definition at line 25 of file x448_internal.cpp.

25 {
26 BOTAN_ARG_CHECK(p_bytes.size() == X448_LEN, "Invalid size for X448 point");
27 return typecast_copy<Point448>(p_bytes);
28}
Botan::X448_LEN
constexpr size_t X448_LEN
Definition x448_internal.h:16
Botan::typecast_copy
constexpr void typecast_copy(ToR &&out, const FromR &in)
Definition mem_ops.h:176

References BOTAN_ARG_CHECK, typecast_copy(), and X448_LEN.

◆ decode_scalar()

ScalarX448 Botan::decode_scalar ( std::span< const uint8_t > scalar_bytes)

Decode a scalar from a byte array. RFC 7748 Section 5 (decodeScalar448).

Definition at line 30 of file x448_internal.cpp.

30 {
31 BOTAN_ARG_CHECK(scalar_bytes.size() == X448_LEN, "Invalid size for X448 scalar");
32 auto buf = typecast_copy<ScalarX448>(scalar_bytes);
33
34 buf[0] &= 0xfc;
35 buf[55] |= 0x80;
36
37 return buf;
38}

References BOTAN_ARG_CHECK, typecast_copy(), and X448_LEN.

◆ div_magic()

template<WordType W, W div>
requires (div == 10)
std::pair< W, size_t > Botan::div_magic ( )
consteval

Definition at line 530 of file mp_core.h.

532{
533 if constexpr(div == 10 && std::same_as<W, uint32_t>) {
534 constexpr W magic = 0xCCCCCCCD;
535 constexpr size_t shift = 35;
536 return std::make_pair(magic, shift);
537 } else if constexpr(div == 10 && std::same_as<W, uint64_t>) {
538 constexpr W magic = 0xCCCCCCCCCCCCCCCD;
539 constexpr size_t shift = 67;
540 return std::make_pair(magic, shift);
541 }
542}

Referenced by divide_10().

◆ divide_10()

template<WordType W>
W Botan::divide_10 ( W x)
inlineconstexpr

Definition at line 545 of file mp_core.h.

545 {
546 auto [magic, shift] = div_magic<W, 10>();
547 const auto p = typename WordInfo<W>::dword(magic) * x;
548 return static_cast<W>(p >> shift);
549}
Botan::div_magic
consteval std::pair< W, size_t > div_magic()
Definition mp_core.h:530

References div_magic().

Referenced by Botan::BigInt::to_dec_string().

◆ dl_exponent_size()

size_t BOTAN_TEST_API Botan::dl_exponent_size ( size_t prime_group_size)

Return the appropriate exponent size to use for a particular prime group. This is twice the size of the estimated cost of breaking the key using an index calculus attack; the assumption is that if an arbitrary discrete log on a group of size bits would take about 2^n effort, and thus using an exponent of size 2^(2*n) implies that all available attacks are about as easy (as e.g Pollard's kangaroo algorithm can compute the DL in sqrt(x) operations) while minimizing the exponent size for performance reasons.

Definition at line 53 of file workfactor.cpp.

53 {
54 BOTAN_ARG_CHECK(p_bits > 1, "Invalid prime length");
55
56 /*
57 For relevant sizes we follow the suggestions in
58 NIST SP 800-56B Rev 2 Appendix D
59 "Maximum Security Strength Estimates for IFC Modulus Lengths"
60
61 For sizes outside the range considered in the SP we use some sensible values
62
63 Note that we return twice the value given in Table 4 since we are choosing
64 the exponent size as twice the estimated security strength.
65
66 See also NIST SP 800-56A Rev 3 Appendix D, Tables 25 and 26
67 */
68
69 if(p_bits <= 256) {
70 /*
71 * For stupidly small groups we might return a value larger than the group
72 * size if we fell into the conditionals below. Just use the maximum
73 * possible exponent size - for all the good it will do you with a group
74 * this weak.
75 */
76 return p_bits - 1;
77 } else if(p_bits <= 1024) {
78 /*
79 Not in the SP, but general estimates are that a 1024 bit group provides at
80 most 80 bits security, so using an exponent appropriate for 96 bit security
81 is more than sufficient.
82 */
83 return 192;
84 } else if(p_bits <= 2048) {
85 return 224; // SP 800-56B
86 } else if(p_bits <= 3072) {
87 return 256; // SP 800-56B
88 } else if(p_bits <= 4096) {
89 return 304; // SP 800-56B
90 } else if(p_bits <= 6144) {
91 return 352; // SP 800-56B
92 } else if(p_bits <= 8192) {
93 return 400; // SP 800-56B
94 } else {
95 // For values larger than we know about, just saturate to 256 bit security
96 // which is Good Enough for FFDH
97 //
98 // NIST puts 15360 bit groups at exactly 256 bits security
99 return 512;
100 }
101}

References BOTAN_ARG_CHECK.

Referenced by Botan::DL_Group::DL_Group().

◆ dl_work_factor()

size_t BOTAN_TEST_API Botan::dl_work_factor ( size_t prime_group_size)

Estimate work factor for discrete logarithm

Parameters
prime_group_sizesize of the group in bits
Returns
estimated security level for this group

Definition at line 48 of file workfactor.cpp.

48 {
49 // Lacking better estimates...
50 return if_work_factor(bits);
51}
Botan::if_work_factor
size_t if_work_factor(size_t bits)
Definition workfactor.cpp:37

References if_work_factor().

◆ do_throw_error()

template<typename E, typename... Args>
void Botan::do_throw_error ( const char * file,
int line,
const char * func,
Args... args )
inline

Definition at line 343 of file exceptn.h.

343 {
344 throw E(file, line, func, args...);
345}

◆ ecp_work_factor()

size_t Botan::ecp_work_factor ( size_t prime_group_size)

Estimate work factor for EC discrete logarithm

Parameters
prime_group_sizesize of the group in bits
Returns
estimated security level for this group

Definition at line 16 of file workfactor.cpp.

16 {
17 return bits / 2;
18}

Referenced by Botan::EC_PublicKey::estimated_strength().

◆ ed25519_basepoint_mul()

void Botan::ed25519_basepoint_mul ( std::span< uint8_t, 32 > out,
const uint8_t in[32] )

Definition at line 1863 of file ge.cpp.

1863 {
1864 std::array<int8_t, 64> e{};
1865
1866 CT::poison(a, 32);
1867
1868 // each e[i] is between 0 and 15 except e[63] which is between 0 and 7
1869 for(size_t i = 0; i != 32; ++i) {
1870 e[2 * i + 0] = (a[i] >> 0) & 0x0F;
1871 e[2 * i + 1] = (a[i] >> 4) & 0x0F;
1872 }
1873
1874 int8_t carry = 0;
1875 for(size_t i = 0; i < 63; ++i) {
1876 e[i] += carry;
1877 carry = e[i] + 8;
1878 carry >>= 4;
1879 e[i] -= carry << 4;
1880 }
1881 e[63] += carry;
1882 /* each e[i] is between -8 and 8 */
1883
1884 auto h = Ed25519_Point_Extended::identity();
1885 for(size_t i = 1; i < 64; i += 2) {
1886 h = Ed25519_Point_Extended::from(h + select(B_precomp[i / 2], e[i]));
1887 }
1888
1889 auto s = Ed25519_Point_Projective::from(h.dbl());
1890 s = Ed25519_Point_Projective::from(s.dbl());
1891 s = Ed25519_Point_Projective::from(s.dbl());
1892 h = Ed25519_Point_Extended::from(s.dbl());
1893
1894 for(size_t i = 0; i != 64; i += 2) {
1895 h = Ed25519_Point_Extended::from(h + select(B_precomp[i / 2], e[i]));
1896 }
1897
1898 h.serialize_to(out);
1899
1900 CT::unpoison(a, 32);
1901 CT::unpoison(out);
1902}

References carry(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by ed25519_gen_keypair(), and ed25519_sign().

◆ ed25519_gen_keypair()

void Botan::ed25519_gen_keypair ( uint8_t pk[32],
uint8_t sk[64],
const uint8_t seed[32] )

Definition at line 18 of file ed25519.cpp.

18 {
19 uint8_t az[64];
20
21 auto sha512 = HashFunction::create_or_throw("SHA-512");
22 sha512->update(seed, 32);
23 sha512->final(az);
24 az[0] &= 248;
25 az[31] &= 63;
26 az[31] |= 64;
27
28 ed25519_basepoint_mul(std::span<uint8_t, 32>{pk, 32}, az);
29
30 copy_mem(sk, seed, 32);
31 copy_mem(sk + 32, pk, 32);
32}
Botan::ed25519_basepoint_mul
void ed25519_basepoint_mul(std::span< uint8_t, 32 > out, const uint8_t in[32])
Definition ge.cpp:1863

References copy_mem(), Botan::HashFunction::create_or_throw(), and ed25519_basepoint_mul().

Referenced by Botan::Sodium::crypto_sign_ed25519_seed_keypair(), Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(), Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(), and Botan::Ed25519_PrivateKey::Ed25519_PrivateKey().

◆ ed25519_sign()

void Botan::ed25519_sign ( uint8_t sig[64],
const uint8_t m[],
size_t mlen,
const uint8_t sk[64],
const uint8_t domain_sep[],
size_t domain_sep_len )

Definition at line 34 of file ed25519.cpp.

39 {
40 uint8_t az[64];
41 uint8_t nonce[64];
42 uint8_t hram[64];
43
44 auto sha512 = HashFunction::create_or_throw("SHA-512");
45
46 sha512->update(sk, 32);
47 sha512->final(az);
48 az[0] &= 248;
49 az[31] &= 63;
50 az[31] |= 64;
51
52 sha512->update(domain_sep, domain_sep_len);
53 sha512->update(az + 32, 32);
54 sha512->update(m, mlen);
55 sha512->final(nonce);
56
57 sc_reduce(nonce);
58 ed25519_basepoint_mul(std::span<uint8_t, 32>{sig, 32}, nonce);
59
60 sha512->update(domain_sep, domain_sep_len);
61 sha512->update(sig, 32);
62 sha512->update(sk + 32, 32);
63 sha512->update(m, mlen);
64 sha512->final(hram);
65
66 sc_reduce(hram);
67 sc_muladd(sig + 32, hram, az, nonce);
68}
Botan::sc_muladd
void sc_muladd(uint8_t *s, const uint8_t *a, const uint8_t *b, const uint8_t *c)
Definition sc_muladd.cpp:26
Botan::sc_reduce
void sc_reduce(uint8_t *s)
Definition sc_reduce.cpp:25

References Botan::HashFunction::create_or_throw(), ed25519_basepoint_mul(), sc_muladd(), and sc_reduce().

Referenced by Botan::Sodium::crypto_sign_ed25519_detached().

◆ ed25519_verify() [1/2]

bool Botan::ed25519_verify ( const uint8_t * m,
size_t mlen,
const uint8_t sig[64],
const uint8_t * pk,
const uint8_t domain_sep[],
size_t domain_sep_len )

Definition at line 70 of file ed25519.cpp.

75 {
76 if((sig[63] & 0xE0) != 0x00) {
77 return false;
78 }
79
80 const uint64_t CURVE25519_ORDER[4] = {
81 0x1000000000000000,
82 0x0000000000000000,
83 0x14def9dea2f79cd6,
84 0x5812631a5cf5d3ed,
85 };
86
87 const uint64_t s[4] = {load_le<uint64_t>(sig + 32, 3),
88 load_le<uint64_t>(sig + 32, 2),
89 load_le<uint64_t>(sig + 32, 1),
90 load_le<uint64_t>(sig + 32, 0)};
91
92 // RFC 8032 adds the requirement that we verify that s < order in
93 // the signature; this did not exist in the original Ed25519 spec.
94 for(size_t i = 0; i != 4; ++i) {
95 if(s[i] > CURVE25519_ORDER[i]) {
96 return false;
97 }
98 if(s[i] < CURVE25519_ORDER[i]) {
99 break;
100 }
101 if(i == 3) { // here s == order
102 return false;
103 }
104 }
105
106 uint8_t h[64];
107 auto sha512 = HashFunction::create_or_throw("SHA-512");
108
109 sha512->update(domain_sep, domain_sep_len);
110 sha512->update(sig, 32);
111 sha512->update(pk, 32);
112 sha512->update(m, mlen);
113 sha512->final(h);
114 sc_reduce(h);
115
116 return signature_check(std::span<const uint8_t, 32>{pk, 32}, h, sig, sig + 32);
117}
Botan::signature_check
bool signature_check(std::span< const uint8_t, 32 > pk, const uint8_t h[32], const uint8_t r[32], const uint8_t s[32])
Definition ge.cpp:1904
Botan::load_le
constexpr auto load_le(ParamTs &&... params)
Definition loadstor.h:495

References Botan::HashFunction::create_or_throw(), load_le(), sc_reduce(), and signature_check().

Referenced by Botan::Sodium::crypto_sign_ed25519_verify_detached(), and ed25519_verify().

◆ ed25519_verify() [2/2]

bool Botan::ed25519_verify ( const uint8_t msg[],
size_t msg_len,
const uint8_t sig[64],
const uint8_t pk[32],
const uint8_t domain_sep[],
size_t domain_sep_len )

References ed25519_verify().

◆ encode_gf2m()

uint32_t Botan::encode_gf2m ( gf2m to_enc,
uint8_t * mem )

Definition at line 96 of file gf2m_small_m.cpp.

96 {
97 mem[0] = to_enc >> 8;
98 mem[1] = to_enc & 0xFF;
99 return sizeof(to_enc);
100}

◆ encode_point()

secure_vector< uint8_t > Botan::encode_point ( const Point448 & p)

Encode a point to a 56 byte vector. RFC 7748 Section 5 (encodeUCoordinate).

Definition at line 21 of file x448_internal.cpp.

21 {
22 return {p.begin(), p.end()};
23}
Botan::detail::Container_Strong_Adapter_Base::begin
decltype(auto) begin() noexcept(noexcept(this->get().begin()))
Definition strong_type.h:125
Botan::detail::Container_Strong_Adapter_Base::end
decltype(auto) end() noexcept(noexcept(this->get().end()))
Definition strong_type.h:129

References Botan::detail::Container_Strong_Adapter_Base< T >::begin(), and Botan::detail::Container_Strong_Adapter_Base< T >::end().

◆ esdm_rng()

RandomNumberGenerator & Botan::esdm_rng ( )

Return a shared reference to a global PRNG instance provided by ESDM

Definition at line 100 of file esdm_rng.cpp.

100 {
101 static ESDM_RNG g_esdm_rng;
102 return g_esdm_rng;
103}
Botan::ESDM_RNG
Definition esdm_rng.h:53

◆ expand_mask_16bit()

template<typename T>
uint16_t Botan::expand_mask_16bit ( T tst)

Expand an input to a bit mask depending on it being being zero or non-zero

Parameters
tstthe input
Returns
the mask 0xFFFF if tst is non-zero and 0 otherwise

Definition at line 25 of file code_based_util.h.

25 {
26 const uint16_t result = (tst != 0);
27 return ~(result - 1);
28}

Referenced by Botan::polyn_gf2m::calc_degree_secure(), Botan::polyn_gf2m::eea_with_coefficients(), and Botan::polyn_gf2m::patchup_deg_secure().

◆ expand_message_xmd()

void BOTAN_TEST_API Botan::expand_message_xmd ( std::string_view hash_fn,
std::span< uint8_t > output,
std::span< const uint8_t > input,
std::span< const uint8_t > domain_sep )

XMD hash function from RFC 9380

This is only used internally to implement hash2curve so is not exposed to end users.

Definition at line 17 of file xmd.cpp.

20 {
21 if(domain_sep.size() > 0xFF) {
22 // RFC 9380 has a specification for handling this
23 throw Not_Implemented("XMD does not currently implement oversize DST handling");
24 }
25
26 const uint8_t domain_sep_len = static_cast<uint8_t>(domain_sep.size());
27
28 auto hash = HashFunction::create_or_throw(hash_fn);
29 const size_t block_size = hash->hash_block_size();
30 if(block_size == 0) {
31 throw Invalid_Argument(fmt("expand_message_xmd cannot be used with {}", hash_fn));
32 }
33
34 const size_t hash_output_size = hash->output_length();
35 if(output.size() > 255 * hash_output_size || output.size() > 0xFFFF) {
36 throw Invalid_Argument("expand_message_xmd requested output length too long");
37 }
38
39 // Compute b_0 = H(msg_prime) = H(Z_pad || msg || l_i_b_str || 0x00 || DST_prime)
40
41 hash->update(std::vector<uint8_t>(block_size));
42 hash->update(input);
43 hash->update_be(static_cast<uint16_t>(output.size()));
44 hash->update(0x00);
45 hash->update(domain_sep);
46 hash->update(domain_sep_len);
47
48 const secure_vector<uint8_t> b_0 = hash->final();
49
50 // Compute b_1 = H(b_0 || 0x01 || DST_prime)
51
52 hash->update(b_0);
53 hash->update(0x01);
54 hash->update(domain_sep);
55 hash->update(domain_sep_len);
56
57 secure_vector<uint8_t> b_i = hash->final();
58
59 uint8_t cnt = 2;
60 for(;;) {
61 const size_t produced = std::min(output.size(), hash_output_size);
62
63 copy_mem(output.data(), b_i.data(), produced);
64 output = output.subspan(produced);
65
66 if(output.empty()) {
67 break;
68 }
69
70 // Now compute the next b_i if needed
71
72 b_i ^= b_0;
73 hash->update(b_i);
74 hash->update(cnt);
75 hash->update(domain_sep);
76 hash->update(domain_sep_len);
77 hash->final(b_i);
78 cnt += 1;
79 }
80}

References copy_mem(), Botan::HashFunction::create_or_throw(), and fmt().

Referenced by Botan::EC_Scalar::hash().

◆ extended_euclidean_algorithm()

template<std::integral T>
eea_result< T > Botan::extended_euclidean_algorithm ( T a,
T b )
consteval

Run the extended Euclidean algorithm to find the greatest common divisor of a and b and the Bézout coefficients, u and v.

Definition at line 69 of file pqcrystals_helpers.h.

69 {
70 if(a > b) {
71 std::swap(a, b);
72 }
73
74 T u1 = 0;
75 T v1 = 1;
76 T u2 = 1;
77 T v2 = 0;
78
79 if(a != b) {
80 while(a != 0) {
81 const T q = b / a;
82 std::tie(a, b) = std::make_tuple(static_cast<T>(b - q * a), a);
83 std::tie(u1, v1, u2, v2) = std::make_tuple(u2, v2, static_cast<T>(u1 - q * u2), static_cast<T>(v1 - q * v2));
84 }
85 }
86
87 return {.gcd = b, .u = u1, .v = v1};
88}

Referenced by modular_inverse().

◆ find_roots_gf2m_decomp()

secure_vector< gf2m > Botan::find_roots_gf2m_decomp ( const polyn_gf2m & polyn,
size_t code_length )

Find the roots of a polynomial over GF(2^m) using the method by Federenko et al.

Definition at line 240 of file gf2m_rootfind_dcmp.cpp.

240 {
241 gf2m_decomp_rootfind_state state(polyn, code_length);
242 return state.find_roots(polyn);
243}

References find_roots_gf2m_decomp().

Referenced by find_roots_gf2m_decomp().

◆ floor_log2()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::floor_log2 ( T n)
constexpr

Definition at line 134 of file bit_ops.h.

134 {
135 BOTAN_ARG_CHECK(n != 0, "log2(0) is not defined");
136 return static_cast<T>(high_bit(n) - 1);
137}
Botan::high_bit
BOTAN_FORCE_INLINE constexpr size_t high_bit(T n)
Definition bit_ops.h:73

References BOTAN_ARG_CHECK, BOTAN_FORCE_INLINE, and high_bit().

Referenced by Botan::Classic_McEliece_GF::log_q_from_mod(), and Botan::Classic_McEliece_Parameters::tau().

◆ fmt()

template<typename... T>
std::string Botan::fmt ( std::string_view format,
const T &... args )

Simple formatter utility.

Should be replaced with std::format once that's available on all our supported compilers.

'{}' markers in the format string are replaced by the arguments. Unlike std::format, there is no support for escaping or for any kind of conversion flags.

Definition at line 53 of file fmt.h.

53 {
54 std::ostringstream oss;
55 oss.imbue(std::locale::classic());
56 fmt_detail::do_fmt(oss, format, args...);
57 return oss.str();
58}
Botan::fmt_detail::do_fmt
void do_fmt(std::ostringstream &oss, std::string_view format)
Definition fmt.h:20

References Botan::fmt_detail::do_fmt().

Referenced by Botan::AlternativeName::add_attribute(), Botan::GOST_3410_PublicKey::algo_name(), Botan::KEX_to_KEM_Adapter_PublicKey::algo_name(), Botan::Algorithm_Not_Found::Algorithm_Not_Found(), Botan::AlternativeName::AlternativeName(), argon2_generate_pwhash(), assert_unreachable(), Botan::TLS::auth_method_from_string(), Botan::BER_Bad_Tag::BER_Bad_Tag(), Botan::BER_Decoding_Error::BER_Decoding_Error(), Botan::CFB_Mode::CFB_Mode(), Botan::TPM2::cipher_tss2_to_botan(), Botan::CMAC::CMAC(), Botan::CommonCrypto_Error::CommonCrypto_Error(), Botan::Compression_Error::Compression_Error(), Botan::TLS::Connection_Cipher_State::Connection_Cipher_State(), Botan::AES_256_CTR_XOF::copy_state(), Botan::KDF::create(), Botan::TPM2::PrivateKey::create(), Botan::TPM2::PublicKey::create(), Botan::Private_Key::create_decryption_op(), Botan::PKCS11::MechanismWrapper::create_ecdh_mechanism(), Botan::PKCS11::MechanismWrapper::create_ecdsa_mechanism(), Botan::Public_Key::create_encryption_op(), Botan::Private_Key::create_kem_decryption_op(), Botan::Public_Key::create_kem_encryption_op(), Botan::Private_Key::create_key_agreement_op(), create_private_key(), Botan::PKCS11::MechanismWrapper::create_rsa_crypt_mechanism(), Botan::PKCS11::MechanismWrapper::create_rsa_sign_mechanism(), Botan::Private_Key::create_signature_op(), Botan::Public_Key::create_verification_op(), Botan::Public_Key::create_x509_verification_op(), Botan::PEM_Code::decode(), Botan::PEM_Code::decode_check_label(), Botan::ASN1_String::decode_from(), Botan::Cert_Extension::ASBlocks::ASIdentifierChoice::decode_from(), Botan::Cert_Extension::ASBlocks::ASIdentifiers::decode_from(), Botan::Cert_Extension::ASBlocks::ASIdOrRange::decode_from(), Botan::Cert_Extension::IPAddressBlocks::IPAddressChoice< V >::decode_from(), Botan::Cert_Extension::IPAddressBlocks::IPAddressFamily::decode_from(), Botan::Cert_Extension::IPAddressBlocks::IPAddressOrRange< V >::decode_from(), Botan::Cert_Extension::TNAuthList::Entry::decode_from(), Botan::Decoding_Error::Decoding_Error(), Botan::DL_Group::DL_Group(), Botan::DL_Group::DL_Group(), Botan::EC_Group::EC_Group(), Botan::PEM_Code::encode(), Botan::TPM2::Error::Error(), Botan::Exception::Exception(), Botan::Exception::Exception(), expand_message_xmd(), Botan::Stream_Decompression::finish(), Botan::DL_Group::from_name(), Botan::EC_Group::from_name(), Botan::EC_Group::from_OID(), Botan::PSS_Params::from_padding_name(), Botan::Classic_McEliece_Parameter_Set::from_string(), Botan::OID::from_string(), generate_dsa_primes(), Botan::EC_PublicKey::get_int_field(), Botan::TPM2::get_raw_rc(), Botan::GOST_28147_89::GOST_28147_89(), Botan::GOST_28147_89_Params::GOST_28147_89_Params(), Botan::Sphincs_Parameters::hash_name(), hex_decode(), hkdf_expand_label(), Botan::HMAC_DRBG::HMAC_DRBG(), Botan::HSS_LMS_Params::HSS_LMS_Params(), Botan::HTTP::http_sync(), Botan::Hybrid_PublicKey::Hybrid_PublicKey(), Botan::Invalid_Algorithm_Name::Invalid_Algorithm_Name(), Botan::Invalid_Argument::Invalid_Argument(), Botan::Invalid_IV_Length::Invalid_IV_Length(), Botan::Invalid_Key_Length::Invalid_Key_Length(), Botan::Pipe::Invalid_Message_Number::Invalid_Message_Number(), Botan::TLS::kex_method_from_string(), Botan::Key_Not_Set::Key_Not_Set(), Botan::Lion::Lion(), load_private_key(), load_public_key(), Botan::PEM_Code::matches(), Botan::BLAKE2b::name(), Botan::BLAKE2s::name(), Botan::Cascade_Cipher::name(), Botan::CBC_Mode::name(), Botan::CCM_Mode::name(), Botan::CFB_Mode::name(), Botan::ChaCha::name(), Botan::CMAC::name(), Botan::Comb4P::name(), Botan::CTR_BE::name(), Botan::DilithiumMessageHash::name(), Botan::FPE_FE1::name(), Botan::GCM_Mode::name(), Botan::GeneralName::name(), Botan::GMAC::name(), Botan::HKDF::name(), Botan::HKDF_Expand::name(), Botan::HKDF_Extract::name(), Botan::HMAC::name(), Botan::HMAC_DRBG::name(), Botan::ISO_9796_DS2::name(), Botan::ISO_9796_DS3::name(), Botan::KDF1::name(), Botan::KDF1_18033::name(), Botan::KDF2::name(), Botan::Keccak_1600::name(), Botan::KMAC128::name(), Botan::KMAC256::name(), Botan::Lion::name(), Botan::OFB::name(), Botan::PBKDF2_Family::name(), Botan::PKCS1v15_Raw_SignaturePaddingScheme::name(), Botan::PKCS1v15_SignaturePaddingScheme::name(), Botan::PKCS5_PBKDF2::name(), Botan::PSS_Raw::name(), Botan::PSSR::name(), Botan::RFC4880_S2K_Family::name(), Botan::SHA_3::name(), Botan::SHAKE_128::name(), Botan::SHAKE_256::name(), Botan::SignRawBytes::name(), Botan::SipHash::name(), Botan::Skein_512::name(), Botan::SP800_108_Counter::name(), Botan::SP800_108_Feedback::name(), Botan::SP800_108_Pipeline::name(), Botan::SP800_56C_One_Step_Hash::name(), Botan::SP800_56C_One_Step_HMAC::name(), Botan::SP800_56C_Two_Step::name(), Botan::Streebog::name(), Botan::TLS::TLS_NULL_HMAC_AEAD_Mode::name(), Botan::TLS_12_PRF::name(), Botan::Truncated_Hash::name(), Botan::X931_SignaturePadding::name(), Botan::Asymmetric_Key::object_identifier(), pbes2_decrypt(), Botan::PK_Decryptor_EME::PK_Decryptor_EME(), Botan::PK_Encryptor_EME::PK_Encryptor_EME(), Botan::PK_KEM_Decryptor::PK_KEM_Decryptor(), Botan::PK_KEM_Encryptor::PK_KEM_Encryptor(), Botan::PK_Key_Agreement::PK_Key_Agreement(), Botan::PK_Signer::PK_Signer(), Botan::PK_Verifier::PK_Verifier(), Botan::PK_Verifier::PK_Verifier(), Botan::PKCS11::PKCS11_ReturnError::PKCS11_ReturnError(), Botan::PRNG_Unseeded::PRNG_Unseeded(), Botan::Provider_Not_Found::Provider_Not_Found(), Botan::Credentials_Manager::psk(), Botan::Dynamically_Loaded_Library::resolve_symbol(), Botan::RFC6979_Nonce_Generator::RFC6979_Nonce_Generator(), Botan::Sqlite3_Database::row_count(), Botan::RSA_PrivateKey::RSA_PrivateKey(), runtime_version_check(), split_on(), srp6_client_agree(), srp6_generate_verifier(), Botan::XOF::start(), Botan::SRP6_Server_Session::step1(), Botan::SRP6_Server_Session::step2(), Botan::Streebog::Streebog(), Botan::System_Error::System_Error(), throw_invalid_argument(), throw_invalid_state(), Botan::TLS::Callbacks::tls12_protocol_specific_kdf(), Botan::Argon2::to_string(), Botan::ASN1_Time::to_string(), Botan::Bcrypt_PBKDF::to_string(), Botan::PBKDF2::to_string(), Botan::RFC4880_S2K::to_string(), Botan::Scrypt::to_string(), Botan::Unknown_PK_Field_Name::Unknown_PK_Field_Name(), Botan::TLS::Cipher_State::update_read_keys(), Botan::TLS::Cipher_State::update_write_keys(), Botan::UUID::UUID(), Botan::TLS::Certificate_Type_Base::validate_selection(), Botan::PK_Ops::Verification_with_Hash::Verification_with_Hash(), Botan::XMSS_Hash::XMSS_Hash(), Botan::XMSS_Parameters::xmss_id_from_string(), Botan::XMSS_WOTS_Parameters::xmss_wots_id_from_string(), and Botan::XTS_Mode::XTS_Mode().

◆ format_char_for_display()

std::string Botan::format_char_for_display ( char c)

Return a string containing 'c', quoted and possibly escaped

This is used when creating an error message nothing an invalid character in some codex (for example during hex decoding)

Currently this function escapes tab, newlines and carriage return as "\t", "\n", and "\r", and also escapes characters > 0x7F as "\xHH" where HH is the hex code.

Definition at line 98 of file charset.cpp.

98 {
99 std::ostringstream oss;
100
101 oss << "'";
102
103 if(c == '\t') {
104 oss << "\\t";
105 } else if(c == '\n') {
106 oss << "\\n";
107 } else if(c == '\r') {
108 oss << "\\r";
109 } else if(static_cast<unsigned char>(c) >= 128) {
110 const unsigned char z = static_cast<unsigned char>(c);
111 oss << "\\x" << std::hex << std::uppercase << static_cast<int>(z);
112 } else {
113 oss << c;
114 }
115
116 oss << "'";
117
118 return oss.str();
119}

Referenced by hex_decode().

◆ fors_public_key_from_signature()

BOTAN_TEST_API SphincsTreeNode Botan::fors_public_key_from_signature ( const SphincsHashedMessage & hashed_message,
StrongSpan< const ForsSignature > signature,
const Sphincs_Address & address,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hash )

FIPS 205, Algorithm 17: fors_pkFromSig.

Reconstructs the FORS public key from a given FORS signature and message. This is tailored for the use case in the SLH-DSA implementation and is not meant for general usability.

Definition at line 130 of file sp_fors.cpp.

134 {
135 const auto indices = fors_message_to_indices(hashed_message, params);
136
137 auto fors_tree_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTree);
138
139 auto fors_pk_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTreeRootsCompression);
140
141 BufferSlicer s(signature);
142 std::vector<uint8_t> roots_buffer(params.k() * params.n());
143 BufferStuffer roots(roots_buffer);
144
145 // For each of the k FORS subtrees: Reconstruct the subtree's root node by using the
146 // leaf and the authentication path offered in the FORS signature.
147 BOTAN_ASSERT_NOMSG(indices.size() == params.k());
148 for(uint32_t i = 0; i < params.k(); ++i) {
149 const uint32_t idx_offset = i * (1 << params.a());
150
151 // Compute the FORS leaf by using the secret leaf contained in the signature
152 fors_tree_addr.set_tree_height(TreeLayerIndex(0)).set_tree_index(indices[i] + idx_offset);
153 auto fors_leaf_secret = s.take<ForsLeafSecret>(params.n());
154 auto auth_path = s.take<SphincsAuthenticationPath>(params.n() * params.a());
155 auto leaf = hashes.T<SphincsTreeNode>(fors_tree_addr, fors_leaf_secret);
156
157 // Reconstruct the subtree's root using the authentication path
158 compute_root(roots.next<SphincsTreeNode>(params.n()),
159 params,
160 hashes,
161 leaf,
162 indices[i],
163 idx_offset,
164 auth_path,
165 params.a(),
166 fors_tree_addr);
167 }
168
169 BOTAN_ASSERT_NOMSG(roots.full());
170
171 // Reconstruct the public key the signature creates with the hash of the concatenation of all roots
172 // Only if the signature is valid, the pk is the correct FORS pk.
173 return hashes.T<SphincsTreeNode>(fors_pk_addr, roots_buffer);
174}
Botan::BufferStuffer
Helper class to ease in-place marshalling of concatenated fixed-length values.
Definition buffer_stuffer.h:24
Botan::Sphincs_Address::set_type
Sphincs_Address & set_type(Sphincs_Address_Type type)
Definition sp_address.h:71
Botan::Sphincs_Address::as_keypair_from
static Sphincs_Address as_keypair_from(const Sphincs_Address &other)
Definition sp_address.h:128
Botan::Sphincs_Parameters::k
uint32_t k() const
Definition sp_parameters.h:119
Botan::Sphincs_Parameters::a
uint32_t a() const
Definition sp_parameters.h:114
Botan::ForsLeafSecret
Strong< secure_vector< uint8_t >, struct ForsLeafSecret_ > ForsLeafSecret
Definition sp_types.h:71
Botan::SphincsAuthenticationPath
Strong< std::vector< uint8_t >, struct SphincsAuthenticationPath_ > SphincsAuthenticationPath
Definition sp_types.h:67
Botan::compute_root
void compute_root(StrongSpan< SphincsTreeNode > out, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, const SphincsTreeNode &leaf, TreeNodeIndex leaf_idx, uint32_t idx_offset, StrongSpan< const SphincsAuthenticationPath > authentication_path, uint32_t total_tree_height, Sphincs_Address &tree_address)
Definition sp_treehash.cpp:102

References Botan::Sphincs_Parameters::a(), Botan::Sphincs_Address::as_keypair_from(), BOTAN_ASSERT_NOMSG, compute_root(), Botan::BufferStuffer::full(), Botan::Sphincs_Parameters::k(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_type(), Botan::Sphincs_Hash_Functions::T(), and Botan::BufferSlicer::take().

◆ fors_sign_and_pkgen()

BOTAN_TEST_API SphincsTreeNode Botan::fors_sign_and_pkgen ( StrongSpan< ForsSignature > sig_out,
const SphincsHashedMessage & hashed_message,
const SphincsSecretSeed & secret_seed,
const Sphincs_Address & address,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 16: fors_sign (with simultaneous FORS pk generation).

Implements a domain specific wrapper for the few-times signature scheme FORS (Forest of Random Subsets). It is meant to be used inside SLH-DSA and does not aim to be applicable for other use cases.

Definition at line 63 of file sp_fors.cpp.

68 {
69 BOTAN_ASSERT_NOMSG(sig_out.size() == params.fors_signature_bytes());
70
71 const auto indices = fors_message_to_indices(hashed_message, params);
72
73 auto fors_tree_addr = Sphincs_Address::as_keypair_from(address);
74
75 auto fors_pk_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTreeRootsCompression);
76
77 std::vector<uint8_t> roots_buffer(params.k() * params.n());
78 BufferStuffer roots(roots_buffer);
79 BufferStuffer sig(sig_out);
80
81 // Buffer to hold the FORS leaves during tree traversal
82 // (Avoids a secure_vector allocation/deallocation in the hot path)
83 ForsLeafSecret fors_leaf_secret(params.n());
84
85 // For each of the k FORS subtrees: Compute the secret leaf, the authentication path
86 // and the trees' root and append the signature respectively
87 BOTAN_ASSERT_NOMSG(indices.size() == params.k());
88 for(uint32_t i = 0; i < params.k(); ++i) {
89 const uint32_t idx_offset = i * (1 << params.a());
90
91 // Compute the secret leaf given by the chunk of the message and append it to the signature
92 fors_tree_addr.set_type(Sphincs_Address_Type::ForsKeyGeneration)
93 .set_tree_height(TreeLayerIndex(0))
94 .set_tree_index(indices[i] + idx_offset);
95
96 hashes.PRF(sig.next<ForsLeafSecret>(params.n()), secret_seed, fors_tree_addr);
97
98 // Compute the authentication path and root for this leaf node
99 fors_tree_addr.set_type(Sphincs_Address_Type::ForsTree);
100
101 const GenerateLeafFunction fors_gen_leaf = [&](StrongSpan<SphincsTreeNode> out_root,
102 TreeNodeIndex address_index) {
103 fors_tree_addr.set_tree_index(address_index);
104 fors_tree_addr.set_type(Sphincs_Address_Type::ForsKeyGeneration);
105
106 hashes.PRF(fors_leaf_secret, secret_seed, fors_tree_addr);
107
108 fors_tree_addr.set_type(Sphincs_Address_Type::ForsTree);
109 hashes.T(out_root, fors_tree_addr, fors_leaf_secret);
110 };
111
112 treehash(roots.next<SphincsTreeNode>(params.n()),
113 sig.next<SphincsAuthenticationPath>(params.a() * params.n()),
114 params,
115 hashes,
116 indices[i],
117 idx_offset,
118 params.a(),
119 fors_gen_leaf,
120 fors_tree_addr);
121 }
122
123 BOTAN_ASSERT_NOMSG(sig.full());
124 BOTAN_ASSERT_NOMSG(roots.full());
125
126 // Compute the public key by the hash of the concatenation of all roots
127 return hashes.T<SphincsTreeNode>(fors_pk_addr, roots_buffer);
128}
Botan::Sphincs_Hash_Functions::PRF
void PRF(StrongSpan< ForsLeafSecret > out, const SphincsSecretSeed &sk_seed, const Sphincs_Address &address)
Definition sp_hash.h:70
Botan::Sphincs_Parameters::fors_signature_bytes
uint32_t fors_signature_bytes() const
Definition sp_parameters.h:180
Botan::GenerateLeafFunction
std::function< void(StrongSpan< SphincsTreeNode >, TreeNodeIndex)> GenerateLeafFunction
Definition sp_treehash.h:25
Botan::TreeNodeIndex
Strong< uint32_t, struct TreeNodeIndex_, EnableArithmeticWithPlainNumber > TreeNodeIndex
Index of an individual node inside an XMSS or FORS tree.
Definition sp_types.h:92
Botan::treehash
void treehash(StrongSpan< SphincsTreeNode > out_root, StrongSpan< SphincsAuthenticationPath > out_auth_path, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, std::optional< TreeNodeIndex > leaf_idx, uint32_t idx_offset, uint32_t total_tree_height, const GenerateLeafFunction &gen_leaf, Sphincs_Address &tree_address)
Definition sp_treehash.cpp:17

References Botan::Sphincs_Parameters::a(), Botan::Sphincs_Address::as_keypair_from(), BOTAN_ASSERT_NOMSG, Botan::Sphincs_Parameters::fors_signature_bytes(), ForsKeyGeneration, ForsTree, Botan::BufferStuffer::full(), Botan::Sphincs_Parameters::k(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Hash_Functions::PRF(), Botan::Sphincs_Address::set_type(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), and treehash().

◆ gcd()

BigInt Botan::gcd ( const BigInt & x,
const BigInt & y )

Compute the greatest common divisor

Parameters
xa positive integer
ya positive integer
Returns
gcd(x,y)

Definition at line 220 of file numthry.cpp.

220 {
221 if(a.is_zero()) {
222 return abs(b);
223 }
224 if(b.is_zero()) {
225 return abs(a);
226 }
227
228 const size_t sz = std::max(a.sig_words(), b.sig_words());
229 auto u = BigInt::with_capacity(sz);
230 auto v = BigInt::with_capacity(sz);
231 u += a;
232 v += b;
233
234 CT::poison_all(u, v);
235
236 u.set_sign(BigInt::Positive);
237 v.set_sign(BigInt::Positive);
238
239 // In the worst case we have two fully populated big ints. After right
240 // shifting so many times, we'll have reached the result for sure.
241 const size_t loop_cnt = u.bits() + v.bits();
242
243 // This temporary is big enough to hold all intermediate results of the
244 // algorithm. No reallocation will happen during the loop.
245 // Note however, that `ct_cond_assign()` will invalidate the 'sig_words'
246 // cache, which _does not_ shrink the capacity of the underlying buffer.
247 auto tmp = BigInt::with_capacity(sz);
248 secure_vector<word> ws(sz * 2);
249 size_t factors_of_two = 0;
250 for(size_t i = 0; i != loop_cnt; ++i) {
251 auto both_odd = CT::Mask<word>::expand_bool(u.is_odd()) & CT::Mask<word>::expand_bool(v.is_odd());
252
253 // Subtract the smaller from the larger if both are odd
254 auto u_gt_v = CT::Mask<word>::expand_bool(bigint_cmp(u._data(), u.size(), v._data(), v.size()) > 0);
255 bigint_sub_abs(tmp.mutable_data(), u._data(), v._data(), sz, ws.data());
256 u.ct_cond_assign((u_gt_v & both_odd).as_bool(), tmp);
257 v.ct_cond_assign((~u_gt_v & both_odd).as_bool(), tmp);
258
259 const auto u_is_even = CT::Mask<word>::expand_bool(u.is_even());
260 const auto v_is_even = CT::Mask<word>::expand_bool(v.is_even());
261 BOTAN_DEBUG_ASSERT((u_is_even | v_is_even).as_bool());
262
263 // When both are even, we're going to eliminate a factor of 2.
264 // We have to reapply this factor to the final result.
265 factors_of_two += (u_is_even & v_is_even).if_set_return(1);
266
267 // remove one factor of 2, if u is even
268 bigint_shr2(tmp.mutable_data(), u._data(), sz, 1);
269 u.ct_cond_assign(u_is_even.as_bool(), tmp);
270
271 // remove one factor of 2, if v is even
272 bigint_shr2(tmp.mutable_data(), v._data(), sz, 1);
273 v.ct_cond_assign(v_is_even.as_bool(), tmp);
274 }
275
276 // The GCD (without factors of two) is either in u or v, the other one is
277 // zero. The non-zero variable _must_ be odd, because all factors of two were
278 // removed in the loop iterations above.
279 BOTAN_DEBUG_ASSERT(u.is_zero() || v.is_zero());
280 BOTAN_DEBUG_ASSERT(u.is_odd() || v.is_odd());
281
282 // make sure that the GCD (without factors of two) is in u
283 u.ct_cond_assign(u.is_even() /* .is_zero() would not be constant time */, v);
284
285 // re-apply the factors of two
286 u.ct_shift_left(factors_of_two);
287
288 CT::unpoison_all(u, v);
289
290 return u;
291}
Botan::CT::Mask::expand_bool
static constexpr Mask< T > expand_bool(bool v)
Definition ct_utils.h:397
Botan::CT::poison_all
constexpr void poison_all(const Ts &... ts)
Definition ct_utils.h:201
Botan::CT::unpoison_all
constexpr void unpoison_all(const Ts &... ts)
Definition ct_utils.h:207
Botan::bigint_shr2
constexpr void bigint_shr2(W y[], const W x[], size_t x_size, size_t shift)
Definition mp_core.h:368
Botan::abs
BigInt abs(const BigInt &n)
Definition numthry.h:22
Botan::bigint_cmp
constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size)
Definition mp_core.h:426
Botan::bigint_sub_abs
constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask< W >
Definition mp_core.h:279

References abs(), bigint_cmp(), bigint_shr2(), bigint_sub_abs(), BOTAN_DEBUG_ASSERT, Botan::CT::Mask< T >::expand_bool(), Botan::BigInt::is_zero(), Botan::CT::poison_all(), Botan::BigInt::Positive, Botan::BigInt::sig_words(), Botan::CT::unpoison_all(), and Botan::BigInt::with_capacity().

Referenced by botan_mp_gcd(), compute_rsa_secret_exponent(), generate_rsa_prime(), lcm(), and random_prime().

◆ generalize_to() [1/2]

template<typename GeneralVariantT, typename SpecialT>
requires (std::is_constructible_v<GeneralVariantT, std::decay_t<SpecialT>>)
GeneralVariantT Botan::generalize_to ( SpecialT && specific)
constexpr

Converts a given variant into another variant-ish whose type states are a super set of the given variant.

This is useful to convert restricted variant types into more general variants types.

Definition at line 87 of file stl_util.h.

89{
90 return std::forward<SpecialT>(specific);
91}

Referenced by Botan::TLS::Channel_Impl_13::send_handshake_message(), and Botan::TLS::Channel_Impl_13::send_handshake_message().

◆ generalize_to() [2/2]

template<typename GeneralVariantT, typename... SpecialTs>
GeneralVariantT Botan::generalize_to ( std::variant< SpecialTs... > specific)
constexpr

Converts a given variant into another variant-ish whose type states are a super set of the given variant.

This is useful to convert restricted variant types into more general variants types.

Definition at line 101 of file stl_util.h.

101 {
102 static_assert(
103 is_generalizable_to<GeneralVariantT>(specific),
104 "Desired general type must be implicitly constructible by all types of the specialized std::variant<>");
105 return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific));
106}
Botan::is_generalizable_to
constexpr bool is_generalizable_to(const SpecialT &) noexcept
Definition stl_util.h:70

References is_generalizable_to().

◆ generate_bcrypt()

std::string Botan::generate_bcrypt ( std::string_view password,
RandomNumberGenerator & rng,
uint16_t work_factor = 12,
char version = 'a' )

Create a password hash using Bcrypt

Takes the password to hash, a rng, and a work_factor. The resulting password hash is returned as a string.

Higher work factors increase the amount of time the algorithm runs, increasing the cost of cracking attempts. The increase is exponential, so a work factor of 12 takes roughly twice as long as work factor 11. The default work factor was set to 10 up until the 2.8.0 release.

It is recommended to set the work factor as high as your system can tolerate (from a performance and latency perspective) since higher work factors greatly improve the security against GPU-based attacks. For example, for protecting high value administrator passwords, consider using work factor 15 or 16; at these work factors each bcrypt computation takes several seconds. Since admin logins will be relatively uncommon, it might be acceptable for each login attempt to take some time. As of 2018, a good password cracking rig (with 8 NVIDIA 1080 cards) can attempt about 1 billion bcrypt computations per month for work factor 13. For work factor 12, it can do twice as many. For work factor 15, it can do only one quarter as many attempts.

Due to bugs affecting various implementations of bcrypt, several different variants of the algorithm are defined. As of 2.7.0 Botan supports generating (or checking) the 2a, 2b, and 2y variants. Since Botan has never been affected by any of the bugs which necessitated these version upgrades, all three versions are identical beyond the version identifier. Which variant to use is controlled by the version argument.

The bcrypt work_factor must be at least 4 (though at this work factor bcrypt is not very secure). The bcrypt format allows up to 31, but Botan currently rejects all work factors greater than 18 since even that work factor requires roughly 15 seconds of computation on a fast machine.

Warning
The password is truncated at at most 72 characters; characters after that do not have any effect on the resulting hash. To support longer passwords, consider pre-hashing the password, for example by using the hex encoding of SHA-256 of the password as the input to bcrypt.
Parameters
passwordthe password.
rnga random number generator
work_factorhow much work to do to slow down guessing attacks
versionwhich version to emit (may be 'a', 'b', or 'y' all of which have identical behavior in this implementation).
See also
https://www.usenix.org/events/usenix99/provos/provos_html/

TODO(Botan4) Convert work_factor to a size_t

Definition at line 146 of file bcrypt.cpp.

146 {
147 /*
148 2a, 2b and 2y are identical for our purposes because our implementation of 2a
149 never had the truncation or signed char bugs in the first place.
150 */
151
152 if(version != 'a' && version != 'b' && version != 'y') {
153 throw Invalid_Argument("Unknown bcrypt version '" + std::string(1, version) + "'");
154 }
155
156 std::vector<uint8_t> salt;
157 rng.random_vec(salt, 16);
158 return make_bcrypt(pass, salt, work_factor, version);
159}
Botan::RandomNumberGenerator::random_vec
void random_vec(std::span< uint8_t > v)
Definition rng.h:204

References Botan::RandomNumberGenerator::random_vec().

Referenced by botan_bcrypt_generate().

◆ generate_dsa_primes() [1/2]

std::vector< uint8_t > Botan::generate_dsa_primes ( RandomNumberGenerator & rng,
BigInt & p_out,
BigInt & q_out,
size_t pbits,
size_t qbits )

Generate DSA parameters using the FIPS 186 kosherizer

Parameters
rnga random number generator
p_outwhere the prime p will be stored
q_outwhere the prime q will be stored
pbitshow long p will be in bits
qbitshow long q will be in bits
Returns
random seed used to generate this parameter set

Definition at line 138 of file dsa_gen.cpp.

138 {
139 while(true) {
140 std::vector<uint8_t> seed(qbits / 8);
141 rng.randomize(seed.data(), seed.size());
142
143 if(generate_dsa_primes(rng, p, q, pbits, qbits, seed)) {
144 return seed;
145 }
146 }
147}
Botan::generate_dsa_primes
bool generate_dsa_primes(RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits, const std::vector< uint8_t > &seed_c, size_t offset)
Definition dsa_gen.cpp:54

References generate_dsa_primes(), and Botan::RandomNumberGenerator::randomize().

◆ generate_dsa_primes() [2/2]

bool BOTAN_TEST_API Botan::generate_dsa_primes ( RandomNumberGenerator & rng,
BigInt & p_out,
BigInt & q_out,
size_t pbits,
size_t qbits,
const std::vector< uint8_t > & seed,
size_t offset = 0 )

Generate DSA parameters using the FIPS 186 kosherizer

Parameters
rnga random number generator
p_outwhere the prime p will be stored
q_outwhere the prime q will be stored
pbitshow long p will be in bits
qbitshow long q will be in bits
seedthe seed used to generate the parameters
offsetoptional offset from seed to start searching at
Returns
true if seed generated a valid DSA parameter set, otherwise false. p_out and q_out are only valid if true was returned.

Definition at line 54 of file dsa_gen.cpp.

60 {
61 if(!fips186_3_valid_size(pbits, qbits)) {
62 throw Invalid_Argument(fmt("FIPS 186-3 does not allow DSA domain parameters of {}/{} bits long", pbits, qbits));
63 }
64
65 if(seed_c.size() * 8 < qbits) {
66 throw Invalid_Argument(
67 fmt("Generating a DSA parameter set with a {} bit long q requires a seed at least as many bits long", qbits));
68 }
69
70 const std::string hash_name = hash_function_for(qbits);
71 auto hash = HashFunction::create_or_throw(hash_name);
72
73 const size_t HASH_SIZE = hash->output_length();
74
75 class Seed final {
76 public:
77 explicit Seed(const std::vector<uint8_t>& s) : m_seed(s) {}
78
79 const std::vector<uint8_t>& value() const { return m_seed; }
80
81 Seed& operator++() {
82 for(size_t j = m_seed.size(); j > 0; --j) {
83 m_seed[j - 1] += 1;
84 if(m_seed[j - 1] != 0) {
85 break;
86 }
87 }
88 return (*this);
89 }
90
91 private:
92 std::vector<uint8_t> m_seed;
93 };
94
95 Seed seed(seed_c);
96
97 q._assign_from_bytes(hash->process(seed.value()));
98 q.set_bit(qbits - 1);
99 q.set_bit(0);
100
101 if(!is_prime(q, rng, 128, true)) {
102 return false;
103 }
104
105 const size_t n = (pbits - 1) / (HASH_SIZE * 8);
106 const size_t b = (pbits - 1) % (HASH_SIZE * 8);
107
108 BigInt X;
109 std::vector<uint8_t> V(HASH_SIZE * (n + 1));
110
111 const BigInt q2 = 2 * q;
112
113 for(size_t j = 0; j != 4 * pbits; ++j) {
114 for(size_t k = 0; k <= n; ++k) {
115 ++seed;
116 hash->update(seed.value());
117 hash->final(&V[HASH_SIZE * (n - k)]);
118 }
119
120 if(j >= offset) {
121 X._assign_from_bytes(std::span{V}.subspan(HASH_SIZE - 1 - b / 8));
122 X.set_bit(pbits - 1);
123
124 // Variable time division is OK here since DSA primes are public anyway
125 p = X - ((X % q2) - 1);
126
127 if(p.bits() == pbits && is_prime(p, rng, 128, true)) {
128 return true;
129 }
130 }
131 }
132 return false;
133}
Botan::operator++
constexpr auto operator++(Strong< T, Tags... > &a, int)
Definition strong_type.h:618
Botan::is_prime
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition numthry.cpp:381

References Botan::BigInt::_assign_from_bytes(), Botan::BigInt::bits(), Botan::HashFunction::create_or_throw(), fmt(), is_prime(), operator++(), Seed, and Botan::BigInt::set_bit().

Referenced by Botan::DL_Group::DL_Group(), Botan::DL_Group::DL_Group(), and generate_dsa_primes().

◆ generate_mceliece_key()

McEliece_PrivateKey Botan::generate_mceliece_key ( RandomNumberGenerator & rng,
size_t ext_deg,
size_t code_length,
size_t t )

Definition at line 181 of file code_based_key_gen.cpp.

181 {
182 const size_t codimension = t * ext_deg;
183
184 if(code_length <= codimension) {
185 throw Invalid_Argument("invalid McEliece parameters");
186 }
187
188 auto sp_field = std::make_shared<GF2m_Field>(ext_deg);
189
190 //pick the support.........
191 std::vector<gf2m> L(code_length);
192
193 for(size_t i = 0; i != L.size(); i++) {
194 L[i] = static_cast<gf2m>(i);
195 }
196 randomize_support(L, rng);
197 polyn_gf2m g(sp_field); // create as zero
198
199 bool success = false;
200 std::unique_ptr<binary_matrix> R;
201
202 // NOLINTNEXTLINE(*-avoid-do-while)
203 do {
204 // create a random irreducible polynomial
205 g = polyn_gf2m(t, rng, sp_field);
206
207 try {
208 R = generate_R(L, &g, *sp_field, code_length, t);
209 success = true;
210 } catch(const Invalid_State&) {}
211 } while(!success);
212
213 const std::vector<polyn_gf2m> sqrtmod = polyn_gf2m::sqrt_mod_init(g);
214 std::vector<polyn_gf2m> F = syndrome_init(g, L, static_cast<int>(code_length));
215
216 // Each F[i] is the (precomputed) syndrome of the error vector with
217 // a single '1' in i-th position.
218 // We do not store the F[i] as polynomials of degree t , but
219 // as binary vectors of length ext_deg * t (this will
220 // speed up the syndrome computation)
221 //
222 const size_t co32 = bit_size_to_32bit_size(codimension);
223 std::vector<uint32_t> H(co32 * code_length);
224 uint32_t* sk = H.data();
225 for(size_t i = 0; i < code_length; ++i) {
226 for(size_t l = 0; l < t; ++l) {
227 const size_t k = (l * ext_deg) / 32;
228 const size_t j = (l * ext_deg) % 32;
229 sk[k] ^= static_cast<uint32_t>(F[i].get_coef(l)) << j;
230 if(j + ext_deg > 32) {
231 if(j > 0) {
232 sk[k + 1] ^= F[i].get_coef(l) >> (32 - j);
233 }
234 }
235 }
236 sk += co32;
237 }
238
239 // We need the support L for decoding (decryption). In fact the
240 // inverse is needed
241
242 std::vector<gf2m> Linv(code_length);
243 for(size_t i = 0; i != Linv.size(); ++i) {
244 Linv[L[i]] = static_cast<gf2m>(i);
245 }
246 std::vector<uint8_t> pubmat(R->elem().size() * 4);
247 for(size_t i = 0; i < R->elem().size(); i++) {
248 store_le(R->elem()[i], &pubmat[i * 4]);
249 }
250
251 return McEliece_PrivateKey(g, H, sqrtmod, Linv, pubmat);
252}
Botan::Invalid_State
Definition exceptn.h:207
Botan::McEliece_PrivateKey
Definition mceliece.h:83
Botan::polyn_gf2m
Definition polyn_gf2m.h:27
Botan::polyn_gf2m::sqrt_mod_init
static std::vector< polyn_gf2m > sqrt_mod_init(const polyn_gf2m &g)
Definition polyn_gf2m.cpp:564
Botan::syndrome_init
std::vector< polyn_gf2m > syndrome_init(const polyn_gf2m &generator, const std::vector< gf2m > &support, int n)
Definition polyn_gf2m.cpp:605
Botan::bit_size_to_32bit_size
size_t bit_size_to_32bit_size(size_t bit_size)
Definition code_based_util.h:46

References bit_size_to_32bit_size(), generate_mceliece_key(), Botan::polyn_gf2m::sqrt_mod_init(), store_le(), and syndrome_init().

Referenced by generate_mceliece_key(), and Botan::McEliece_PrivateKey::McEliece_PrivateKey().

◆ generate_passhash9()

std::string Botan::generate_passhash9 ( std::string_view password,
RandomNumberGenerator & rng,
uint16_t work_factor = 15,
uint8_t alg_id = 4 )

Create a password hash using PBKDF2

Functions much like generate_bcrypt(). The last parameter, alg_id, specifies which PRF to use. Currently defined values are:

  • 0: HMAC(SHA-1)
  • 1: HMAC(SHA-256)
  • 2: CMAC(Blowfish)
  • 3: HMAC(SHA-384)
  • 4: HMAC(SHA-512)

The work_factor must be greater than zero and less than 512. This performs 10000 * work_factor PBKDF2 iterations, using 96 bits of salt taken from rng. Using work factor of 10 or more is recommended.

Parameters
passwordthe password
rnga random number generator
work_factorhow much work to do to slow down guessing attacks
alg_idspecifies which PRF to use with PBKDF2 0 is HMAC(SHA-1) 1 is HMAC(SHA-256) 2 is CMAC(Blowfish) 3 is HMAC(SHA-384) 4 is HMAC(SHA-512) all other values are currently undefined

Definition at line 47 of file passhash9.cpp.

50 {
51 BOTAN_ARG_CHECK(work_factor > 0 && work_factor < 512, "Invalid Passhash9 work factor");
52
53 auto prf = get_pbkdf_prf(alg_id);
54
55 if(!prf) {
56 throw Invalid_Argument("Passhash9: Algorithm id " + std::to_string(alg_id) + " is not defined");
57 }
58
59 const PKCS5_PBKDF2 kdf(std::move(prf));
60
61 secure_vector<uint8_t> salt(SALT_BYTES);
62 rng.randomize(salt.data(), salt.size());
63
64 const size_t kdf_iterations = WORK_FACTOR_SCALE * work_factor;
65
66 secure_vector<uint8_t> blob;
67 blob.push_back(alg_id);
68 blob.push_back(get_byte<0>(work_factor));
69 blob.push_back(get_byte<1>(work_factor));
70 blob += salt;
71 blob += kdf.derive_key(PASSHASH9_PBKDF_OUTPUT_LEN, pass, salt.data(), salt.size(), kdf_iterations).bits_of();
72
73 return std::string(MAGIC_PREFIX) + base64_encode(blob);
74}
Botan::get_byte
constexpr uint8_t get_byte(T input)
Definition loadstor.h:79

References base64_encode(), Botan::OctetString::bits_of(), BOTAN_ARG_CHECK, Botan::PBKDF::derive_key(), get_byte(), and Botan::RandomNumberGenerator::randomize().

◆ generate_rfc6979_nonce()

BigInt Botan::generate_rfc6979_nonce ( const BigInt & x,
const BigInt & q,
const BigInt & h,
std::string_view hash )
inline
Parameters
xthe secret (EC)DSA key
qthe group order
hthe message hash already reduced mod q
hashthe hash function used to generate h

Definition at line 56 of file rfc6979.h.

56 {
57 RFC6979_Nonce_Generator gen(hash, q.bits(), x);
58 return gen.nonce_for(q, h);
59}
Botan::RFC6979_Nonce_Generator
Definition rfc6979.h:23

References Botan::BigInt::bits(), and Botan::RFC6979_Nonce_Generator::nonce_for().

◆ generate_rsa_prime()

BigInt Botan::generate_rsa_prime ( RandomNumberGenerator & keygen_rng,
RandomNumberGenerator & prime_test_rng,
size_t bits,
const BigInt & coprime,
size_t prob = 128 )

Generate a prime suitable for RSA p/q

Parameters
keygen_rnga random number generator
prime_test_rnga random number generator
bitshow large the resulting prime should be in bits (must be >= 512)
coprimea positive integer that (prime - 1) should be coprime to
probuse test so false positive is bounded by 1/2**prob
Returns
random prime with the specified criteria

Definition at line 226 of file make_prm.cpp.

230 {
231 if(bits < 512) {
232 throw Invalid_Argument("generate_rsa_prime bits too small");
233 }
234
235 /*
236 * The restriction on coprime <= 64 bits is arbitrary but generally speaking
237 * very large RSA public exponents are a bad idea both for performance and due
238 * to attacks on small d.
239 */
240 if(coprime <= 1 || coprime.is_even() || coprime.bits() > 64) {
241 throw Invalid_Argument("generate_rsa_prime coprime must be small odd positive integer");
242 }
243
244 const size_t MAX_ATTEMPTS = 32 * 1024;
245
246 const size_t mr_trials = miller_rabin_test_iterations(bits, prob, true);
247
248 while(true) {
249 BigInt p(keygen_rng, bits);
250
251 auto scope = CT::scoped_poison(p);
252
253 /*
254 Force high two bits so multiplication always results in expected n bit integer
255
256 Force the two low bits, and step by 4, so the generated prime is always == 3 (mod 4).
257 This way when we perform the inversion modulo phi(n) it is always of the form 2*o
258 with o odd, which allows a fastpath and avoids leaking any information about the
259 structure of the prime.
260 */
261 p.set_bit(bits - 1);
262 p.set_bit(bits - 2);
263 p.set_bit(1);
264 p.set_bit(0);
265
266 const word step = 4;
267
268 Prime_Sieve sieve(p, bits, step, false);
269
270 for(size_t attempt = 0; attempt <= MAX_ATTEMPTS; ++attempt) {
271 p += step;
272
273 if(!sieve.next()) {
274 continue;
275 }
276
277 BOTAN_DEBUG_ASSERT(no_small_multiples(p, sieve));
278
279 auto mod_p = Barrett_Reduction::for_secret_modulus(p);
280
281 /*
282 * Do a single primality test first before checking coprimality, since
283 * currently a single Miller-Rabin test is faster than computing gcd,
284 * and this eliminates almost all wasted gcd computations.
285 */
286 if(!is_miller_rabin_probable_prime(p, mod_p, prime_test_rng, 1)) {
287 continue;
288 }
289
290 /*
291 * Check if p - 1 and coprime are relatively prime.
292 */
293 if(gcd(p - 1, coprime) > 1) {
294 continue;
295 }
296
297 if(p.bits() > bits) {
298 break;
299 }
300
301 if(is_miller_rabin_probable_prime(p, mod_p, prime_test_rng, mr_trials)) {
302 return p;
303 }
304 }
305 }
306}
Botan::Barrett_Reduction::for_secret_modulus
static Barrett_Reduction for_secret_modulus(const BigInt &m)
Definition barrett.cpp:23
Botan::BigInt::is_even
bool is_even() const
Definition bigint.h:455
Botan::CT::scoped_poison
constexpr auto scoped_poison(const Ts &... xs)
Definition ct_utils.h:222
Botan::miller_rabin_test_iterations
size_t miller_rabin_test_iterations(size_t n_bits, size_t prob, bool random)
Definition primality.cpp:182
Botan::is_miller_rabin_probable_prime
bool is_miller_rabin_probable_prime(const BigInt &n, const Barrett_Reduction &mod_n, RandomNumberGenerator &rng, size_t test_iterations)
Definition primality.cpp:160

References Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, Botan::Barrett_Reduction::for_secret_modulus(), gcd(), Botan::BigInt::is_even(), is_miller_rabin_probable_prime(), miller_rabin_test_iterations(), Botan::CT::scoped_poison(), and Botan::BigInt::set_bit().

Referenced by Botan::RSA_PrivateKey::RSA_PrivateKey().

◆ get_aead()

AEAD_Mode * Botan::get_aead ( std::string_view name,
Cipher_Dir direction )
inline

Get an AEAD mode by name (eg "AES-128/GCM" or "Serpent/EAX")

Parameters
nameAEAD name
directionCipher_Dir::Encryption or Cipher_Dir::Decryption

Definition at line 138 of file aead.h.

138 {
139 return AEAD_Mode::create(name, direction, "").release();
140}
Botan::AEAD_Mode::create
static std::unique_ptr< AEAD_Mode > create(std::string_view algo, Cipher_Dir direction, std::string_view provider="")
Definition aead.cpp:59

References Botan::AEAD_Mode::create(), and get_aead().

Referenced by get_aead().

◆ get_byte()

template<size_t B, typename T>
requires (B < sizeof(T))
uint8_t Botan::get_byte ( T input)
inlineconstexpr

Byte extraction

Parameters
inputthe value to extract from
Returns
byte byte number B of input

Definition at line 79 of file loadstor.h.

81{
82 const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
83 return static_cast<uint8_t>((input >> shift) & 0xFF);
84}

Referenced by Botan::TLS::TLS_CBC_HMAC_AEAD_Mode::assoc_data_with_len(), Botan::polyn_gf2m::encode(), Botan::Cert_Extension::IPAddressBlocks::IPAddressFamily::encode_into(), Botan::detail::fallback_store_any(), Botan::TLS::Connection_Cipher_State::format_ad(), generate_passhash9(), hex_encode(), Botan::TLS::Channel_Impl_12::key_material_export(), Botan::McEliece_PrivateKey::private_key_bits(), Botan::TLS::Application_Layer_Protocol_Notification::serialize(), Botan::TLS::Certificate_Verify::serialize(), Botan::TLS::Cookie::serialize(), Botan::TLS::EarlyDataIndication::serialize(), Botan::TLS::Extensions::serialize(), Botan::TLS::PSK::serialize(), Botan::TLS::Record_Size_Limit::serialize(), Botan::TLS::Server_Hello::serialize(), Botan::TLS::Server_Name_Indicator::serialize(), Botan::TLS::SRTP_Protection_Profiles::serialize(), Botan::TLS::Supported_Groups::serialize(), Botan::TLS::Server_Key_Exchange::Server_Key_Exchange(), Botan::CCM_Mode::set_associated_data_n(), Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n(), sm2_compute_za(), and Botan::RTSS_Share::split().

◆ get_byte_var()

template<typename T>
uint8_t Botan::get_byte_var ( size_t byte_num,
T input )
inlineconstexpr

Byte extraction

Parameters
byte_numwhich byte to extract, 0 == highest byte
inputthe value to extract from
Returns
byte byte_num of input

Definition at line 69 of file loadstor.h.

69 {
70 return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
71}

Referenced by Botan::TLS::append_tls_length_value(), Botan::BigInt::binary_encode(), Botan::BigInt::byte_at(), copy_out_be(), copy_out_le(), Botan::CCM_Mode::encode_length(), Botan::TLS::Certificate_12::serialize(), and Botan::TLS::Certificate_Status::serialize().

◆ get_cipher() [1/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec,
Cipher_Dir direction )
inline

Factory method for general symmetric cipher filters. No key will be set in the filter.

Parameters
algo_specthe name of the desired cipher
directiondetermines whether the filter will be an encrypting or decrypting filter
Returns
pointer to the encryption or decryption filter

Definition at line 201 of file filters.h.

201 {
202 auto c = Cipher_Mode::create_or_throw(algo_spec, direction);
203 // NOLINTNEXTLINE(*-owning-memory)
204 return new Cipher_Mode_Filter(c.release());
205}
Botan::Cipher_Mode_Filter
Definition filters.h:159
Botan::Cipher_Mode::create_or_throw
static std::unique_ptr< Cipher_Mode > create_or_throw(std::string_view algo, Cipher_Dir direction, std::string_view provider="")
Definition cipher_mode.cpp:44

References Botan::Cipher_Mode::create_or_throw().

Referenced by get_cipher(), and get_cipher().

◆ get_cipher() [2/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec,
const SymmetricKey & key,
Cipher_Dir direction )
inline

Factory method for general symmetric cipher filters.

Parameters
algo_specthe name of the desired cipher
keythe key to be used for encryption/decryption performed by the filter
directiondetermines whether the filter will be an encrypting or decrypting filter
Returns
pointer to the encryption or decryption filter

Definition at line 216 of file filters.h.

216 {
217 Keyed_Filter* cipher = get_cipher(algo_spec, direction);
218 cipher->set_key(key);
219 return cipher;
220}
Botan::Keyed_Filter
Definition filters.h:116
Botan::Keyed_Filter::set_key
virtual void set_key(const SymmetricKey &key)=0
Botan::get_cipher
Keyed_Filter * get_cipher(std::string_view algo_spec, Cipher_Dir direction)
Definition filters.h:201

References get_cipher(), and Botan::Keyed_Filter::set_key().

◆ get_cipher() [3/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec,
const SymmetricKey & key,
const InitializationVector & iv,
Cipher_Dir direction )
inline

Factory method for general symmetric cipher filters.

Parameters
algo_specthe name of the desired cipher
keythe key to be used for encryption/decryption performed by the filter
ivthe initialization vector to be used
directiondetermines whether the filter will be an encrypting or decrypting filter
Returns
pointer to newly allocated encryption or decryption filter

Definition at line 232 of file filters.h.

235 {
236 Keyed_Filter* cipher = get_cipher(algo_spec, key, direction);
237 if(!iv.empty()) {
238 cipher->set_iv(iv);
239 }
240 return cipher;
241}
Botan::Keyed_Filter::set_iv
virtual void set_iv(const InitializationVector &iv)
Definition filters.h:129
Botan::OctetString::empty
bool empty() const
Definition symkey.h:31

References Botan::OctetString::empty(), get_cipher(), and Botan::Keyed_Filter::set_iv().

◆ get_cipher_mode()

Cipher_Mode * Botan::get_cipher_mode ( std::string_view algo_spec,
Cipher_Dir direction,
std::string_view provider = "" )
inline

Get a cipher mode by name (eg "AES-128/CBC" or "Serpent/XTS")

Parameters
algo_speccipher name
directionCipher_Dir::Encryption or Cipher_Dir::Decryption
providerprovider implementation to choose

Definition at line 283 of file cipher_mode.h.

283 {
284 return Cipher_Mode::create(algo_spec, direction, provider).release();
285}
Botan::Cipher_Mode::create
static std::unique_ptr< Cipher_Mode > create(std::string_view algo, Cipher_Dir direction, std::string_view provider="")
Definition cipher_mode.cpp:54

References Botan::Cipher_Mode::create(), and get_cipher_mode().

Referenced by get_cipher_mode().

◆ get_files_recursive()

BOTAN_TEST_API std::vector< std::string > Botan::get_files_recursive ( std::string_view dir)

Definition at line 123 of file filesystem.cpp.

123 {
124 std::vector<std::string> files;
125
126#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
127 files = impl_readdir(dir);
128#elif defined(BOTAN_TARGET_OS_HAS_WIN32)
129 files = impl_win32(dir);
130#else
131 BOTAN_UNUSED(dir);
132 throw No_Filesystem_Access();
133#endif
134
135 std::sort(files.begin(), files.end());
136
137 return files;
138}
Botan::No_Filesystem_Access
Definition filesystem.h:20

References BOTAN_UNUSED.

◆ get_kdf()

KDF * Botan::get_kdf ( std::string_view algo_spec)
inline

Factory method for KDF (key derivation function)

Parameters
algo_specthe name of the KDF to create
Returns
pointer to newly allocated object of that type

Prefer KDF::create

Definition at line 274 of file kdf.h.

274 {
275 if(algo_spec == "Raw") {
276 return nullptr;
277 }
278
279 return KDF::create_or_throw(algo_spec).release();
280}
Botan::KDF::create_or_throw
static std::unique_ptr< KDF > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition kdf.cpp:204

References Botan::KDF::create_or_throw(), and get_kdf().

Referenced by get_kdf().

◆ get_pbkdf()

PBKDF * Botan::get_pbkdf ( std::string_view algo_spec,
std::string_view provider = "" )
inline

Password based key derivation function factory method

Parameters
algo_specthe name of the desired PBKDF algorithm
providerthe provider to use
Returns
pointer to newly allocated object of that type

Definition at line 246 of file pbkdf.h.

246 {
247 return PBKDF::create_or_throw(algo_spec, provider).release();
248}
Botan::PBKDF::create_or_throw
static std::unique_ptr< PBKDF > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition pbkdf.cpp:57

References Botan::PBKDF::create_or_throw(), and get_pbkdf().

Referenced by get_pbkdf().

◆ get_s2k()

PBKDF * Botan::get_s2k ( std::string_view algo_spec)
inline

Definition at line 250 of file pbkdf.h.

250 {
251 return PBKDF::create_or_throw(algo_spec).release();
252}

References Botan::PBKDF::create_or_throw(), and get_s2k().

Referenced by get_s2k().

◆ get_uint32()

template<WordType W>
uint32_t Botan::get_uint32 ( const W xw[],
size_t i )
constexpr

Definition at line 33 of file pcurves_solinas.h.

33 {
34 static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
35
36 if constexpr(WordInfo<W>::bits == 32) {
37 return xw[i];
38 } else {
39 return static_cast<uint32_t>(xw[i / 2] >> ((i % 2) * 32));
40 }
41}

◆ gf2p8affine()

template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8affine ( const SIMD_8x32 & x)

Definition at line 52 of file simd_avx2_gfni.h.

52 {
53 return SIMD_8x32(_mm256_gf2p8affine_epi64_epi8(x.raw(), _mm256_set1_epi64x(A), B));
54}
Botan::SIMD_8x32
Definition simd_avx2.h:19
Botan::SIMD_8x32::raw
__m256i BOTAN_FN_ISA_AVX2 raw() const noexcept
Definition simd_avx2.h:340

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

◆ gf2p8affineinv()

template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8affineinv ( const SIMD_8x32 & x)

Definition at line 57 of file simd_avx2_gfni.h.

57 {
58 return SIMD_8x32(_mm256_gf2p8affineinv_epi64_epi8(x.raw(), _mm256_set1_epi64x(A), B));
59}

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

◆ gf2p8mul()

BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8mul ( const SIMD_8x32 & a,
const SIMD_8x32 & b )

Definition at line 61 of file simd_avx2_gfni.h.

61 {
62 return SIMD_8x32(_mm256_gf2p8mul_epi8(a.raw(), b.raw()));
63}

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

◆ gfni_matrix()

uint64_t Botan::gfni_matrix ( std::string_view s)
consteval

Definition at line 19 of file simd_avx2_gfni.h.

19 {
20 uint64_t matrix = 0;
21 size_t bit_cnt = 0;
22 uint8_t row = 0;
23
24 for(const char c : s) {
25 if(c == ' ' || c == '\n') {
26 continue;
27 }
28 if(c != '0' && c != '1') {
29 throw std::runtime_error("gfni_matrix: invalid bit value");
30 }
31
32 if(c == '1') {
33 row |= 0x80 >> (7 - bit_cnt % 8);
34 }
35 bit_cnt++;
36
37 if(bit_cnt % 8 == 0) {
38 matrix <<= 8;
39 matrix |= row;
40 row = 0;
41 }
42 }
43
44 if(bit_cnt != 64) {
45 throw std::runtime_error("gfni_matrix: invalid bit count");
46 }
47
48 return matrix;
49}

◆ gray_to_lex()

gf2m Botan::gray_to_lex ( gf2m gray)
inline

Definition at line 30 of file code_based_util.h.

30 {
31 gf2m result = gray ^ (gray >> 8);
32 result ^= (result >> 4);
33 result ^= (result >> 2);
34 result ^= (result >> 1);
35 return result;
36}

◆ has_filesystem_impl()

BOTAN_TEST_API bool Botan::has_filesystem_impl ( )

Definition at line 113 of file filesystem.cpp.

113 {
114#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
115 return true;
116#elif defined(BOTAN_TARGET_OS_HAS_WIN32)
117 return true;
118#else
119 return false;
120#endif
121}

◆ hash_to_curve_sswu()

template<typename C, bool RO, std::invocable< std::span< uint8_t > > ExpandMsg>
requires C::ValidForSswuHash
auto Botan::hash_to_curve_sswu ( const ExpandMsg & expand_message) ->std::conditional_t< RO, typenameC::ProjectivePoint, typenameC::AffinePoint >
inline

Hash to curve (SSWU); RFC 9380

This is the Simplified Shallue-van de Woestijne-Ulas (SSWU) map.

The parameter expand_message models the function of RFC 9380 and is provided by higher levels. For the curves implemented here it will typically be XMD, but could also be an XOF (expand_message_xof) or a MHF like Argon2.

For details see RFC 9380 sections 3, 5.2 and 6.6.2.

Definition at line 1712 of file pcurves_impl.h.

1713 {
1714 constexpr size_t SecurityLevel = (C::OrderBits + 1) / 2;
1715 constexpr size_t L = (C::PrimeFieldBits + SecurityLevel + 7) / 8;
1716 constexpr size_t Cnt = RO ? 2 : 1;
1717
1718 std::array<uint8_t, L * Cnt> uniform_bytes = {};
1719 expand_message(uniform_bytes);
1720
1721 if constexpr(RO) {
1722 const auto u0 = C::FieldElement::from_wide_bytes(std::span<const uint8_t, L>(uniform_bytes.data(), L));
1723 const auto u1 = C::FieldElement::from_wide_bytes(std::span<const uint8_t, L>(uniform_bytes.data() + L, L));
1724
1725 auto accum = C::ProjectivePoint::from_affine(map_to_curve_sswu<C>(u0));
1726 accum += map_to_curve_sswu<C>(u1);
1727 return accum;
1728 } else {
1729 const auto u = C::FieldElement::from_wide_bytes(std::span<const uint8_t, L>(uniform_bytes.data(), L));
1730 return map_to_curve_sswu<C>(u);
1731 }
1732}
Botan::map_to_curve_sswu
auto map_to_curve_sswu(const typename C::FieldElement &u) -> typename C::AffinePoint
Definition pcurves_impl.h:1675

References map_to_curve_sswu().

Referenced by Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_nu(), and Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_ro().

◆ hex_decode() [1/6]

std::vector< uint8_t > Botan::hex_decode ( const char input[],
size_t input_length,
bool ignore_ws = true )

Perform hex decoding

Parameters
inputsome hex input
input_lengththe length of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded hex output

Definition at line 148 of file hex.cpp.

148 {
149 std::vector<uint8_t> bin(1 + input_length / 2);
150
151 const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
152
153 bin.resize(written);
154 return bin;
155}
Botan::hex_decode
size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool ignore_ws)
Definition hex.cpp:72

References hex_decode().

◆ hex_decode() [2/6]

size_t Botan::hex_decode ( std::span< uint8_t > output,
std::string_view input,
bool ignore_ws = true )

Perform hex decoding

Parameters
outputa contiguous byte buffer of at least input_length/2 bytes
inputsome hex input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 131 of file hex.cpp.

131 {
132 return hex_decode(output.data(), input.data(), input.length(), ignore_ws);
133}

References hex_decode().

◆ hex_decode() [3/6]

std::vector< uint8_t > Botan::hex_decode ( std::string_view input,
bool ignore_ws = true )

Perform hex decoding

Parameters
inputsome hex input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded hex output

Definition at line 157 of file hex.cpp.

157 {
158 return hex_decode(input.data(), input.size(), ignore_ws);
159}

References hex_decode().

◆ hex_decode() [4/6]

size_t Botan::hex_decode ( uint8_t output[],
const char input[],
size_t input_length,
bool ignore_ws = true )

Perform hex decoding

Parameters
outputan array of at least input_length/2 bytes
inputsome hex input
input_lengthlength of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 116 of file hex.cpp.

116 {
117 size_t consumed = 0;
118 const size_t written = hex_decode(output, input, input_length, consumed, ignore_ws);
119
120 if(consumed != input_length) {
121 throw Invalid_Argument("hex_decode: input did not have full bytes");
122 }
123
124 return written;
125}

References hex_decode().

◆ hex_decode() [5/6]

size_t Botan::hex_decode ( uint8_t output[],
const char input[],
size_t input_length,
size_t & input_consumed,
bool ignore_ws = true )

Perform hex decoding

Parameters
outputan array of at least input_length/2 bytes
inputsome hex input
input_lengthlength of input in bytes
input_consumedis an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 72 of file hex.cpp.

72 {
73 uint8_t* out_ptr = output;
74 bool top_nibble = true;
75
76 clear_mem(output, input_length / 2);
77
78 for(size_t i = 0; i != input_length; ++i) {
79 const uint8_t bin = hex_char_to_bin(input[i]);
80
81 if(bin >= 0x10) {
82 if(bin == 0x80 && ignore_ws) {
83 continue;
84 }
85
86 throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i])));
87 }
88
89 if(top_nibble) {
90 *out_ptr |= bin << 4;
91 } else {
92 *out_ptr |= bin;
93 }
94
95 top_nibble = !top_nibble;
96 if(top_nibble) {
97 ++out_ptr;
98 }
99 }
100
101 input_consumed = input_length;
102 const size_t written = (out_ptr - output);
103
104 /*
105 * We only got half of a uint8_t at the end; zap the half-written
106 * output and mark it as unread
107 */
108 if(!top_nibble) {
109 *out_ptr = 0;
110 input_consumed -= 1;
111 }
112
113 return written;
114}
Botan::format_char_for_display
std::string format_char_for_display(char c)
Definition charset.cpp:98

References clear_mem(), fmt(), format_char_for_display(), and out_ptr().

Referenced by botan_hex_decode(), Botan::Hex_Decoder::end_msg(), Botan::TLS::Session_Manager_SQL::find_some(), hex_decode(), hex_decode(), hex_decode(), hex_decode(), hex_decode(), hex_decode_locked(), Botan::OctetString::OctetString(), Botan::UUID::UUID(), and Botan::Hex_Decoder::write().

◆ hex_decode() [6/6]

size_t Botan::hex_decode ( uint8_t output[],
std::string_view input,
bool ignore_ws = true )

Perform hex decoding

Parameters
outputan array of at least input_length/2 bytes
inputsome hex input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
number of bytes written to output

Definition at line 127 of file hex.cpp.

127 {
128 return hex_decode(output, input.data(), input.length(), ignore_ws);
129}

References hex_decode().

◆ hex_decode_locked() [1/2]

secure_vector< uint8_t > Botan::hex_decode_locked ( const char input[],
size_t input_length,
bool ignore_ws = true )

Perform hex decoding

Parameters
inputsome hex input
input_lengththe length of input in bytes
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded hex output

Definition at line 135 of file hex.cpp.

135 {
136 secure_vector<uint8_t> bin(1 + input_length / 2);
137
138 const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
139
140 bin.resize(written);
141 return bin;
142}

References hex_decode().

Referenced by Botan::BigInt::from_radix_digits(), hex_decode_locked(), and Botan::RTSS_Share::RTSS_Share().

◆ hex_decode_locked() [2/2]

secure_vector< uint8_t > Botan::hex_decode_locked ( std::string_view input,
bool ignore_ws = true )

Perform hex decoding

Parameters
inputsome hex input
ignore_wsignore whitespace on input; if false, throw an exception if whitespace is encountered
Returns
decoded hex output

Definition at line 144 of file hex.cpp.

144 {
145 return hex_decode_locked(input.data(), input.size(), ignore_ws);
146}
Botan::hex_decode_locked
secure_vector< uint8_t > hex_decode_locked(const char input[], size_t input_length, bool ignore_ws)
Definition hex.cpp:135

References hex_decode_locked().

◆ hex_encode() [1/3]

void Botan::hex_encode ( char output[],
const uint8_t input[],
size_t input_length,
bool uppercase = true )

Perform hex encoding

Parameters
outputan array of at least input_length*2 bytes
inputis some binary data
input_lengthlength of input in bytes
uppercaseshould output be upper or lower case?

Definition at line 34 of file hex.cpp.

34 {
35 for(size_t i = 0; i != input_length; ++i) {
36 const uint16_t h = hex_encode_2nibble(input[i], uppercase);
37 output[2 * i] = get_byte<0>(h);
38 output[2 * i + 1] = get_byte<1>(h);
39 }
40}

References get_byte().

Referenced by botan_hex_encode(), create_hex_fingerprint(), hex_encode(), hex_encode(), Botan::TLS::Session_Manager_SQL::remove(), Botan::TLS::Session_Manager_SQL::retrieve_one(), Botan::TLS::Session_Manager_SQL::store(), Botan::BigInt::to_hex_string(), Botan::OctetString::to_string(), Botan::RTSS_Share::to_string(), Botan::UUID::to_string(), Botan::X509_Certificate::to_string(), and Botan::UUID::UUID().

◆ hex_encode() [2/3]

std::string Botan::hex_encode ( const uint8_t input[],
size_t input_length,
bool uppercase = true )

Perform hex encoding

Parameters
inputsome input
input_lengthlength of input in bytes
uppercaseshould output be upper or lower case?
Returns
hexadecimal representation of input

Definition at line 42 of file hex.cpp.

42 {
43 std::string output(2 * input_length, 0);
44
45 if(input_length > 0) {
46 hex_encode(&output.front(), input, input_length, uppercase);
47 }
48
49 return output;
50}

References hex_encode().

◆ hex_encode() [3/3]

std::string Botan::hex_encode ( std::span< const uint8_t > input,
bool uppercase = true )
inline

Perform hex encoding

Parameters
inputsome input
uppercaseshould output be upper or lower case?
Returns
hexadecimal representation of input

Definition at line 43 of file hex.h.

43 {
44 return hex_encode(input.data(), input.size(), uppercase);
45}

References hex_encode().

◆ hex_to_words()

template<WordType W, size_t N>
auto Botan::hex_to_words ( const char(&) s[N])
constexpr

Definition at line 743 of file mp_core.h.

743 {
744 // Char count includes null terminator which we ignore
745 const constexpr size_t C = N - 1;
746
747 // Number of nibbles that a word can hold
748 const constexpr size_t NPW = (WordInfo<W>::bits / 4);
749
750 // Round up to the next number of words that will fit the input
751 const constexpr size_t S = (C + NPW - 1) / NPW;
752
753 auto hex2int = [](char c) -> int8_t {
754 if(c >= '0' && c <= '9') {
755 return static_cast<int8_t>(c - '0');
756 } else if(c >= 'a' && c <= 'f') {
757 return static_cast<int8_t>(c - 'a' + 10);
758 } else if(c >= 'A' && c <= 'F') {
759 return static_cast<int8_t>(c - 'A' + 10);
760 } else {
761 return -1;
762 }
763 };
764
765 std::array<W, S> r = {0};
766
767 for(size_t i = 0; i != C; ++i) {
768 const int8_t c = hex2int(s[i]);
769 if(c >= 0) {
770 shift_left<4>(r);
771 r[0] += c;
772 }
773 }
774
775 return r;
776}

References shift_left().

◆ high_bit()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t Botan::high_bit ( T n)
constexpr

Return the index of the highest set bit T is an unsigned integer type

Parameters
nan integer value
Returns
index of the highest set bit in n

Definition at line 73 of file bit_ops.h.

73 {
74 size_t hb = 0;
75
76 for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
77 // Equivalent to: ((n >> s) == 0) ? 0 : s;
78 const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
79 hb += z;
80 n >>= z;
81 }
82
83 hb += n;
84
85 return hb;
86}

References BOTAN_FORCE_INLINE, and ct_if_is_zero_ret().

Referenced by Botan::OID::encode_into(), floor_log2(), random_prime(), and Botan::BigInt::top_bits_free().

◆ hkdf_expand_label()

secure_vector< uint8_t > BOTAN_TEST_API Botan::hkdf_expand_label ( std::string_view hash_fn,
std::span< const uint8_t > secret,
std::string_view label,
std::span< const uint8_t > hash_val,
size_t length )

HKDF-Expand-Label from TLS 1.3/QUIC

Parameters
hash_fnthe hash to use
secretthe secret bits
labelthe full label (no "TLS 1.3, " or "tls13 " prefix is applied)
hash_valthe previous hash value (used for chaining, may be empty)
lengththe desired output length

Definition at line 119 of file hkdf.cpp.

123 {
124 BOTAN_ARG_CHECK(length <= 0xFFFF, "HKDF-Expand-Label requested output too large");
125 BOTAN_ARG_CHECK(label.size() <= 0xFF, "HKDF-Expand-Label label too long");
126 BOTAN_ARG_CHECK(hash_val.size() <= 0xFF, "HKDF-Expand-Label hash too long");
127
128 const HKDF_Expand hkdf(MessageAuthenticationCode::create_or_throw(fmt("HMAC({})", hash_fn)));
129
130 const auto prefix = concat<std::vector<uint8_t>>(store_be(static_cast<uint16_t>(length)),
131 store_be(static_cast<uint8_t>(label.size())),
132 as_span_of_bytes(label),
133 store_be(static_cast<uint8_t>(hash_val.size())));
134
135 /*
136 * We do something a little dirty here to avoid copying the hash_val,
137 * making use of the fact that Botan's KDF interface supports label+salt,
138 * and knowing that our HKDF hashes first param label then param salt.
139 */
140 return hkdf.derive_key(length, secret, hash_val, prefix);
141}
Botan::HKDF_Expand
Definition hkdf.h:68
Botan::MessageAuthenticationCode::create_or_throw
static std::unique_ptr< MessageAuthenticationCode > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition mac.cpp:147
Botan::concat
constexpr auto concat(Rs &&... ranges)
Definition concat_util.h:90
Botan::store_be
constexpr auto store_be(ParamTs &&... params)
Definition loadstor.h:745

References as_span_of_bytes(), BOTAN_ARG_CHECK, concat(), Botan::MessageAuthenticationCode::create_or_throw(), Botan::KDF::derive_key(), fmt(), and store_be().

◆ holds_any_of()

template<typename... Alts, typename... Ts>
bool Botan::holds_any_of ( const std::variant< Ts... > & v)
constexprnoexcept

Definition at line 65 of file stl_util.h.

65 {
66 return (std::holds_alternative<Alts>(v) || ...);
67}

Referenced by Botan::TLS::Channel_Impl_13::from_peer().

◆ host_wildcard_match()

BOTAN_TEST_API bool Botan::host_wildcard_match ( std::string_view wildcard,
std::string_view host )

Check if the given hostname is a match for the specified wildcard

Definition at line 252 of file parsing.cpp.

252 {
253 const std::string issued = tolower_string(issued_);
254 const std::string host = tolower_string(host_);
255
256 if(host.empty() || issued.empty()) {
257 return false;
258 }
259
260 /*
261 If there are embedded nulls in your issued name
262 Well I feel bad for you son
263 */
264 if(std::count(issued.begin(), issued.end(), char(0)) > 0) {
265 return false;
266 }
267
268 // If more than one wildcard, then issued name is invalid
269 const size_t stars = std::count(issued.begin(), issued.end(), '*');
270 if(stars > 1) {
271 return false;
272 }
273
274 // '*' is not a valid character in DNS names so should not appear on the host side
275 if(std::count(host.begin(), host.end(), '*') != 0) {
276 return false;
277 }
278
279 // Similarly a DNS name can't end in .
280 if(host[host.size() - 1] == '.') {
281 return false;
282 }
283
284 // And a host can't have an empty name component, so reject that
285 if(host.find("..") != std::string::npos) {
286 return false;
287 }
288
289 // Exact match: accept
290 if(issued == host) {
291 return true;
292 }
293
294 /*
295 Otherwise it might be a wildcard
296
297 If the issued size is strictly longer than the hostname size it
298 couldn't possibly be a match, even if the issued value is a
299 wildcard. The only exception is when the wildcard ends up empty
300 (eg www.example.com matches www*.example.com)
301 */
302 if(issued.size() > host.size() + 1) {
303 return false;
304 }
305
306 // If no * at all then not a wildcard, and so not a match
307 if(stars != 1) {
308 return false;
309 }
310
311 /*
312 Now walk through the issued string, making sure every character
313 matches. When we come to the (singular) '*', jump forward in the
314 hostname by the corresponding amount. We know exactly how much
315 space the wildcard takes because it must be exactly `len(host) -
316 len(issued) + 1 chars`.
317
318 We also verify that the '*' comes in the leftmost component, and
319 doesn't skip over any '.' in the hostname.
320 */
321 size_t dots_seen = 0;
322 size_t host_idx = 0;
323
324 for(size_t i = 0; i != issued.size(); ++i) {
325 if(issued[i] == '.') {
326 dots_seen += 1;
327 }
328
329 if(issued[i] == '*') {
330 // Fail: wildcard can only come in leftmost component
331 if(dots_seen > 0) {
332 return false;
333 }
334
335 /*
336 Since there is only one * we know the tail of the issued and
337 hostname must be an exact match. In this case advance host_idx
338 to match.
339 */
340 const size_t advance = (host.size() - issued.size() + 1);
341
342 if(host_idx + advance > host.size()) { // shouldn't happen
343 return false;
344 }
345
346 // Can't be any intervening .s that we would have skipped
347 if(std::count(host.begin() + host_idx, host.begin() + host_idx + advance, '.') != 0) {
348 return false;
349 }
350
351 host_idx += advance;
352 } else {
353 if(issued[i] != host[host_idx]) {
354 return false;
355 }
356
357 host_idx += 1;
358 }
359 }
360
361 // Wildcard issued name must have at least 3 components
362 if(dots_seen < 2) {
363 return false;
364 }
365
366 return true;
367}
Botan::tolower_string
std::string tolower_string(std::string_view str)
Definition parsing.cpp:241

References tolower_string().

Referenced by Botan::X509_Certificate::matches_dns_name().

◆ ht_sign()

void Botan::ht_sign ( StrongSpan< SphincsHypertreeSignature > out_sig,
const SphincsTreeNode & message_to_sign,
const SphincsSecretSeed & secret_seed,
XmssTreeIndexInLayer tree_index_in_layer,
TreeNodeIndex idx_leaf,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 12: ht_sign.

Creates a SLH-DSA XMSS hypertree signature of message_to_sign. The signature is written into the buffer defined by out_sig. tree_index_in_layer and idx_leaf define which XMSS tree of the hypertree and which leaf of this XMSS tree is used for signing.

Definition at line 22 of file sp_hypertree.cpp.

28 {
29 BOTAN_ASSERT_NOMSG(out_sig.size() == params.ht_signature_bytes());
30 BufferStuffer ht_signature(out_sig);
31
32 Sphincs_Address wots_addr(Sphincs_Address_Type::WotsHash);
33 wots_addr.set_tree_address(tree_index_in_layer).set_keypair_address(idx_leaf);
34
35 Sphincs_Address tree_addr(Sphincs_Address_Type::HashTree);
36
37 SphincsTreeNode xmss_root;
38 for(HypertreeLayerIndex layer_idx(0); layer_idx < params.d(); layer_idx++) {
39 // The first XMSS tree signs the message, the others their underlying XMSS tree root
40 const SphincsTreeNode& node_to_xmss_sign = (layer_idx == 0U) ? message_to_sign : xmss_root;
41
42 tree_addr.set_layer_address(layer_idx).set_tree_address(tree_index_in_layer);
43 wots_addr.copy_subtree_from(tree_addr).set_keypair_address(idx_leaf);
44
45 xmss_root = xmss_sign_and_pkgen(ht_signature.next<SphincsXmssSignature>(params.xmss_signature_bytes()),
46 node_to_xmss_sign,
47 secret_seed,
48 wots_addr,
49 tree_addr,
50 idx_leaf,
51 params,
52 hashes);
53
54 // Update the indices for the next layer.
55 idx_leaf = TreeNodeIndex(tree_index_in_layer.get() & ((1 << params.xmss_tree_height()) - 1));
56 tree_index_in_layer = tree_index_in_layer >> params.xmss_tree_height();
57 }
58
59 BOTAN_ASSERT_NOMSG(ht_signature.full());
60}
Botan::Sphincs_Address
Definition sp_address.h:32
Botan::Sphincs_Parameters::xmss_tree_height
uint32_t xmss_tree_height() const
Definition sp_parameters.h:135
Botan::Sphincs_Parameters::ht_signature_bytes
uint32_t ht_signature_bytes() const
Definition sp_parameters.h:145
Botan::Sphincs_Parameters::xmss_signature_bytes
uint32_t xmss_signature_bytes() const
Definition sp_parameters.h:140
Botan::Sphincs_Parameters::d
uint32_t d() const
Definition sp_parameters.h:106
Botan::SphincsXmssSignature
Strong< std::vector< uint8_t >, struct SphincsXmssSignature_ > SphincsXmssSignature
Definition sp_types.h:65
Botan::xmss_sign_and_pkgen
SphincsTreeNode xmss_sign_and_pkgen(StrongSpan< SphincsXmssSignature > out_sig, const SphincsTreeNode &message, const SphincsSecretSeed &secret_seed, Sphincs_Address &wots_addr, Sphincs_Address &tree_addr, std::optional< TreeNodeIndex > idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
FIPS 205, Algorithm 10: xmss_sign.
Definition sp_xmss.cpp:19
Botan::HypertreeLayerIndex
Strong< uint32_t, struct HypertreeLayerIndex_ > HypertreeLayerIndex
Index of a layer in the XMSS hyper-tree.
Definition sp_types.h:86

References BOTAN_ASSERT_NOMSG, Botan::Sphincs_Address::copy_subtree_from(), Botan::Sphincs_Parameters::d(), Botan::BufferStuffer::full(), Botan::detail::Strong_Base< T >::get(), HashTree, Botan::Sphincs_Parameters::ht_signature_bytes(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Address::set_tree_address(), Botan::StrongSpan< T >::size(), WotsHash, xmss_sign_and_pkgen(), Botan::Sphincs_Parameters::xmss_signature_bytes(), and Botan::Sphincs_Parameters::xmss_tree_height().

◆ ht_verify()

bool Botan::ht_verify ( const SphincsTreeNode & signed_msg,
StrongSpan< const SphincsHypertreeSignature > ht_sig,
const SphincsTreeNode & pk_root,
XmssTreeIndexInLayer tree_index_in_layer,
TreeNodeIndex idx_leaf,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 13: ht_verify.

Given a message signed_msg the SLH-DSA XMSS hypertree is reconstructed using a hypertree signature ht_sig. tree_index_in_layer and idx_leaf define which XMSS tree of the hypertree and which leaf of this XMSS tree was used for signing.

Returns
true iff the top-most reconstructed root equals pk_root

Definition at line 62 of file sp_hypertree.cpp.

68 {
69 BOTAN_ASSERT_NOMSG(ht_sig.size() == params.ht_signature_bytes());
70 BufferSlicer sig_s(ht_sig);
71
72 Sphincs_Address wots_addr(Sphincs_Address_Type::WotsHash);
73 Sphincs_Address tree_addr(Sphincs_Address_Type::HashTree);
74 Sphincs_Address wots_pk_addr(Sphincs_Address_Type::WotsPublicKeyCompression);
75
76 SphincsTreeNode reconstructed_root(params.n());
77
78 // Each iteration reconstructs the root of one XMSS tree of the hypertree
79 for(HypertreeLayerIndex layer_idx(0); layer_idx < params.d(); layer_idx++) {
80 // The first XMSS tree signs the message, the others their underlying XMSS tree root
81 const SphincsTreeNode& current_root = (layer_idx == 0U) ? signed_msg : reconstructed_root;
82
83 tree_addr.set_layer_address(layer_idx);
84 tree_addr.set_tree_address(tree_index_in_layer);
85
86 wots_addr.copy_subtree_from(tree_addr);
87 wots_addr.set_keypair_address(idx_leaf);
88
89 wots_pk_addr.copy_keypair_from(wots_addr);
90
91 const auto wots_pk = wots_public_key_from_signature(
92 current_root, sig_s.take<WotsSignature>(params.wots_bytes()), wots_addr, params, hashes);
93
94 // Compute the leaf node using the WOTS public key.
95 const auto leaf = hashes.T<SphincsTreeNode>(wots_pk_addr, wots_pk);
96
97 // Compute the root node of this subtree.
98 compute_root(StrongSpan<SphincsTreeNode>(reconstructed_root),
99 params,
100 hashes,
101 leaf,
102 idx_leaf,
103 0,
104 sig_s.take<SphincsAuthenticationPath>(params.xmss_tree_height() * params.n()),
105 params.xmss_tree_height(),
106 tree_addr);
107
108 // Update the indices for the next layer.
109 idx_leaf = TreeNodeIndex(tree_index_in_layer.get() & ((1 << params.xmss_tree_height()) - 1));
110 tree_index_in_layer = tree_index_in_layer >> params.xmss_tree_height();
111 }
112
113 BOTAN_ASSERT_NOMSG(sig_s.empty());
114
115 // Check if the root node equals the root node in the public key.
116 return reconstructed_root == pk_root;
117}
Botan::Sphincs_Parameters::wots_bytes
uint32_t wots_bytes() const
Definition sp_parameters.h:170
Botan::wots_public_key_from_signature
WotsPublicKey wots_public_key_from_signature(const SphincsTreeNode &hashed_message, StrongSpan< const WotsSignature > signature, Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
FIPS 205, Algorithm 8: wots_pkFromSig.
Definition sp_wots.cpp:104
Botan::WotsSignature
Strong< secure_vector< uint8_t >, struct WotsSignature_ > WotsSignature
Definition sp_types.h:80

References BOTAN_ASSERT_NOMSG, compute_root(), Botan::Sphincs_Address::copy_keypair_from(), Botan::Sphincs_Address::copy_subtree_from(), Botan::Sphincs_Parameters::d(), Botan::BufferSlicer::empty(), Botan::detail::Strong_Base< T >::get(), HashTree, Botan::Sphincs_Parameters::ht_signature_bytes(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Address::set_tree_address(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), Botan::BufferSlicer::take(), Botan::Sphincs_Parameters::wots_bytes(), wots_public_key_from_signature(), WotsHash, WotsPublicKeyCompression, and Botan::Sphincs_Parameters::xmss_tree_height().

◆ ieee1363_hash_id()

uint8_t Botan::ieee1363_hash_id ( std::string_view hash_name)

Return the IEEE 1363 hash identifier

Parameters
hash_namethe name of the hash function
Returns
uint8_t code identifying the hash, or 0 if not known

Definition at line 144 of file hash_id.cpp.

144 {
145 if(name == "SHA-1") {
146 return 0x33;
147 }
148
149 if(name == "SHA-224") {
150 return 0x38;
151 }
152 if(name == "SHA-256") {
153 return 0x34;
154 }
155 if(name == "SHA-384") {
156 return 0x36;
157 }
158 if(name == "SHA-512") {
159 return 0x35;
160 }
161
162 if(name == "RIPEMD-160") {
163 return 0x31;
164 }
165
166 if(name == "Whirlpool") {
167 return 0x37;
168 }
169
170 return 0;
171}

Referenced by Botan::X931_SignaturePadding::X931_SignaturePadding().

◆ if_work_factor()

size_t BOTAN_TEST_API Botan::if_work_factor ( size_t n_bits)

Estimate work factor for integer factorization

Parameters
n_bitssize of modulus in bits
Returns
estimated security level for this modulus

Definition at line 37 of file workfactor.cpp.

37 {
38 if(bits < 512) {
39 return 0;
40 }
41
42 // RFC 3766 estimates k at .02 and o(1) to be effectively zero for sizes of interest
43
44 const double log2_k = -5.6438; // log2(.02)
45 return nfs_workfactor(bits, log2_k);
46}

Referenced by dl_work_factor(), Botan::RSA_PublicKey::estimated_strength(), and Botan::TPM_PrivateKey::estimated_strength().

◆ ignore_params()

template<typename... T>
void Botan::ignore_params ( const T &... args)
constexpr

Mark variable as unused.

Takes any number of arguments and marks all as unused, for instance BOTAN_UNUSED(a); or BOTAN_UNUSED(x, y, z);

Definition at line 142 of file assert.h.

142{}

References ignore_params().

Referenced by ignore_params().

◆ index_of_first_set_byte()

template<std::unsigned_integral T>
size_t Botan::index_of_first_set_byte ( T v)
constexpr

Return the index of the first byte with the high bit set

Definition at line 130 of file int_utils.h.

130 {
131 // The constant 0x010101... as a T
132 constexpr T lo1 = (static_cast<T>(-1) / 255);
133 // The constant 0x808080... as a T
134 constexpr T hi1 = lo1 << 7;
135 // How many bits to shift in order to get the top byte
136 constexpr size_t bits = (sizeof(T) * 8) - 8;
137
138 return static_cast<size_t>((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1);
139}

◆ initialize_allocator()

void BOTAN_UNSTABLE_API Botan::initialize_allocator ( )

Ensure the allocator is initialized

Definition at line 66 of file allocator.cpp.

66 {
67#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
68 mlock_allocator::instance();
69#endif
70}

References Botan::mlock_allocator::instance().

Referenced by Botan::Allocator_Initializer::Allocator_Initializer().

◆ intersects()

bool Botan::intersects ( ASN1_Class x,
ASN1_Class y )
inline

Definition at line 70 of file asn1_obj.h.

70 {
71 return (static_cast<uint32_t>(x) & static_cast<uint32_t>(y)) != 0;
72}

◆ inverse_mod()

BigInt Botan::inverse_mod ( const BigInt & x,
const BigInt & modulus )

Modular inversion. This algorithm is const time with respect to x, as long as x is less than modulus. It also avoids leaking information about the modulus, except that it does leak which of 3 categories the modulus is in: an odd integer, a power of 2, or some other even number, and if the modulus is even, leaks the power of 2 which divides the modulus.

Parameters
xa positive integer
modulusa positive integer
Returns
y st (x*y) % modulus == 1 or 0 if no such value

Definition at line 371 of file mod_inv.cpp.

371 {
372 BOTAN_ARG_CHECK(!mod.is_zero(), "modulus cannot be zero");
373 BOTAN_ARG_CHECK(!mod.is_negative(), "modulus cannot be negative");
374 BOTAN_ARG_CHECK(!n.is_negative(), "value cannot be negative");
375
376 if(n.is_zero() || (n.is_even() && mod.is_even())) {
377 return BigInt::zero();
378 }
379
380 if(n >= mod) {
381 return inverse_mod(ct_modulo(n, mod), mod);
382 }
383
384 return inverse_mod_general(n, mod).value_or(BigInt::zero());
385}
Botan::ct_modulo
BigInt ct_modulo(const BigInt &x, const BigInt &y)
Definition divide.cpp:192
Botan::inverse_mod
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition mod_inv.cpp:371

References BOTAN_ARG_CHECK, ct_modulo(), inverse_mod(), inverse_mod_general(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), and Botan::BigInt::zero().

Referenced by inverse_mod().

◆ inverse_mod_general()

std::optional< BigInt > BOTAN_TEST_API Botan::inverse_mod_general ( const BigInt & x,
const BigInt & m )

Compute the inverse of x modulo some integer m

Returns nullopt if no such integer exists eg if gcd(x, m) > 1

This algorithm is const time with respect to x, aside from its length. It also avoids leaking information about the modulus m, except that it does leak which of 3 categories the modulus is in:

  • An odd integer
  • A power of 2
  • Some even number not a power of 2

And if the modulus is even, it leaks the power of 2 which divides the modulus.

Parameters
xa positive integer less than m
ma positive integer

Throws Invalid_Argument if x or m are negative

Definition at line 179 of file mod_inv.cpp.

179 {
180 BOTAN_ARG_CHECK(x > 0, "x must be greater than zero");
181 BOTAN_ARG_CHECK(mod > 0, "mod must be greater than zero");
182 BOTAN_ARG_CHECK(x < mod, "x must be less than m");
183
184 // Easy case where gcd > 1 so no inverse exists
185 if(x.is_even() && mod.is_even()) {
186 return std::nullopt;
187 }
188
189 if(mod.is_odd()) {
190 BigInt z = inverse_mod_odd_modulus(x, mod);
191 if(z.is_zero()) {
192 return std::nullopt;
193 } else {
194 return z;
195 }
196 }
197
198 // If x is even and mod is even we already returned 0
199 // If x is even and mod is odd we jumped directly to odd-modulus algo
200 BOTAN_ASSERT_NOMSG(x.is_odd());
201
202 const size_t mod_lz = low_zero_bits(mod);
203 BOTAN_ASSERT_NOMSG(mod_lz > 0);
204 const size_t mod_bits = mod.bits();
205 BOTAN_ASSERT_NOMSG(mod_bits > mod_lz);
206
207 if(mod_lz == mod_bits - 1) {
208 // In this case we are performing an inversion modulo 2^k
209 auto z = inverse_mod_pow2(x, mod_lz);
210 if(z.is_zero()) {
211 return std::nullopt;
212 } else {
213 return z;
214 }
215 }
216
217 if(mod_lz == 1) {
218 /*
219 Inversion modulo 2*o is an easier special case of CRT
220
221 This is exactly the main CRT flow below but taking advantage of
222 the fact that any odd number ^-1 modulo 2 is 1. As a result both
223 inv_2k and c can be taken to be 1, m2k is 2, and h is always
224 either 0 or 1, and its value depends only on the low bit of inv_o.
225
226 This is worth special casing because we generate RSA primes such
227 that phi(n) is of this form. However this only works for keys
228 that we generated in this way; pre-existing keys will typically
229 fall back to the general algorithm below.
230 */
231
232 const BigInt o = mod >> 1;
233 const BigInt inv_o = inverse_mod_odd_modulus(ct_modulo(x, o), o);
234
235 // No modular inverse in this case:
236 if(inv_o == 0) {
237 return std::nullopt;
238 }
239
240 BigInt h = inv_o;
241 h.ct_cond_add(!inv_o.get_bit(0), o);
242 return h;
243 }
244
245 /*
246 * In this case we are performing an inversion modulo 2^k*o for
247 * some k >= 2 and some odd (not necessarily prime) integer.
248 * Compute the inversions modulo 2^k and modulo o, then combine them
249 * using CRT, which is possible because 2^k and o are relatively prime.
250 */
251
252 const BigInt o = mod >> mod_lz;
253 const BigInt inv_o = inverse_mod_odd_modulus(ct_modulo(x, o), o);
254 const BigInt inv_2k = inverse_mod_pow2(x, mod_lz);
255
256 // No modular inverse in this case:
257 if(inv_o == 0 || inv_2k == 0) {
258 return std::nullopt;
259 }
260
261 const BigInt m2k = BigInt::power_of_2(mod_lz);
262 // Compute the CRT parameter
263 const BigInt c = inverse_mod_pow2(o, mod_lz);
264
265 // This should never happen; o is odd so gcd is 1 and inverse mod 2^k exists
266 BOTAN_ASSERT_NOMSG(!c.is_zero());
267
268 // Compute h = c*(inv_2k-inv_o) mod 2^k
269 BigInt h = c * (inv_2k - inv_o);
270 const bool h_neg = h.is_negative();
271 h.set_sign(BigInt::Positive);
272 h.mask_bits(mod_lz);
273 const bool h_nonzero = h.is_nonzero();
274 h.ct_cond_assign(h_nonzero && h_neg, m2k - h);
275
276 // Return result inv_o + h * o
277 h *= o;
278 h += inv_o;
279 return h;
280}
Botan::BigInt::ct_cond_add
void ct_cond_add(bool predicate, const BigInt &value)
Definition bigint.cpp:449
Botan::BigInt::is_odd
bool is_odd() const
Definition bigint.h:461
Botan::BigInt::power_of_2
static BigInt power_of_2(size_t n)
Definition bigint.h:836
Botan::low_zero_bits
size_t low_zero_bits(const BigInt &n)
Definition numthry.cpp:194

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::BigInt::ct_cond_add(), Botan::BigInt::ct_cond_assign(), ct_modulo(), Botan::BigInt::get_bit(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_nonzero(), Botan::BigInt::is_odd(), Botan::BigInt::is_zero(), low_zero_bits(), Botan::BigInt::mask_bits(), Botan::BigInt::Positive, Botan::BigInt::power_of_2(), and Botan::BigInt::set_sign().

Referenced by botan_mp_mod_inverse(), compute_rsa_secret_exponent(), and inverse_mod().

◆ inverse_mod_public_prime()

BigInt BOTAN_TEST_API Botan::inverse_mod_public_prime ( const BigInt & x,
const BigInt & p )

Compute the inverse of x modulo a public prime p

This algorithm is constant time with respect to x. The prime p is assumed to be public.

Parameters
xa positive integer less than p
pan odd prime
Returns
y such that (x*y) % p == 1

This always returns a result since any integer in [1,p) has an inverse modulo a prime p.

This function assumes as a precondition that p truly is prime; the results may not be correct if this does not hold.

Throws Invalid_Argument if x is less than or equal to zero, or if p is even or less than 3.

Definition at line 293 of file mod_inv.cpp.

293 {
294 return inverse_mod_secret_prime(x, p);
295}
Botan::inverse_mod_secret_prime
BigInt inverse_mod_secret_prime(const BigInt &x, const BigInt &p)
Definition mod_inv.cpp:282

References inverse_mod_secret_prime().

Referenced by Botan::DL_Group::inverse_mod_p(), Botan::DL_Group::inverse_mod_q(), Botan::EC_Scalar_Data_BN::invert(), and Botan::EC_Scalar_Data_BN::invert_vartime().

◆ inverse_mod_rsa_public_modulus()

BigInt Botan::inverse_mod_rsa_public_modulus ( const BigInt & x,
const BigInt & n )

Compute the inverse of x modulo a public RSA modulus n

This algorithm is constant time with respect to x. The RSA modulus is assumed to be public.

Parameters
xa positive integer less than n
na RSA public modulus
Returns
y such that (x*y) % n == 1

This always returns a result since any integer in [1,n) has an inverse modulo a RSA public modulus n, unless you have happened to guess one of the factors at random. In the unlikely event of this occurring, Internal_Error will be thrown.

Definition at line 297 of file mod_inv.cpp.

297 {
298 BOTAN_ARG_CHECK(n.is_positive() && n.is_odd(), "RSA public modulus must be odd and positive");
299 BOTAN_ARG_CHECK(x.is_positive() && x < n, "Input must be positive and less than RSA modulus");
300 BigInt z = inverse_mod_odd_modulus(x, n);
301 BOTAN_ASSERT(!z.is_zero(), "Accidentally factored the public modulus"); // whoops
302 return z;
303}

References BOTAN_ARG_CHECK, BOTAN_ASSERT, Botan::BigInt::is_odd(), Botan::BigInt::is_positive(), and Botan::BigInt::is_zero().

◆ inverse_mod_secret_prime()

BigInt BOTAN_TEST_API Botan::inverse_mod_secret_prime ( const BigInt & x,
const BigInt & p )

Compute the inverse of x modulo a secret prime p

This algorithm is constant time with respect to x and p, aside from leaking the length of p. (In particular it should not leak the length of x, if x is shorter)

Parameters
xa positive integer less than p
pan odd prime
Returns
y such that (x*y) % p == 1

This always returns a result since any integer in [1,p) has an inverse modulo a prime p.

This function assumes as a precondition that p truly is prime; the results may not be correct if this does not hold.

Throws Invalid_Argument if x is less than or equal to zero, or if p is even or less than 3.

Definition at line 282 of file mod_inv.cpp.

282 {
283 BOTAN_ARG_CHECK(x.is_positive() && p.is_positive(), "Parameters must be positive");
284 BOTAN_ARG_CHECK(x < p, "x must be less than p");
285 BOTAN_ARG_CHECK(p.is_odd() && p > 1, "Primes are odd integers greater than 1");
286
287 // TODO possibly use FLT, or the algorithm presented for this case in
288 // Handbook of Elliptic and Hyperelliptic Curve Cryptography
289
290 return inverse_mod_odd_modulus(x, p);
291}

References BOTAN_ARG_CHECK, Botan::BigInt::is_odd(), and Botan::BigInt::is_positive().

Referenced by Botan::RSA_PrivateKey::check_key(), inverse_mod_public_prime(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

◆ invert_field_element()

template<typename C>
auto Botan::invert_field_element ( const typename C::FieldElement & fe)
inlineconstexpr

Field inversion

Uses the specialized fe_invert2 if available, or otherwise the standard (FLT-based) field inversion.

Definition at line 35 of file pcurves_algos.h.

35 {
36 if constexpr(curve_supports_fe_invert2<C>) {
37 return C::fe_invert2(fe) * fe;
38 } else {
39 return fe.invert();
40 }
41}
Botan::curve_supports_fe_invert2
Definition pcurves_algos.h:24

Referenced by map_to_curve_sswu(), SSWU_C2(), to_affine(), to_affine_batch(), and to_affine_x().

◆ ipv4_to_string()

std::string BOTAN_TEST_API Botan::ipv4_to_string ( uint32_t ip_addr)

Convert an IPv4 address to a string

Parameters
ip_addrthe IPv4 address to convert
Returns
string representation of the IPv4 address

Definition at line 225 of file parsing.cpp.

225 {
226 uint8_t bits[4];
227 store_be(ip, bits);
228
229 std::string str;
230
231 for(size_t i = 0; i != 4; ++i) {
232 if(i > 0) {
233 str += ".";
234 }
235 str += std::to_string(bits[i]);
236 }
237
238 return str;
239}

References store_be().

Referenced by Botan::AlternativeName::contents(), Botan::AlternativeName::get_attribute(), and Botan::GeneralName::name().

◆ is_bailie_psw_probable_prime()

bool BOTAN_TEST_API Botan::is_bailie_psw_probable_prime ( const BigInt & n,
const Barrett_Reduction & mod_n )

Perform Bailie-PSW primality test

This is a combination of Miller-Rabin with base 2 and a Lucas test. No known composite integer passes both tests, though it is conjectured that infinitely many composite counterexamples exist.

Parameters
nthe positive integer to test
mod_na pre-created Barrett_Reduction for n
Returns
true if n seems probably prime, false if n is composite

Definition at line 98 of file primality.cpp.

98 {
99 if(n == 2) {
100 return true;
101 } else if(n <= 1 || n.is_even()) {
102 return false;
103 }
104
105 const Montgomery_Params monty_n(n, mod_n);
106 const auto base = BigInt::from_word(2);
107 return passes_miller_rabin_test(n, mod_n, monty_n, base) && is_lucas_probable_prime(n, mod_n);
108}
Botan::BigInt::from_word
static BigInt from_word(word n)
Definition bigint.cpp:35
Botan::Montgomery_Params
Definition monty.h:23
Botan::is_lucas_probable_prime
bool is_lucas_probable_prime(const BigInt &C, const Barrett_Reduction &mod_C)
Definition primality.cpp:18
Botan::passes_miller_rabin_test
bool passes_miller_rabin_test(const BigInt &n, const Barrett_Reduction &mod_n, const Montgomery_Params &monty_n, const BigInt &a)
Definition primality.cpp:110

References Botan::BigInt::from_word(), Botan::BigInt::is_even(), is_lucas_probable_prime(), and passes_miller_rabin_test().

Referenced by Botan::EC_Group::EC_Group(), and is_prime().

◆ is_generalizable_to() [1/2]

template<typename GeneralVariantT, typename SpecialT>
bool Botan::is_generalizable_to ( const SpecialT & )
constexprnoexcept

Definition at line 70 of file stl_util.h.

70 {
71 return std::is_constructible_v<GeneralVariantT, SpecialT>;
72}

Referenced by generalize_to(), and Botan::TLS::Handshake_State_13< Connection_Side::Client, Client_Handshake_13_Message, Server_Handshake_13_Message, Server_Post_Handshake_13_Message >::sending().

◆ is_generalizable_to() [2/2]

template<typename GeneralVariantT, typename... SpecialTs>
bool Botan::is_generalizable_to ( const std::variant< SpecialTs... > & )
constexprnoexcept

Definition at line 75 of file stl_util.h.

75 {
76 return (std::is_constructible_v<GeneralVariantT, SpecialTs> && ...);
77}

◆ is_lucas_probable_prime()

bool BOTAN_TEST_API Botan::is_lucas_probable_prime ( const BigInt & n,
const Barrett_Reduction & mod_n )

Perform Lucas primality test

See also
FIPS 186-4 C.3.3
Warning
it is possible to construct composite integers which pass this test alone.
Parameters
nthe positive integer to test
mod_na pre-created Barrett_Reduction for n
Returns
true if n seems probably prime, false if n is composite

Definition at line 18 of file primality.cpp.

18 {
19 BOTAN_ARG_CHECK(C.is_positive(), "Argument should be a positive integer");
20
21 if(C == 2 || C == 3 || C == 5 || C == 7 || C == 11 || C == 13) {
22 return true;
23 }
24
25 if(C <= 1 || C.is_even()) {
26 return false;
27 }
28
29 BigInt D = BigInt::from_word(5);
30
31 for(;;) {
32 const int32_t j = jacobi(D, C);
33 if(j == 0) {
34 return false;
35 }
36
37 if(j == -1) {
38 break;
39 }
40
41 // Check 5, -7, 9, -11, 13, -15, 17, ...
42 if(D.is_negative()) {
43 D.flip_sign();
44 D += 2;
45 } else {
46 D += 2;
47 D.flip_sign();
48 }
49
50 if(D == 17 && is_perfect_square(C).is_nonzero()) {
51 return false;
52 }
53 }
54
55 if(D.is_negative()) {
56 D += C;
57 }
58
59 const BigInt K = C + 1;
60 const size_t K_bits = K.bits() - 1;
61
62 BigInt U = BigInt::one();
63 BigInt V = BigInt::one();
64
65 BigInt Ut;
66 BigInt Vt;
67 BigInt U2;
68 BigInt V2;
69
70 for(size_t i = 0; i != K_bits; ++i) {
71 const bool k_bit = K.get_bit(K_bits - 1 - i);
72
73 Ut = mod_C.multiply(U, V);
74
75 Vt = mod_C.reduce(mod_C.square(V) + mod_C.multiply(D, mod_C.square(U)));
76 Vt.ct_cond_add(Vt.is_odd(), C);
77 Vt >>= 1;
78 Vt = mod_C.reduce(Vt);
79
80 U = Ut;
81 V = Vt;
82
83 U2 = mod_C.reduce(Ut + Vt);
84 U2.ct_cond_add(U2.is_odd(), C);
85 U2 >>= 1;
86
87 V2 = mod_C.reduce(Vt + mod_C.multiply(Ut, D));
88 V2.ct_cond_add(V2.is_odd(), C);
89 V2 >>= 1;
90
91 U.ct_cond_assign(k_bit, U2);
92 V.ct_cond_assign(k_bit, V2);
93 }
94
95 return (U == 0);
96}
Botan::BigInt::one
static BigInt one()
Definition bigint.h:55
Botan::jacobi
int32_t jacobi(BigInt a, BigInt n)
Definition numthry.cpp:119
Botan::is_perfect_square
BigInt is_perfect_square(const BigInt &C)
Definition numthry.cpp:347

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, Botan::BigInt::ct_cond_add(), Botan::BigInt::ct_cond_assign(), Botan::BigInt::flip_sign(), Botan::BigInt::from_word(), Botan::BigInt::get_bit(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_odd(), is_perfect_square(), Botan::BigInt::is_positive(), jacobi(), Botan::Barrett_Reduction::multiply(), Botan::BigInt::one(), Botan::Barrett_Reduction::reduce(), and Botan::Barrett_Reduction::square().

Referenced by is_bailie_psw_probable_prime(), is_prime(), and random_prime().

◆ is_miller_rabin_probable_prime()

bool BOTAN_TEST_API Botan::is_miller_rabin_probable_prime ( const BigInt & n,
const Barrett_Reduction & mod_n,
RandomNumberGenerator & rng,
size_t t )

Perform t iterations of a Miller-Rabin primality test with random bases

Parameters
nthe positive integer to test
mod_na pre-created Barrett_Reduction for n
rnga random number generator
tnumber of tests to perform
Returns
result of primality test

Definition at line 160 of file primality.cpp.

163 {
164 if(n < 3 || n.is_even()) {
165 return false;
166 }
167
168 const Montgomery_Params monty_n(n, mod_n);
169
170 for(size_t i = 0; i != test_iterations; ++i) {
171 const BigInt a = BigInt::random_integer(rng, BigInt::from_word(2), n);
172
173 if(!passes_miller_rabin_test(n, mod_n, monty_n, a)) {
174 return false;
175 }
176 }
177
178 // Failed to find a counterexample
179 return true;
180}
Botan::BigInt::random_integer
static BigInt random_integer(RandomNumberGenerator &rng, const BigInt &min, const BigInt &max)
Definition big_rand.cpp:44

References Botan::BigInt::from_word(), Botan::BigInt::is_even(), passes_miller_rabin_test(), and Botan::BigInt::random_integer().

Referenced by generate_rsa_prime(), is_prime(), and random_prime().

◆ is_passhash9_alg_supported()

bool Botan::is_passhash9_alg_supported ( uint8_t alg_id)

Check if the PRF used with PBKDF2 is supported

Parameters
alg_idalg_id used in generate_passhash9()

Definition at line 129 of file passhash9.cpp.

129 {
130 if(get_pbkdf_prf(alg_id)) {
131 return true;
132 }
133 return false;
134}

◆ is_perfect_square()

BigInt Botan::is_perfect_square ( const BigInt & x)

Test if the positive integer x is a perfect square ie if there exists some positive integer y st y*y == x See FIPS 186-4 sec C.4

Returns
0 if the integer is not a perfect square, otherwise returns the positive y st y*y == x

Definition at line 347 of file numthry.cpp.

347 {
348 if(C < 1) {
349 throw Invalid_Argument("is_perfect_square requires C >= 1");
350 }
351 if(C == 1) {
352 return BigInt::one();
353 }
354
355 const size_t n = C.bits();
356 const size_t m = (n + 1) / 2;
357 const BigInt B = C + BigInt::power_of_2(m);
358
359 BigInt X = BigInt::power_of_2(m) - 1;
360 BigInt X2 = (X * X);
361
362 for(;;) {
363 X = (X2 + C) / (2 * X);
364 X2 = (X * X);
365
366 if(X2 < B) {
367 break;
368 }
369 }
370
371 if(X2 == C) {
372 return X;
373 } else {
374 return BigInt::zero();
375 }
376}

References Botan::BigInt::bits(), Botan::BigInt::one(), Botan::BigInt::power_of_2(), and Botan::BigInt::zero().

Referenced by is_lucas_probable_prime().

◆ is_power_of_2()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr bool Botan::is_power_of_2 ( T arg)
constexpr

Power of 2 test. T should be an unsigned integer type

Parameters
argan integer value
Returns
true iff arg is 2^n for some n > 0

Definition at line 62 of file bit_ops.h.

62 {
63 return (arg != 0) && (arg != 1) && ((arg & static_cast<T>(arg - 1)) == 0);
64}

References BOTAN_FORCE_INLINE.

Referenced by operator%(), Botan::BigInt::operator%=(), Botan::BigInt::operator/=(), Botan::Scrypt::Scrypt(), and Botan::CTR_BE::seek().

◆ is_prime()

bool Botan::is_prime ( const BigInt & n,
RandomNumberGenerator & rng,
size_t prob = 64,
bool is_random = false )

Check for primality

This uses probabilistic algorithms - there is some non-zero (but very low) probability that this function will return true even if n is actually composite.

Parameters
na positive integer to test for primality
rnga random number generator
probchance of false positive is bounded by 1/2**prob
is_randomtrue if n was randomly chosen by us
Returns
true if all primality tests passed, otherwise false

Definition at line 381 of file numthry.cpp.

381 {
382 if(n == 2) {
383 return true;
384 }
385 if(n <= 1 || n.is_even()) {
386 return false;
387 }
388
389 const size_t n_bits = n.bits();
390
391 // Fast path testing for small numbers (<= 65521)
392 if(n_bits <= 16) {
393 const uint16_t num = static_cast<uint16_t>(n.word_at(0));
394
395 return std::binary_search(PRIMES, PRIMES + PRIME_TABLE_SIZE, num);
396 }
397
398 auto mod_n = Barrett_Reduction::for_secret_modulus(n);
399
400 if(rng.is_seeded()) {
401 const size_t t = miller_rabin_test_iterations(n_bits, prob, is_random);
402
403 if(!is_miller_rabin_probable_prime(n, mod_n, rng, t)) {
404 return false;
405 }
406
407 if(is_random) {
408 return true;
409 } else {
410 return is_lucas_probable_prime(n, mod_n);
411 }
412 } else {
413 return is_bailie_psw_probable_prime(n, mod_n);
414 }
415}
Botan::BigInt::word_at
word word_at(size_t n) const
Definition bigint.h:563
Botan::RandomNumberGenerator::is_seeded
virtual bool is_seeded() const =0
Botan::PRIMES
const uint16_t PRIMES[]
Definition primes.cpp:12
Botan::PRIME_TABLE_SIZE
const size_t PRIME_TABLE_SIZE
Definition numthry.h:175
Botan::is_bailie_psw_probable_prime
bool is_bailie_psw_probable_prime(const BigInt &n, const Barrett_Reduction &mod_n)
Definition primality.cpp:98

References Botan::BigInt::bits(), Botan::Barrett_Reduction::for_secret_modulus(), is_bailie_psw_probable_prime(), Botan::BigInt::is_even(), is_lucas_probable_prime(), is_miller_rabin_probable_prime(), Botan::RandomNumberGenerator::is_seeded(), miller_rabin_test_iterations(), PRIME_TABLE_SIZE, PRIMES, and Botan::BigInt::word_at().

Referenced by botan_mp_is_prime(), Botan::RSA_PrivateKey::check_key(), Botan::DL_Group::DL_Group(), generate_dsa_primes(), random_safe_prime(), Botan::DL_Group::verify_group(), and Botan::EC_Group::verify_group().

◆ is_sub_element_of()

std::optional< uint32_t > Botan::is_sub_element_of ( const OID & oid,
std::initializer_list< uint32_t > prefix )
inline

Definition at line 16 of file x509_utils.h.

16 {
17 const auto& c = oid.get_components();
18
19 if(c.size() != prefix.size() + 1) {
20 return {};
21 }
22
23 if(!std::equal(c.begin(), c.end() - 1, prefix.begin(), prefix.end())) {
24 return {};
25 }
26
27 return c[c.size() - 1];
28}
Botan::OID::get_components
const std::vector< uint32_t > & get_components() const
Definition asn1_obj.h:321

References Botan::OID::get_components().

Referenced by Botan::X509_DN::lookup_ub().

◆ jacobi()

int32_t Botan::jacobi ( BigInt a,
BigInt n )

Compute the Jacobi symbol. If n is prime, this is equivalent to the Legendre symbol.

See also
http://mathworld.wolfram.com/JacobiSymbol.html
Parameters
ais a non-negative integer
nis an odd integer > 1
Returns
(n / m)

Definition at line 119 of file numthry.cpp.

119 {
120 BOTAN_ARG_CHECK(n.is_odd() && n >= 3, "Argument n must be an odd integer >= 3");
121
122 if(a < 0 || a >= n) {
123 a %= n;
124 }
125
126 if(a == 0) {
127 return 0;
128 }
129 if(a == 1) {
130 return 1;
131 }
132
133 int32_t s = 1;
134
135 for(;;) {
136 const size_t e = low_zero_bits(a);
137 a >>= e;
138 const word n_mod_8 = n.word_at(0) % 8;
139 const word n_mod_4 = n_mod_8 % 4;
140
141 if(e % 2 == 1 && (n_mod_8 == 3 || n_mod_8 == 5)) {
142 s = -s;
143 }
144
145 if(n_mod_4 == 3 && a % 4 == 3) {
146 s = -s;
147 }
148
149 /*
150 * The HAC presentation of the algorithm uses recursion, which is not
151 * desirable or necessary.
152 *
153 * Instead we loop accumulating the product of the various jacobi()
154 * subcomputations into s, until we reach algorithm termination, which
155 * occurs in one of two ways.
156 *
157 * If a == 1 then the recursion has completed; we can return the value of s.
158 *
159 * Otherwise, after swapping and reducing, check for a == 0 [this value is
160 * called `n1` in HAC's presentation]. This would imply that jacobi(n1,a1)
161 * would have the value 0, due to Line 1 in HAC 2.149, in which case the
162 * entire product is zero, and we can immediately return that result.
163 */
164
165 if(a == 1) {
166 return s;
167 }
168
169 std::swap(a, n);
170
171 BOTAN_ASSERT_NOMSG(n.is_odd());
172
173 a %= n;
174
175 if(a == 0) {
176 return 0;
177 }
178 }
179}

References BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::BigInt::is_odd(), low_zero_bits(), and Botan::BigInt::word_at().

Referenced by Botan::DL_Group::DL_Group(), is_lucas_probable_prime(), and sqrt_modulo_prime().

◆ keccak_absorb_padded_strings_encoding()

template<absorbing_object T, typename... Ts>
requires (std::constructible_from<std::span<const uint8_t>, Ts> && ...)
size_t Botan::keccak_absorb_padded_strings_encoding ( T & sink,
size_t padding_mod,
Ts... byte_strings )

This is a combination of the functions encode_string() and bytepad() defined in NIST SP.800-185 Section 2.3. Additionally, the result is directly streamed into the provided XOF to avoid unnecessary memory allocation or a byte vector.

Parameters
sinkthe XOF or byte vector to absorb the byte_strings into
padding_modthe modulus value to create a padding for (NIST calls this 'w')
byte_stringsa variable-length list of byte strings to be encoded and absorbed into the given xof
Returns
the number of bytes absorbed into the xof

Definition at line 91 of file keccak_helpers.h.

91 {
92 BOTAN_ASSERT_NOMSG(padding_mod > 0);
93
94 // used as temporary storage for all integer encodings in this function
95 std::array<uint8_t, keccak_max_int_encoding_size()> int_encoding_buffer{};
96
97 // absorbs byte strings and counts the number of absorbed bytes
98 size_t bytes_absorbed = 0;
99 auto absorb = [&](std::span<const uint8_t> bytes) {
100 if constexpr(updatable_object<T>) {
101 sink.update(bytes);
102 } else if constexpr(appendable_object<T>) {
103 sink.insert(sink.end(), bytes.begin(), bytes.end());
104 }
105 bytes_absorbed += bytes.size();
106 };
107
108 // encodes a given string and absorbs it into the XOF straight away
109 auto encode_string_and_absorb = [&](std::span<const uint8_t> bytes) {
110 absorb(keccak_int_left_encode(int_encoding_buffer, bytes.size() * 8));
111 absorb(bytes);
112 };
113
114 // absorbs as many zero-bytes as requested into the XOF
115 auto absorb_padding = [&](size_t padding_bytes) {
116 for(size_t i = 0; i < padding_bytes; ++i) {
117 const uint8_t zero_byte = 0;
118 absorb({&zero_byte, 1});
119 }
120 };
121
122 // implementation of bytepad(encode_string(Ts) || ...) that absorbs the result
123 // staight into the given xof
124 absorb(keccak_int_left_encode(int_encoding_buffer, padding_mod));
125 (encode_string_and_absorb(byte_strings), ...);
126 absorb_padding(padding_mod - (bytes_absorbed % padding_mod));
127
128 return bytes_absorbed;
129}
Botan::appendable_object
Definition keccak_helpers.h:73
Botan::keccak_int_left_encode
std::span< const uint8_t > keccak_int_left_encode(std::span< uint8_t > out, size_t x)
Definition keccak_helpers.cpp:42
Botan::keccak_max_int_encoding_size
constexpr size_t keccak_max_int_encoding_size()
Definition keccak_helpers.h:65

References BOTAN_ASSERT_NOMSG, keccak_absorb_padded_strings_encoding(), keccak_int_left_encode(), and keccak_max_int_encoding_size().

Referenced by keccak_absorb_padded_strings_encoding().

◆ keccak_int_encoding_size()

BOTAN_TEST_API size_t Botan::keccak_int_encoding_size ( size_t x)
Returns
the required bytes for encodings of keccak_int_left_encode() or keccak_int_right_encode() given an integer x

Definition at line 55 of file keccak_helpers.cpp.

55 {
56 return int_encoding_size(x) + 1 /* the length tag */;
57}

◆ keccak_int_left_encode()

BOTAN_TEST_API std::span< const uint8_t > Botan::keccak_int_left_encode ( std::span< uint8_t > buffer,
size_t x )

Integer encoding defined in NIST SP.800-185 that can be unambiguously parsed from the beginning of the string.

This function does not allocate any memory and requires the caller to provide a sufficiently large buffer. For a given x, this will need exactly keccak_int_encoding_size() bytes. For an arbitrary x it will generate keccak_max_int_encoding_size() bytes at most.

Parameters
bufferbuffer to write the left-encoding of x to. It is assumed that the buffer will hold at least keccak_int_encoding_size() bytes.
xthe integer to be left-encoded
Returns
the byte span that represents the bytes written to buffer.

Definition at line 42 of file keccak_helpers.cpp.

42 {
43 BOTAN_ASSERT_NOMSG(!out.empty());
44 out[0] = encode(out.last(out.size() - 1), x);
45 return out.first(out[0] + 1 /* the length tag */);
46}

References BOTAN_ASSERT_NOMSG.

Referenced by keccak_absorb_padded_strings_encoding().

◆ keccak_int_right_encode()

BOTAN_TEST_API std::span< const uint8_t > Botan::keccak_int_right_encode ( std::span< uint8_t > out,
size_t x )

Integer encoding defined in NIST SP.800-185 that can be unambiguously parsed from the end of the string.

This function does not allocate any memory and requires the caller to provide a sufficiently large buffer. For a given x, this will need exactly keccak_int_encoding_size() bytes. For an arbitrary x it will generate keccak_max_int_encoding_size() bytes at most.

Parameters
outbuffer to write the right-encoding of x to. It is assumed that the buffer will hold at least keccak_int_encoding_size() bytes.
xthe integer to be right-encoded
Returns
the byte span that represents the bytes written to buffer.

Definition at line 48 of file keccak_helpers.cpp.

48 {
49 const auto bytes_needed = encode(out, x);
50 BOTAN_ASSERT_NOMSG(out.size() >= bytes_needed + size_t(1));
51 out[bytes_needed] = bytes_needed;
52 return out.first(bytes_needed + 1 /* the length tag */);
53}

References BOTAN_ASSERT_NOMSG.

◆ keccak_max_int_encoding_size()

size_t Botan::keccak_max_int_encoding_size ( )
constexpr
Returns
the maximum required bytes for encodings of keccak_int_left_encode() or keccak_int_right_encode()

Definition at line 65 of file keccak_helpers.h.

65 {
66 return sizeof(size_t) + 1 /* the length tag */;
67}

Referenced by keccak_absorb_padded_strings_encoding().

◆ Keccak_Permutation_round()

BOTAN_FORCE_INLINE void Botan::Keccak_Permutation_round ( uint64_t T[25],
const uint64_t A[25],
uint64_t RC )

Definition at line 15 of file keccak_perm_round.h.

15 {
16 const uint64_t C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
17 const uint64_t C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
18 const uint64_t C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
19 const uint64_t C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
20 const uint64_t C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
21
22 const uint64_t D0 = rotl<1>(C0) ^ C3;
23 const uint64_t D1 = rotl<1>(C1) ^ C4;
24 const uint64_t D2 = rotl<1>(C2) ^ C0;
25 const uint64_t D3 = rotl<1>(C3) ^ C1;
26 const uint64_t D4 = rotl<1>(C4) ^ C2;
27
28 const uint64_t B00 = A[0] ^ D1;
29 const uint64_t B01 = rotl<44>(A[6] ^ D2);
30 const uint64_t B02 = rotl<43>(A[12] ^ D3);
31 const uint64_t B03 = rotl<21>(A[18] ^ D4);
32 const uint64_t B04 = rotl<14>(A[24] ^ D0);
33 T[0] = B00 ^ (~B01 & B02) ^ RC;
34 T[1] = B01 ^ (~B02 & B03);
35 T[2] = B02 ^ (~B03 & B04);
36 T[3] = B03 ^ (~B04 & B00);
37 T[4] = B04 ^ (~B00 & B01);
38
39 const uint64_t B05 = rotl<28>(A[3] ^ D4);
40 const uint64_t B06 = rotl<20>(A[9] ^ D0);
41 const uint64_t B07 = rotl<3>(A[10] ^ D1);
42 const uint64_t B08 = rotl<45>(A[16] ^ D2);
43 const uint64_t B09 = rotl<61>(A[22] ^ D3);
44 T[5] = B05 ^ (~B06 & B07);
45 T[6] = B06 ^ (~B07 & B08);
46 T[7] = B07 ^ (~B08 & B09);
47 T[8] = B08 ^ (~B09 & B05);
48 T[9] = B09 ^ (~B05 & B06);
49
50 const uint64_t B10 = rotl<1>(A[1] ^ D2);
51 const uint64_t B11 = rotl<6>(A[7] ^ D3);
52 const uint64_t B12 = rotl<25>(A[13] ^ D4);
53 const uint64_t B13 = rotl<8>(A[19] ^ D0);
54 const uint64_t B14 = rotl<18>(A[20] ^ D1);
55 T[10] = B10 ^ (~B11 & B12);
56 T[11] = B11 ^ (~B12 & B13);
57 T[12] = B12 ^ (~B13 & B14);
58 T[13] = B13 ^ (~B14 & B10);
59 T[14] = B14 ^ (~B10 & B11);
60
61 const uint64_t B15 = rotl<27>(A[4] ^ D0);
62 const uint64_t B16 = rotl<36>(A[5] ^ D1);
63 const uint64_t B17 = rotl<10>(A[11] ^ D2);
64 const uint64_t B18 = rotl<15>(A[17] ^ D3);
65 const uint64_t B19 = rotl<56>(A[23] ^ D4);
66 T[15] = B15 ^ (~B16 & B17);
67 T[16] = B16 ^ (~B17 & B18);
68 T[17] = B17 ^ (~B18 & B19);
69 T[18] = B18 ^ (~B19 & B15);
70 T[19] = B19 ^ (~B15 & B16);
71
72 const uint64_t B20 = rotl<62>(A[2] ^ D3);
73 const uint64_t B21 = rotl<55>(A[8] ^ D4);
74 const uint64_t B22 = rotl<39>(A[14] ^ D0);
75 const uint64_t B23 = rotl<41>(A[15] ^ D1);
76 const uint64_t B24 = rotl<2>(A[21] ^ D2);
77 T[20] = B20 ^ (~B21 & B22);
78 T[21] = B21 ^ (~B22 & B23);
79 T[22] = B22 ^ (~B23 & B24);
80 T[23] = B23 ^ (~B24 & B20);
81 T[24] = B24 ^ (~B20 & B21);
82}
Botan::rotl
BOTAN_FORCE_INLINE constexpr T rotl(T input)
Definition rotate.h:23

References BOTAN_FORCE_INLINE, and rotl().

Referenced by Botan::Keccak_Permutation::permute().

◆ key_constraints_to_string()

std::string Botan::key_constraints_to_string ( Key_Constraints c)
inline

Definition at line 34 of file pkix_types.h.

34 {
35 return c.to_string();
36}
Botan::Key_Constraints::to_string
std::string to_string() const
Definition key_constraint.cpp:16

References key_constraints_to_string().

Referenced by key_constraints_to_string().

◆ latin1_to_utf8()

BOTAN_TEST_API std::string Botan::latin1_to_utf8 ( const uint8_t chars[],
size_t len )

Definition at line 89 of file charset.cpp.

89 {
90 std::string s;
91 for(size_t i = 0; i != len; ++i) {
92 const uint32_t c = static_cast<uint8_t>(chars[i]);
93 append_utf8_for(s, c);
94 }
95 return s;
96}

Referenced by Botan::ASN1_String::decode_from().

◆ lcm()

BigInt Botan::lcm ( const BigInt & x,
const BigInt & y )

Least common multiple

Parameters
xa positive integer
ya positive integer
Returns
z, smallest integer such that z % x == 0 and z % y == 0

Definition at line 296 of file numthry.cpp.

296 {
297 if(a == b) {
298 return a;
299 }
300
301 auto ab = a * b;
302 ab.set_sign(BigInt::Positive); // ignore the signs of a & b
303 const auto g = gcd(a, b);
304 return ct_divide(ab, g);
305}

References ct_divide(), gcd(), Botan::BigInt::Positive, and Botan::BigInt::set_sign().

Referenced by Botan::Cascade_Cipher::Cascade_Cipher(), Botan::RSA_PrivateKey::check_key(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

◆ lex_to_gray()

gf2m Botan::lex_to_gray ( gf2m lex)
inline

Definition at line 38 of file code_based_util.h.

38 {
39 return (lex >> 1) ^ lex;
40}

Referenced by syndrome_init().

◆ lmots_compute_pubkey_from_sig()

BOTAN_TEST_API LMOTS_K Botan::lmots_compute_pubkey_from_sig ( const LMOTS_Signature & sig,
const LMS_Message & msg,
const LMS_Identifier & identifier,
LMS_Tree_Node_Idx q )

Compute a public key candidate for an OTS-signature-message pair and the OTS instance parameters.

Defined in RFC 8554 4.6 - Algorithm 4b

Definition at line 333 of file lm_ots.cpp.

336 {
337 auto params = LMOTS_Params::create_or_throw(sig.algorithm_type());
338
339 // Alg. 4b 3.
340
341 const auto Q_with_cksm = gen_Q_with_cksm(params, identifier, q, sig.C(), msg);
342
343 // Prefill the final hash object
344 const auto pk_hash = params.hash();
345 pk_hash->update(identifier);
346 pk_hash->update(store_be(q));
347 pk_hash->update(store_be(D_PBLC));
348
349 Chain_Generator chain_gen(identifier, q);
350 const auto hash = params.hash();
351 LMOTS_Node tmp(params.n());
352 for(uint16_t i = 0; i < params.p(); ++i) {
353 const uint8_t a = coef(Q_with_cksm, i, params);
354 chain_gen.process(*hash, i, a, params.coef_max(), sig.y(i), tmp);
355 pk_hash->update(tmp);
356 }
357 // Alg. 4b 4.
358 return pk_hash->final<LMOTS_K>();
359}
Botan::LMOTS_Params::create_or_throw
static LMOTS_Params create_or_throw(LMOTS_Algorithm_Type type)
Create the LM-OTS parameters from a known algorithm type.
Definition lm_ots.cpp:106
Botan::LMOTS_Signature::y
StrongSpan< const LMOTS_Node > y(uint16_t chain_idx) const
Returns the part of the signature for chain_idx.
Definition lm_ots.h:205
Botan::LMOTS_Signature::algorithm_type
LMOTS_Algorithm_Type algorithm_type() const
Returns the LM-OTS algorithm type.
Definition lm_ots.h:195
Botan::LMOTS_Signature::C
std::span< const uint8_t > C() const
The n-byte randomizer of the signature.
Definition lm_ots.h:200
Botan::LMOTS_K
Strong< std::vector< uint8_t >, struct LMOTS_K_ > LMOTS_K
The K value from the LM-OTS public key.
Definition lm_ots.h:38
Botan::LMOTS_Node
Strong< secure_vector< uint8_t >, struct LMOTS_Node_ > LMOTS_Node
One node within one LM-OTS hash chain.
Definition lm_ots.h:33

References Botan::LMOTS_Signature::algorithm_type(), Botan::LMOTS_Signature::C(), Botan::LMOTS_Params::create_or_throw(), store_be(), and Botan::LMOTS_Signature::y().

◆ load_3()

uint32_t Botan::load_3 ( const uint8_t in[3])
inline

Definition at line 18 of file ed25519_internal.h.

18 {
19 return static_cast<uint32_t>(in[0]) | (static_cast<uint32_t>(in[1]) << 8) | (static_cast<uint32_t>(in[2]) << 16);
20}

Referenced by Botan::Ed25519_FieldElement::deserialize(), sc_muladd(), and sc_reduce().

◆ load_4()

uint32_t Botan::load_4 ( const uint8_t * in)
inline

Definition at line 22 of file ed25519_internal.h.

22 {
23 return load_le<uint32_t>(in, 0);
24}

References load_le().

Referenced by Botan::Ed25519_FieldElement::deserialize(), sc_muladd(), and sc_reduce().

◆ load_be()

template<typename OutT = detail::AutoDetect, typename... ParamTs>
auto Botan::load_be ( ParamTs &&... params)
inlineconstexpr

Load "something" in big endian byte order See the documentation of this file for more details.

Definition at line 504 of file loadstor.h.

504 {
505 return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
506}
Botan::detail::load_any
constexpr WrappedOutT load_any(InR &&in_range)
Definition loadstor.h:278

References Botan::detail::load_any().

Referenced by Botan::TLS::Datagram_Handshake_IO::add_record(), base58_check_decode(), bytes_to_words(), check_passhash9(), Botan::SHA_256::compress_digest(), Botan::SHA_512::compress_digest(), Botan::SHA_1::compress_n(), Botan::SM3::compress_n(), Botan::Whirlpool::compress_n(), Botan::AlternativeName::decode_from(), Botan::GeneralName::decode_from(), Botan::TLS::Session::decrypt(), Botan::CryptoBox::decrypt_bin(), Botan::Blowfish::decrypt_n(), Botan::CAST_128::decrypt_n(), Botan::Noekeon::decrypt_n(), Botan::SEED::decrypt_n(), Botan::SHACAL2::decrypt_n(), Botan::SM4::decrypt_n(), Botan::Blowfish::encrypt_n(), Botan::CAST_128::encrypt_n(), Botan::Noekeon::encrypt_n(), Botan::SEED::encrypt_n(), Botan::SHACAL2::encrypt_n(), Botan::SM4::encrypt_n(), Botan::HSS_LMS_PrivateKeyInternal::from_bytes_or_throw(), Botan::HSS_LMS_PublicKeyInternal::from_bytes_or_throw(), Botan::HSS_Signature::from_bytes_or_throw(), Botan::LMOTS_Signature::from_bytes_or_throw(), Botan::LMS_PublicKey::from_bytes_or_throw(), Botan::LMS_Signature::from_bytes_or_throw(), Botan::HOTP::generate_hotp(), Botan::TLS::TLS_Data_Reader::get_elem(), Botan::SIMD_4x32::load_be(), nist_key_unwrap(), nist_key_unwrap_padded(), Botan::TLS::Server_Hello_12_Shim::random_signals_downgrade(), Botan::TLS::Server_Hello_13::random_signals_downgrade(), Botan::CTR_BE::seek(), Botan::TLS::Session::Session(), ucs2_to_utf8(), and ucs4_to_utf8().

◆ load_le()

template<typename OutT = detail::AutoDetect, typename... ParamTs>
auto Botan::load_le ( ParamTs &&... params)
inlineconstexpr

Load "something" in little endian byte order See the documentation of this file for more details.

Definition at line 495 of file loadstor.h.

495 {
496 return detail::load_any<std::endian::little, OutT>(std::forward<ParamTs>(params)...);
497}

References Botan::detail::load_any().

Referenced by Botan::BlindedScalarBits< C, WindowBits+1 >::BlindedScalarBits(), Botan::Gf448Elem::bytes_are_canonical_representation(), Botan::MD4::compress_n(), Botan::MD5::compress_n(), Botan::RIPEMD_160::compress_n(), Botan::Classic_McEliece_Field_Ordering::create_field_ordering(), Botan::Sodium::crypto_core_hsalsa20(), Botan::GOST_28147_89::decrypt_n(), Botan::Kuznyechik::decrypt_n(), Botan::Serpent::decrypt_n(), Botan::Threefish_512::decrypt_n(), Botan::Twofish::decrypt_n(), Botan::FrodoMatrix::deserialize(), ed25519_verify(), Botan::GOST_28147_89::encrypt_n(), Botan::Kuznyechik::encrypt_n(), Botan::Serpent::encrypt_n(), Botan::Threefish_512::encrypt_n(), Botan::Twofish::encrypt_n(), Botan::Dilithium_Algos::expand_A(), Botan::Classic_McEliece_Minimal_Polynomial::from_bytes(), Botan::Gf448Elem::Gf448Elem(), load_4(), Botan::SIMD_4x32::load_le(), Botan::Kyber_Algos::load_le3(), Botan::FrodoMatrix::mul_add_as_plus_e(), Botan::FrodoMatrix::mul_add_sa_plus_e(), random_prime(), Botan::detail::FullWordBounds< SpongeT >::read_from(), Botan::detail::PartialWordBounds< SpongeT >::read_from(), Botan::FrodoMatrix::sample(), Botan::Dilithium_Algos::sample_in_ball(), Botan::ChaCha::seek(), Botan::Salsa20::seek(), Botan::Salsa20::set_iv_bytes(), Botan::Threefish_512::set_tweak(), Botan::Sodium::sodium_free(), Botan::bitvector_base< secure_allocator >::subvector(), Botan::CRYSTALS::unpack(), and xts_compute_tweak_block().

◆ load_private_key()

std::unique_ptr< Private_Key > Botan::load_private_key ( const AlgorithmIdentifier & alg_id,
std::span< const uint8_t > key_bits )

Definition at line 289 of file pk_algs.cpp.

290 {
291 const std::string oid_str = alg_id.oid().to_formatted_string();
292 const std::vector<std::string> alg_info = split_on(oid_str, '/');
293 const std::string_view alg_name = alg_info[0];
294
295#if defined(BOTAN_HAS_RSA)
296 if(alg_name == "RSA") {
297 return std::make_unique<RSA_PrivateKey>(alg_id, key_bits);
298 }
299#endif
300
301#if defined(BOTAN_HAS_X25519)
302 if(alg_name == "X25519" || alg_name == "Curve25519") {
303 return std::make_unique<X25519_PrivateKey>(alg_id, key_bits);
304 }
305#endif
306
307#if defined(BOTAN_HAS_X448)
308 if(alg_name == "X448") {
309 return std::make_unique<X448_PrivateKey>(alg_id, key_bits);
310 }
311#endif
312
313#if defined(BOTAN_HAS_ECDSA)
314 if(alg_name == "ECDSA") {
315 return std::make_unique<ECDSA_PrivateKey>(alg_id, key_bits);
316 }
317#endif
318
319#if defined(BOTAN_HAS_ECDH)
320 if(alg_name == "ECDH") {
321 return std::make_unique<ECDH_PrivateKey>(alg_id, key_bits);
322 }
323#endif
324
325#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
326 if(alg_name == "DH") {
327 return std::make_unique<DH_PrivateKey>(alg_id, key_bits);
328 }
329#endif
330
331#if defined(BOTAN_HAS_DSA)
332 if(alg_name == "DSA") {
333 return std::make_unique<DSA_PrivateKey>(alg_id, key_bits);
334 }
335#endif
336
337#if defined(BOTAN_HAS_FRODOKEM)
338 if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) {
339 return std::make_unique<FrodoKEM_PrivateKey>(alg_id, key_bits);
340 }
341#endif
342
343#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
344 if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
345 return std::make_unique<Kyber_PrivateKey>(alg_id, key_bits);
346 }
347#endif
348
349#if defined(BOTAN_HAS_ML_KEM)
350 if(alg_name.starts_with("ML-KEM-")) {
351 return std::make_unique<ML_KEM_PrivateKey>(alg_id, key_bits);
352 }
353#endif
354
355#if defined(BOTAN_HAS_MCELIECE)
356 if(alg_name == "McEliece") {
357 return std::make_unique<McEliece_PrivateKey>(key_bits);
358 }
359#endif
360
361#if defined(BOTAN_HAS_ECGDSA)
362 if(alg_name == "ECGDSA") {
363 return std::make_unique<ECGDSA_PrivateKey>(alg_id, key_bits);
364 }
365#endif
366
367#if defined(BOTAN_HAS_ECKCDSA)
368 if(alg_name == "ECKCDSA") {
369 return std::make_unique<ECKCDSA_PrivateKey>(alg_id, key_bits);
370 }
371#endif
372
373#if defined(BOTAN_HAS_ED25519)
374 if(alg_name == "Ed25519") {
375 return std::make_unique<Ed25519_PrivateKey>(alg_id, key_bits);
376 }
377#endif
378
379#if defined(BOTAN_HAS_ED448)
380 if(alg_name == "Ed448") {
381 return std::make_unique<Ed448_PrivateKey>(alg_id, key_bits);
382 }
383#endif
384
385#if defined(BOTAN_HAS_GOST_34_10_2001)
386 if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
387 return std::make_unique<GOST_3410_PrivateKey>(alg_id, key_bits);
388 }
389#endif
390
391#if defined(BOTAN_HAS_SM2)
392 if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
393 return std::make_unique<SM2_PrivateKey>(alg_id, key_bits);
394 }
395#endif
396
397#if defined(BOTAN_HAS_ELGAMAL)
398 if(alg_name == "ElGamal") {
399 return std::make_unique<ElGamal_PrivateKey>(alg_id, key_bits);
400 }
401#endif
402
403#if defined(BOTAN_HAS_XMSS_RFC8391)
404 if(alg_name == "XMSS") {
405 return std::make_unique<XMSS_PrivateKey>(key_bits);
406 }
407#endif
408
409#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
410 if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
411 return std::make_unique<Dilithium_PrivateKey>(alg_id, key_bits);
412 }
413#endif
414
415#if defined(BOTAN_HAS_ML_DSA)
416 if(alg_name.starts_with("ML-DSA-")) {
417 return std::make_unique<ML_DSA_PrivateKey>(alg_id, key_bits);
418 }
419#endif
420
421#if defined(BOTAN_HAS_HSS_LMS)
422 if(alg_name == "HSS-LMS-Private-Key") {
423 return std::make_unique<HSS_LMS_PrivateKey>(key_bits);
424 }
425#endif
426
427#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
428 if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) {
429 return std::make_unique<SphincsPlus_PrivateKey>(alg_id, key_bits);
430 }
431#endif
432
433#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
434 if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) {
435 return std::make_unique<SLH_DSA_PrivateKey>(alg_id, key_bits);
436 }
437#endif
438
439#if defined(BOTAN_HAS_CLASSICMCELIECE)
440 if(alg_name.starts_with("ClassicMcEliece")) {
441 return std::make_unique<Classic_McEliece_PrivateKey>(alg_id, key_bits);
442 }
443#endif
444
445 throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
446}
Botan::AlgorithmIdentifier::oid
const OID & oid() const
Definition asn1_obj.h:407
Botan::OID::to_formatted_string
std::string to_formatted_string() const
Definition asn1_oid.cpp:139

References fmt(), Botan::AlgorithmIdentifier::oid(), split_on(), and Botan::OID::to_formatted_string().

◆ load_public_key()

std::unique_ptr< Public_Key > Botan::load_public_key ( const AlgorithmIdentifier & alg_id,
std::span< const uint8_t > key_bits )

Definition at line 130 of file pk_algs.cpp.

131 {
132 const std::string oid_str = alg_id.oid().to_formatted_string();
133 const std::vector<std::string> alg_info = split_on(oid_str, '/');
134 const std::string_view alg_name = alg_info[0];
135
136#if defined(BOTAN_HAS_RSA)
137 if(alg_name == "RSA") {
138 return std::make_unique<RSA_PublicKey>(alg_id, key_bits);
139 }
140#endif
141
142#if defined(BOTAN_HAS_X25519)
143 if(alg_name == "X25519" || alg_name == "Curve25519") {
144 return std::make_unique<X25519_PublicKey>(alg_id, key_bits);
145 }
146#endif
147
148#if defined(BOTAN_HAS_X448)
149 if(alg_name == "X448") {
150 return std::make_unique<X448_PublicKey>(alg_id, key_bits);
151 }
152#endif
153
154#if defined(BOTAN_HAS_MCELIECE)
155 if(alg_name == "McEliece") {
156 return std::make_unique<McEliece_PublicKey>(key_bits);
157 }
158#endif
159
160#if defined(BOTAN_HAS_FRODOKEM)
161 if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) {
162 return std::make_unique<FrodoKEM_PublicKey>(alg_id, key_bits);
163 }
164#endif
165
166#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
167 if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
168 return std::make_unique<Kyber_PublicKey>(alg_id, key_bits);
169 }
170#endif
171
172#if defined(BOTAN_HAS_ML_KEM)
173 if(alg_name.starts_with("ML-KEM-")) {
174 return std::make_unique<ML_KEM_PublicKey>(alg_id, key_bits);
175 }
176#endif
177
178#if defined(BOTAN_HAS_ECDSA)
179 if(alg_name == "ECDSA") {
180 return std::make_unique<ECDSA_PublicKey>(alg_id, key_bits);
181 }
182#endif
183
184#if defined(BOTAN_HAS_ECDH)
185 if(alg_name == "ECDH") {
186 return std::make_unique<ECDH_PublicKey>(alg_id, key_bits);
187 }
188#endif
189
190#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
191 if(alg_name == "DH") {
192 return std::make_unique<DH_PublicKey>(alg_id, key_bits);
193 }
194#endif
195
196#if defined(BOTAN_HAS_DSA)
197 if(alg_name == "DSA") {
198 return std::make_unique<DSA_PublicKey>(alg_id, key_bits);
199 }
200#endif
201
202#if defined(BOTAN_HAS_ELGAMAL)
203 if(alg_name == "ElGamal") {
204 return std::make_unique<ElGamal_PublicKey>(alg_id, key_bits);
205 }
206#endif
207
208#if defined(BOTAN_HAS_ECGDSA)
209 if(alg_name == "ECGDSA") {
210 return std::make_unique<ECGDSA_PublicKey>(alg_id, key_bits);
211 }
212#endif
213
214#if defined(BOTAN_HAS_ECKCDSA)
215 if(alg_name == "ECKCDSA") {
216 return std::make_unique<ECKCDSA_PublicKey>(alg_id, key_bits);
217 }
218#endif
219
220#if defined(BOTAN_HAS_ED25519)
221 if(alg_name == "Ed25519") {
222 return std::make_unique<Ed25519_PublicKey>(alg_id, key_bits);
223 }
224#endif
225
226#if defined(BOTAN_HAS_ED448)
227 if(alg_name == "Ed448") {
228 return std::make_unique<Ed448_PublicKey>(alg_id, key_bits);
229 }
230#endif
231
232#if defined(BOTAN_HAS_GOST_34_10_2001)
233 if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
234 return std::make_unique<GOST_3410_PublicKey>(alg_id, key_bits);
235 }
236#endif
237
238#if defined(BOTAN_HAS_SM2)
239 if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
240 return std::make_unique<SM2_PublicKey>(alg_id, key_bits);
241 }
242#endif
243
244#if defined(BOTAN_HAS_XMSS_RFC8391)
245 if(alg_name == "XMSS") {
246 return std::make_unique<XMSS_PublicKey>(key_bits);
247 }
248#endif
249
250#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
251 if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
252 return std::make_unique<Dilithium_PublicKey>(alg_id, key_bits);
253 }
254#endif
255
256#if defined(BOTAN_HAS_ML_DSA)
257 if(alg_name.starts_with("ML-DSA-")) {
258 return std::make_unique<ML_DSA_PublicKey>(alg_id, key_bits);
259 }
260#endif
261
262#if defined(BOTAN_HAS_HSS_LMS)
263 if(alg_name == "HSS-LMS") {
264 return std::make_unique<HSS_LMS_PublicKey>(key_bits);
265 }
266#endif
267
268#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
269 if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) {
270 return std::make_unique<SphincsPlus_PublicKey>(alg_id, key_bits);
271 }
272#endif
273
274#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
275 if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) {
276 return std::make_unique<SLH_DSA_PublicKey>(alg_id, key_bits);
277 }
278#endif
279
280#if defined(BOTAN_HAS_CLASSICMCELIECE)
281 if(alg_name.starts_with("ClassicMcEliece")) {
282 return std::make_unique<Classic_McEliece_PublicKey>(alg_id, key_bits);
283 }
284#endif
285
286 throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
287}

References fmt(), Botan::AlgorithmIdentifier::oid(), split_on(), and Botan::OID::to_formatted_string().

Referenced by Botan::TLS::Hybrid_KEM_PublicKey::load_for_group(), and Botan::X509::load_key().

◆ lock()

template<typename T>
secure_vector< T > Botan::lock ( const std::vector< T > & in)

Definition at line 80 of file secmem.h.

80 {
81 return secure_vector<T>(in.begin(), in.end());
82}

Referenced by Botan::Semaphore::acquire(), Botan::OID_Map::add_oid(), Botan::OID_Map::add_oid2str(), Botan::OID_Map::add_str2oid(), Botan::Memory_Pool::allocate(), Botan::Stateful_RNG::clear(), Botan::Stateful_Key_Index_Registry::current_index(), Botan::Memory_Pool::deallocate(), Botan::Stateful_RNG::force_reseed(), Botan::Stateful_RNG::initialize_with(), Botan::Stateful_RNG::is_seeded(), Botan::OID_Map::oid2str(), Botan::Thread_Pool::queue_thunk(), Botan::TPM2::PrivateKey::raw_private_key_bits(), Botan::Semaphore::release(), Botan::Stateful_Key_Index_Registry::remaining_operations(), Botan::Stateful_RNG::reseed_from_rng(), Botan::Stateful_RNG::reseed_from_sources(), Botan::Stateful_Key_Index_Registry::reserve_next_index(), Botan::Stateful_Key_Index_Registry::set_index_lower_bound(), Botan::Thread_Pool::shutdown(), Botan::OID_Map::str2oid(), Botan::Barrier::sync(), and Botan::Barrier::wait().

◆ low_zero_bits()

size_t Botan::low_zero_bits ( const BigInt & x)
Parameters
xan integer
Returns
count of the low zero bits in x, or, equivalently, the largest value of n such that 2^n divides x evenly. Returns zero if x is equal to zero.

Definition at line 194 of file numthry.cpp.

194 {
195 size_t low_zero = 0;
196
197 auto seen_nonempty_word = CT::Mask<word>::cleared();
198
199 for(size_t i = 0; i != n.size(); ++i) {
200 const word x = n.word_at(i);
201
202 // ctz(0) will return sizeof(word)
203 const size_t tz_x = ctz(x);
204
205 // if x > 0 we want to count tz_x in total but not any
206 // further words, so set the mask after the addition
207 low_zero += seen_nonempty_word.if_not_set_return(tz_x);
208
209 seen_nonempty_word |= CT::Mask<word>::expand(x);
210 }
211
212 // if we saw no words with x > 0 then n == 0 and the value we have
213 // computed is meaningless. Instead return BigInt::zero() in that case.
214 return static_cast<size_t>(seen_nonempty_word.if_set_return(low_zero));
215}
Botan::CT::Mask::cleared
static constexpr Mask< T > cleared()
Definition ct_utils.h:387
Botan::ctz
BOTAN_FORCE_INLINE constexpr size_t ctz(T n)
Definition bit_ops.h:115

References Botan::CT::Mask< T >::cleared(), ctz(), Botan::CT::Mask< T >::expand(), Botan::BigInt::size(), and Botan::BigInt::word_at().

Referenced by inverse_mod_general(), jacobi(), passes_miller_rabin_test(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and sqrt_modulo_prime().

◆ majority()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::majority ( T a,
T b,
T c )
constexpr

Definition at line 222 of file bit_ops.h.

222 {
223 /*
224 Considering each bit of a, b, c individually
225
226 If a xor b is set, then c is the deciding vote.
227
228 If a xor b is not set then either a and b are both set or both unset.
229 In either case the value of c doesn't matter, and examining b (or a)
230 allows us to determine which case we are in.
231 */
232 return choose(a ^ b, c, b);
233}
Botan::choose
BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b)
Definition bit_ops.h:216

References BOTAN_FORCE_INLINE, and choose().

Referenced by Botan::SHA1_F::F3(), R2(), SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

◆ make_commoncrypto_block_cipher()

std::unique_ptr< BlockCipher > Botan::make_commoncrypto_block_cipher ( std::string_view name)

Definition at line 133 of file commoncrypto_block.cpp.

133 {
134 try {
135 CommonCryptor_Opts opts = commoncrypto_opts_from_algo_name(name);
136 return std::make_unique<CommonCrypto_BlockCipher>(name, opts);
137 } catch(CommonCrypto_Error& e) {
138 return nullptr;
139 }
140}

References commoncrypto_opts_from_algo_name(), and make_commoncrypto_block_cipher().

Referenced by Botan::BlockCipher::create(), and make_commoncrypto_block_cipher().

◆ make_commoncrypto_cipher_mode()

std::unique_ptr< Cipher_Mode > Botan::make_commoncrypto_cipher_mode ( std::string_view name,
Cipher_Dir direction )

Definition at line 214 of file commoncrypto_mode.cpp.

214 {
215 try {
216 CommonCryptor_Opts opts = commoncrypto_opts_from_algo(name);
217 return std::make_unique<CommonCrypto_Cipher_Mode>(name, direction, opts);
218 } catch(CommonCrypto_Error& e) {
219 return nullptr;
220 }
221}
Botan::commoncrypto_opts_from_algo
CommonCryptor_Opts commoncrypto_opts_from_algo(std::string_view algo)
Definition commoncrypto_utils.cpp:96

References commoncrypto_opts_from_algo(), and make_commoncrypto_cipher_mode().

Referenced by Botan::Cipher_Mode::create(), and make_commoncrypto_cipher_mode().

◆ make_commoncrypto_hash()

std::unique_ptr< HashFunction > Botan::make_commoncrypto_hash ( std::string_view name)

Definition at line 79 of file commoncrypto_hash.cpp.

79 {
80#define MAKE_COMMONCRYPTO_HASH_3(name, hash, ctx) \
81 std::unique_ptr<HashFunction>(new CommonCrypto_HashFunction<CC_##ctx##_CTX>({std::string(name), \
82 CC_##hash##_DIGEST_LENGTH, \
83 CC_##hash##_BLOCK_BYTES, \
84 CC_##hash##_Init, \
85 CC_##hash##_Update, \
86 CC_##hash##_Final}));
87
88#define MAKE_COMMONCRYPTO_HASH_2(name, id) MAKE_COMMONCRYPTO_HASH_3(name, id, id)
89
90#define MAKE_COMMONCRYPTO_HASH_1(id) MAKE_COMMONCRYPTO_HASH_2(#id, id)
91
92#if defined(BOTAN_HAS_SHA2_32)
93 if(name == "SHA-224")
94 return MAKE_COMMONCRYPTO_HASH_3(name, SHA224, SHA256);
95 if(name == "SHA-256")
96 return MAKE_COMMONCRYPTO_HASH_2(name, SHA256);
97#endif
98#if defined(BOTAN_HAS_SHA2_64)
99 if(name == "SHA-384")
100 return MAKE_COMMONCRYPTO_HASH_3(name, SHA384, SHA512);
101 if(name == "SHA-512")
102 return MAKE_COMMONCRYPTO_HASH_2(name, SHA512);
103#endif
104
105#if defined(BOTAN_HAS_SHA1)
106 if(name == "SHA-1")
107 return MAKE_COMMONCRYPTO_HASH_2(name, SHA1);
108#endif
109
110 return nullptr;
111}
MAKE_COMMONCRYPTO_HASH_2
#define MAKE_COMMONCRYPTO_HASH_2(name, id)
MAKE_COMMONCRYPTO_HASH_3
#define MAKE_COMMONCRYPTO_HASH_3(name, hash, ctx)

References MAKE_COMMONCRYPTO_HASH_2, and MAKE_COMMONCRYPTO_HASH_3.

Referenced by Botan::HashFunction::create().

◆ make_compressor()

Compression_Algorithm * Botan::make_compressor ( std::string_view type)
inline

Definition at line 154 of file compression.h.

154 {
155 return Compression_Algorithm::create(type).release();
156}
Botan::Compression_Algorithm::create
static std::unique_ptr< Compression_Algorithm > create(std::string_view algo_spec)
Definition compression.cpp:29

References Botan::Compression_Algorithm::create(), and make_compressor().

Referenced by make_compressor().

◆ make_decompressor()

Decompression_Algorithm * Botan::make_decompressor ( std::string_view type)
inline

Definition at line 160 of file compression.h.

160 {
161 return Decompression_Algorithm::create(type).release();
162}
Botan::Decompression_Algorithm::create
static std::unique_ptr< Decompression_Algorithm > create(std::string_view algo_spec)
Definition compression.cpp:67

References Botan::Decompression_Algorithm::create(), and make_decompressor().

Referenced by make_decompressor().

◆ make_uint16()

uint16_t Botan::make_uint16 ( uint8_t i0,
uint8_t i1 )
inlineconstexpr

Make a uint16_t from two bytes

Parameters
i0the first byte
i1the second byte
Returns
i0 || i1

Definition at line 92 of file loadstor.h.

92 {
93 return static_cast<uint16_t>((static_cast<uint16_t>(i0) << 8) | i1);
94}

Referenced by Botan::TLS::Certificate_Request_12::Certificate_Request_12(), Botan::TLS::TLS_Data_Reader::get_uint16_t(), Botan::ML_KEM_Symmetric_Primitives::init_XOF(), Botan::TLS::TLS_Data_Reader::peek_uint16_t(), random_gf2m(), Botan::RTSS_Share::reconstruct(), and Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n().

◆ make_uint32()

uint32_t Botan::make_uint32 ( uint8_t i0,
uint8_t i1,
uint8_t i2,
uint8_t i3 )
inlineconstexpr

Make a uint32_t from four bytes

Parameters
i0the first byte
i1the second byte
i2the third byte
i3the fourth byte
Returns
i0 || i1 || i2 || i3

Definition at line 104 of file loadstor.h.

104 {
105 return ((static_cast<uint32_t>(i0) << 24) | (static_cast<uint32_t>(i1) << 16) | (static_cast<uint32_t>(i2) << 8) |
106 (static_cast<uint32_t>(i3)));
107}

Referenced by Botan::TLS::Certificate_12::Certificate_12(), Botan::TLS::Certificate_Status::Certificate_Status(), Botan::TLS::Stream_Handshake_IO::get_next_record(), Botan::TLS::TLS_Data_Reader::get_uint24_t(), Botan::TLS::TLS_Data_Reader::get_uint32_t(), and Botan::SIMD_4x32::splat_u8().

◆ make_uint64()

uint64_t Botan::make_uint64 ( uint8_t i0,
uint8_t i1,
uint8_t i2,
uint8_t i3,
uint8_t i4,
uint8_t i5,
uint8_t i6,
uint8_t i7 )
inlineconstexpr

Make a uint64_t from eight bytes

Parameters
i0the first byte
i1the second byte
i2the third byte
i3the fourth byte
i4the fifth byte
i5the sixth byte
i6the seventh byte
i7the eighth byte
Returns
i0 || i1 || i2 || i3 || i4 || i5 || i6 || i7

Definition at line 121 of file loadstor.h.

122 {
123 return ((static_cast<uint64_t>(i0) << 56) | (static_cast<uint64_t>(i1) << 48) | (static_cast<uint64_t>(i2) << 40) |
124 (static_cast<uint64_t>(i3) << 32) | (static_cast<uint64_t>(i4) << 24) | (static_cast<uint64_t>(i5) << 16) |
125 (static_cast<uint64_t>(i6) << 8) | (static_cast<uint64_t>(i7)));
126}

◆ map_remove_if()

template<typename T, typename Pred>
void Botan::map_remove_if ( Pred pred,
T & assoc )

Definition at line 53 of file stl_util.h.

53 {
54 auto i = assoc.begin();
55 while(i != assoc.end()) {
56 if(pred(i->first)) {
57 assoc.erase(i++);
58 } else {
59 i++;
60 }
61 }
62}

Referenced by Botan::TLS::Channel_Impl_12::activate_session().

◆ map_to_curve_sswu()

template<typename C>
auto Botan::map_to_curve_sswu ( const typename C::FieldElement & u) ->typenameC::AffinePoint
inline

Map to curve (SSWU)

See RFC 9380 ("Hashing to Elliptic Curves") section 6.6.2

Definition at line 1675 of file pcurves_impl.h.

1675 {
1676 CT::poison(u);
1677 const auto z_u2 = C::SSWU_Z * u.square(); // z * u^2
1678 const auto z2_u4 = z_u2.square();
1679 const auto tv1 = invert_field_element<C>(z2_u4 + z_u2);
1680 auto x1 = SSWU_C1<C>() * (C::FieldElement::one() + tv1);
1681 x1.conditional_assign(tv1.is_zero(), SSWU_C2<C>());
1682 const auto x2 = z_u2 * x1;
1683
1684 // By design one of gx1 and gx2 must be a quadratic residue
1685 const CT::Option<typename C::FieldElement> y1 = sqrt_field_element<C>(C::x3_ax_b(x1));
1686 const CT::Option<typename C::FieldElement> y2 = sqrt_field_element<C>(C::x3_ax_b(x2));
1687
1688 const auto use_y1 = y1.has_value();
1689
1690 auto x = C::FieldElement::choose(use_y1, x1, x2);
1691 auto y = C::FieldElement::choose(use_y1, y1.value_or(C::FieldElement::zero()), y2.value_or(C::FieldElement::zero()));
1692
1693 auto pt = typename C::AffinePoint(x, y.correct_sign(u.is_even()));
1694
1695 CT::unpoison(pt);
1696 return pt;
1697}
Botan::CT::Option::has_value
constexpr Choice has_value() const
Return true if this Option contains a value.
Definition ct_utils.h:664
Botan::CT::Option::value_or
constexpr T value_or(T other) const
Definition ct_utils.h:688
Botan::sqrt_field_element
constexpr CT::Option< typename C::FieldElement > sqrt_field_element(const typename C::FieldElement &fe)
Definition pcurves_algos.h:60
Botan::SSWU_C1
const auto & SSWU_C1()
Definition pcurves_impl.h:1660
Botan::invert_field_element
constexpr auto invert_field_element(const typename C::FieldElement &fe)
Definition pcurves_algos.h:35
Botan::SSWU_C2
const auto & SSWU_C2()
Definition pcurves_impl.h:1646

References Botan::CT::Option< T >::has_value(), invert_field_element(), Botan::CT::poison(), sqrt_field_element(), SSWU_C1(), SSWU_C2(), Botan::CT::unpoison(), and Botan::CT::Option< T >::value_or().

Referenced by hash_to_curve_sswu().

◆ mceliece_decrypt() [1/3]

secure_vector< uint8_t > Botan::mceliece_decrypt ( secure_vector< gf2m > & error_pos,
const uint8_t * ciphertext,
size_t ciphertext_len,
const McEliece_PrivateKey & key )

p_err_pos_len must point to the available length of error_pos on input, the function will set it to the actual number of errors returned in the error_pos array

Definition at line 146 of file goppa_code.cpp.

149 {
150 const size_t dimension = key.get_dimension();
151 const size_t codimension = key.get_codimension();
152 const uint32_t t = key.get_goppa_polyn().get_degree();
153 polyn_gf2m syndrome_polyn(key.get_goppa_polyn().get_sp_field()); // init as zero polyn
154 const unsigned unused_pt_bits = dimension % 8;
155 const uint8_t unused_pt_bits_mask = (1 << unused_pt_bits) - 1;
156
157 if(ciphertext_len != (key.get_code_length() + 7) / 8) {
158 throw Invalid_Argument("wrong size of McEliece ciphertext");
159 }
160 const size_t cleartext_len = (key.get_message_word_bit_length() + 7) / 8;
161
162 if(cleartext_len != bit_size_to_byte_size(dimension)) {
163 throw Invalid_Argument("mce-decryption: wrong length of cleartext buffer");
164 }
165
166 secure_vector<uint32_t> syndrome_vec(bit_size_to_32bit_size(codimension));
167 matrix_arr_mul(key.get_H_coeffs(),
168 key.get_code_length(),
169 bit_size_to_32bit_size(codimension),
170 ciphertext,
171 syndrome_vec.data(),
172 syndrome_vec.size());
173
174 secure_vector<uint8_t> syndrome_byte_vec(bit_size_to_byte_size(codimension));
175 const size_t syndrome_byte_vec_size = syndrome_byte_vec.size();
176 for(size_t i = 0; i < syndrome_byte_vec_size; i++) {
177 syndrome_byte_vec[i] = static_cast<uint8_t>(syndrome_vec[i / 4] >> (8 * (i % 4)));
178 }
179
180 syndrome_polyn = polyn_gf2m(
181 t - 1, syndrome_byte_vec.data(), bit_size_to_byte_size(codimension), key.get_goppa_polyn().get_sp_field());
182
183 syndrome_polyn.get_degree();
184 error_pos = goppa_decode(syndrome_polyn, key.get_goppa_polyn(), key.get_sqrtmod(), key.get_Linv());
185
186 const size_t nb_err = error_pos.size();
187
188 secure_vector<uint8_t> cleartext(cleartext_len);
189 copy_mem(cleartext.data(), ciphertext, cleartext_len);
190
191 for(size_t i = 0; i < nb_err; i++) {
192 const gf2m current = error_pos[i];
193
194 if(current >= cleartext_len * 8) {
195 // an invalid position, this shouldn't happen
196 continue;
197 }
198 cleartext[current / 8] ^= (1 << (current % 8));
199 }
200
201 if(unused_pt_bits > 0) {
202 cleartext[cleartext_len - 1] &= unused_pt_bits_mask;
203 }
204
205 return cleartext;
206}
Botan::McEliece_PrivateKey::get_sqrtmod
const std::vector< polyn_gf2m > & get_sqrtmod() const
Definition mceliece.h:123
Botan::McEliece_PrivateKey::get_codimension
size_t get_codimension() const
Definition mceliece.h:127
Botan::McEliece_PrivateKey::get_dimension
size_t get_dimension() const
Definition mceliece.h:125
Botan::McEliece_PrivateKey::get_goppa_polyn
const polyn_gf2m & get_goppa_polyn() const
Definition mceliece_key.cpp:53
Botan::McEliece_PrivateKey::get_Linv
const std::vector< gf2m > & get_Linv() const
Definition mceliece.h:121
Botan::McEliece_PrivateKey::get_H_coeffs
const std::vector< uint32_t > & get_H_coeffs() const
Definition mceliece.h:119
Botan::McEliece_PublicKey::get_message_word_bit_length
size_t get_message_word_bit_length() const
Definition mceliece_key.cpp:57
Botan::McEliece_PublicKey::get_code_length
size_t get_code_length() const
Definition mceliece.h:52
Botan::polyn_gf2m::get_degree
int get_degree() const
Definition polyn_gf2m.cpp:167
Botan::polyn_gf2m::get_sp_field
std::shared_ptr< GF2m_Field > get_sp_field() const
Definition polyn_gf2m.h:79
Botan::bit_size_to_byte_size
size_t bit_size_to_byte_size(size_t bit_size)
Definition code_based_util.h:42

References bit_size_to_32bit_size(), bit_size_to_byte_size(), copy_mem(), Botan::McEliece_PublicKey::get_code_length(), Botan::McEliece_PrivateKey::get_codimension(), Botan::polyn_gf2m::get_degree(), Botan::McEliece_PrivateKey::get_dimension(), Botan::McEliece_PrivateKey::get_goppa_polyn(), Botan::McEliece_PrivateKey::get_H_coeffs(), Botan::McEliece_PrivateKey::get_Linv(), Botan::McEliece_PublicKey::get_message_word_bit_length(), Botan::polyn_gf2m::get_sp_field(), and Botan::McEliece_PrivateKey::get_sqrtmod().

◆ mceliece_decrypt() [2/3]

void Botan::mceliece_decrypt ( secure_vector< uint8_t > & plaintext,
secure_vector< uint8_t > & error_mask,
const uint8_t ciphertext[],
size_t ciphertext_len,
const McEliece_PrivateKey & key )

Definition at line 122 of file goppa_code.cpp.

126 {
127 secure_vector<gf2m> error_pos;
128 plaintext = mceliece_decrypt(error_pos, ciphertext, ciphertext_len, key);
129
130 const size_t code_length = key.get_code_length();
131 secure_vector<uint8_t> result((code_length + 7) / 8);
132 for(auto&& pos : error_pos) {
133 if(pos > code_length) {
134 throw Invalid_Argument("error position larger than code size");
135 }
136 result[pos / 8] |= (1 << (pos % 8));
137 }
138
139 error_mask = result;
140}
Botan::mceliece_decrypt
void mceliece_decrypt(secure_vector< uint8_t > &plaintext_out, secure_vector< uint8_t > &error_mask_out, const secure_vector< uint8_t > &ciphertext, const McEliece_PrivateKey &key)
Definition goppa_code.cpp:115

References Botan::McEliece_PublicKey::get_code_length(), and mceliece_decrypt().

◆ mceliece_decrypt() [3/3]

void Botan::mceliece_decrypt ( secure_vector< uint8_t > & plaintext_out,
secure_vector< uint8_t > & error_mask_out,
const secure_vector< uint8_t > & ciphertext,
const McEliece_PrivateKey & key )

Definition at line 115 of file goppa_code.cpp.

118 {
119 mceliece_decrypt(plaintext_out, error_mask_out, ciphertext.data(), ciphertext.size(), key);
120}

References mceliece_decrypt().

Referenced by Botan::McEliece_PrivateKey::check_key(), mceliece_decrypt(), and mceliece_decrypt().

◆ mceliece_encrypt()

void Botan::mceliece_encrypt ( secure_vector< uint8_t > & ciphertext_out,
secure_vector< uint8_t > & error_mask_out,
const secure_vector< uint8_t > & plaintext,
const McEliece_PublicKey & key,
RandomNumberGenerator & rng )

Definition at line 109 of file mceliece.cpp.

113 {
114 const uint16_t code_length = static_cast<uint16_t>(key.get_code_length());
115
116 secure_vector<uint8_t> error_mask = create_random_error_vector(code_length, key.get_t(), rng);
117
118 secure_vector<uint8_t> ciphertext =
119 mult_by_pubkey(plaintext, key.get_public_matrix(), key.get_code_length(), key.get_t());
120
121 ciphertext ^= error_mask;
122
123 ciphertext_out.swap(ciphertext);
124 error_mask_out.swap(error_mask);
125}
Botan::McEliece_PublicKey::get_t
size_t get_t() const
Definition mceliece.h:50
Botan::McEliece_PublicKey::get_public_matrix
const std::vector< uint8_t > & get_public_matrix() const
Definition mceliece.h:56

References Botan::McEliece_PublicKey::get_code_length(), Botan::McEliece_PublicKey::get_public_matrix(), and Botan::McEliece_PublicKey::get_t().

Referenced by Botan::McEliece_PrivateKey::check_key().

◆ mceliece_work_factor()

size_t Botan::mceliece_work_factor ( size_t code_size,
size_t t )

Estimate work factor for McEliece

Returns
estimated security level for these key parameters

Definition at line 90 of file mce_workfactor.cpp.

90 {
91 const size_t k = n - ceil_log2(n) * t;
92
93 double min = cout_total(n, k, t, 0, 0); // correspond a p=1
94 for(size_t p = 0; p != t / 2; ++p) {
95 const double lwf = best_wf(n, k + 1, t, p);
96 if(lwf < 0) {
97 break;
98 }
99
100 min = std::min(min, lwf);
101 }
102
103 return static_cast<size_t>(min);
104}

References ceil_log2().

Referenced by Botan::McEliece_PublicKey::estimated_strength().

◆ measure_cost()

template<typename F>
uint64_t Botan::measure_cost ( uint64_t trial_msec,
F func )

Definition at line 19 of file time_utils.h.

19 {
20#if defined(BOTAN_HAS_OS_UTILS)
21 const uint64_t trial_nsec = trial_msec * 1000000;
22
23 uint64_t total_nsec = 0;
24 uint64_t trials = 0;
25
26 auto trial_start = OS::get_system_timestamp_ns();
27
28 for(;;) {
29 const auto start = OS::get_system_timestamp_ns();
30 func();
31 const auto end = OS::get_system_timestamp_ns();
32
33 if(end >= start) {
34 total_nsec += (end - start);
35 trials += 1;
36
37 if((end - trial_start) >= trial_nsec) {
38 return (total_nsec / trials);
39 }
40 }
41 }
42
43#else
44 BOTAN_UNUSED(trial_msec, func);
45 throw Not_Implemented("No system clock available");
46#endif
47}
Botan::OS::get_system_timestamp_ns
uint64_t BOTAN_TEST_API get_system_timestamp_ns()
Definition os_utils.cpp:326

References BOTAN_UNUSED, and Botan::OS::get_system_timestamp_ns().

Referenced by Botan::Argon2_Family::tune_params(), Botan::Bcrypt_PBKDF_Family::tune_params(), Botan::RFC4880_S2K_Family::tune_params(), and Botan::Scrypt_Family::tune_params().

◆ mgf1_mask()

void Botan::mgf1_mask ( HashFunction & hash,
std::span< const uint8_t > input,
std::span< uint8_t > output )

MGF1 from PKCS #1 v2.0

Parameters
hashhash function to use
input- the input buffer
output- the output buffer. The buffer is XORed with the output of MGF1.

Definition at line 15 of file mgf1.cpp.

15 {
16 uint32_t counter = 0;
17
18 std::vector<uint8_t> buffer(hash.output_length());
19 while(!output.empty()) {
20 hash.update(input);
21 hash.update_be(counter);
22 hash.final(buffer);
23
24 const size_t xored = std::min<size_t>(buffer.size(), output.size());
25 xor_buf(output.first(xored), std::span{buffer}.first(xored));
26 output = output.subspan(xored);
27
28 ++counter;
29 }
30}
Botan::Buffered_Computation::update
void update(const uint8_t in[], size_t length)
Definition buf_comp.h:34
Botan::Buffered_Computation::output_length
virtual size_t output_length() const =0
Botan::Buffered_Computation::update_be
void update_be(uint16_t val)
Definition buf_comp.cpp:18
Botan::Buffered_Computation::final
void final(uint8_t out[])
Definition buf_comp.h:69
Botan::xor_buf
constexpr void xor_buf(ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
Definition mem_ops.h:341

References Botan::Buffered_Computation::final(), Botan::Buffered_Computation::output_length(), Botan::Buffered_Computation::update(), Botan::Buffered_Computation::update_be(), and xor_buf().

◆ miller_rabin_test_iterations()

size_t Botan::miller_rabin_test_iterations ( size_t n_bits,
size_t prob,
bool random )

Return required number of Miller-Rabin tests in order to reach the specified probability of error.

Parameters
n_bitsthe bit-length of the integer being tested
probchance of false positive is bounded by 1/2**prob
randomis set if (and only if) the integer was randomly generated by us and thus cannot have been maliciously constructed.

Definition at line 182 of file primality.cpp.

182 {
183 const size_t base = (prob + 2) / 2; // worst case 4^-t error rate
184
185 /*
186 * If the candidate prime was maliciously constructed, we can't rely
187 * on arguments based on p being random.
188 */
189 if(!random) {
190 return base;
191 }
192
193 /*
194 * For randomly chosen numbers we can use the estimates from
195 * http://www.math.dartmouth.edu/~carlp/PDF/paper88.pdf
196 *
197 * These values are derived from the inequality for p(k,t) given on
198 * the second page.
199 */
200 if(prob <= 128) {
201 if(n_bits >= 1536) {
202 return 4; // < 2^-133
203 }
204 if(n_bits >= 1024) {
205 return 6; // < 2^-133
206 }
207 if(n_bits >= 512) {
208 return 12; // < 2^-129
209 }
210 if(n_bits >= 256) {
211 return 29; // < 2^-128
212 }
213 }
214
215 /*
216 If the user desires a smaller error probability than we have
217 precomputed error estimates for, just fall back to using the worst
218 case error rate.
219 */
220 return base;
221}

Referenced by generate_rsa_prime(), is_prime(), and random_prime().

◆ modular_inverse()

template<std::integral T, std::integral T2 = next_longer_int_t<T>>
requires (sizeof(T) <= 4)
T Botan::modular_inverse ( T q,
T2 m = T2(1) << sizeof(T) * 8 )
consteval

Calculate the modular multiplacative inverse of q modulo m. By default, this assumes m to be 2^bitlength of T for application in a Montgomery reduction.

Definition at line 97 of file pqcrystals_helpers.h.

97 {
98 return static_cast<T>(extended_euclidean_algorithm<T2>(q, m).u);
99}
Botan::extended_euclidean_algorithm
consteval eea_result< T > extended_euclidean_algorithm(T a, T b)
Definition pqcrystals_helpers.h:69

References extended_euclidean_algorithm().

◆ montgomery_R()

template<std::integral T>
requires (sizeof(T) <= 4)
T Botan::montgomery_R ( T q)
consteval

Definition at line 44 of file pqcrystals_helpers.h.

44 {
45 using T_unsigned = std::make_unsigned_t<T>;
46 using T2 = next_longer_uint_t<T_unsigned>;
47 return (T2(1) << (sizeof(T) * 8)) % q;
48}
Botan::next_longer_uint_t
std::conditional_t< sizeof(T)==1, uint16_t, std::conditional_t< sizeof(T)==2, uint32_t, std::conditional_t< sizeof(T)==4, uint64_t, void > > > next_longer_uint_t
Definition pqcrystals_helpers.h:28

Referenced by montgomery_R2().

◆ montgomery_R2()

template<std::integral T>
requires (sizeof(T) <= 4)
T Botan::montgomery_R2 ( T q)
consteval

Definition at line 52 of file pqcrystals_helpers.h.

52 {
53 using T2 = next_longer_int_t<T>;
54 return (static_cast<T2>(montgomery_R(q)) * static_cast<T2>(montgomery_R(q))) % q;
55}
Botan::next_longer_int_t
std::conditional_t< sizeof(T)==1, int16_t, std::conditional_t< sizeof(T)==2, int32_t, std::conditional_t< sizeof(T)==4, int64_t, void > > > next_longer_int_t
Definition pqcrystals_helpers.h:35
Botan::montgomery_R
consteval T montgomery_R(T q)
Definition pqcrystals_helpers.h:44

References montgomery_R().

◆ monty_execute()

Montgomery_Int Botan::monty_execute ( const Montgomery_Exponentiation_State & precomputed_state,
const BigInt & k,
size_t max_k_bits )

Definition at line 156 of file monty_exp.cpp.

158 {
159 return precomputed_state.exponentiation(k, max_k_bits);
160}

References monty_execute().

Referenced by monty_execute(), monty_exp(), and passes_miller_rabin_test().

◆ monty_execute_vartime()

Montgomery_Int Botan::monty_execute_vartime ( const Montgomery_Exponentiation_State & precomputed_state,
const BigInt & k )

Definition at line 162 of file monty_exp.cpp.

162 {
163 return precomputed_state.exponentiation_vartime(k);
164}

References monty_execute_vartime().

Referenced by monty_execute_vartime(), and monty_exp_vartime().

◆ monty_exp()

Montgomery_Int Botan::monty_exp ( const Montgomery_Params & params_p,
const BigInt & g,
const BigInt & k,
size_t max_k_bits )
inline

Definition at line 46 of file monty_exp.h.

49 {
50 auto precomputed = monty_precompute(params_p, g, 4, true);
51 return monty_execute(*precomputed, k, max_k_bits);
52}
Botan::monty_precompute
std::shared_ptr< const Montgomery_Exponentiation_State > monty_precompute(const Montgomery_Int &g, size_t window_bits, bool const_time)
Definition monty_exp.cpp:141
Botan::monty_execute
Montgomery_Int monty_execute(const Montgomery_Exponentiation_State &precomputed_state, const BigInt &k, size_t max_k_bits)
Definition monty_exp.cpp:156

References monty_execute(), and monty_precompute().

Referenced by power_mod().

◆ monty_exp_vartime()

Montgomery_Int Botan::monty_exp_vartime ( const Montgomery_Params & params_p,
const BigInt & g,
const BigInt & k )
inline

Definition at line 54 of file monty_exp.h.

54 {
55 auto precomputed = monty_precompute(params_p, g, 4, false);
56 return monty_execute_vartime(*precomputed, k);
57}
Botan::monty_execute_vartime
Montgomery_Int monty_execute_vartime(const Montgomery_Exponentiation_State &precomputed_state, const BigInt &k)
Definition monty_exp.cpp:162

References monty_execute_vartime(), and monty_precompute().

Referenced by sqrt_modulo_prime().

◆ monty_inverse()

template<WordType W>
auto Botan::monty_inverse ( W a) ->W
inlineconstexpr

Definition at line 690 of file mp_core.h.

690 {
691 BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer");
692
693 // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/
694
695 constexpr size_t iter = WordInfo<W>::bits == 64 ? 4 : 3;
696
697 // Initial guess provides 5 bits of accuracy
698 W r = (3 * a) ^ 2;
699
700 // Each iteration doubles the accuracy
701 for(size_t i = 0; i != iter; ++i) {
702 r = r * (2 - r * a);
703 }
704
705 // Now invert in addition space
706 r = (WordInfo<W>::max - r) + 1;
707
708 return r;
709}

References BOTAN_ARG_CHECK.

◆ monty_multi_exp()

Montgomery_Int Botan::monty_multi_exp ( const Montgomery_Params & params_p,
const BigInt & x,
const BigInt & z1,
const BigInt & y,
const BigInt & z2 )

Return (x^z1 * y^z2) % p

Definition at line 166 of file monty_exp.cpp.

167 {
168 if(z1.is_negative() || z2.is_negative()) {
169 throw Invalid_Argument("multi_exponentiate exponents must be positive");
170 }
171
172 const size_t z_bits = round_up(std::max(z1.bits(), z2.bits()), 2);
173
174 secure_vector<word> ws(2 * params_p.p_words());
175
176 const Montgomery_Int one = Montgomery_Int::one(params_p);
177
178 const Montgomery_Int x1(params_p, x_bn);
179 const Montgomery_Int x2 = x1.square(ws);
180 const Montgomery_Int x3 = x2.mul(x1, ws);
181
182 const Montgomery_Int y1(params_p, y_bn);
183 const Montgomery_Int y2 = y1.square(ws);
184 const Montgomery_Int y3 = y2.mul(y1, ws);
185
186 const Montgomery_Int y1x1 = y1.mul(x1, ws);
187 const Montgomery_Int y1x2 = y1.mul(x2, ws);
188 const Montgomery_Int y1x3 = y1.mul(x3, ws);
189
190 const Montgomery_Int y2x1 = y2.mul(x1, ws);
191 const Montgomery_Int y2x2 = y2.mul(x2, ws);
192 const Montgomery_Int y2x3 = y2.mul(x3, ws);
193
194 const Montgomery_Int y3x1 = y3.mul(x1, ws);
195 const Montgomery_Int y3x2 = y3.mul(x2, ws);
196 const Montgomery_Int y3x3 = y3.mul(x3, ws);
197
198 // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
199 const Montgomery_Int* M[16] = {&one,
200 &x1, // 0001
201 &x2, // 0010
202 &x3, // 0011
203 &y1, // 0100
204 &y1x1,
205 &y1x2,
206 &y1x3,
207 &y2, // 1000
208 &y2x1,
209 &y2x2,
210 &y2x3,
211 &y3, // 1100
212 &y3x1,
213 &y3x2,
214 &y3x3};
215
216 Montgomery_Int H = one;
217
218 for(size_t i = 0; i != z_bits; i += 2) {
219 if(i > 0) {
220 H.square_this_n_times(ws, 2);
221 }
222
223 const uint32_t z1_b = z1.get_substring(z_bits - i - 2, 2);
224 const uint32_t z2_b = z2.get_substring(z_bits - i - 2, 2);
225
226 const uint32_t z12 = (4 * z2_b) + z1_b;
227
228 if(z12 > 0) {
229 H.mul_by(*M[z12], ws);
230 }
231 }
232
233 return H;
234}
Botan::BigInt::get_substring
uint32_t get_substring(size_t offset, size_t length) const
Definition bigint.cpp:239
Botan::Montgomery_Int
Definition monty.h:103
Botan::Montgomery_Int::one
static Montgomery_Int one(const Montgomery_Params &params)
Definition monty.cpp:204
Botan::Montgomery_Params::p_words
size_t p_words() const
Definition monty.h:51
Botan::round_up
constexpr size_t round_up(size_t n, size_t align_to)
Definition rounding.h:26

References Botan::BigInt::bits(), Botan::BigInt::get_substring(), Botan::BigInt::is_negative(), monty_multi_exp(), Botan::Montgomery_Int::mul(), Botan::Montgomery_Int::mul_by(), Botan::Montgomery_Int::one(), Botan::Montgomery_Params::p_words(), round_up(), Botan::Montgomery_Int::square(), and Botan::Montgomery_Int::square_this_n_times().

Referenced by monty_multi_exp(), and Botan::DL_Group::multi_exponentiate().

◆ monty_precompute() [1/2]

std::shared_ptr< const Montgomery_Exponentiation_State > Botan::monty_precompute ( const Montgomery_Int & g,
size_t window_bits,
bool const_time )

Definition at line 141 of file monty_exp.cpp.

143 {
144 return std::make_shared<const Montgomery_Exponentiation_State>(g, window_bits, const_time);
145}

References monty_precompute().

Referenced by monty_exp(), monty_exp_vartime(), monty_precompute(), monty_precompute(), and passes_miller_rabin_test().

◆ monty_precompute() [2/2]

std::shared_ptr< const Montgomery_Exponentiation_State > Botan::monty_precompute ( const Montgomery_Params & params,
const BigInt & g,
size_t window_bits,
bool const_time )

Definition at line 147 of file monty_exp.cpp.

150 {
151 BOTAN_ARG_CHECK(g < params.p(), "Montgomery base too big");
152 const Montgomery_Int monty_g(params, g);
153 return monty_precompute(monty_g, window_bits, const_time);
154}
Botan::Montgomery_Params::p
const BigInt & p() const
Definition monty.h:41

References BOTAN_ARG_CHECK, monty_precompute(), and Botan::Montgomery_Params::p().

◆ monty_redc()

template<WordType W, size_t N>
auto Botan::monty_redc ( const std::array< W, 2 *N > & z,
const std::array< W, N > & p,
W p_dash )->std::array< W, N >
inlineconstexpr

Definition at line 109 of file pcurves_util.h.

110 {
111 static_assert(N >= 1);
112
113 std::array<W, N> ws; // NOLINT(*-member-init)
114 std::array<W, N> r; // NOLINT(*-member-init)
115
116 // Conditional ok: the parameter size is public
117 if(!std::is_constant_evaluated()) {
118 // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words
119 if constexpr(N == 4) {
120 bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data());
121 return r;
122 } else if constexpr(N == 6) {
123 bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data());
124 return r;
125 } else if constexpr(N == 8) {
126 bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data());
127 return r;
128 } else if constexpr(N == 12) {
129 bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data());
130 return r;
131 } else if constexpr(N == 16) {
132 bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data());
133 return r;
134 }
135 }
136
137 word3<W> accum;
138
139 accum.add(z[0]);
140
141 ws[0] = accum.monty_step(p[0], p_dash);
142
143 for(size_t i = 1; i != N; ++i) {
144 for(size_t j = 0; j < i; ++j) {
145 accum.mul(ws[j], p[i - j]);
146 }
147
148 accum.add(z[i]);
149
150 ws[i] = accum.monty_step(p[0], p_dash);
151 }
152
153 for(size_t i = 0; i != N - 1; ++i) {
154 for(size_t j = i + 1; j != N; ++j) {
155 accum.mul(ws[j], p[N + i - j]);
156 }
157
158 accum.add(z[N + i]);
159
160 ws[i] = accum.extract();
161 }
162
163 accum.add(z[2 * N - 1]);
164
165 ws[N - 1] = accum.extract();
166 // w1 is the final part, which is not stored in the workspace
167 const W w1 = accum.extract();
168
169 bigint_monty_maybe_sub<N>(r.data(), w1, ws.data(), p.data());
170
171 return r;
172}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), bigint_monty_redc_12(), bigint_monty_redc_16(), bigint_monty_redc_4(), bigint_monty_redc_6(), bigint_monty_redc_8(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by Botan::MontgomeryRep< Params >::redc().

◆ monty_redc_pdash1()

template<WordType W, size_t N>
auto Botan::monty_redc_pdash1 ( const std::array< W, 2 *N > & z,
const std::array< W, N > & p )->std::array< W, N >
inlineconstexpr

Definition at line 65 of file pcurves_util.h.

65 {
66 static_assert(N >= 1);
67
68 std::array<W, N> ws; // NOLINT(*-member-init);
69 std::array<W, N> r; // NOLINT(*-member-init)
70
71 word3<W> accum;
72
73 accum.add(z[0]);
74
75 ws[0] = accum.monty_step_pdash1();
76
77 for(size_t i = 1; i != N; ++i) {
78 for(size_t j = 0; j < i; ++j) {
79 accum.mul(ws[j], p[i - j]);
80 }
81
82 accum.add(z[i]);
83
84 ws[i] = accum.monty_step_pdash1();
85 }
86
87 for(size_t i = 0; i != N - 1; ++i) {
88 for(size_t j = i + 1; j != N; ++j) {
89 accum.mul(ws[j], p[N + i - j]);
90 }
91
92 accum.add(z[N + i]);
93
94 ws[i] = accum.extract();
95 }
96
97 accum.add(z[2 * N - 1]);
98
99 ws[N - 1] = accum.extract();
100 // w1 is the final part, which is not stored in the workspace
101 const W w1 = accum.extract();
102
103 bigint_monty_maybe_sub<N>(r.data(), w1, ws.data(), p.data());
104
105 return r;
106}
Botan::word3::monty_step_pdash1
constexpr W monty_step_pdash1()
Definition mp_asmi.h:627

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step_pdash1(), and Botan::word3< W >::mul().

Referenced by Botan::MontgomeryRep< Params >::redc().

◆ montygomery_r()

template<WordType W, size_t N>
std::array< W, N > Botan::montygomery_r ( const std::array< W, N > & p)
inlineconsteval

Definition at line 49 of file pcurves_util.h.

49 {
50 std::array<W, N + 1> x = {};
51 x[N] = 1;
52 return reduce_mod(x, p);
53}
Botan::reduce_mod
consteval std::array< W, N > reduce_mod(const std::array< W, XN > &x, const std::array< W, N > &p)
Definition pcurves_util.h:16

References reduce_mod().

◆ mul2_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint Botan::mul2_exec ( const AffinePointTable< C > & table,
const BlindedScalar & x,
const BlindedScalar & y,
RandomNumberGenerator & rng )

Definition at line 510 of file pcurves_mul.h.

513 {
514 const size_t Windows = (x.bits() + WindowBits - 1) / WindowBits;
515
516 auto accum = [&]() {
517 const size_t w_1 = x.get_window((Windows - 1) * WindowBits);
518 const size_t w_2 = y.get_window((Windows - 1) * WindowBits);
519 const size_t window = w_1 + (w_2 << WindowBits);
520 auto pt = C::ProjectivePoint::from_affine(table.ct_select(window));
521 CT::poison(pt);
522 pt.randomize_rep(rng);
523 return pt;
524 }();
525
526 for(size_t i = 1; i != Windows; ++i) {
527 accum = accum.dbl_n(WindowBits);
528
529 const size_t w_1 = x.get_window((Windows - i - 1) * WindowBits);
530 const size_t w_2 = y.get_window((Windows - i - 1) * WindowBits);
531 const size_t window = w_1 + (w_2 << WindowBits);
532 accum += table.ct_select(window);
533
534 // Conditional ok: loop iteration count is public
535 if(i <= 3) {
536 accum.randomize_rep(rng);
537 }
538 }
539
540 CT::unpoison(accum);
541 return accum;
542}
Botan::AffinePointTable::ct_select
AffinePoint ct_select(size_t idx) const
Definition pcurves_mul.h:84

References Botan::AffinePointTable< C, R >::ct_select(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by Botan::WindowedMul2Table< C, W >::mul2().

◆ mul2_setup()

template<typename C, size_t WindowBits>
std::vector< typename C::ProjectivePoint > Botan::mul2_setup ( const typename C::AffinePoint & p,
const typename C::AffinePoint & q )

Definition at line 448 of file pcurves_mul.h.

449 {
450 static_assert(WindowBits >= 1 && WindowBits <= 4);
451
452 // 2^(2*W) elements, less the identity element
453 constexpr size_t TableSize = (1 << (2 * WindowBits)) - 1;
454 constexpr size_t WindowSize = (1 << WindowBits);
455
456 std::vector<typename C::ProjectivePoint> table;
457 table.reserve(TableSize);
458
459 for(size_t i = 0; i != TableSize; ++i) {
460 const size_t t_i = (i + 1);
461 const size_t p_i = t_i % WindowSize;
462 const size_t q_i = (t_i >> WindowBits) % WindowSize;
463
464 // Conditionals ok: all based on t_i/p_i/q_i which in turn are derived from public i
465
466 // Returns x_i * x + y_i * y
467 auto next_tbl_e = [&]() {
468 if(p_i % 2 == 0 && q_i % 2 == 0) {
469 // Where possible using doubling (eg indices 1, 7, 9 in
470 // the table above)
471 return table[(t_i / 2) - 1].dbl();
472 } else if(p_i > 0 && q_i > 0) {
473 // A combination of p and q
474 if(p_i == 1) {
475 return p + table[(q_i << WindowBits) - 1];
476 } else if(q_i == 1) {
477 return table[p_i - 1] + q;
478 } else {
479 return table[p_i - 1] + table[(q_i << WindowBits) - 1];
480 }
481 } else if(p_i > 0 && q_i == 0) {
482 // A multiple of p without a q component
483 if(p_i == 1) {
484 // Just p
485 return C::ProjectivePoint::from_affine(p);
486 } else {
487 // p * p_{i-1}
488 return p + table[p_i - 1 - 1];
489 }
490 } else if(p_i == 0 && q_i > 0) {
491 if(q_i == 1) {
492 // Just q
493 return C::ProjectivePoint::from_affine(q);
494 } else {
495 // q * q_{i-1}
496 return q + table[((q_i - 1) << WindowBits) - 1];
497 }
498 } else {
499 BOTAN_ASSERT_UNREACHABLE();
500 }
501 };
502
503 table.emplace_back(next_tbl_e());
504 }
505
506 return table;
507}
BOTAN_ASSERT_UNREACHABLE
#define BOTAN_ASSERT_UNREACHABLE()
Definition assert.h:163

References BOTAN_ASSERT_UNREACHABLE.

Referenced by Botan::VartimeMul2Table< C, W >::VartimeMul2Table(), and Botan::WindowedMul2Table< C, W >::WindowedMul2Table().

◆ mul64x64_128()

void Botan::mul64x64_128 ( uint64_t a,
uint64_t b,
uint64_t * lo,
uint64_t * hi )
inlineconstexpr

Perform a 64x64->128 bit multiplication

Definition at line 24 of file mul128.h.

24 {
25 if(!std::is_constant_evaluated()) {
26#if defined(BOTAN_BUILD_COMPILER_IS_MSVC) && defined(BOTAN_TARGET_ARCH_IS_X86_64)
27 *lo = _umul128(a, b, hi);
28 return;
29
30#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) && defined(BOTAN_TARGET_ARCH_IS_ARM64)
31 *lo = a * b;
32 *hi = __umulh(a, b);
33 return;
34#endif
35 }
36
37#if defined(BOTAN_TARGET_HAS_NATIVE_UINT128)
38 const uint128_t r = static_cast<uint128_t>(a) * b;
39 *hi = (r >> 64) & 0xFFFFFFFFFFFFFFFF;
40 *lo = (r) & 0xFFFFFFFFFFFFFFFF;
41#else
42
43 /*
44 * Do a 64x64->128 multiply using four 32x32->64 multiplies plus
45 * some adds and shifts.
46 */
47 const size_t HWORD_BITS = 32;
48 const uint32_t HWORD_MASK = 0xFFFFFFFF;
49
50 const uint32_t a_hi = (a >> HWORD_BITS);
51 const uint32_t a_lo = (a & HWORD_MASK);
52 const uint32_t b_hi = (b >> HWORD_BITS);
53 const uint32_t b_lo = (b & HWORD_MASK);
54
55 const uint64_t x0 = static_cast<uint64_t>(a_hi) * b_hi;
56 const uint64_t x1 = static_cast<uint64_t>(a_lo) * b_hi;
57 const uint64_t x2 = static_cast<uint64_t>(a_hi) * b_lo;
58 const uint64_t x3 = static_cast<uint64_t>(a_lo) * b_lo;
59
60 // this cannot overflow as (2^32-1)^2 + 2^32-1 + 2^32-1 = 2^64-1
61 const uint64_t middle = x2 + (x3 >> HWORD_BITS) + (x1 & HWORD_MASK);
62
63 // likewise these cannot overflow
64 *hi = x0 + (middle >> HWORD_BITS) + (x1 >> HWORD_BITS);
65 *lo = (middle << HWORD_BITS) + (x3 & HWORD_MASK);
66#endif
67}

Referenced by operator*().

◆ mul_a24()

Gf448Elem Botan::mul_a24 ( const Gf448Elem & a)

Multiply a field element by the Curve448 constant a24 = 39081.

Definition at line 439 of file curve448_gf.cpp.

439 {
440 Gf448Elem res(0);
441 gf_mul_a24(res.words(), a.words());
442 return res;
443}
Botan::Gf448Elem::words
std::span< uint64_t, WORDS_448 > words()
Accessor to the internal words of the GF element.
Definition curve448_gf.h:120

References Botan::Gf448Elem::words().

Referenced by Botan::Ed448Point::decode(), Botan::Ed448Point::operator+(), and x448().

◆ mul_mod()

template<WordType W, size_t N>
std::array< W, N > Botan::mul_mod ( const std::array< W, N > & x,
const std::array< W, N > & y,
const std::array< W, N > & p )
inlineconsteval

Definition at line 56 of file pcurves_util.h.

58 {
59 std::array<W, 2 * N> z = {};
60 comba_mul<N>(z.data(), x.data(), y.data());
61 return reduce_mod(z, p);
62}
Botan::comba_mul
constexpr void comba_mul(W z[2 *N], const W x[N], const W y[N])
Definition mp_core.h:801

References comba_mul(), and reduce_mod().

◆ multi_exponentiate()

EC_Point Botan::multi_exponentiate ( const EC_Point & p1,
const BigInt & z1,
const EC_Point & p2,
const BigInt & z2 )

ECC point multiexponentiation - not constant time!

Parameters
p1a point
z1a scalar
p2a point
z2a scalar
Returns
(p1 * z1 + p2 * z2)

Definition at line 36 of file point_mul.cpp.

36 {
37 const EC_Point_Multi_Point_Precompute xy_mul(x, y);
38 return xy_mul.multi_exp(z1, z2);
39}
Botan::EC_Point_Multi_Point_Precompute
Definition point_mul.h:64

References Botan::EC_Point_Multi_Point_Precompute::multi_exp().

◆ mulx_polyval()

BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 Botan::mulx_polyval ( const SIMD_4x32 & h)

Definition at line 92 of file polyval_fn.h.

92 {
93 const auto V = SIMD_4x32(0x00000001, 0x00000000, 0x00000000, 0xc2000000);
94
95 // Bitmask set iff the top bit of h is set
96 const auto mask = h.top_bit_mask();
97
98 // Extract the top bits of the words and move them into place as the low bit of the next word
99 auto top_bits = h.shr<31>().shift_elems_left<1>();
100
101 // The main shift, adding back in the top bits that are otherwise lost
102 auto shifted_h = h.shl<1>() | top_bits;
103
104 return shifted_h ^ (mask & V);
105}
Botan::SIMD_4x32::top_bit_mask
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 top_bit_mask() const
Definition simd_4x32.h:883
Botan::SIMD_4x32::shr
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shr() const noexcept
Definition simd_4x32.h:520
Botan::SIMD_4x32::shl
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shl() const noexcept
Definition simd_4x32.h:500

References BOTAN_FORCE_INLINE, Botan::SIMD_4x32::shl(), Botan::SIMD_4x32::shr(), and Botan::SIMD_4x32::top_bit_mask().

◆ nist_key_unwrap() [1/2]

secure_vector< uint8_t > Botan::nist_key_unwrap ( const uint8_t input[],
size_t input_len,
const BlockCipher & bc )
Parameters
inputthe value to be decrypted, output of nist_key_wrap
input_lenlength of input
bca keyed 128-bit block cipher that will be used to decrypt input
Returns
input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 116 of file nist_keywrap.cpp.

116 {
117 if(bc.block_size() != 16) {
118 throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
119 }
120
121 if(input_len < 16 || input_len % 8 != 0) {
122 throw Invalid_Argument("Bad input size for NIST key unwrap");
123 }
124
125 const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
126
127 uint64_t ICV_out = 0;
128 secure_vector<uint8_t> R;
129
130 if(input_len == 16) {
131 secure_vector<uint8_t> block(input, input + input_len);
132 bc.decrypt(block);
133
134 ICV_out = load_be<uint64_t>(block.data(), 0);
135 R.resize(8);
136 copy_mem(R.data(), block.data() + 8, 8);
137 } else {
138 R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
139 }
140
141 if(ICV_out != ICV) {
142 throw Invalid_Authentication_Tag("NIST key unwrap failed");
143 }
144
145 return R;
146}
Botan::BlockCipher::decrypt
void decrypt(const uint8_t in[], uint8_t out[]) const
Definition block_cipher.h:91
Botan::BlockCipher::block_size
virtual size_t block_size() const =0
Botan::Invalid_Authentication_Tag
Definition exceptn.h:274

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::decrypt(), and load_be().

Referenced by botan_nist_kw_dec(), nist_key_unwrap(), and rfc3394_keyunwrap().

◆ nist_key_unwrap() [2/2]

secure_vector< uint8_t > Botan::nist_key_unwrap ( std::span< const uint8_t > input,
const BlockCipher & bc )
inline
Parameters
inputthe value to be decrypted, output of nist_key_wrap
bca keyed 128-bit block cipher that will be used to decrypt input
Returns
input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 53 of file nist_keywrap.h.

53 {
54 return nist_key_unwrap(input.data(), input.size(), bc);
55}
Botan::nist_key_unwrap
secure_vector< uint8_t > nist_key_unwrap(const uint8_t input[], size_t input_len, const BlockCipher &bc)
Definition nist_keywrap.cpp:116

References nist_key_unwrap().

◆ nist_key_unwrap_padded() [1/2]

secure_vector< uint8_t > Botan::nist_key_unwrap_padded ( const uint8_t input[],
size_t input_len,
const BlockCipher & bc )
Parameters
inputthe value to be decrypted, output of nist_key_wrap
input_lenlength of input
bca keyed 128-bit block cipher that will be used to decrypt input
Returns
input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 169 of file nist_keywrap.cpp.

169 {
170 if(bc.block_size() != 16) {
171 throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
172 }
173
174 if(input_len < 16 || input_len % 8 != 0) {
175 throw Invalid_Argument("Bad input size for NIST key unwrap");
176 }
177
178 uint64_t ICV_out = 0;
179 secure_vector<uint8_t> R;
180
181 if(input_len == 16) {
182 secure_vector<uint8_t> block(input, input + input_len);
183 bc.decrypt(block);
184
185 ICV_out = load_be<uint64_t>(block.data(), 0);
186 R.resize(8);
187 copy_mem(R.data(), block.data() + 8, 8);
188 } else {
189 R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
190 }
191
192 if((ICV_out >> 32) != 0xA65959A6) {
193 throw Invalid_Authentication_Tag("NIST key unwrap failed");
194 }
195
196 const size_t len = (ICV_out & 0xFFFFFFFF);
197
198 if(R.size() < 8 || len > R.size() || len <= R.size() - 8) {
199 throw Invalid_Authentication_Tag("NIST key unwrap failed");
200 }
201
202 const size_t padding = R.size() - len;
203
204 for(size_t i = 0; i != padding; ++i) {
205 if(R[R.size() - i - 1] != 0) {
206 throw Invalid_Authentication_Tag("NIST key unwrap failed");
207 }
208 }
209
210 R.resize(R.size() - padding);
211
212 return R;
213}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::decrypt(), and load_be().

Referenced by botan_nist_kw_dec(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::list_names(), and nist_key_unwrap_padded().

◆ nist_key_unwrap_padded() [2/2]

secure_vector< uint8_t > Botan::nist_key_unwrap_padded ( std::span< const uint8_t > input,
const BlockCipher & bc )
inline
Parameters
inputthe value to be decrypted, output of nist_key_wrap
bca keyed 128-bit block cipher that will be used to decrypt input
Returns
input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 93 of file nist_keywrap.h.

93 {
94 return nist_key_unwrap_padded(input.data(), input.size(), bc);
95}
Botan::nist_key_unwrap_padded
secure_vector< uint8_t > nist_key_unwrap_padded(const uint8_t input[], size_t input_len, const BlockCipher &bc)
Definition nist_keywrap.cpp:169

References nist_key_unwrap_padded().

◆ nist_key_wrap() [1/2]

std::vector< uint8_t > Botan::nist_key_wrap ( const uint8_t input[],
size_t input_len,
const BlockCipher & bc )

Key wrap. See RFC 3394 and NIST SP800-38F

Parameters
inputthe value to be encrypted
input_lenlength of input, must be a multiple of 8
bca keyed 128-bit block cipher that will be used to encrypt input
Returns
input encrypted under NIST key wrap algorithm

Definition at line 90 of file nist_keywrap.cpp.

90 {
91 if(bc.block_size() != 16) {
92 throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
93 }
94
95 if(input_len % 8 != 0) {
96 throw Invalid_Argument("Bad input size for NIST key wrap");
97 }
98
99 const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
100
101 if(input_len == 8) {
102 /*
103 * Special case for small inputs: if input == 8 bytes just use ECB
104 * (see RFC 3394 Section 2)
105 */
106 std::vector<uint8_t> block(16);
107 store_be(ICV, block.data());
108 copy_mem(block.data() + 8, input, input_len);
109 bc.encrypt(block);
110 return block;
111 } else {
112 return raw_nist_key_wrap(input, input_len, bc, ICV);
113 }
114}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::encrypt(), and store_be().

Referenced by botan_nist_kw_enc(), nist_key_wrap(), and rfc3394_keywrap().

◆ nist_key_wrap() [2/2]

std::vector< uint8_t > Botan::nist_key_wrap ( std::span< const uint8_t > input,
const BlockCipher & bc )
inline

Key wrap. See RFC 3394 and NIST SP800-38F

Parameters
inputthe value to be encrypted
bca keyed 128-bit block cipher that will be used to encrypt input
Returns
input encrypted under NIST key wrap algorithm

Definition at line 33 of file nist_keywrap.h.

33 {
34 return nist_key_wrap(input.data(), input.size(), bc);
35}
Botan::nist_key_wrap
std::vector< uint8_t > nist_key_wrap(const uint8_t input[], size_t input_len, const BlockCipher &bc)
Definition nist_keywrap.cpp:90

References nist_key_wrap().

◆ nist_key_wrap_padded() [1/2]

std::vector< uint8_t > Botan::nist_key_wrap_padded ( const uint8_t input[],
size_t input_len,
const BlockCipher & bc )

KWP (key wrap with padding). See RFC 5649 and NIST SP800-38F

Parameters
inputthe value to be encrypted
input_lenlength of input
bca keyed 128-bit block cipher that will be used to encrypt input
Returns
input encrypted under NIST key wrap algorithm

Definition at line 148 of file nist_keywrap.cpp.

148 {
149 if(bc.block_size() != 16) {
150 throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
151 }
152
153 const uint64_t ICV = 0xA65959A600000000 | static_cast<uint32_t>(input_len);
154
155 if(input_len <= 8) {
156 /*
157 * Special case for small inputs: if input <= 8 bytes just use ECB
158 */
159 std::vector<uint8_t> block(16);
160 store_be(ICV, block.data());
161 copy_mem(block.data() + 8, input, input_len);
162 bc.encrypt(block);
163 return block;
164 } else {
165 return raw_nist_key_wrap(input, input_len, bc, ICV);
166 }
167}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::encrypt(), and store_be().

Referenced by botan_nist_kw_enc(), Botan::Encrypted_PSK_Database::get(), nist_key_wrap_padded(), Botan::Encrypted_PSK_Database::remove(), and Botan::Encrypted_PSK_Database::set().

◆ nist_key_wrap_padded() [2/2]

std::vector< uint8_t > Botan::nist_key_wrap_padded ( std::span< const uint8_t > input,
const BlockCipher & bc )
inline

KWP (key wrap with padding). See RFC 5649 and NIST SP800-38F

Parameters
inputthe value to be encrypted
bca keyed 128-bit block cipher that will be used to encrypt input
Returns
input encrypted under NIST key wrap algorithm

Definition at line 73 of file nist_keywrap.h.

73 {
74 return nist_key_wrap_padded(input.data(), input.size(), bc);
75}
Botan::nist_key_wrap_padded
std::vector< uint8_t > nist_key_wrap_padded(const uint8_t input[], size_t input_len, const BlockCipher &bc)
Definition nist_keywrap.cpp:148

References nist_key_wrap_padded().

◆ oaep_find_delim()

BOTAN_FUZZER_API CT::Option< size_t > Botan::oaep_find_delim ( std::span< const uint8_t > input,
std::span< const uint8_t > phash )

Definition at line 102 of file oaep.cpp.

102 {
103 // Too short to be valid, reject immediately
104 if(input.size() < 1 + 2 * phash.size()) {
105 return {};
106 }
107
108 size_t delim_idx = 2 * phash.size();
109 CT::Mask<uint8_t> waiting_for_delim = CT::Mask<uint8_t>::set();
110 CT::Mask<uint8_t> bad_input_m = CT::Mask<uint8_t>::cleared();
111
112 for(const uint8_t ib : input.subspan(2 * phash.size())) {
113 const auto zero_m = CT::Mask<uint8_t>::is_zero(ib);
114 const auto one_m = CT::Mask<uint8_t>::is_equal(ib, 1);
115
116 const auto add_m = waiting_for_delim & zero_m;
117
118 bad_input_m |= waiting_for_delim & ~(zero_m | one_m);
119
120 delim_idx += add_m.if_set_return(1);
121
122 waiting_for_delim &= zero_m;
123 }
124
125 // If we never saw any non-zero byte, then it's not valid input
126 bad_input_m |= waiting_for_delim;
127
128 // If the P hash is wrong, then it's not valid
129 bad_input_m |= CT::is_not_equal(&input[phash.size()], phash.data(), phash.size());
130
131 delim_idx += 1;
132
133 const auto accept = !(bad_input_m.as_choice());
134
135 return CT::Option(delim_idx, accept);
136}
Botan::CT::Mask::set
static constexpr Mask< T > set()
Definition ct_utils.h:382
Botan::CT::is_not_equal
constexpr CT::Mask< T > is_not_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:838

References Botan::CT::Mask< T >::as_choice(), Botan::CT::Mask< T >::cleared(), Botan::CT::Mask< T >::if_set_return(), Botan::CT::Mask< T >::is_equal(), Botan::CT::is_not_equal(), Botan::CT::Mask< T >::is_zero(), and Botan::CT::Mask< T >::set().

◆ operator!=() [1/11]

bool Botan::operator!= ( const AlgorithmIdentifier & a1,
const AlgorithmIdentifier & a2 )

Definition at line 68 of file alg_id.cpp.

68 {
69 return !(a1 == a2);
70}

◆ operator!=() [2/11]

bool Botan::operator!= ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 271 of file asn1_time.cpp.

271 {
272 return (t1.cmp(t2) != 0);
273}
Botan::ASN1_Time::cmp
int32_t cmp(const ASN1_Time &other) const
Compare this time against another.
Definition asn1_time.cpp:116

References Botan::ASN1_Time::cmp().

◆ operator!=() [3/11]

bool Botan::operator!= ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1140 of file bigint.h.

1140 {
1141 return !a.is_equal(b);
1142}
Botan::BigInt::is_equal
bool is_equal(const BigInt &n) const
Definition bigint.cpp:156

References Botan::BigInt::is_equal().

◆ operator!=() [4/11]

bool Botan::operator!= ( const BigInt & a,
word b )
inline

Definition at line 1164 of file bigint.h.

1164 {
1165 return (a.cmp_word(b) != 0);
1166}
Botan::BigInt::cmp_word
int32_t cmp_word(word n) const
Definition bigint.cpp:122

References Botan::BigInt::cmp_word().

◆ operator!=() [5/11]

bool Botan::operator!= ( const CRL_Entry & lhs,
const CRL_Entry & rhs )

Test two CRL entries for inequality in at least one field.

Definition at line 60 of file crl_ent.cpp.

60 {
61 return !(a1 == a2);
62}

◆ operator!=() [6/11]

bool Botan::operator!= ( const EC_Group & lhs,
const EC_Group & rhs )
inline

Definition at line 736 of file ec_group.h.

736 {
737 return !(lhs == rhs);
738}

◆ operator!=() [7/11]

bool Botan::operator!= ( const OctetString & x,
const OctetString & y )

Compare two strings

Parameters
xan octet string
yan octet string
Returns
if x is not equal to y

Definition at line 92 of file symkey.cpp.

92 {
93 return !(s1 == s2);
94}

◆ operator!=() [8/11]

bool Botan::operator!= ( const OID & a,
const OID & b )
inline

Compare two OIDs.

Parameters
athe first OID
bthe second OID
Returns
true if a is not equal to b

Definition at line 342 of file asn1_obj.h.

342 {
343 return !(a == b);
344}

◆ operator!=() [9/11]

template<typename T, typename U>
bool Botan::operator!= ( const secure_allocator< T > & ,
const secure_allocator< U > &  )
inline

Definition at line 63 of file secmem.h.

63 {
64 return false;
65}

◆ operator!=() [10/11]

bool Botan::operator!= ( const X509_Certificate & cert1,
const X509_Certificate & cert2 )

Check two certificates for inequality

Parameters
cert1The first certificate
cert2The second certificate
Returns
true if the arguments represent different certificates, false if they are binary identical

Definition at line 714 of file x509cert.cpp.

714 {
715 return !(cert1 == cert2);
716}

◆ operator!=() [11/11]

bool Botan::operator!= ( const X509_DN & dn1,
const X509_DN & dn2 )

Definition at line 257 of file x509_dn.cpp.

257 {
258 return !(dn1 == dn2);
259}

◆ operator%() [1/2]

BigInt Botan::operator% ( const BigInt & n,
const BigInt & mod )

Definition at line 134 of file big_ops3.cpp.

134 {
135 if(mod.is_zero()) {
136 throw Invalid_Argument("BigInt::operator% divide by zero");
137 }
138 if(mod.is_negative()) {
139 throw Invalid_Argument("BigInt::operator% modulus must be > 0");
140 }
141 if(n.is_positive() && mod.is_positive() && n < mod) {
142 return n;
143 }
144
145 if(mod.sig_words() == 1) {
146 return BigInt::from_word(n % mod.word_at(0));
147 }
148
149 BigInt q;
150 BigInt r;
151 vartime_divide(n, mod, q, r);
152 return r;
153}
Botan::vartime_divide
void vartime_divide(const BigInt &x, const BigInt &y_arg, BigInt &q_out, BigInt &r_out)
Definition divide.cpp:325

References Botan::BigInt::from_word(), Botan::BigInt::is_negative(), Botan::BigInt::is_positive(), Botan::BigInt::is_zero(), Botan::BigInt::sig_words(), vartime_divide(), and Botan::BigInt::word_at().

◆ operator%() [2/2]

word Botan::operator% ( const BigInt & n,
word mod )

Definition at line 158 of file big_ops3.cpp.

158 {
159 if(mod == 0) {
160 throw Invalid_Argument("BigInt::operator% divide by zero");
161 }
162
163 if(mod == 1) {
164 return 0;
165 }
166
167 word remainder = 0;
168
169 if(n.is_positive() && is_power_of_2(mod)) {
170 remainder = (n.word_at(0) & (mod - 1));
171 } else {
172 const divide_precomp redc_mod(mod);
173 const size_t sw = n.sig_words();
174 for(size_t i = sw; i > 0; --i) {
175 remainder = redc_mod.vartime_mod_2to1(remainder, n.word_at(i - 1));
176 }
177 }
178
179 if(remainder != 0 && n.sign() == BigInt::Negative) {
180 return mod - remainder;
181 }
182 return remainder;
183}
Botan::BigInt::sign
Sign sign() const
Definition bigint.h:587
Botan::divide_precomp
Definition mp_core.h:559
Botan::is_power_of_2
BOTAN_FORCE_INLINE constexpr bool is_power_of_2(T arg)
Definition bit_ops.h:62

References Botan::BigInt::is_positive(), is_power_of_2(), Botan::BigInt::Negative, Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::divide_precomp< W >::vartime_mod_2to1(), and Botan::BigInt::word_at().

◆ operator&() [1/5]

template<bitvectorish T1, bitvectorish T2>
auto Botan::operator& ( const T1 & lhs,
const T2 & rhs )

Definition at line 1335 of file bitvector.h.

1335 {
1336 auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
1337 res &= rhs;
1338 return res;
1339}
Botan::detail::copy_lhs_allocator_aware
constexpr auto copy_lhs_allocator_aware(const T1 &lhs, const T2 &)
Definition bitvector.h:1314

References Botan::detail::copy_lhs_allocator_aware().

◆ operator&() [2/5]

ECIES_Flags Botan::operator& ( ECIES_Flags a,
ECIES_Flags b )
inline

Definition at line 70 of file ecies.h.

70 {
71 return static_cast<ECIES_Flags>(static_cast<uint32_t>(a) & static_cast<uint32_t>(b));
72}
Botan::ECIES_Flags
ECIES_Flags
Definition ecies.h:44

◆ operator&() [3/5]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator& ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 445 of file strong_type.h.

445 {
446 return Strong<T, Tags...>(a.get() & b.get());
447}

References Botan::detail::Strong_Base< T >::get().

◆ operator&() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator& ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 440 of file strong_type.h.

440 {
441 return Strong<T1, Tags...>(a.get() & b);
442}

References Botan::detail::Strong_Base< T >::get().

◆ operator&() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator& ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 434 of file strong_type.h.

434 {
435 return Strong<T2, Tags...>(a & b.get());
436}

References Botan::detail::Strong_Base< T >::get().

◆ operator&=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator&= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 573 of file strong_type.h.

573 {
574 a.get() &= b.get();
575 return a;
576}

References Botan::detail::Strong_Base< T >::get().

◆ operator&=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator&= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 567 of file strong_type.h.

567 {
568 a.get() &= b;
569 return a;
570}

References Botan::detail::Strong_Base< T >::get().

◆ operator*() [1/12]

EC_Point Botan::operator* ( const BigInt & scalar,
const EC_Point & point )
inline

Definition at line 399 of file ec_point.h.

399 {
400 return point.mul(scalar);
401}
Botan::EC_Point::mul
EC_Point mul(const BigInt &scalar) const
Definition ec_point.cpp:497

References Botan::EC_Point::mul().

◆ operator*() [2/12]

BigInt Botan::operator* ( const BigInt & x,
const BigInt & y )

Definition at line 57 of file big_ops3.cpp.

57 {
58 const size_t x_sw = x.sig_words();
59 const size_t y_sw = y.sig_words();
60
61 BigInt z = BigInt::with_capacity(x.size() + y.size());
62
63 if(x_sw == 1 && y_sw > 0) {
64 bigint_linmul3(z.mutable_data(), y._data(), y_sw, x.word_at(0));
65 } else if(y_sw == 1 && x_sw > 0) {
66 bigint_linmul3(z.mutable_data(), x._data(), x_sw, y.word_at(0));
67 } else if(x_sw > 0 && y_sw > 0) {
68 secure_vector<word> workspace(z.size());
69
70 bigint_mul(z.mutable_data(),
71 z.size(),
72 x._data(),
73 x.size(),
74 x_sw,
75 y._data(),
76 y.size(),
77 y_sw,
78 workspace.data(),
79 workspace.size());
80 }
81
82 z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
83
84 return z;
85}
Botan::BigInt::mutable_data
word * mutable_data()
Definition bigint.h:656
Botan::BigInt::size
size_t size() const
Definition bigint.h:625
Botan::BigInt::cond_flip_sign
void cond_flip_sign(bool predicate)
Definition bigint.cpp:515
Botan::bigint_mul
void bigint_mul(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, const word y[], size_t y_size, size_t y_sw, word workspace[], size_t ws_size)
Definition mp_karat.cpp:283

References Botan::BigInt::_data(), bigint_linmul3(), bigint_mul(), Botan::BigInt::cond_flip_sign(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::BigInt::size(), Botan::BigInt::with_capacity(), and Botan::BigInt::word_at().

◆ operator*() [3/12]

BigInt Botan::operator* ( const BigInt & x,
word y )

Definition at line 90 of file big_ops3.cpp.

90 {
91 const size_t x_sw = x.sig_words();
92
93 BigInt z = BigInt::with_capacity(x_sw + 1);
94
95 if(x_sw > 0 && y > 0) {
96 bigint_linmul3(z.mutable_data(), x._data(), x_sw, y);
97 z.set_sign(x.sign());
98 }
99
100 return z;
101}
Botan::BigInt::set_sign
void set_sign(Sign sign)
Definition bigint.h:608

References Botan::BigInt::_data(), bigint_linmul3(), Botan::BigInt::mutable_data(), Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), and Botan::BigInt::with_capacity().

◆ operator*() [4/12]

template<std::integral T>
donna128 Botan::operator* ( const donna128 & x,
T y )
inlineconstexpr

Definition at line 95 of file donna128.h.

95 {
96 BOTAN_ARG_CHECK(x.hi() == 0, "High 64 bits of donna128 set to zero during multiply");
97
98 uint64_t lo = 0;
99 uint64_t hi = 0;
100 mul64x64_128(x.lo(), static_cast<uint64_t>(y), &lo, &hi);
101 return donna128(lo, hi);
102}
Botan::donna128::hi
constexpr uint64_t hi() const
Definition donna128.h:85
Botan::mul64x64_128
constexpr void mul64x64_128(uint64_t a, uint64_t b, uint64_t *lo, uint64_t *hi)
Definition mul128.h:24

References BOTAN_ARG_CHECK, Botan::donna128::hi(), Botan::donna128::lo(), and mul64x64_128().

◆ operator*() [5/12]

EC_Point Botan::operator* ( const EC_Point & point,
const BigInt & scalar )
inline

Definition at line 395 of file ec_point.h.

395 {
396 return point.mul(scalar);
397}

References Botan::EC_Point::mul().

◆ operator*() [6/12]

Ed25519_FieldElement Botan::operator* ( const Ed25519_FieldElement & x,
const Ed25519_FieldElement & y )
inline

Definition at line 148 of file ed25519_fe.h.

148 {
149 return Ed25519_FieldElement::mul(x, y);
150}
Botan::Ed25519_FieldElement::mul
static Ed25519_FieldElement mul(const Ed25519_FieldElement &a, const Ed25519_FieldElement &b)
Definition ed25519_fe.cpp:105

References Botan::Ed25519_FieldElement::mul().

◆ operator*() [7/12]

Ed448Point Botan::operator* ( const Scalar448 & lhs,
const Ed448Point & rhs )

Syntax sugar for scalar multiplication.

Definition at line 365 of file ed448_internal.cpp.

365 {
366 return rhs.scalar_mul(lhs);
367}
Botan::Ed448Point::scalar_mul
Ed448Point scalar_mul(const Scalar448 &scalar) const
Scalar multiplication.
Definition ed448_internal.cpp:189

References Botan::Ed448Point::scalar_mul().

◆ operator*() [8/12]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator* ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 394 of file strong_type.h.

394 {
395 return Strong<T, Tags...>(a.get() * b.get());
396}

References Botan::detail::Strong_Base< T >::get().

◆ operator*() [9/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator* ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 389 of file strong_type.h.

389 {
390 return Strong<T1, Tags...>(a.get() * b);
391}

References Botan::detail::Strong_Base< T >::get().

◆ operator*() [10/12]

template<std::integral T>
donna128 Botan::operator* ( T y,
const donna128 & x )
inlineconstexpr

Definition at line 105 of file donna128.h.

105 {
106 return x * y;
107}

◆ operator*() [11/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator* ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 383 of file strong_type.h.

383 {
384 return Strong<T2, Tags...>(a * b.get());
385}

References Botan::detail::Strong_Base< T >::get().

◆ operator*() [12/12]

BigInt Botan::operator* ( word x,
const BigInt & y )
inline

Definition at line 1122 of file bigint.h.

1122 {
1123 return y * x;
1124}

◆ operator*=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator*= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 534 of file strong_type.h.

534 {
535 a.get() *= b.get();
536 return a;
537}

References Botan::detail::Strong_Base< T >::get().

◆ operator*=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator*= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 528 of file strong_type.h.

528 {
529 a.get() *= b;
530 return a;
531}

References Botan::detail::Strong_Base< T >::get().

◆ operator+() [1/11]

BigInt Botan::operator+ ( const BigInt & x,
const BigInt & y )
inline

Definition at line 1099 of file bigint.h.

1099 {
1100 return BigInt::add2(x, y._data(), y.sig_words(), y.sign());
1101}
Botan::BigInt::add2
static BigInt add2(const BigInt &x, const word y[], size_t y_words, Sign y_sign)
Definition big_ops3.cpp:20

References Botan::BigInt::_data(), Botan::BigInt::add2(), Botan::BigInt::sig_words(), and Botan::BigInt::sign().

◆ operator+() [2/11]

BigInt Botan::operator+ ( const BigInt & x,
word y )
inline

Definition at line 1103 of file bigint.h.

1103 {
1104 return BigInt::add2(x, &y, 1, BigInt::Positive);
1105}

References Botan::BigInt::add2(), and Botan::BigInt::Positive.

◆ operator+() [3/11]

donna128 Botan::operator+ ( const donna128 & x,
const donna128 & y )
inlineconstexpr

Definition at line 109 of file donna128.h.

109 {
110 donna128 z = x;
111 z += y;
112 return z;
113}

◆ operator+() [4/11]

donna128 Botan::operator+ ( const donna128 & x,
uint64_t y )
inlineconstexpr

Definition at line 115 of file donna128.h.

115 {
116 donna128 z = x;
117 z += y;
118 return z;
119}

◆ operator+() [5/11]

EC_Point Botan::operator+ ( const EC_Point & lhs,
const EC_Point & rhs )
inline

Definition at line 385 of file ec_point.h.

385 {
386 EC_Point tmp(lhs);
387 return tmp += rhs;
388}
Botan::EC_Point
Definition ec_point.h:32

◆ operator+() [6/11]

Ed25519_FieldElement Botan::operator+ ( const Ed25519_FieldElement & x,
const Ed25519_FieldElement & y )
inline

Definition at line 140 of file ed25519_fe.h.

140 {
141 return Ed25519_FieldElement::add(x, y);
142}
Botan::Ed25519_FieldElement::add
static Ed25519_FieldElement add(const Ed25519_FieldElement &a, const Ed25519_FieldElement &b)
Definition ed25519_fe.h:94

References Botan::Ed25519_FieldElement::add().

◆ operator+() [7/11]

OctetString Botan::operator+ ( const OctetString & x,
const OctetString & y )

Concatenate two strings

Parameters
xan octet string
yan octet string
Returns
x concatenated with y

Definition at line 99 of file symkey.cpp.

99 {
100 secure_vector<uint8_t> out;
101 out += k1.bits_of();
102 out += k2.bits_of();
103 return OctetString(out);
104}

References Botan::OctetString::bits_of(), and OctetString.

◆ operator+() [8/11]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator+ ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 360 of file strong_type.h.

360 {
361 return Strong<T, Tags...>(a.get() + b.get());
362}

References Botan::detail::Strong_Base< T >::get().

◆ operator+() [9/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator+ ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 355 of file strong_type.h.

355 {
356 return Strong<T1, Tags...>(a.get() + b);
357}

References Botan::detail::Strong_Base< T >::get().

◆ operator+() [10/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator+ ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 349 of file strong_type.h.

349 {
350 return Strong<T2, Tags...>(a + b.get());
351}

References Botan::detail::Strong_Base< T >::get().

◆ operator+() [11/11]

BigInt Botan::operator+ ( word x,
const BigInt & y )
inline

Definition at line 1107 of file bigint.h.

1107 {
1108 return y + x;
1109}

◆ operator++() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator++ ( Strong< T, Tags... > & a)
constexpr

Definition at line 625 of file strong_type.h.

625 {
626 ++a.get();
627 return a;
628}

References Botan::detail::Strong_Base< T >::get().

◆ operator++() [2/2]

template<std::integral T, typename... Tags>
auto Botan::operator++ ( Strong< T, Tags... > & a,
int  )
constexpr

Definition at line 618 of file strong_type.h.

618 {
619 auto tmp = a;
620 ++a.get();
621 return tmp;
622}

References Botan::detail::Strong_Base< T >::get().

Referenced by generate_dsa_primes().

◆ operator+=() [1/7]

template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > & Botan::operator+= ( std::vector< T, Alloc > & out,
const std::pair< const T *, L > & in )

Definition at line 108 of file secmem.h.

108 {
109 out.insert(out.end(), in.first, in.first + in.second);
110 return out;
111}

◆ operator+=() [2/7]

template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > & Botan::operator+= ( std::vector< T, Alloc > & out,
const std::pair< T *, L > & in )

Definition at line 114 of file secmem.h.

114 {
115 out.insert(out.end(), in.first, in.first + in.second);
116 return out;
117}

◆ operator+=() [3/7]

template<typename T, typename Alloc, typename Alloc2>
std::vector< T, Alloc > & Botan::operator+= ( std::vector< T, Alloc > & out,
const std::vector< T, Alloc2 > & in )

Definition at line 90 of file secmem.h.

90 {
91 out.insert(out.end(), in.begin(), in.end());
92 return out;
93}

◆ operator+=() [4/7]

template<typename T, typename Alloc>
std::vector< T, Alloc > & Botan::operator+= ( std::vector< T, Alloc > & out,
std::span< const T > in )

Definition at line 96 of file secmem.h.

96 {
97 out.insert(out.end(), in.begin(), in.end());
98 return out;
99}

◆ operator+=() [5/7]

template<typename T, typename Alloc>
std::vector< T, Alloc > & Botan::operator+= ( std::vector< T, Alloc > & out,
T in )

Definition at line 102 of file secmem.h.

102 {
103 out.push_back(in);
104 return out;
105}

◆ operator+=() [6/7]

template<std::integral T, typename... Tags>
auto Botan::operator+= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 508 of file strong_type.h.

508 {
509 a.get() += b.get();
510 return a;
511}

References Botan::detail::Strong_Base< T >::get().

◆ operator+=() [7/7]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator+= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 502 of file strong_type.h.

502 {
503 a.get() += b;
504 return a;
505}

References Botan::detail::Strong_Base< T >::get().

◆ operator-() [1/9]

BigInt Botan::operator- ( const BigInt & x,
const BigInt & y )
inline

Definition at line 1111 of file bigint.h.

1111 {
1112 return BigInt::add2(x, y._data(), y.sig_words(), y.reverse_sign());
1113}
Botan::BigInt::reverse_sign
Sign reverse_sign() const
Definition bigint.h:592

References Botan::BigInt::_data(), Botan::BigInt::add2(), Botan::BigInt::reverse_sign(), and Botan::BigInt::sig_words().

◆ operator-() [2/9]

BigInt Botan::operator- ( const BigInt & x,
word y )
inline

Definition at line 1115 of file bigint.h.

1115 {
1116 return BigInt::add2(x, &y, 1, BigInt::Negative);
1117}

References Botan::BigInt::add2(), and Botan::BigInt::Negative.

◆ operator-() [3/9]

EC_Point Botan::operator- ( const EC_Point & lhs)
inline

Definition at line 381 of file ec_point.h.

381 {
382 return EC_Point(lhs).negate();
383}
Botan::EC_Point::negate
EC_Point & negate()
Definition ec_point.h:133

References Botan::EC_Point::negate().

◆ operator-() [4/9]

EC_Point Botan::operator- ( const EC_Point & lhs,
const EC_Point & rhs )
inline

Definition at line 390 of file ec_point.h.

390 {
391 EC_Point tmp(lhs);
392 return tmp -= rhs;
393}

◆ operator-() [5/9]

Ed25519_FieldElement Botan::operator- ( const Ed25519_FieldElement & x)
inline

Definition at line 152 of file ed25519_fe.h.

152 {
153 return Ed25519_FieldElement::negate(x);
154}
Botan::Ed25519_FieldElement::negate
static Ed25519_FieldElement negate(const Ed25519_FieldElement &a)
Definition ed25519_fe.h:110

References Botan::Ed25519_FieldElement::negate().

◆ operator-() [6/9]

Ed25519_FieldElement Botan::operator- ( const Ed25519_FieldElement & x,
const Ed25519_FieldElement & y )
inline

Definition at line 144 of file ed25519_fe.h.

144 {
145 return Ed25519_FieldElement::sub(x, y);
146}
Botan::Ed25519_FieldElement::sub
static Ed25519_FieldElement sub(const Ed25519_FieldElement &a, const Ed25519_FieldElement &b)
Definition ed25519_fe.h:102

References Botan::Ed25519_FieldElement::sub().

◆ operator-() [7/9]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator- ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 377 of file strong_type.h.

377 {
378 return Strong<T, Tags...>(a.get() - b.get());
379}

References Botan::detail::Strong_Base< T >::get().

◆ operator-() [8/9]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator- ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 372 of file strong_type.h.

372 {
373 return Strong<T1, Tags...>(a.get() - b);
374}

References Botan::detail::Strong_Base< T >::get().

◆ operator-() [9/9]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator- ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 366 of file strong_type.h.

366 {
367 return Strong<T2, Tags...>(a - b.get());
368}

References Botan::detail::Strong_Base< T >::get().

◆ operator--() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator-- ( Strong< T, Tags... > & a)
constexpr

Definition at line 638 of file strong_type.h.

638 {
639 --a.get();
640 return a;
641}

References Botan::detail::Strong_Base< T >::get().

◆ operator--() [2/2]

template<std::integral T, typename... Tags>
auto Botan::operator-- ( Strong< T, Tags... > & a,
int  )
constexpr

Definition at line 631 of file strong_type.h.

631 {
632 auto tmp = a;
633 --a.get();
634 return tmp;
635}

References Botan::detail::Strong_Base< T >::get().

◆ operator-=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator-= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 521 of file strong_type.h.

521 {
522 a.get() -= b.get();
523 return a;
524}

References Botan::detail::Strong_Base< T >::get().

◆ operator-=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator-= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 515 of file strong_type.h.

515 {
516 a.get() -= b;
517 return a;
518}

References Botan::detail::Strong_Base< T >::get().

◆ operator/() [1/5]

BigInt Botan::operator/ ( const BigInt & x,
const BigInt & y )

Definition at line 106 of file big_ops3.cpp.

106 {
107 if(y.sig_words() == 1 && y.is_positive()) {
108 return x / y.word_at(0);
109 }
110
111 BigInt q;
112 BigInt r;
113 vartime_divide(x, y, q, r);
114 return q;
115}

References Botan::BigInt::is_positive(), Botan::BigInt::sig_words(), vartime_divide(), and Botan::BigInt::word_at().

◆ operator/() [2/5]

BigInt Botan::operator/ ( const BigInt & x,
word y )

Definition at line 120 of file big_ops3.cpp.

120 {
121 if(y == 0) {
122 throw Invalid_Argument("BigInt::operator/ divide by zero");
123 }
124
125 BigInt q;
126 word r = 0;
127 ct_divide_word(x, y, q, r);
128 return q;
129}

References ct_divide_word().

◆ operator/() [3/5]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator/ ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 411 of file strong_type.h.

411 {
412 return Strong<T, Tags...>(a.get() / b.get());
413}

References Botan::detail::Strong_Base< T >::get().

◆ operator/() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator/ ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 406 of file strong_type.h.

406 {
407 return Strong<T1, Tags...>(a.get() / b);
408}

References Botan::detail::Strong_Base< T >::get().

◆ operator/() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator/ ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 400 of file strong_type.h.

400 {
401 return Strong<T2, Tags...>(a / b.get());
402}

References Botan::detail::Strong_Base< T >::get().

◆ operator/=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator/= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 547 of file strong_type.h.

547 {
548 a.get() /= b.get();
549 return a;
550}

References Botan::detail::Strong_Base< T >::get().

◆ operator/=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator/= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 541 of file strong_type.h.

541 {
542 a.get() /= b;
543 return a;
544}

References Botan::detail::Strong_Base< T >::get().

◆ operator<() [1/5]

bool Botan::operator< ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 283 of file asn1_time.cpp.

283 {
284 return (t1.cmp(t2) < 0);
285}

References Botan::ASN1_Time::cmp().

◆ operator<() [2/5]

bool Botan::operator< ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1152 of file bigint.h.

1152 {
1153 return a.is_less_than(b);
1154}
Botan::BigInt::is_less_than
bool is_less_than(const BigInt &n) const
Definition bigint.cpp:164

References Botan::BigInt::is_less_than().

◆ operator<() [3/5]

bool Botan::operator< ( const BigInt & a,
word b )
inline

Definition at line 1176 of file bigint.h.

1176 {
1177 return (a.cmp_word(b) < 0);
1178}

References Botan::BigInt::cmp_word().

◆ operator<() [4/5]

bool Botan::operator< ( const OID & a,
const OID & b )

Compare two OIDs.

Parameters
athe first OID
bthe second OID
Returns
true if a is lexicographically smaller than b

Definition at line 173 of file asn1_oid.cpp.

173 {
174 const std::vector<uint32_t>& oid1 = a.get_components();
175 const std::vector<uint32_t>& oid2 = b.get_components();
176
177 return std::lexicographical_compare(oid1.begin(), oid1.end(), oid2.begin(), oid2.end());
178}

References Botan::OID::get_components().

◆ operator<() [5/5]

bool Botan::operator< ( const X509_DN & dn1,
const X509_DN & dn2 )

Definition at line 264 of file x509_dn.cpp.

264 {
265 auto attr1 = dn1.get_attributes();
266 auto attr2 = dn2.get_attributes();
267
268 // If they are not the same size, choose the smaller as the "lessor"
269 if(attr1.size() < attr2.size()) {
270 return true;
271 }
272 if(attr1.size() > attr2.size()) {
273 return false;
274 }
275
276 // We know they are the same # of elements, now compare the OIDs:
277 auto p1 = attr1.begin();
278 auto p2 = attr2.begin();
279
280 while(p1 != attr1.end() && p2 != attr2.end()) {
281 if(p1->first != p2->first) {
282 return (p1->first < p2->first);
283 }
284
285 ++p1;
286 ++p2;
287 }
288
289 // We know this is true because maps have the same size
290 BOTAN_ASSERT_NOMSG(p1 == attr1.end());
291 BOTAN_ASSERT_NOMSG(p2 == attr2.end());
292
293 // Now we know all elements have the same OIDs, compare
294 // their string values:
295
296 p1 = attr1.begin();
297 p2 = attr2.begin();
298 while(p1 != attr1.end() && p2 != attr2.end()) {
299 BOTAN_DEBUG_ASSERT(p1->first == p2->first);
300
301 // They may be binary different but same by X.500 rules, check this
302 if(!x500_name_cmp(p1->second, p2->second)) {
303 // If they are not (by X.500) the same string, pick the
304 // lexicographic first as the lessor
305 return (p1->second < p2->second);
306 }
307
308 ++p1;
309 ++p2;
310 }
311
312 // if we reach here, then the DNs should be identical
313 BOTAN_DEBUG_ASSERT(dn1 == dn2);
314 return false;
315}
Botan::X509_DN::get_attributes
std::multimap< OID, std::string > get_attributes() const
Definition x509_dn.cpp:113
Botan::x500_name_cmp
bool x500_name_cmp(std::string_view name1, std::string_view name2)
Definition x509_dn.cpp:32

References BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, Botan::X509_DN::get_attributes(), and x500_name_cmp().

◆ operator<<() [1/12]

BigInt Botan::operator<< ( const BigInt & x,
size_t shift )

Definition at line 188 of file big_ops3.cpp.

188 {
189 if(x.is_zero()) {
190 return BigInt::zero();
191 }
192
193 const size_t x_sw = x.sig_words();
194
195 const size_t new_size = x_sw + (shift + WordInfo<word>::bits - 1) / WordInfo<word>::bits;
196 BigInt y = BigInt::with_capacity(new_size);
197 bigint_shl2(y.mutable_data(), x._data(), x_sw, shift);
198 y.set_sign(x.sign());
199 return y;
200}
Botan::bigint_shl2
constexpr void bigint_shl2(W y[], const W x[], size_t x_size, size_t shift)
Definition mp_core.h:350

References Botan::BigInt::_data(), bigint_shl2(), Botan::BigInt::is_zero(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::BigInt::with_capacity(), and Botan::BigInt::zero().

◆ operator<<() [2/12]

int Botan::operator<< ( int out,
Pipe & pipe )

Stream output operator; dumps the results from pipe's default message to the output stream.

Parameters
outfile descriptor for an open output stream
pipethe pipe

Definition at line 18 of file fd_unix.cpp.

18 {
19 secure_vector<uint8_t> buffer(DefaultBufferSize);
20 while(pipe.remaining() > 0) {
21 size_t got = pipe.read(buffer.data(), buffer.size());
22 size_t position = 0;
23 while(got > 0) {
24 const ssize_t ret = ::write(fd, &buffer[position], got);
25 if(ret < 0) {
26 throw Stream_IO_Error("Pipe output operator (unixfd) has failed");
27 }
28
29 position += static_cast<size_t>(ret);
30 got -= static_cast<size_t>(ret);
31 }
32 }
33 return fd;
34}
Botan::Pipe::read
size_t read(uint8_t output[], size_t length) override
Definition pipe_rw.cpp:84
Botan::Pipe::remaining
size_t remaining(message_id msg=DEFAULT_MESSAGE) const
Definition pipe_rw.cpp:129
Botan::Stream_IO_Error
Definition exceptn.h:289
Botan::DefaultBufferSize
constexpr size_t DefaultBufferSize
Definition types.h:137

References DefaultBufferSize, Botan::Pipe::read(), and Botan::Pipe::remaining().

◆ operator<<() [3/12]

std::ostream & Botan::operator<< ( std::ostream & os,
const GeneralName & gn )

Definition at line 325 of file name_constraint.cpp.

325 {
326 os << gn.type() << ":" << gn.name();
327 return os;
328}
Botan::GeneralName::type
std::string type() const
Definition name_constraint.cpp:33
Botan::GeneralName::name
std::string name() const
Definition name_constraint.cpp:86

References Botan::GeneralName::name(), and Botan::GeneralName::type().

◆ operator<<() [4/12]

std::ostream & Botan::operator<< ( std::ostream & os,
const GeneralSubtree & gs )

Definition at line 349 of file name_constraint.cpp.

349 {
350 os << gs.base();
351 return os;
352}
Botan::GeneralSubtree::base
const GeneralName & base() const
Definition pkix_types.h:395

References Botan::GeneralSubtree::base().

◆ operator<<() [5/12]

template<typename T, typename... Tags>
requires (concepts::streamable<T>)
decltype(auto) Botan::operator<< ( std::ostream & os,
const Strong< T, Tags... > & v )

Definition at line 311 of file strong_type.h.

311 {
312 return os << v.get();
313}

References Botan::detail::Strong_Base< T >::get().

◆ operator<<() [6/12]

std::ostream & Botan::operator<< ( std::ostream & out,
const OID & oid )

Definition at line 300 of file asn1_oid.cpp.

300 {
301 out << oid.to_string();
302 return out;
303}
Botan::OID::to_string
std::string to_string() const
Definition asn1_oid.cpp:125

References Botan::OID::to_string().

◆ operator<<() [7/12]

std::ostream & Botan::operator<< ( std::ostream & out,
const X509_DN & dn )

Definition at line 409 of file x509_dn.cpp.

409 {
410 const auto& info = dn.dn_info();
411
412 for(size_t i = 0; i != info.size(); ++i) {
413 out << to_short_form(info[i].first) << "=\"";
414 for(const char c : info[i].second.value()) {
415 if(c == '\\' || c == '\"') {
416 out << "\\";
417 }
418 out << c;
419 }
420 out << "\"";
421
422 if(i + 1 < info.size()) {
423 out << ",";
424 }
425 }
426 return out;
427}
Botan::X509_DN::dn_info
const std::vector< std::pair< OID, ASN1_String > > & dn_info() const
Definition pkix_types.h:96

References Botan::X509_DN::dn_info().

◆ operator<<() [8/12]

std::ostream & Botan::operator<< ( std::ostream & out,
Pipe & pipe )

Stream output operator; dumps the results from pipe's default message to the output stream.

Parameters
outan output stream
pipethe pipe

Definition at line 19 of file pipe_io.cpp.

19 {
20 secure_vector<uint8_t> buffer(DefaultBufferSize);
21 while(stream.good() && pipe.remaining() > 0) {
22 const size_t got = pipe.read(buffer.data(), buffer.size());
23 stream.write(cast_uint8_ptr_to_char(buffer.data()), static_cast<std::streamsize>(got));
24 }
25 if(!stream.good()) {
26 throw Stream_IO_Error("Pipe output operator (iostream) has failed");
27 }
28 return stream;
29}
Botan::cast_uint8_ptr_to_char
const char * cast_uint8_ptr_to_char(const uint8_t *b)
Definition mem_ops.h:281

References cast_uint8_ptr_to_char(), DefaultBufferSize, Botan::Pipe::read(), and Botan::Pipe::remaining().

◆ operator<<() [9/12]

std::ostream & Botan::operator<< ( std::ostream & stream,
const BigInt & n )

Definition at line 19 of file big_io.cpp.

19 {
20 const auto stream_flags = stream.flags();
21 if((stream_flags & std::ios::oct) != 0) {
22 throw Invalid_Argument("Octal output of BigInt not supported");
23 }
24
25 const size_t base = (stream_flags & std::ios::hex) != 0 ? 16 : 10;
26
27 if(base == 10) {
28 stream << n.to_dec_string();
29 } else {
30 stream << n.to_hex_string();
31 }
32
33 if(!stream.good()) {
34 throw Stream_IO_Error("BigInt output operator has failed");
35 }
36 return stream;
37}
Botan::BigInt::to_dec_string
std::string to_dec_string() const
Definition big_code.cpp:40
Botan::BigInt::to_hex_string
std::string to_hex_string() const
Definition big_code.cpp:107

References Botan::BigInt::to_dec_string(), and Botan::BigInt::to_hex_string().

◆ operator<<() [10/12]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator<< ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 496 of file strong_type.h.

496 {
497 return Strong<T, Tags...>(a.get() << b.get());
498}

References Botan::detail::Strong_Base< T >::get().

◆ operator<<() [11/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator<< ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 491 of file strong_type.h.

491 {
492 return Strong<T1, Tags...>(a.get() << b);
493}

References Botan::detail::Strong_Base< T >::get().

◆ operator<<() [12/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator<< ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 485 of file strong_type.h.

485 {
486 return Strong<T2, Tags...>(a << b.get());
487}

References Botan::detail::Strong_Base< T >::get().

◆ operator<<=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator<<= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 612 of file strong_type.h.

612 {
613 a.get() <<= b.get();
614 return a;
615}

References Botan::detail::Strong_Base< T >::get().

◆ operator<<=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator<<= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 606 of file strong_type.h.

606 {
607 a.get() <<= b;
608 return a;
609}

References Botan::detail::Strong_Base< T >::get().

◆ operator<=() [1/3]

bool Botan::operator<= ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 275 of file asn1_time.cpp.

275 {
276 return (t1.cmp(t2) <= 0);
277}

References Botan::ASN1_Time::cmp().

◆ operator<=() [2/3]

bool Botan::operator<= ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1144 of file bigint.h.

1144 {
1145 return (a.cmp(b) <= 0);
1146}
Botan::BigInt::cmp
int32_t cmp(const BigInt &n, bool check_signs=true) const
Definition bigint.cpp:138

References Botan::BigInt::cmp().

◆ operator<=() [3/3]

bool Botan::operator<= ( const BigInt & a,
word b )
inline

Definition at line 1168 of file bigint.h.

1168 {
1169 return (a.cmp_word(b) <= 0);
1170}

References Botan::BigInt::cmp_word().

◆ operator<=>() [1/3]

template<typename T, typename... Tags>
requires (std::three_way_comparable<T>)
auto Botan::operator<=> ( const Strong< T, Tags... > & lhs,
const Strong< T, Tags... > & rhs )

Definition at line 323 of file strong_type.h.

323 {
324 return lhs.get() <=> rhs.get();
325}

References Botan::detail::Strong_Base< T >::get(), and operator<=>().

Referenced by operator<=>().

◆ operator<=>() [2/3]

template<std::integral T1, std::integral T2, typename... Tags>
auto Botan::operator<=> ( Strong< T1, Tags... > a,
T2 b )

Definition at line 333 of file strong_type.h.

333 {
334 return a.get() <=> b;
335}

References Botan::detail::Strong_Base< T >::get().

◆ operator<=>() [3/3]

template<std::integral T1, std::integral T2, typename... Tags>
auto Botan::operator<=> ( T1 a,
Strong< T2, Tags... > b )

Definition at line 328 of file strong_type.h.

328 {
329 return a <=> b.get();
330}

References Botan::detail::Strong_Base< T >::get().

◆ operator==() [1/13]

bool Botan::operator== ( const AlgorithmIdentifier & a1,
const AlgorithmIdentifier & a2 )

Definition at line 53 of file alg_id.cpp.

53 {
54 if(a1.oid() != a2.oid()) {
55 return false;
56 }
57
58 /*
59 * Treat NULL and empty as equivalent
60 */
61 if(a1.parameters_are_null_or_empty() && a2.parameters_are_null_or_empty()) {
62 return true;
63 }
64
65 return (a1.parameters() == a2.parameters());
66}
Botan::AlgorithmIdentifier::parameters_are_null_or_empty
bool parameters_are_null_or_empty() const
Definition asn1_obj.h:421
Botan::AlgorithmIdentifier::parameters
const std::vector< uint8_t > & parameters() const
Definition asn1_obj.h:409

References Botan::AlgorithmIdentifier::oid(), Botan::AlgorithmIdentifier::parameters(), and Botan::AlgorithmIdentifier::parameters_are_null_or_empty().

◆ operator==() [2/13]

bool Botan::operator== ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 267 of file asn1_time.cpp.

267 {
268 return (t1.cmp(t2) == 0);
269}

References Botan::ASN1_Time::cmp().

◆ operator==() [3/13]

bool Botan::operator== ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1136 of file bigint.h.

1136 {
1137 return a.is_equal(b);
1138}

◆ operator==() [4/13]

bool Botan::operator== ( const BigInt & a,
word b )
inline

Definition at line 1160 of file bigint.h.

1160 {
1161 return (a.cmp_word(b) == 0);
1162}

References Botan::BigInt::cmp_word().

◆ operator==() [5/13]

bool Botan::operator== ( const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient & lhs,
const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient & rhs )

Definition at line 72 of file cmce_poly.cpp.

73 {
74 return lhs.coeff == rhs.coeff && lhs.idx == rhs.idx;
75}
Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::idx
size_t idx
Definition cmce_poly.h:112
Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::coeff
Classic_McEliece_GF coeff
Definition cmce_poly.h:113

References Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::coeff, and Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::idx.

◆ operator==() [6/13]

bool Botan::operator== ( const CRL_Entry & lhs,
const CRL_Entry & rhs )

Test two CRL entries for equality in all fields.

Definition at line 44 of file crl_ent.cpp.

44 {
45 if(a1.serial_number() != a2.serial_number()) {
46 return false;
47 }
48 if(a1.expire_time() != a2.expire_time()) {
49 return false;
50 }
51 if(a1.reason_code() != a2.reason_code()) {
52 return false;
53 }
54 return true;
55}

References Botan::CRL_Entry::expire_time(), Botan::CRL_Entry::reason_code(), and Botan::CRL_Entry::serial_number().

◆ operator==() [7/13]

bool Botan::operator== ( const OctetString & x,
const OctetString & y )

Compare two strings

Parameters
xan octet string
yan octet string
Returns
if x is equal to y

Definition at line 85 of file symkey.cpp.

85 {
86 return (s1.bits_of() == s2.bits_of());
87}

References Botan::OctetString::bits_of().

◆ operator==() [8/13]

template<typename T, typename U>
bool Botan::operator== ( const secure_allocator< T > & ,
const secure_allocator< U > &  )
inline

Definition at line 58 of file secmem.h.

58 {
59 return true;
60}

◆ operator==() [9/13]

template<typename T, typename... Tags>
requires (std::equality_comparable<T>)
bool Botan::operator== ( const Strong< T, Tags... > & lhs,
const Strong< T, Tags... > & rhs )

Definition at line 317 of file strong_type.h.

317 {
318 return lhs.get() == rhs.get();
319}

References Botan::detail::Strong_Base< T >::get().

◆ operator==() [10/13]

template<bitvectorish T1, bitvectorish T2>
bool Botan::operator== ( const T1 & lhs,
const T2 & rhs )

Definition at line 1349 of file bitvector.h.

1349 {
1350 return lhs.equals_vartime(rhs);
1351}

◆ operator==() [11/13]

bool Botan::operator== ( const X509_DN & dn1,
const X509_DN & dn2 )

Definition at line 221 of file x509_dn.cpp.

221 {
222 auto attr1 = dn1.get_attributes();
223 auto attr2 = dn2.get_attributes();
224
225 if(attr1.size() != attr2.size()) {
226 return false;
227 }
228
229 auto p1 = attr1.begin();
230 auto p2 = attr2.begin();
231
232 while(true) {
233 if(p1 == attr1.end() && p2 == attr2.end()) {
234 break;
235 }
236 if(p1 == attr1.end()) {
237 return false;
238 }
239 if(p2 == attr2.end()) {
240 return false;
241 }
242 if(p1->first != p2->first) {
243 return false;
244 }
245 if(!x500_name_cmp(p1->second, p2->second)) {
246 return false;
247 }
248 ++p1;
249 ++p2;
250 }
251 return true;
252}

References Botan::X509_DN::get_attributes(), and x500_name_cmp().

◆ operator==() [12/13]

template<std::integral T1, std::integral T2, typename... Tags>
auto Botan::operator== ( Strong< T1, Tags... > a,
T2 b )

Definition at line 343 of file strong_type.h.

343 {
344 return a.get() == b;
345}

References Botan::detail::Strong_Base< T >::get().

◆ operator==() [13/13]

template<std::integral T1, std::integral T2, typename... Tags>
auto Botan::operator== ( T1 a,
Strong< T2, Tags... > b )

Definition at line 338 of file strong_type.h.

338 {
339 return a == b.get();
340}

References Botan::detail::Strong_Base< T >::get().

◆ operator>() [1/3]

bool Botan::operator> ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 287 of file asn1_time.cpp.

287 {
288 return (t1.cmp(t2) > 0);
289}

References Botan::ASN1_Time::cmp().

◆ operator>() [2/3]

bool Botan::operator> ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1156 of file bigint.h.

1156 {
1157 return b.is_less_than(a);
1158}

References Botan::BigInt::is_less_than().

◆ operator>() [3/3]

bool Botan::operator> ( const BigInt & a,
word b )
inline

Definition at line 1180 of file bigint.h.

1180 {
1181 return (a.cmp_word(b) > 0);
1182}

References Botan::BigInt::cmp_word().

◆ operator>=() [1/3]

bool Botan::operator>= ( const ASN1_Time & t1,
const ASN1_Time & t2 )

Definition at line 279 of file asn1_time.cpp.

279 {
280 return (t1.cmp(t2) >= 0);
281}

References Botan::ASN1_Time::cmp().

◆ operator>=() [2/3]

bool Botan::operator>= ( const BigInt & a,
const BigInt & b )
inline

Definition at line 1148 of file bigint.h.

1148 {
1149 return (a.cmp(b) >= 0);
1150}

References Botan::BigInt::cmp().

◆ operator>=() [3/3]

bool Botan::operator>= ( const BigInt & a,
word b )
inline

Definition at line 1172 of file bigint.h.

1172 {
1173 return (a.cmp_word(b) >= 0);
1174}

References Botan::BigInt::cmp_word().

◆ operator>>() [1/8]

BigInt Botan::operator>> ( const BigInt & x,
size_t shift )

Definition at line 205 of file big_ops3.cpp.

205 {
206 const size_t shift_words = shift / WordInfo<word>::bits;
207 const size_t x_sw = x.sig_words();
208
209 if(shift_words >= x_sw) {
210 return BigInt::zero();
211 }
212
213 BigInt y = BigInt::with_capacity(x_sw - shift_words);
214 bigint_shr2(y.mutable_data(), x._data(), x_sw, shift);
215
216 if(x.is_negative() && y.is_zero()) {
217 y.set_sign(BigInt::Positive);
218 } else {
219 y.set_sign(x.sign());
220 }
221
222 return y;
223}

References Botan::BigInt::_data(), bigint_shr2(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::Positive, Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::BigInt::with_capacity(), and Botan::BigInt::zero().

◆ operator>>() [2/8]

int Botan::operator>> ( int in,
Pipe & pipe )

File descriptor input operator; dumps the remaining bytes of input to the (assumed open) pipe message.

Parameters
infile descriptor for an open input stream
pipethe pipe

Definition at line 39 of file fd_unix.cpp.

39 {
40 secure_vector<uint8_t> buffer(DefaultBufferSize);
41 while(true) {
42 const ssize_t ret = ::read(fd, buffer.data(), buffer.size());
43 if(ret < 0) {
44 throw Stream_IO_Error("Pipe input operator (unixfd) has failed");
45 } else if(ret == 0) {
46 break;
47 }
48 pipe.write(buffer.data(), static_cast<size_t>(ret));
49 }
50 return fd;
51}
Botan::Pipe::write
void write(const uint8_t in[], size_t length)
Definition pipe_rw.cpp:42

References DefaultBufferSize, and Botan::Pipe::write().

◆ operator>>() [3/8]

std::istream & Botan::operator>> ( std::istream & in,
Pipe & pipe )

Stream input operator; dumps the remaining bytes of input to the (assumed open) pipe message.

Parameters
inthe input stream
pipethe pipe

Definition at line 34 of file pipe_io.cpp.

34 {
35 secure_vector<uint8_t> buffer(DefaultBufferSize);
36 while(stream.good()) {
37 stream.read(cast_uint8_ptr_to_char(buffer.data()), static_cast<std::streamsize>(buffer.size()));
38 const size_t got = static_cast<size_t>(stream.gcount());
39 pipe.write(buffer.data(), got);
40 }
41 if(stream.bad() || (stream.fail() && !stream.eof())) {
42 throw Stream_IO_Error("Pipe input operator (iostream) has failed");
43 }
44 return stream;
45}

References cast_uint8_ptr_to_char(), DefaultBufferSize, and Botan::Pipe::write().

◆ operator>>() [4/8]

std::istream & Botan::operator>> ( std::istream & in,
X509_DN & dn )

Definition at line 429 of file x509_dn.cpp.

429 {
430 in >> std::noskipws;
431 // NOLINTNEXTLINE(*-avoid-do-while)
432 do {
433 std::string key;
434 std::string val;
435 char c = 0;
436
437 while(in.good()) {
438 in >> c;
439
440 if(is_space(c) && key.empty()) {
441 continue;
442 } else if(!is_space(c)) {
443 key.push_back(c);
444 break;
445 } else {
446 break;
447 }
448 }
449
450 while(in.good()) {
451 in >> c;
452
453 if(!is_space(c) && c != '=') {
454 key.push_back(c);
455 } else if(c == '=') {
456 break;
457 } else {
458 throw Invalid_Argument("Ill-formed X.509 DN");
459 }
460 }
461
462 bool in_quotes = false;
463 while(in.good()) {
464 in >> c;
465
466 if(is_space(c)) {
467 if(!in_quotes && !val.empty()) {
468 break;
469 } else if(in_quotes) {
470 val.push_back(' ');
471 }
472 } else if(c == '"') {
473 in_quotes = !in_quotes;
474 } else if(c == '\\') {
475 if(in.good()) {
476 in >> c;
477 }
478 val.push_back(c);
479 } else if(c == ',' && !in_quotes) {
480 break;
481 } else {
482 val.push_back(c);
483 }
484 }
485
486 if(!key.empty() && !val.empty()) {
487 dn.add_attribute(X509_DN::deref_info_field(key), val);
488 } else {
489 break;
490 }
491 } while(in.good());
492 return in;
493}
Botan::X509_DN::add_attribute
void add_attribute(std::string_view key, std::string_view val)
Definition x509_dn.cpp:94
Botan::X509_DN::deref_info_field
static std::string deref_info_field(std::string_view key)
Definition x509_dn.cpp:190

References Botan::X509_DN::add_attribute(), and Botan::X509_DN::deref_info_field().

◆ operator>>() [5/8]

std::istream & Botan::operator>> ( std::istream & stream,
BigInt & n )

Definition at line 42 of file big_io.cpp.

42 {
43 std::string str;
44 std::getline(stream, str);
45 if(stream.bad() || (stream.fail() && !stream.eof())) {
46 throw Stream_IO_Error("BigInt input operator has failed");
47 }
48 n = BigInt(str);
49 return stream;
50}

◆ operator>>() [6/8]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator>> ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 479 of file strong_type.h.

479 {
480 return Strong<T, Tags...>(a.get() >> b.get());
481}

References Botan::detail::Strong_Base< T >::get().

◆ operator>>() [7/8]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator>> ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 474 of file strong_type.h.

474 {
475 return Strong<T1, Tags...>(a.get() >> b);
476}

References Botan::detail::Strong_Base< T >::get().

◆ operator>>() [8/8]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator>> ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 468 of file strong_type.h.

468 {
469 return Strong<T2, Tags...>(a >> b.get());
470}

References Botan::detail::Strong_Base< T >::get().

◆ operator>>=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator>>= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 599 of file strong_type.h.

599 {
600 a.get() >>= b.get();
601 return a;
602}

References Botan::detail::Strong_Base< T >::get().

◆ operator>>=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator>>= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 593 of file strong_type.h.

593 {
594 a.get() >>= b;
595 return a;
596}

References Botan::detail::Strong_Base< T >::get().

◆ operator^() [1/5]

OctetString Botan::operator^ ( const OctetString & x,
const OctetString & y )

XOR two strings

Parameters
xan octet string
yan octet string
Returns
x XORed with y

Definition at line 109 of file symkey.cpp.

109 {
110 secure_vector<uint8_t> out(std::max(k1.length(), k2.length()));
111
112 copy_mem(out.data(), k1.begin(), k1.length());
113 xor_buf(out.data(), k2.begin(), k2.length());
114 return OctetString(out);
115}

References Botan::OctetString::begin(), copy_mem(), Botan::OctetString::length(), OctetString, and xor_buf().

◆ operator^() [2/5]

template<bitvectorish T1, bitvectorish T2>
auto Botan::operator^ ( const T1 & lhs,
const T2 & rhs )

Definition at line 1342 of file bitvector.h.

1342 {
1343 auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
1344 res ^= rhs;
1345 return res;
1346}

References Botan::detail::copy_lhs_allocator_aware().

◆ operator^() [3/5]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator^ ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 428 of file strong_type.h.

428 {
429 return Strong<T, Tags...>(a.get() ^ b.get());
430}

References Botan::detail::Strong_Base< T >::get().

◆ operator^() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator^ ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 423 of file strong_type.h.

423 {
424 return Strong<T1, Tags...>(a.get() ^ b);
425}

References Botan::detail::Strong_Base< T >::get().

◆ operator^() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator^ ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 417 of file strong_type.h.

417 {
418 return Strong<T2, Tags...>(a ^ b.get());
419}

References Botan::detail::Strong_Base< T >::get().

◆ operator^=() [1/3]

template<typename Alloc, typename Alloc2>
std::vector< uint8_t, Alloc > & Botan::operator^= ( std::vector< uint8_t, Alloc > & out,
const std::vector< uint8_t, Alloc2 > & in )

Definition at line 445 of file mem_ops.h.

445 {
446 if(out.size() < in.size()) {
447 out.resize(in.size());
448 }
449
450 xor_buf(std::span{out}.first(in.size()), in);
451 return out;
452}

References xor_buf().

◆ operator^=() [2/3]

template<std::integral T, typename... Tags>
auto Botan::operator^= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 560 of file strong_type.h.

560 {
561 a.get() ^= b.get();
562 return a;
563}

References Botan::detail::Strong_Base< T >::get().

◆ operator^=() [3/3]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator^= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 554 of file strong_type.h.

554 {
555 a.get() ^= b;
556 return a;
557}

References Botan::detail::Strong_Base< T >::get().

◆ operator|() [1/11]

ASN1_Class Botan::operator| ( ASN1_Class x,
ASN1_Class y )
inline

Definition at line 78 of file asn1_obj.h.

78 {
79 return static_cast<ASN1_Class>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
80}
Botan::ASN1_Class
ASN1_Class
Definition asn1_obj.h:28

◆ operator|() [2/11]

uint32_t Botan::operator| ( ASN1_Class x,
ASN1_Type y )
inline

Definition at line 86 of file asn1_obj.h.

86 {
87 return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
88}

◆ operator|() [3/11]

uint32_t Botan::operator| ( ASN1_Type x,
ASN1_Class y )
inline

Definition at line 82 of file asn1_obj.h.

82 {
83 return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
84}

◆ operator|() [4/11]

ASN1_Type Botan::operator| ( ASN1_Type x,
ASN1_Type y )
inline

Definition at line 74 of file asn1_obj.h.

74 {
75 return static_cast<ASN1_Type>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
76}
Botan::ASN1_Type
ASN1_Type
Definition asn1_obj.h:43

◆ operator|() [5/11]

donna128 Botan::operator| ( const donna128 & x,
const donna128 & y )
inlineconstexpr

Definition at line 121 of file donna128.h.

121 {
122 return donna128(x.lo() | y.lo(), x.hi() | y.hi());
123}

References Botan::donna128::hi(), and Botan::donna128::lo().

◆ operator|() [6/11]

donna128 Botan::operator| ( const donna128 & x,
uint64_t y )
inlineconstexpr

Definition at line 125 of file donna128.h.

125 {
126 return donna128(x.lo() | y, x.hi());
127}

References Botan::donna128::hi(), and Botan::donna128::lo().

◆ operator|() [7/11]

template<bitvectorish T1, bitvectorish T2>
auto Botan::operator| ( const T1 & lhs,
const T2 & rhs )

Definition at line 1328 of file bitvector.h.

1328 {
1329 auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
1330 res |= rhs;
1331 return res;
1332}

References Botan::detail::copy_lhs_allocator_aware().

◆ operator|() [8/11]

ECIES_Flags Botan::operator| ( ECIES_Flags a,
ECIES_Flags b )
inline

Definition at line 65 of file ecies.h.

65 {
66 // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange)
67 return static_cast<ECIES_Flags>(static_cast<uint32_t>(a) | static_cast<uint32_t>(b));
68}

◆ operator|() [9/11]

template<std::integral T, typename... Tags>
decltype(auto) Botan::operator| ( Strong< T, Tags... > a,
Strong< T, Tags... > b )
constexpr

Definition at line 462 of file strong_type.h.

462 {
463 return Strong<T, Tags...>(a.get() | b.get());
464}

References Botan::detail::Strong_Base< T >::get().

◆ operator|() [10/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator| ( Strong< T1, Tags... > a,
T2 b )
constexpr

Definition at line 457 of file strong_type.h.

457 {
458 return Strong<T1, Tags...>(a.get() | b);
459}

References Botan::detail::Strong_Base< T >::get().

◆ operator|() [11/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
decltype(auto) Botan::operator| ( T1 a,
Strong< T2, Tags... > b )
constexpr

Definition at line 451 of file strong_type.h.

451 {
452 return Strong<T2, Tags...>(a | b.get());
453}

References Botan::detail::Strong_Base< T >::get().

◆ operator|=() [1/2]

template<std::integral T, typename... Tags>
auto Botan::operator|= ( Strong< T, Tags... > & a,
Strong< T, Tags... > b )
constexpr

Definition at line 586 of file strong_type.h.

586 {
587 a.get() |= b.get();
588 return a;
589}

References Botan::detail::Strong_Base< T >::get().

◆ operator|=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
auto Botan::operator|= ( Strong< T1, Tags... > & a,
T2 b )
constexpr

Definition at line 580 of file strong_type.h.

580 {
581 a.get() |= b;
582 return a;
583}

References Botan::detail::Strong_Base< T >::get().

◆ OS2ECP() [1/3]

EC_Point Botan::OS2ECP ( const uint8_t data[],
size_t data_len,
const CurveGFp & curve )

Perform point decoding Use EC_Group::OS2ECP instead

Definition at line 870 of file ec_point.cpp.

870 {
871 if(data_len == 1 && data[0] == 0) {
872 // SEC1 standard representation of the point at infinity
873 return EC_Point(curve);
874 }
875
876 const auto [g_x, g_y] = OS2ECP(data, data_len, curve.get_p(), curve.get_a(), curve.get_b());
877
878 EC_Point point(curve, g_x, g_y);
879
880 if(!point.on_the_curve()) {
881 throw Decoding_Error("OS2ECP: Decoded point was not on the curve");
882 }
883
884 return point;
885}
Botan::CurveGFp::get_a
const BigInt & get_a() const
Definition ec_point.cpp:37
Botan::CurveGFp::get_p
const BigInt & get_p() const
Definition ec_point.cpp:45
Botan::CurveGFp::get_b
const BigInt & get_b() const
Definition ec_point.cpp:41
Botan::OS2ECP
EC_Point OS2ECP(std::span< const uint8_t > data, const CurveGFp &curve)
Definition ec_point.cpp:866

References Botan::CurveGFp::get_a(), Botan::CurveGFp::get_b(), Botan::CurveGFp::get_p(), Botan::EC_Point::on_the_curve(), and OS2ECP().

◆ OS2ECP() [2/3]

std::pair< BigInt, BigInt > BOTAN_UNSTABLE_API Botan::OS2ECP ( const uint8_t data[],
size_t data_len,
const BigInt & curve_p,
const BigInt & curve_a,
const BigInt & curve_b )

Perform point decoding

This is an internal function which was accidentally made public. Do not use it; it will be removed in Botan4.

Parameters
datathe encoded point
data_lenlength of data in bytes
curve_pthe curve equation prime
curve_athe curve equation a parameter
curve_bthe curve equation b parameter

Definition at line 887 of file ec_point.cpp.

887 {
888 if(pt_len <= 1) {
889 throw Decoding_Error("OS2ECP invalid point encoding");
890 }
891
892 const uint8_t pc = pt[0];
893 const size_t p_bytes = p.bytes();
894
895 BigInt x;
896 BigInt y;
897
898 if(pc == 2 || pc == 3) {
899 if(pt_len != 1 + p_bytes) {
900 throw Decoding_Error("OS2ECP invalid point encoding");
901 }
902 x = BigInt::decode(&pt[1], pt_len - 1);
903
904 const bool y_mod_2 = ((pc & 0x01) == 1);
905 y = decompress_point(y_mod_2, x, p, a, b);
906 } else if(pc == 4) {
907 if(pt_len != 1 + 2 * p_bytes) {
908 throw Decoding_Error("OS2ECP invalid point encoding");
909 }
910
911 x = BigInt::decode(&pt[1], p_bytes);
912 y = BigInt::decode(&pt[p_bytes + 1], p_bytes);
913 } else if(pc == 6 || pc == 7) {
914 if(pt_len != 1 + 2 * p_bytes) {
915 throw Decoding_Error("OS2ECP invalid point encoding");
916 }
917
918 x = BigInt::decode(&pt[1], p_bytes);
919 y = BigInt::decode(&pt[p_bytes + 1], p_bytes);
920
921 const bool y_mod_2 = ((pc & 0x01) == 1);
922
923 if(decompress_point(y_mod_2, x, p, a, b) != y) {
924 throw Decoding_Error("OS2ECP: Decoding error in hybrid format");
925 }
926 } else {
927 throw Decoding_Error("OS2ECP: Unknown format type " + std::to_string(static_cast<int>(pc)));
928 }
929
930 if(x >= p || y >= p) {
931 throw Decoding_Error("OS2ECP invalid point encoding");
932 }
933
934 return std::make_pair(x, y);
935}
Botan::BigInt::decode
static BigInt decode(const uint8_t buf[], size_t length)
Definition bigint.h:873

References Botan::BigInt::bytes(), and Botan::BigInt::decode().

◆ OS2ECP() [3/3]

EC_Point BOTAN_UNSTABLE_API Botan::OS2ECP ( std::span< const uint8_t > data,
const CurveGFp & curve )

Definition at line 866 of file ec_point.cpp.

866 {
867 return OS2ECP(data.data(), data.size(), curve);
868}

References OS2ECP().

Referenced by OS2ECP(), OS2ECP(), and Botan::EC_Group_Data::point_deserialize().

◆ out_ptr()

template<typename T>
auto Botan::out_ptr ( T & outptr)
nodiscardconstexprnoexcept

Definition at line 127 of file stl_util.h.

127 {
128 class out_ptr_t {
129 public:
130 constexpr ~out_ptr_t() noexcept {
131 m_ptr.reset(m_rawptr);
132 m_rawptr = nullptr;
133 }
134
135 constexpr explicit out_ptr_t(T& outptr) noexcept : m_ptr(outptr), m_rawptr(nullptr) {}
136
137 out_ptr_t(const out_ptr_t&) = delete;
138 out_ptr_t(out_ptr_t&&) = delete;
139 out_ptr_t& operator=(const out_ptr_t&) = delete;
140 out_ptr_t& operator=(out_ptr_t&&) = delete;
141
142 // NOLINTNEXTLINE(*-explicit-conversions) - Implicit by design for C API interop
143 [[nodiscard]] constexpr operator typename T::element_type **() && noexcept { return &m_rawptr; }
144
145 private:
146 T& m_ptr;
147 typename T::element_type* m_rawptr;
148 };
149
150 return out_ptr_t{outptr};
151}

Referenced by Botan::TPM2::Object::_public_info(), base_decode(), Botan::TPM2::PrivateKey::create_transient_from_template(), Botan::TPM2::HashFunction::final_with_ticket(), hex_decode(), Botan::TPM2::Signature_Operation::sign(), Botan::TLS::Extensions::take(), and Botan::TPM2::Session::tpm_nonce().

◆ overloaded()

template<class... Ts>
Botan::overloaded ( Ts... ) ->overloaded< Ts... >

◆ P0()

uint32_t Botan::P0 ( uint32_t X)
inline

Definition at line 17 of file sm3_fn.h.

17 {
18 return X ^ rotl<9>(X) ^ rotl<17>(X);
19}

References rotl().

Referenced by R1(), R2(), and redc_crandall().

◆ P1()

uint32_t Botan::P1 ( uint32_t X)
inline

Definition at line 65 of file sm3_fn.h.

65 {
66 return X ^ rotl<15>(X) ^ rotl<23>(X);
67}

References rotl().

Referenced by SM3_E().

◆ p_div_2_plus_1()

template<WordType W, size_t N>
std::array< W, N > Botan::p_div_2_plus_1 ( const std::array< W, N > & p)
inlineconsteval

Definition at line 206 of file pcurves_util.h.

206 {
207 const W one = 1;
208 std::array<W, N> r = p;
209 shift_right<1>(r);
210 bigint_add2(r.data(), N, &one, 1);
211 return r;
212}
Botan::bigint_add2
constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W
Definition mp_core.h:94
Botan::shift_right
constexpr W shift_right(std::array< W, N > &x)
Definition mp_core.h:727

References bigint_add2(), and shift_right().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::_invert_vartime_div2_helper(), and Botan::IntMod< MontgomeryRep< ScalarParams > >::div2().

◆ p_minus()

template<uint8_t X, WordType W, size_t N>
std::array< W, N > Botan::p_minus ( const std::array< W, N > & p)
inlineconsteval

Definition at line 175 of file pcurves_util.h.

175 {
176 // TODO combine into p_plus_x_over_y<-1, 1>
177 static_assert(X > 0);
178 std::array<W, N> r{};
179 W x = X;
180 bigint_sub3(r.data(), p.data(), N, &x, 1);
181 std::reverse(r.begin(), r.end());
182 return r;
183}

References bigint_sub3().

◆ p_minus_1_over_2()

template<WordType W, size_t N>
std::array< W, N > Botan::p_minus_1_over_2 ( const std::array< W, N > & p)
inlineconsteval

Definition at line 196 of file pcurves_util.h.

196 {
197 const W one = 1;
198 std::array<W, N> r{};
199 bigint_sub3(r.data(), p.data(), N, &one, 1);
200 shift_right<1>(r);
201 std::reverse(r.begin(), r.end());
202 return r;
203}

References bigint_sub3(), and shift_right().

Referenced by shanks_tonelli_c4(), and Botan::IntMod< MontgomeryRep< ScalarParams > >::sqrt().

◆ p_plus_1_over_4()

template<WordType W, size_t N>
std::array< W, N > Botan::p_plus_1_over_4 ( const std::array< W, N > & p)
inlineconsteval

Definition at line 186 of file pcurves_util.h.

186 {
187 const W one = 1;
188 std::array<W, N> r{};
189 bigint_add3(r.data(), p.data(), N, &one, 1);
190 shift_right<2>(r);
191 std::reverse(r.begin(), r.end());
192 return r;
193}

References bigint_add3(), and shift_right().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::sqrt().

◆ parse_algorithm_name()

std::vector< std::string > Botan::parse_algorithm_name ( std::string_view scan_name)

Parse a SCAN-style algorithm name

Parameters
scan_namethe name
Returns
the name components

Definition at line 57 of file parsing.cpp.

57 {
58 if(scan_name.find('(') == std::string::npos && scan_name.find(')') == std::string::npos) {
59 return {std::string(scan_name)};
60 }
61
62 std::string name(scan_name);
63 std::string substring;
64 std::vector<std::string> elems;
65 size_t level = 0;
66
67 elems.push_back(name.substr(0, name.find('(')));
68 name = name.substr(name.find('('));
69
70 for(auto i = name.begin(); i != name.end(); ++i) {
71 const char c = *i;
72
73 if(c == '(') {
74 ++level;
75 }
76 if(c == ')') {
77 if(level == 1 && i == name.end() - 1) {
78 if(elems.size() == 1) {
79 elems.push_back(substring.substr(1));
80 } else {
81 elems.push_back(substring);
82 }
83 return elems;
84 }
85
86 if(level == 0 || (level == 1 && i != name.end() - 1)) {
87 throw Invalid_Algorithm_Name(scan_name);
88 }
89 --level;
90 }
91
92 if(c == ',' && level == 1) {
93 if(elems.size() == 1) {
94 elems.push_back(substring.substr(1));
95 } else {
96 elems.push_back(substring);
97 }
98 substring.clear();
99 } else {
100 substring += c;
101 }
102 }
103
104 if(!substring.empty()) {
105 throw Invalid_Algorithm_Name(scan_name);
106 }
107
108 return elems;
109}
Botan::Invalid_Algorithm_Name
Definition exceptn.h:174

Referenced by Botan::AEAD_Mode::create(), Botan::Cipher_Mode::create(), and Botan::EncryptionPaddingScheme::create().

◆ passes_miller_rabin_test()

bool Botan::passes_miller_rabin_test ( const BigInt & n,
const Barrett_Reduction & mod_n,
const Montgomery_Params & monty_n,
const BigInt & a )

Perform a single Miller-Rabin test with specified base

Parameters
nthe positive integer to test
mod_na pre-created Barrett_Reduction for n
monty_nMontgomery parameters for n
athe base to check
Returns
result of primality test

Definition at line 110 of file primality.cpp.

113 {
114 if(n < 3 || n.is_even()) {
115 return false;
116 }
117
118 BOTAN_ASSERT_NOMSG(n > 1);
119
120 const BigInt n_minus_1 = n - 1;
121 /*
122 * This unpoison is not ideal but realistically there is no way to
123 * hide the number of loop iterations (below). The main user of
124 * secret primes is RSA and we always generate RSA primes such that
125 * p == 3 (mod 4), which means s is always 1.
126 */
127 const size_t s = CT::driveby_unpoison(low_zero_bits(n_minus_1));
128 const BigInt nm1_s = n_minus_1 >> s;
129 const size_t n_bits = n.bits();
130
131 const size_t powm_window = 4;
132
133 auto powm_a_n = monty_precompute(monty_n, a, powm_window);
134
135 BigInt y = monty_execute(*powm_a_n, nm1_s, n_bits).value();
136
137 if(y == 1 || y == n_minus_1) {
138 return true;
139 }
140
141 for(size_t i = 1; i != s; ++i) {
142 y = mod_n.square(y);
143
144 if(y == 1) { // found a non-trivial square root
145 return false;
146 }
147
148 /*
149 -1 is the trivial square root of unity, so ``a`` is not a
150 witness for this number - give up
151 */
152 if(y == n_minus_1) {
153 return true;
154 }
155 }
156
157 return false;
158}
Botan::Barrett_Reduction::square
BigInt square(const BigInt &x) const
Definition barrett.cpp:182
Botan::Montgomery_Int::value
BigInt value() const
Definition monty.cpp:246
Botan::CT::driveby_unpoison
decltype(auto) driveby_unpoison(T &&v)
Definition ct_utils.h:243

References Botan::BigInt::bits(), BOTAN_ASSERT_NOMSG, Botan::CT::driveby_unpoison(), Botan::BigInt::is_even(), low_zero_bits(), monty_execute(), monty_precompute(), Botan::Barrett_Reduction::square(), and Botan::Montgomery_Int::value().

Referenced by is_bailie_psw_probable_prime(), and is_miller_rabin_probable_prime().

◆ pbes2_decrypt()

secure_vector< uint8_t > Botan::pbes2_decrypt ( std::span< const uint8_t > key_bits,
std::string_view passphrase,
const std::vector< uint8_t > & params )

Decrypt a PKCS #5 v2.0 encrypted stream

Parameters
key_bitsthe input
passphrasethe passphrase to use for decryption
paramsthe PBES2 parameters

Definition at line 281 of file pbes2.cpp.

283 {
284 AlgorithmIdentifier kdf_algo;
285 AlgorithmIdentifier enc_algo;
286
287 BER_Decoder(params).start_sequence().decode(kdf_algo).decode(enc_algo).end_cons();
288
289 const std::string cipher = enc_algo.oid().human_name_or_empty();
290 const auto cipher_spec = split_on(cipher, '/');
291 if(cipher_spec.size() != 2 || !known_pbes_cipher_mode(cipher_spec[1])) {
292 throw Decoding_Error(fmt("PBE-PKCS5 v2.0: Unknown/invalid cipher OID {}", enc_algo.oid()));
293 }
294
295 secure_vector<uint8_t> iv;
296 BER_Decoder(enc_algo.parameters()).decode(iv, ASN1_Type::OctetString).verify_end();
297
298 auto dec = Cipher_Mode::create(cipher, Cipher_Dir::Decryption);
299 if(!dec) {
300 throw Decoding_Error(fmt("PBE-PKCS5 cannot decrypt no cipher '{}'", cipher));
301 }
302
303 dec->set_key(derive_key(passphrase, kdf_algo, dec->key_spec().maximum_keylength()));
304
305 dec->start(iv);
306
307 secure_vector<uint8_t> buf(key_bits.begin(), key_bits.end());
308 dec->finish(buf);
309
310 return buf;
311}
Botan::BER_Decoder
Definition ber_dec.h:25
Botan::BER_Decoder::decode
BER_Decoder & decode(bool &out)
Definition ber_dec.h:188
Botan::BER_Decoder::end_cons
BER_Decoder & end_cons()
Definition ber_dec.cpp:337
Botan::BER_Decoder::start_sequence
BER_Decoder start_sequence()
Definition ber_dec.h:128
Botan::OID::human_name_or_empty
std::string human_name_or_empty() const
Definition asn1_oid.cpp:147

References Botan::Cipher_Mode::create(), Botan::BER_Decoder::decode(), Decryption, Botan::BER_Decoder::end_cons(), fmt(), Botan::OID::human_name_or_empty(), OctetString, Botan::AlgorithmIdentifier::oid(), Botan::AlgorithmIdentifier::parameters(), split_on(), Botan::BER_Decoder::start_sequence(), and Botan::BER_Decoder::verify_end().

◆ pbes2_encrypt()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt ( std::span< const uint8_t > key_bits,
std::string_view passphrase,
std::chrono::milliseconds msec,
std::string_view cipher,
std::string_view digest,
RandomNumberGenerator & rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters
key_bitsthe input
passphrasethe passphrase to use for encryption
msechow many milliseconds to run PBKDF2
cipherspecifies the block cipher to use to encrypt
digestspecifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rnga random number generator

Definition at line 243 of file pbes2.cpp.

248 {
249 size_t msec_in_iterations_out = static_cast<size_t>(msec.count());
250 return pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
251 // return value msec_in_iterations_out discarded
252}

◆ pbes2_encrypt_iter()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt_iter ( std::span< const uint8_t > key_bits,
std::string_view passphrase,
size_t iterations,
std::string_view cipher,
std::string_view digest,
RandomNumberGenerator & rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters
key_bitsthe input
passphrasethe passphrase to use for encryption
iterationshow many iterations to run PBKDF2
cipherspecifies the block cipher to use to encrypt
digestspecifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rnga random number generator

Definition at line 272 of file pbes2.cpp.

277 {
278 return pbes2_encrypt_shared(key_bits, passphrase, nullptr, pbkdf_iter, cipher, digest, rng);
279}

Referenced by Botan::PKCS8::BER_encode_encrypted_pbkdf_iter().

◆ pbes2_encrypt_msec()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt_msec ( std::span< const uint8_t > key_bits,
std::string_view passphrase,
std::chrono::milliseconds msec,
size_t * out_iterations_if_nonnull,
std::string_view cipher,
std::string_view digest,
RandomNumberGenerator & rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters
key_bitsthe input
passphrasethe passphrase to use for encryption
msechow many milliseconds to run PBKDF2
out_iterations_if_nonnullif not null, set to the number of PBKDF iterations used
cipherspecifies the block cipher to use to encrypt
digestspecifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rnga random number generator

Definition at line 254 of file pbes2.cpp.

260 {
261 size_t msec_in_iterations_out = static_cast<size_t>(msec.count());
262
263 auto ret = pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
264
265 if(out_iterations_if_nonnull != nullptr) {
266 *out_iterations_if_nonnull = msec_in_iterations_out;
267 }
268
269 return ret;
270}

Referenced by Botan::PKCS8::BER_encode(), and Botan::PKCS8::BER_encode_encrypted_pbkdf_msec().

◆ pbkdf2() [1/2]

void Botan::pbkdf2 ( MessageAuthenticationCode & prf,
uint8_t out[],
size_t out_len,
const uint8_t salt[],
size_t salt_len,
size_t iterations )

Perform PBKDF2. The prf is assumed to be keyed already.

Definition at line 91 of file pbkdf2.cpp.

96 {
97 if(iterations == 0) {
98 throw Invalid_Argument("PBKDF2: Invalid iteration count");
99 }
100
101 clear_mem(out, out_len);
102
103 if(out_len == 0) {
104 return;
105 }
106
107 const size_t prf_sz = prf.output_length();
108 BOTAN_ASSERT_NOMSG(prf_sz > 0);
109
110 secure_vector<uint8_t> U(prf_sz);
111
112 uint32_t counter = 1;
113 while(out_len > 0) {
114 const size_t prf_output = std::min<size_t>(prf_sz, out_len);
115
116 prf.update(salt, salt_len);
117 prf.update_be(counter++);
118 prf.final(U.data());
119
120 xor_buf(out, U.data(), prf_output);
121
122 for(size_t i = 1; i != iterations; ++i) {
123 prf.update(U);
124 prf.final(U.data());
125 xor_buf(out, U.data(), prf_output);
126 }
127
128 out_len -= prf_output;
129 out += prf_output;
130 }
131}

References BOTAN_ASSERT_NOMSG, clear_mem(), Botan::Buffered_Computation::final(), Botan::Buffered_Computation::output_length(), Botan::Buffered_Computation::update(), Botan::Buffered_Computation::update_be(), and xor_buf().

◆ pbkdf2() [2/2]

size_t Botan::pbkdf2 ( MessageAuthenticationCode & prf,
uint8_t out[],
size_t out_len,
std::string_view password,
const uint8_t salt[],
size_t salt_len,
size_t iterations,
std::chrono::milliseconds msec )

Definition at line 72 of file pbkdf2.cpp.

79 {
80 if(iterations == 0) {
81 iterations = tune_pbkdf2(prf, out_len, msec.count());
82 }
83
84 const PBKDF2 pbkdf2(prf, iterations);
85
86 pbkdf2.derive_key(out, out_len, password.data(), password.size(), salt, salt_len);
87
88 return iterations;
89}
Botan::pbkdf2
size_t pbkdf2(MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t iterations, std::chrono::milliseconds msec)
Definition pbkdf2.cpp:72

References pbkdf2().

Referenced by Botan::PBKDF2::derive_key(), Botan::Scrypt::derive_key(), Botan::PKCS5_PBKDF2::pbkdf(), and pbkdf2().

◆ pkcs_hash_id()

std::vector< uint8_t > BOTAN_TEST_API Botan::pkcs_hash_id ( std::string_view hash_name)

Return the PKCS #1 hash identifier

See also
RFC 3447 section 9.2
Parameters
hash_namethe name of the hash function
Returns
uint8_t sequence identifying the hash
Exceptions
Invalid_Argumentif the hash has no known PKCS #1 hash id

Definition at line 78 of file hash_id.cpp.

78 {
79 // Special case for SSL/TLS RSA signatures
80 if(name == "Parallel(MD5,SHA-1)") {
81 return std::vector<uint8_t>();
82 }
83
84 // If you add a value to this function, also update test_hash_id.cpp
85
86 if(name == "MD5") {
87 return std::vector<uint8_t>(MD5_PKCS_ID, MD5_PKCS_ID + sizeof(MD5_PKCS_ID));
88 }
89
90 if(name == "RIPEMD-160") {
91 return std::vector<uint8_t>(RIPEMD_160_PKCS_ID, RIPEMD_160_PKCS_ID + sizeof(RIPEMD_160_PKCS_ID));
92 }
93
94 if(name == "SHA-1") {
95 return std::vector<uint8_t>(SHA_1_PKCS_ID, SHA_1_PKCS_ID + sizeof(SHA_1_PKCS_ID));
96 }
97
98 if(name == "SHA-224") {
99 return std::vector<uint8_t>(SHA_224_PKCS_ID, SHA_224_PKCS_ID + sizeof(SHA_224_PKCS_ID));
100 }
101
102 if(name == "SHA-256") {
103 return std::vector<uint8_t>(SHA_256_PKCS_ID, SHA_256_PKCS_ID + sizeof(SHA_256_PKCS_ID));
104 }
105
106 if(name == "SHA-384") {
107 return std::vector<uint8_t>(SHA_384_PKCS_ID, SHA_384_PKCS_ID + sizeof(SHA_384_PKCS_ID));
108 }
109
110 if(name == "SHA-512") {
111 return std::vector<uint8_t>(SHA_512_PKCS_ID, SHA_512_PKCS_ID + sizeof(SHA_512_PKCS_ID));
112 }
113
114 if(name == "SHA-512-256") {
115 return std::vector<uint8_t>(SHA_512_256_PKCS_ID, SHA_512_256_PKCS_ID + sizeof(SHA_512_256_PKCS_ID));
116 }
117
118 if(name == "SHA-3(224)") {
119 return std::vector<uint8_t>(SHA3_224_PKCS_ID, SHA3_224_PKCS_ID + sizeof(SHA3_224_PKCS_ID));
120 }
121
122 if(name == "SHA-3(256)") {
123 return std::vector<uint8_t>(SHA3_256_PKCS_ID, SHA3_256_PKCS_ID + sizeof(SHA3_256_PKCS_ID));
124 }
125
126 if(name == "SHA-3(384)") {
127 return std::vector<uint8_t>(SHA3_384_PKCS_ID, SHA3_384_PKCS_ID + sizeof(SHA3_384_PKCS_ID));
128 }
129
130 if(name == "SHA-3(512)") {
131 return std::vector<uint8_t>(SHA3_512_PKCS_ID, SHA3_512_PKCS_ID + sizeof(SHA3_512_PKCS_ID));
132 }
133
134 if(name == "SM3") {
135 return std::vector<uint8_t>(SM3_PKCS_ID, SM3_PKCS_ID + sizeof(SM3_PKCS_ID));
136 }
137
138 throw Invalid_Argument("No PKCS #1 identifier for " + std::string(name));
139}

Referenced by botan_pkcs_hash_id(), Botan::PKCS1v15_Raw_SignaturePaddingScheme::PKCS1v15_Raw_SignaturePaddingScheme(), and Botan::PKCS1v15_SignaturePaddingScheme::PKCS1v15_SignaturePaddingScheme().

◆ point_add()

template<typename ProjectivePoint, typename FieldElement>
ProjectivePoint Botan::point_add ( const ProjectivePoint & a,
const ProjectivePoint & b )
inlineconstexpr

Definition at line 187 of file pcurves_algos.h.

187 {
188 const auto a_is_identity = a.is_identity();
189 const auto b_is_identity = b.is_identity();
190
191 const auto Z1Z1 = a.z().square();
192 const auto Z2Z2 = b.z().square();
193 const auto U1 = a.x() * Z2Z2;
194 const auto U2 = b.x() * Z1Z1;
195 const auto S1 = a.y() * b.z() * Z2Z2;
196 const auto S2 = b.y() * a.z() * Z1Z1;
197 const auto H = U2 - U1;
198 const auto r = S2 - S1;
199
200 /* Risky conditional
201 *
202 * This implementation uses projective coordinates, which do not have an efficient complete
203 * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
204 *
205 * This conditional only comes into play for the actual doubling case, not x + (-x) which
206 * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
207 * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
208 * output (the identity element)
209 */
210 if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
211 return a.dbl();
212 }
213
214 const auto HH = H.square();
215 const auto HHH = H * HH;
216 const auto V = U1 * HH;
217 const auto t2 = r.square();
218 const auto t3 = V + V;
219 const auto t4 = t2 - HHH;
220 auto X3 = t4 - t3;
221 const auto t5 = V - X3;
222 const auto t6 = S1 * HHH;
223 const auto t7 = r * t5;
224 auto Y3 = t7 - t6;
225 const auto t8 = b.z() * H;
226 auto Z3 = a.z() * t8;
227
228 // if a is identity then return b
229 FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
230
231 // if b is identity then return a
232 FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
233
234 return ProjectivePoint(X3, Y3, Z3);
235}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::add().

◆ point_add_mixed()

template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
ProjectivePoint Botan::point_add_mixed ( const ProjectivePoint & a,
const AffinePoint & b,
const FieldElement & one )
inlineconstexpr

Definition at line 238 of file pcurves_algos.h.

240 {
241 const auto a_is_identity = a.is_identity();
242 const auto b_is_identity = b.is_identity();
243
244 /*
245 https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
246
247 Cost: 8M + 3S + 6add + 1*2
248 */
249
250 const auto Z1Z1 = a.z().square();
251 const auto U2 = b.x() * Z1Z1;
252 const auto S2 = b.y() * a.z() * Z1Z1;
253 const auto H = U2 - a.x();
254 const auto r = S2 - a.y();
255
256 /* Risky conditional
257 *
258 * This implementation uses projective coordinates, which do not have an efficient complete
259 * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
260 *
261 * This conditional only comes into play for the actual doubling case, not x + (-x) which
262 * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
263 * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output
264 * (the identity element)
265 */
266 if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
267 return a.dbl();
268 }
269
270 const auto HH = H.square();
271 const auto HHH = H * HH;
272 const auto V = a.x() * HH;
273 const auto t2 = r.square();
274 const auto t3 = V + V;
275 const auto t4 = t2 - HHH;
276 auto X3 = t4 - t3;
277 const auto t5 = V - X3;
278 const auto t6 = a.y() * HHH;
279 const auto t7 = r * t5;
280 auto Y3 = t7 - t6;
281 auto Z3 = a.z() * H;
282
283 // if a is identity then return b
284 FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one);
285
286 // if b is identity then return a
287 FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
288
289 return ProjectivePoint(X3, Y3, Z3);
290}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::add_mixed().

◆ point_add_or_sub_mixed()

template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
ProjectivePoint Botan::point_add_or_sub_mixed ( const ProjectivePoint & a,
const AffinePoint & b,
CT::Choice sub,
const FieldElement & one )
inlineconstexpr

Definition at line 293 of file pcurves_algos.h.

296 {
297 const auto a_is_identity = a.is_identity();
298 const auto b_is_identity = b.is_identity();
299
300 /*
301 https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
302
303 Cost: 8M + 3S + 6add + 1*2
304 */
305
306 auto by = b.y();
307 by.conditional_assign(sub, by.negate());
308
309 const auto Z1Z1 = a.z().square();
310 const auto U2 = b.x() * Z1Z1;
311 const auto S2 = by * a.z() * Z1Z1;
312 const auto H = U2 - a.x();
313 const auto r = S2 - a.y();
314
315 /* Risky conditional
316 *
317 * This implementation uses projective coordinates, which do not have an efficient complete
318 * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
319 *
320 * This conditional only comes into play for the actual doubling case, not x + (-x) which
321 * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
322 * in which case at the end we'll set z to a.z * H = 0, resulting in the correct output
323 * (the identity element)
324 */
325 if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
326 return a.dbl();
327 }
328
329 const auto HH = H.square();
330 const auto HHH = H * HH;
331 const auto V = a.x() * HH;
332 const auto t2 = r.square();
333 const auto t3 = V + V;
334 const auto t4 = t2 - HHH;
335 auto X3 = t4 - t3;
336 const auto t5 = V - X3;
337 const auto t6 = a.y() * HHH;
338 const auto t7 = r * t5;
339 auto Y3 = t7 - t6;
340 auto Z3 = a.z() * H;
341
342 // if a is identity then return b
343 FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one);
344
345 // if b is identity then return a
346 FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
347
348 return ProjectivePoint(X3, Y3, Z3);
349}

Referenced by Botan::ProjectiveCurvePoint< FieldElement, Params >::add_or_sub().

◆ poly_double_n() [1/2]

void Botan::poly_double_n ( uint8_t buf[],
size_t n )
inline

Definition at line 26 of file poly_dbl.h.

26 {
27 return poly_double_n(buf, buf, n);
28}
Botan::poly_double_n
void poly_double_n(uint8_t out[], const uint8_t in[], size_t n)
Definition poly_dbl.cpp:81

References poly_double_n().

◆ poly_double_n() [2/2]

void BOTAN_TEST_API Botan::poly_double_n ( uint8_t out[],
const uint8_t in[],
size_t n )

Polynomial doubling in GF(2^n)

Definition at line 81 of file poly_dbl.cpp.

81 {
82 switch(n) {
83 case 8:
84 return poly_double<1, MinWeightPolynomial::P64>(out, in);
85 case 16:
86 return poly_double<2, MinWeightPolynomial::P128>(out, in);
87 case 24:
88 return poly_double<3, MinWeightPolynomial::P192>(out, in);
89 case 32:
90 return poly_double<4, MinWeightPolynomial::P256>(out, in);
91 case 64:
92 return poly_double<8, MinWeightPolynomial::P512>(out, in);
93 case 128:
94 return poly_double<16, MinWeightPolynomial::P1024>(out, in);
95 default:
96 throw Invalid_Argument("Unsupported size for poly_double_n");
97 }
98}

Referenced by poly_double_n(), and Botan::SIV_Mode::S2V().

◆ poly_double_n_le()

void BOTAN_TEST_API Botan::poly_double_n_le ( uint8_t out[],
const uint8_t in[],
size_t n )

Definition at line 100 of file poly_dbl.cpp.

100 {
101 switch(n) {
102 case 8:
103 return poly_double_le<1, MinWeightPolynomial::P64>(out, in);
104 case 16:
105 return poly_double_le<2, MinWeightPolynomial::P128>(out, in);
106 case 24:
107 return poly_double_le<3, MinWeightPolynomial::P192>(out, in);
108 case 32:
109 return poly_double_le<4, MinWeightPolynomial::P256>(out, in);
110 case 64:
111 return poly_double_le<8, MinWeightPolynomial::P512>(out, in);
112 case 128:
113 return poly_double_le<16, MinWeightPolynomial::P1024>(out, in);
114 default:
115 throw Invalid_Argument("Unsupported size for poly_double_n_le");
116 }
117}

Referenced by xts_compute_tweak_block().

◆ poly_double_supported_size()

bool Botan::poly_double_supported_size ( size_t n)
inline

Returns true iff poly_double_n is implemented for this size.

Definition at line 22 of file poly_dbl.h.

22 {
23 return (n == 8 || n == 16 || n == 24 || n == 32 || n == 64 || n == 128);
24}

Referenced by Botan::CMAC::CMAC(), and Botan::XTS_Mode::XTS_Mode().

◆ poly_mul()

template<uint8_t POLY, std::unsigned_integral T>
T Botan::poly_mul ( T x,
uint8_t y )
constexpr

Compile-time polynomial multiplication in GF(2^8) modulo an irreducible polynomial POLY

When T is larger than a byte, the function computes the product of each byte of T and returns the packed result.

This function is intended only for use at compile-time, and in particular should not be used with secret inputs.

TODO(Botan4) this function should be consteval, but that hits bugs in older versions of GCC and Clang.

Definition at line 306 of file bit_ops.h.

306 {
307 // The constant 0x010101... as a T
308 constexpr T lo_bit = (static_cast<T>(-1) / 255);
309
310 // The constant 0x7F7F7F... as a T
311 constexpr T mask = static_cast<T>(~(lo_bit << 7));
312
313 constexpr T poly = POLY;
314
315 T r = 0;
316 while(x > 0 && y > 0) {
317 if((y & 1) != 0) {
318 r ^= x;
319 }
320 const T carry = ((x >> 7) & lo_bit) * poly;
321 x = ((x & mask) << 1) ^ carry;
322 y >>= 1;
323 }
324 return r;
325}

References carry().

◆ polyval_multiply()

BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL Botan::polyval_multiply ( const SIMD_4x32 & H,
const SIMD_4x32 & x )

Definition at line 128 of file polyval_fn.h.

128 {
129 SIMD_4x32 hi = clmul<0x11>(H, x);
130 const SIMD_4x32 mid = clmul<0x10>(H, x) ^ clmul<0x01>(H, x);
131 SIMD_4x32 lo = clmul<0x00>(H, x);
132
133 hi ^= mid.shift_elems_right<2>();
134 lo ^= mid.shift_elems_left<2>();
135
136 return polyval_reduce(hi, lo);
137}
Botan::SIMD_4x32::shift_elems_right
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shift_elems_right() const noexcept
Definition simd_4x32.h:639
Botan::SIMD_4x32::shift_elems_left
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 shift_elems_left() const noexcept
Definition simd_4x32.h:602
Botan::polyval_reduce
BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL polyval_reduce(const SIMD_4x32 &hi, const SIMD_4x32 &lo)
Definition polyval_fn.h:107
Botan::clmul
BOTAN_FORCE_INLINE BOTAN_FN_ISA_CLMUL SIMD_4x32 clmul(const SIMD_4x32 &H, const SIMD_4x32 &x)
Definition polyval_fn.h:31

References BOTAN_FORCE_INLINE, clmul(), polyval_reduce(), Botan::SIMD_4x32::shift_elems_left(), and Botan::SIMD_4x32::shift_elems_right().

◆ polyval_reduce()

BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FN_ISA_CLMUL Botan::polyval_reduce ( const SIMD_4x32 & hi,
const SIMD_4x32 & lo )

Definition at line 107 of file polyval_fn.h.

107 {
108 const SIMD_4x32 V(0, 0xC2000000, 0, 0);
109
110 /*
111 Montgomery reduction
112 Input: 256-bit operand [X3 : X2 : X1 : X0]
113 [A1 : A0] = X0 • 0xc200000000000000
114 [B1 : B0] = [X0 ⨁ A1 : X1 ⨁ A0]
115 [C1 : C0] = B0 • 0xc200000000000000
116 [D1 : D0] = [B0 ⨁ C1 : B1 ⨁ C0]
117 Output: [D1 ⨁ X3 : D0 ⨁ X2]
118 */
119
120 const auto A = clmul<0x00>(lo, V);
121 const auto B = A ^ lo.swap_halves();
122 const auto C = clmul<0x00>(B, V);
123 const auto D = C ^ B.swap_halves();
124
125 return D ^ hi;
126}
Botan::SIMD_4x32::swap_halves
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 swap_halves() const
Definition simd_4x32.h:908

References BOTAN_FORCE_INLINE, clmul(), and Botan::SIMD_4x32::swap_halves().

Referenced by polyval_multiply().

◆ power_mod()

BigInt Botan::power_mod ( const BigInt & b,
const BigInt & x,
const BigInt & m )

Modular exponentiation

Parameters
ban integer base
xa positive exponent
ma positive modulus
Returns
(b^x) % m

Definition at line 310 of file numthry.cpp.

310 {
311 if(mod.is_negative() || mod == 1) {
312 return BigInt::zero();
313 }
314
315 if(base.is_zero() || mod.is_zero()) {
316 if(exp.is_zero()) {
317 return BigInt::one();
318 }
319 return BigInt::zero();
320 }
321
322 auto reduce_mod = Barrett_Reduction::for_secret_modulus(mod);
323
324 const size_t exp_bits = exp.bits();
325
326 if(mod.is_odd()) {
327 const Montgomery_Params monty_params(mod, reduce_mod);
328 return monty_exp(monty_params, ct_modulo(base, mod), exp, exp_bits).value();
329 }
330
331 /*
332 Support for even modulus is just a convenience and not considered
333 cryptographically important, so this implementation is slow ...
334 */
335 BigInt accum = BigInt::one();
336 BigInt g = ct_modulo(base, mod);
337 BigInt t;
338
339 for(size_t i = 0; i != exp_bits; ++i) {
340 t = reduce_mod.multiply(g, accum);
341 g = reduce_mod.square(g);
342 accum.ct_cond_assign(exp.get_bit(i), t);
343 }
344 return accum;
345}
Botan::monty_exp
Montgomery_Int monty_exp(const Montgomery_Params &params_p, const BigInt &g, const BigInt &k, size_t max_k_bits)
Definition monty_exp.h:46

References Botan::BigInt::bits(), Botan::BigInt::ct_cond_assign(), ct_modulo(), Botan::Barrett_Reduction::for_secret_modulus(), Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_odd(), Botan::BigInt::is_zero(), monty_exp(), Botan::BigInt::one(), reduce_mod(), Botan::Montgomery_Int::value(), and Botan::BigInt::zero().

Referenced by botan_mp_powmod().

◆ prefetch_array_raw()

uint64_t Botan::prefetch_array_raw ( size_t bytes,
const void * array )
noexcept

Prefetch an array

This function returns a uint64_t which is accumulated from values read from the array. This may help confuse the compiler sufficiently to not elide otherwise "useless" reads. The return value will always be zero.

Definition at line 14 of file prefetch.cpp.

14 {
15#if defined(__cpp_lib_hardware_interference_size)
16 const size_t cache_line_size = std::hardware_destructive_interference_size;
17#else
18 // We arbitrarily use a 64 byte cache line, which is by far the most
19 // common size.
20 //
21 // Runtime detection adds too much overhead to this function.
22 const size_t cache_line_size = 64;
23#endif
24
25 const uint8_t* array = static_cast<const uint8_t*>(arrayv);
26
27 volatile uint64_t combiner = 1;
28
29 for(size_t idx = 0; idx < bytes; idx += cache_line_size) {
30#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_prefetch)
31 // we have no way of knowing if the compiler will emit anything here
32 __builtin_prefetch(&array[idx]);
33#endif
34
35 combiner = combiner | array[idx];
36 }
37
38 /*
39 * The combiner variable is initialized with 1, and we accumulate using OR, so
40 * now combiner must be a value other than zero. This being the case we will
41 * always return zero here. Hopefully the compiler will not figure this out.
42 */
43 return ct_is_zero(combiner);
44}
Botan::ct_is_zero
BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x)
Definition bit_ops.h:37

References ct_is_zero().

Referenced by prefetch_arrays().

◆ prefetch_arrays()

template<std::unsigned_integral T, size_t... Ns>
T Botan::prefetch_arrays ( T(&... arr) [Ns])
noexcept

Prefetch several arrays

This function returns a uint64_t which is accumulated from values read from the array. This may help confuse the compiler sufficiently to not elide otherwise "useless" reads. The return value will always be zero.

Definition at line 34 of file prefetch.h.

34 {
35 return (static_cast<T>(prefetch_array_raw(sizeof(T) * Ns, arr)) & ...);
36}
Botan::prefetch_array_raw
uint64_t prefetch_array_raw(size_t bytes, const void *arrayv) noexcept
Definition prefetch.cpp:14

References prefetch_array_raw().

Referenced by Botan::SEED::decrypt_n(), and Botan::SEED::encrypt_n().

◆ probe_provider_private_key()

std::vector< std::string > Botan::probe_provider_private_key ( std::string_view alg_name,
const std::vector< std::string > & possible )

Definition at line 736 of file pk_algs.cpp.

737 {
738 std::vector<std::string> providers;
739
740 for(auto&& prov : possible) {
741 if(prov == "base") {
742 providers.push_back(prov);
743 }
744 }
745
746 BOTAN_UNUSED(alg_name);
747
748 return providers;
749}

References BOTAN_UNUSED.

◆ probe_providers_of()

template<typename T>
std::vector< std::string > Botan::probe_providers_of ( std::string_view algo_spec,
const std::vector< std::string > & possible = {"base"} )

Definition at line 105 of file scan_name.h.

106 {"base"}) {
107 std::vector<std::string> providers;
108 for(auto&& prov : possible) {
109 auto o = T::create(algo_spec, prov);
110 if(o) {
111 providers.push_back(prov); // available
112 }
113 }
114 return providers;
115}

Referenced by Botan::BlockCipher::providers(), Botan::HashFunction::providers(), Botan::KDF::providers(), Botan::MessageAuthenticationCode::providers(), Botan::PasswordHashFamily::providers(), Botan::PBKDF::providers(), Botan::StreamCipher::providers(), and Botan::XOF::providers().

◆ process_bytes_in_sponge() [1/2]

template<detail::SpongeLikeWithTrivialPermute SpongeT>
void Botan::process_bytes_in_sponge ( SpongeT & sponge,
size_t bytes_to_process,
const detail::ModifierFn< SpongeT > auto & modifier_fn )
inline

Definition at line 206 of file sponge_processing.h.

208 {
209 process_bytes_in_sponge(
210 sponge, bytes_to_process, [&sponge] { sponge.permute(); }, modifier_fn);
211}

References process_bytes_in_sponge().

◆ process_bytes_in_sponge() [2/2]

template<detail::SpongeLike SpongeT>
BOTAN_FORCE_INLINE void Botan::process_bytes_in_sponge ( SpongeT & sponge,
size_t bytes_to_process,
const detail::PermutationFn auto & permutation_fn,
const detail::ModifierFn< SpongeT > auto & modifier_fn )

Performs the core processing loop for ingesting or extracting data into/from the sponge state in a byte-oriented manner for the given number of bytes_to_process. The provided word_modifier_fn is called for each (partial) word of the sponge state that needs to be modified or read.

The processing loop ensures efficient handling of unaligned input and output data. For that, it calls the provided permutation function either with an instance of PartialWordBounds or FullWordBounds. Hence word_modifier_fn must be able to handle both types of bounds and should use their respective methods to read from or write into input or output buffers.

Parameters
spongethe sponge instance to process data into or from
bytes_to_processthe number of sponge state bytes to traverse
permutation_fna function that performs the sponge's permutation
modifier_fna function that modifies the sponge state words

Definition at line 136 of file sponge_processing.h.

139 {
140 if(bytes_to_process == 0) {
141 return;
142 }
143
144 constexpr auto word_bytes = SpongeT::word_bytes;
145 const auto byte_rate = sponge.byte_rate();
146 auto& S = sponge.state();
147 auto& cursor = sponge._cursor();
148
149 // If necessary, try to get aligned with the sponge state's words array
150 const auto bytes_out_of_word_alignment = static_cast<size_t>(cursor % word_bytes);
151 if(bytes_out_of_word_alignment > 0) {
152 const auto bytes_until_word_alignment = word_bytes - bytes_out_of_word_alignment;
153 const auto bytes_from_input = std::min(bytes_to_process, bytes_until_word_alignment);
154 BOTAN_DEBUG_ASSERT(bytes_from_input < word_bytes);
155
156 S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes],
157 detail::PartialWordBounds<SpongeT>{
158 .offset = bytes_out_of_word_alignment,
159 .length = bytes_from_input,
160 });
161 cursor += bytes_from_input;
162 bytes_to_process -= bytes_from_input;
163
164 if(cursor == byte_rate) {
165 permutation_fn();
166 cursor = 0;
167 }
168 }
169
170 // If we didn't exhaust the bytes to process for this invocation, we should
171 // be word-aligned with the sponge state now
172 BOTAN_DEBUG_ASSERT(bytes_to_process == 0 || cursor % word_bytes == 0);
173
174 // Block-wise incorporation of the input data into the sponge state until
175 // all input bytes are processed
176 while(bytes_to_process >= word_bytes) {
177 // Process full words until we either run out of data or reach the
178 // end of the current sponge state block
179 while(bytes_to_process >= word_bytes && cursor < byte_rate) {
180 S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes], detail::FullWordBounds<SpongeT>{});
181 cursor += word_bytes;
182 bytes_to_process -= word_bytes;
183 }
184
185 if(cursor == byte_rate) {
186 permutation_fn();
187 cursor = 0;
188 }
189 }
190
191 // Process the remaining bytes that don't fill an entire word.
192 // Therefore, leaving the sponge state in an unaligned state that won't
193 // need another permutation until the next call to process().
194 BOTAN_DEBUG_ASSERT(bytes_to_process < word_bytes && cursor < byte_rate);
195 if(bytes_to_process > 0) {
196 S[cursor / word_bytes] = modifier_fn(S[cursor / word_bytes],
197 detail::PartialWordBounds<SpongeT>{
198 .offset = 0,
199 .length = bytes_to_process,
200 });
201 cursor += bytes_to_process;
202 }
203}

References BOTAN_DEBUG_ASSERT, and BOTAN_FORCE_INLINE.

Referenced by absorb_into_sponge(), Botan::Ascon_p::percolate_in(), Botan::Ascon_p::percolate_out(), process_bytes_in_sponge(), and squeeze_from_sponge().

◆ R1()

void Botan::R1 ( uint32_t A,
uint32_t & B,
uint32_t C,
uint32_t & D,
uint32_t E,
uint32_t & F,
uint32_t G,
uint32_t & H,
uint32_t TJ,
uint32_t Wi,
uint32_t Wj )
inline

Definition at line 21 of file sm3_fn.h.

31 {
32 const uint32_t A12 = rotl<12>(A);
33 const uint32_t SS1 = rotl<7>(A12 + E + TJ);
34 const uint32_t TT1 = (A ^ B ^ C) + D + (SS1 ^ A12) + (Wi ^ Wj);
35 const uint32_t TT2 = (E ^ F ^ G) + H + SS1 + Wi;
36
37 B = rotl<9>(B);
38 D = TT1;
39 F = rotl<19>(F);
40 H = P0(TT2);
41}
Botan::P0
uint32_t P0(uint32_t X)
Definition sm3_fn.h:17

References P0(), and rotl().

Referenced by Botan::SM3::compress_n(), Botan::Blowfish::decrypt_n(), Botan::CAST_128::decrypt_n(), Botan::EC_Point::EC_Point(), Botan::EC_Point::EC_Point(), Botan::Blowfish::encrypt_n(), Botan::CAST_128::encrypt_n(), Botan::SIMD_4x32::load_be(), and Botan::SIMD_4x32::load_le().

◆ R2()

void Botan::R2 ( uint32_t A,
uint32_t & B,
uint32_t C,
uint32_t & D,
uint32_t E,
uint32_t & F,
uint32_t G,
uint32_t & H,
uint32_t TJ,
uint32_t Wi,
uint32_t Wj )
inline

Definition at line 43 of file sm3_fn.h.

53 {
54 const uint32_t A12 = rotl<12>(A);
55 const uint32_t SS1 = rotl<7>(A12 + E + TJ);
56 const uint32_t TT1 = majority(A, B, C) + D + (SS1 ^ A12) + (Wi ^ Wj);
57 const uint32_t TT2 = choose(E, F, G) + H + SS1 + Wi;
58
59 B = rotl<9>(B);
60 D = TT1;
61 F = rotl<19>(F);
62 H = P0(TT2);
63}
Botan::majority
BOTAN_FORCE_INLINE constexpr T majority(T a, T b, T c)
Definition bit_ops.h:222

References choose(), majority(), P0(), and rotl().

Referenced by Botan::SM3::compress_n(), Botan::Blowfish::decrypt_n(), Botan::Blowfish::encrypt_n(), Botan::SIMD_4x32::load_be(), and Botan::SIMD_4x32::load_le().

◆ random_code_element()

gf2m Botan::random_code_element ( uint16_t code_length,
RandomNumberGenerator & rng )

Definition at line 81 of file polyn_gf2m.cpp.

81 {
82 if(code_length == 0) {
83 throw Invalid_Argument("random_code_element() was supplied a code length of zero");
84 }
85 const unsigned nlz = nlz_16bit(code_length - 1);
86 const gf2m mask = (1 << (16 - nlz)) - 1;
87
88 gf2m result = random_gf2m(rng) & mask;
89
90 while(result >= code_length) {
91 // rejection sampling
92 result = random_gf2m(rng) & mask;
93 }
94
95 return result;
96}
Botan::random_gf2m
gf2m random_gf2m(RandomNumberGenerator &rng)
Definition polyn_gf2m.cpp:75

References random_gf2m().

Referenced by Botan::polyn_gf2m::polyn_gf2m().

◆ random_gf2m()

gf2m Botan::random_gf2m ( RandomNumberGenerator & rng)

Definition at line 75 of file polyn_gf2m.cpp.

75 {
76 uint8_t b[2];
77 rng.randomize(b, sizeof(b));
78 return make_uint16(b[1], b[0]);
79}
Botan::make_uint16
constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1)
Definition loadstor.h:92

References make_uint16(), and Botan::RandomNumberGenerator::randomize().

Referenced by random_code_element().

◆ random_prime()

BigInt Botan::random_prime ( RandomNumberGenerator & rng,
size_t bits,
const BigInt & coprime = BigInt::from_u64(0),
size_t equiv = 1,
size_t equiv_mod = 2,
size_t prob = 128 )

Randomly generate a prime suitable for discrete logarithm parameters

Parameters
rnga random number generator
bitshow large the resulting prime should be in bits
coprimea positive integer that (prime - 1) should be coprime to
equiva non-negative number that the result should be equivalent to modulo equiv_mod
equiv_modthe modulus equiv should be checked against
probuse test so false positive is bounded by 1/2**prob
Returns
random prime with the specified criteria

Definition at line 111 of file make_prm.cpp.

112 {
113 if(bits <= 1) {
114 throw Invalid_Argument("random_prime: Can't make a prime of " + std::to_string(bits) + " bits");
115 }
116 if(coprime.is_negative() || (!coprime.is_zero() && coprime.is_even()) || coprime.bits() >= bits) {
117 throw Invalid_Argument("random_prime: invalid coprime");
118 }
119 // TODO(Botan4) reduce this to ~1000
120 if(modulo == 0 || modulo >= 100000) {
121 throw Invalid_Argument("random_prime: Invalid modulo value");
122 }
123
124 equiv %= modulo;
125
126 if(equiv == 0) {
127 throw Invalid_Argument("random_prime Invalid value for equiv/modulo");
128 }
129
130 // Handle small values:
131
132 if(bits <= 16) {
133 if(equiv != 1 || modulo != 2 || coprime != 0) {
134 throw Not_Implemented("random_prime equiv/modulo/coprime options not usable for small primes");
135 }
136
137 if(bits == 2) {
138 return BigInt::from_word(((rng.next_byte() % 2) == 0 ? 2 : 3));
139 } else if(bits == 3) {
140 return BigInt::from_word(((rng.next_byte() % 2) == 0 ? 5 : 7));
141 } else if(bits == 4) {
142 return BigInt::from_word(((rng.next_byte() % 2) == 0 ? 11 : 13));
143 } else {
144 for(;;) {
145 // This is slightly biased, but for small primes it does not seem to matter
146 uint8_t b[4] = {0};
147 rng.randomize(b, 4);
148 const size_t idx = load_le<uint32_t>(b, 0) % PRIME_TABLE_SIZE;
149 const uint16_t small_prime = PRIMES[idx];
150
151 if(high_bit(small_prime) == bits) {
152 return BigInt::from_word(small_prime);
153 }
154 }
155 }
156 }
157
158 const size_t MAX_ATTEMPTS = 32 * 1024;
159
160 const size_t mr_trials = miller_rabin_test_iterations(bits, prob, true);
161
162 while(true) {
163 BigInt p(rng, bits);
164
165 // Force lowest and two top bits on
166 p.set_bit(bits - 1);
167 p.set_bit(bits - 2);
168 p.set_bit(0);
169
170 // Force p to be equal to equiv mod modulo
171 p += (modulo - (p % modulo)) + equiv;
172
173 Prime_Sieve sieve(p, bits, modulo, true);
174
175 for(size_t attempt = 0; attempt <= MAX_ATTEMPTS; ++attempt) {
176 p += modulo;
177
178 if(!sieve.next()) {
179 continue;
180 }
181
182 // here p can be even if modulo is odd, continue on in that case
183 if(p.is_even()) {
184 continue;
185 }
186
187 BOTAN_DEBUG_ASSERT(no_small_multiples(p, sieve));
188
189 auto mod_p = Barrett_Reduction::for_secret_modulus(p);
190
191 if(coprime > 1) {
192 /*
193 First do a single M-R iteration to quickly eliminate most non-primes,
194 before doing the coprimality check which is expensive
195 */
196 if(!is_miller_rabin_probable_prime(p, mod_p, rng, 1)) {
197 continue;
198 }
199
200 /*
201 * Check if p - 1 and coprime are relatively prime, using gcd.
202 * The gcd computation is const-time
203 */
204 if(gcd(p - 1, coprime) > 1) {
205 continue;
206 }
207 }
208
209 if(p.bits() > bits) {
210 break;
211 }
212
213 if(!is_miller_rabin_probable_prime(p, mod_p, rng, mr_trials)) {
214 continue;
215 }
216
217 if(prob > 32 && !is_lucas_probable_prime(p, mod_p)) {
218 continue;
219 }
220
221 return p;
222 }
223 }
224}

References Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, Botan::Barrett_Reduction::for_secret_modulus(), Botan::BigInt::from_word(), gcd(), high_bit(), Botan::BigInt::is_even(), is_lucas_probable_prime(), is_miller_rabin_probable_prime(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), load_le(), miller_rabin_test_iterations(), Botan::RandomNumberGenerator::next_byte(), PRIME_TABLE_SIZE, PRIMES, Botan::RandomNumberGenerator::randomize(), and Botan::BigInt::set_bit().

Referenced by Botan::DL_Group::DL_Group(), and random_safe_prime().

◆ random_safe_prime()

BigInt Botan::random_safe_prime ( RandomNumberGenerator & rng,
size_t bits )

Return a 'safe' prime, of the form p=2*q+1 with q prime

Parameters
rnga random number generator
bitsis how long the resulting prime should be
Returns
prime randomly chosen from safe primes of length bits

Definition at line 311 of file make_prm.cpp.

311 {
312 if(bits <= 64) {
313 throw Invalid_Argument("random_safe_prime: Can't make a prime of " + std::to_string(bits) + " bits");
314 }
315
316 const size_t error_bound = 128;
317
318 BigInt q;
319 BigInt p;
320 for(;;) {
321 /*
322 Generate q == 2 (mod 3), since otherwise [in the case of q == 1 (mod 3)],
323 2*q+1 == 3 (mod 3) and so certainly not prime.
324 */
325 q = random_prime(rng, bits - 1, BigInt::zero(), 2, 3, error_bound);
326 p = (q << 1) + 1;
327
328 if(is_prime(p, rng, error_bound, true)) {
329 return p;
330 }
331 }
332}
Botan::random_prime
BigInt random_prime(RandomNumberGenerator &rng, size_t bits, const BigInt &coprime, size_t equiv, size_t modulo, size_t prob)
Definition make_prm.cpp:111

References is_prime(), random_prime(), and Botan::BigInt::zero().

Referenced by Botan::DL_Group::DL_Group().

◆ read_cfg()

std::map< std::string, std::string > Botan::read_cfg ( std::istream & is)

Definition at line 35 of file read_cfg.cpp.

35 {
36 std::map<std::string, std::string> kv;
37 size_t line = 0;
38
39 while(is.good()) {
40 std::string s;
41
42 std::getline(is, s);
43
44 ++line;
45
46 if(s.empty() || s[0] == '#') {
47 continue;
48 }
49
50 s = clean_ws(s.substr(0, s.find('#')));
51
52 if(s.empty()) {
53 continue;
54 }
55
56 auto eq = s.find('=');
57
58 if(eq == std::string::npos || eq == 0 || eq == s.size() - 1) {
59 throw Decoding_Error("Bad read_cfg input '" + s + "' on line " + std::to_string(line));
60 }
61
62 const std::string key = clean_ws(s.substr(0, eq));
63 const std::string val = clean_ws(s.substr(eq + 1, std::string::npos));
64
65 kv[key] = val;
66 }
67
68 return kv;
69}

Referenced by Botan::TLS::Text_Policy::Text_Policy(), and Botan::TLS::Text_Policy::Text_Policy().

◆ read_kv()

std::map< std::string, std::string > Botan::read_kv ( std::string_view kv)

Accepts key value pairs delimited by commas:

"" (returns empty map) "K=V" (returns map {'K': 'V'}) "K1=V1,K2=V2" "K1=V1,K2=V2,K3=V3" "K1=V1,K2=V2,K3=a_value\,with\,commas_and_\=equals"

Values may be empty, keys must be non-empty and unique. Duplicate keys cause an exception.

Within both key and value, comma and equals can be escaped with backslash. Backslash can also be escaped.

Definition at line 13 of file read_kv.cpp.

13 {
14 std::map<std::string, std::string> m;
15 if(kv.empty()) {
16 return m;
17 }
18
19 std::vector<std::string> parts;
20
21 try {
22 parts = split_on(kv, ',');
23 } catch(std::exception&) {
24 throw Invalid_Argument("Bad KV spec");
25 }
26
27 bool escaped = false;
28 bool reading_key = true;
29 std::string cur_key;
30 std::string cur_val;
31
32 for(const char c : kv) {
33 if(c == '\\' && !escaped) {
34 escaped = true;
35 } else if(c == ',' && !escaped) {
36 if(cur_key.empty()) {
37 throw Invalid_Argument("Bad KV spec empty key");
38 }
39
40 if(m.contains(cur_key)) {
41 throw Invalid_Argument("Bad KV spec duplicated key");
42 }
43 m[cur_key] = cur_val;
44 cur_key = "";
45 cur_val = "";
46 reading_key = true;
47 } else if(c == '=' && !escaped) {
48 if(!reading_key) {
49 throw Invalid_Argument("Bad KV spec unexpected equals sign");
50 }
51 reading_key = false;
52 } else {
53 if(reading_key) {
54 cur_key += c;
55 } else {
56 cur_val += c;
57 }
58
59 if(escaped) {
60 escaped = false;
61 }
62 }
63 }
64
65 if(!cur_key.empty()) {
66 if(!reading_key) {
67 if(m.contains(cur_key)) {
68 throw Invalid_Argument("Bad KV spec duplicated key");
69 }
70 m[cur_key] = cur_val;
71 } else {
72 throw Invalid_Argument("Bad KV spec incomplete string");
73 }
74 }
75
76 return m;
77}

References split_on().

◆ read_window_bits()

template<size_t WindowBits, typename W, size_t N>
size_t Botan::read_window_bits ( std::span< const W, N > words,
size_t offset )
constexpr

Definition at line 1054 of file mp_core.h.

1054 {
1055 static_assert(WindowBits >= 1 && WindowBits <= 7);
1056
1057 constexpr uint8_t WindowMask = static_cast<uint8_t>(1 << WindowBits) - 1;
1058
1059 constexpr size_t W_bits = sizeof(W) * 8;
1060 const auto bit_shift = offset % W_bits;
1061 const auto word_offset = words.size() - 1 - (offset / W_bits);
1062
1063 const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0;
1064
1065 const auto w0 = words[word_offset];
1066
1067 if(single_byte_window) {
1068 return (w0 >> bit_shift) & WindowMask;
1069 } else {
1070 // Otherwise we must join two words and extract the result
1071 const auto w1 = words[word_offset - 1];
1072 const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift)));
1073 return combined & WindowMask;
1074 }
1075}

Referenced by Botan::BlindedScalarBits< C, WindowBits+1 >::get_window(), Botan::UnblindedScalarBits< C, WindowBits >::get_window(), and Botan::IntMod< MontgomeryRep< ScalarParams > >::pow_vartime().

◆ redc_crandall()

template<WordType W, size_t N, W C>
std::array< W, N > Botan::redc_crandall ( std::span< const W, 2 *N > z)
constexpr

Reduce z modulo p = 2**B - C where C is small

z is assumed to be at most (p-1)**2

For details on the algorithm see

  • Handbook of Applied Cryptography, Algorithm 14.47
  • Guide to Elliptic Curve Cryptography, Algorithm 2.54 and Note 2.55

Definition at line 975 of file mp_core.h.

975 {
976 static_assert(N >= 2);
977
978 std::array<W, N> hi = {};
979
980 // hi = hi * c + lo
981
982 W carry = 0;
983 for(size_t i = 0; i != N; ++i) {
984 hi[i] = word_madd3(z[i + N], C, z[i], &carry);
985 }
986
987 // hi += carry * C
988 word carry_c[2] = {0};
989 carry_c[0] = word_madd2(carry, C, &carry_c[1]);
990
991 carry = bigint_add2(hi.data(), N, carry_c, 2);
992
993 constexpr W P0 = WordInfo<W>::max - (C - 1);
994
995 std::array<W, N> r = {};
996
997 W borrow = 0;
998
999 /*
1000 * For undetermined reasons, on GCC (only) removing this asm block causes
1001 * massive (up to 20%) performance regressions in secp256k1.
1002 *
1003 * The generated code without the asm seems quite reasonable, and timing
1004 * repeated calls to redc_crandall with the cycle counter show that GCC
1005 * computes it in about the same number of cycles with or without the asm.
1006 *
1007 * So the cause of the regression is unclear. But it is reproducible across
1008 * machines and GCC versions.
1009 */
1010#if defined(BOTAN_MP_USE_X86_64_ASM) && defined(__GNUC__) && !defined(__clang__)
1011 if constexpr(N == 4 && std::same_as<W, uint64_t>) {
1012 if(!std::is_constant_evaluated()) {
1013 asm volatile(R"(
1014 movq 0(%[x]), %[borrow]
1015 subq %[p0], %[borrow]
1016 movq %[borrow], 0(%[r])
1017 movq 16(%[x]), %[borrow]
1018 sbbq $-1, %[borrow]
1019 movq %[borrow], 8(%[r])
1020 movq 16(%[x]), %[borrow]
1021 sbbq $-1, %[borrow]
1022 movq %[borrow], 16(%[r])
1023 movq 24(%[x]), %[borrow]
1024 sbbq $-1, %[borrow]
1025 movq %[borrow], 24(%[r])
1026 sbbq %[borrow],%[borrow]
1027 negq %[borrow]
1028 )"
1029 : [borrow] "=r"(borrow)
1030 : [x] "r"(hi.data()), [p0] "r"(P0), [r] "r"(r.data()), "0"(borrow)
1031 : "cc", "memory");
1032 }
1033
1034 borrow = (carry - borrow) > carry;
1035 CT::conditional_assign_mem(borrow, r.data(), hi.data(), N);
1036 return r;
1037 }
1038#endif
1039
1040 r[0] = word_sub(hi[0], P0, &borrow);
1041 for(size_t i = 1; i != N; ++i) {
1042 r[i] = word_sub(hi[i], WordInfo<W>::max, &borrow);
1043 }
1044
1045 borrow = (carry - borrow) > carry;
1046
1047 CT::conditional_assign_mem(borrow, r.data(), hi.data(), N);
1048
1049 return r;
1050}

References bigint_add2(), carry(), Botan::CT::conditional_assign_mem(), P0(), word_madd2(), word_madd3(), and word_sub().

◆ redc_mul()

void Botan::redc_mul ( int64_t & s1,
int64_t & s2,
int64_t & s3,
int64_t & s4,
int64_t & s5,
int64_t & s6,
int64_t & X )
inline

Definition at line 57 of file ed25519_internal.h.

57 {
58 s1 += X * 666643;
59 s2 += X * 470296;
60 s3 += X * 654183;
61 s4 -= X * 997805;
62 s5 += X * 136657;
63 s6 -= X * 683901;
64 X = 0;
65}

Referenced by sc_muladd(), and sc_reduce().

◆ reduce()

template<typename RetT, typename KeyT, typename ReducerT>
requires std::invocable<ReducerT&, RetT, const KeyT&> && std::convertible_to<std::invoke_result_t<ReducerT&, RetT, const KeyT&>, RetT>
RetT Botan::reduce ( const std::vector< KeyT > & keys,
RetT acc,
ReducerT reducer )

Reduce the values of keys into an accumulator initialized with acc using the reducer function reducer.

The reducer is a function taking the accumulator and a single key to return the new accumulator. Keys are consecutively reduced into the accumulator.

Returns
the accumulator containing the reduction of keys

Definition at line 29 of file stl_util.h.

32{
33 for(const KeyT& key : keys) {
34 acc = reducer(std::move(acc), key);
35 }
36 return acc;
37}

Referenced by Botan::Hybrid_PrivateKey::check_key(), Botan::Hybrid_PublicKey::check_key(), Botan::TLS::Hybrid_KEM_PublicKey::load_for_group(), Botan::Hybrid_PublicKey::raw_public_key_bits(), and Botan::TLS::Hybrid_KEM_PublicKey::raw_public_key_bits().

◆ reduce_mod()

template<WordType W, size_t N, size_t XN>
std::array< W, N > Botan::reduce_mod ( const std::array< W, XN > & x,
const std::array< W, N > & p )
inlineconsteval

Definition at line 16 of file pcurves_util.h.

16 {
17 std::array<W, N + 1> r = {0};
18 std::array<W, N + 1> t = {0};
19
20 const size_t x_bits = XN * WordInfo<W>::bits;
21
22 for(size_t i = 0; i != x_bits; ++i) {
23 const size_t b = x_bits - 1 - i;
24
25 const size_t b_word = b / WordInfo<W>::bits;
26 const size_t b_bit = b % WordInfo<W>::bits;
27 const bool x_b = (x[b_word] >> b_bit) & 1;
28
29 shift_left<1>(r);
30 // Conditional ok: this function is consteval
31 if(x_b) {
32 r[0] += 1;
33 }
34
35 const W carry = bigint_sub3(t.data(), r.data(), N + 1, p.data(), N);
36
37 // Conditional ok: this function is consteval
38 if(carry == 0) {
39 std::swap(r, t);
40 }
41 }
42
43 std::array<W, N> rs = {};
44 copy_mem(rs, std::span{r}.template first<N>());
45 return rs;
46}

References bigint_sub3(), carry(), copy_mem(), and shift_left().

Referenced by montygomery_r(), mul_mod(), and power_mod().

◆ reverse_bytes()

template<std::unsigned_integral T>
requires (sizeof(T) == 1 || sizeof(T) == 2 || sizeof(T) == 4 || sizeof(T) == 8)
T Botan::reverse_bytes ( T x)
inlineconstexpr

Swap the byte order of an unsigned integer

Definition at line 27 of file bswap.h.

27 {
28 if constexpr(sizeof(T) == 1) {
29 return x;
30 } else if constexpr(sizeof(T) == 2) {
31#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
32 return static_cast<T>(__builtin_bswap16(x));
33#else
34 return static_cast<T>((x << 8) | (x >> 8));
35#endif
36 } else if constexpr(sizeof(T) == 4) {
37#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
38 return static_cast<T>(__builtin_bswap32(x));
39#else
40 // MSVC at least recognizes this as a bswap
41 return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
42 ((x & 0xFF000000) >> 24));
43#endif
44 } else if constexpr(sizeof(T) == 8) {
45#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
46 return static_cast<T>(__builtin_bswap64(x));
47#else
48 uint32_t hi = static_cast<uint32_t>(x >> 32);
49 uint32_t lo = static_cast<uint32_t>(x);
50
51 hi = reverse_bytes(hi);
52 lo = reverse_bytes(lo);
53
54 return (static_cast<T>(lo) << 32) | hi;
55#endif
56 }
57}

References reverse_bytes().

Referenced by ct_reverse_bits(), Botan::detail::load_any(), reverse_bytes(), and Botan::detail::store_any().

◆ reverse_vector()

BOTAN_FORCE_INLINE BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 Botan::reverse_vector ( const SIMD_4x32 & in)

Definition at line 16 of file polyval_fn.h.

16 {
17#if defined(BOTAN_SIMD_USE_SSSE3)
18 const __m128i BSWAP_MASK = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15);
19 return SIMD_4x32(_mm_shuffle_epi8(in.raw(), BSWAP_MASK));
20#elif defined(BOTAN_SIMD_USE_NEON)
21 const uint8_t maskb[16] = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0};
22 const uint8x16_t mask = vld1q_u8(maskb);
23 return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(in.raw()), mask)));
24#elif defined(BOTAN_SIMD_USE_ALTIVEC)
25 const __vector unsigned char mask = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0};
26 return SIMD_4x32(vec_perm(in.raw(), in.raw(), mask));
27#endif
28}

References BOTAN_FORCE_INLINE, and Botan::SIMD_4x32::raw().

Referenced by clmul().

◆ rfc3394_keyunwrap()

secure_vector< uint8_t > Botan::rfc3394_keyunwrap ( const secure_vector< uint8_t > & key,
const SymmetricKey & kek )

Decrypt a key under a key encryption key using the algorithm described in RFC 3394

Parameters
keythe encrypted key to decrypt
kekthe key encryption key
Returns
key decrypted under kek

Definition at line 27 of file rfc3394.cpp.

27 {
28 BOTAN_ARG_CHECK(kek.size() == 16 || kek.size() == 24 || kek.size() == 32, "Invalid KEK length for NIST key wrap");
29
30 BOTAN_ARG_CHECK(key.size() >= 16 && key.size() % 8 == 0, "Bad input key size for NIST key unwrap");
31
32 const std::string cipher_name = "AES-" + std::to_string(8 * kek.size());
33 auto aes = BlockCipher::create_or_throw(cipher_name);
34 aes->set_key(kek);
35
36 return nist_key_unwrap(key.data(), key.size(), *aes);
37}
Botan::BlockCipher::create_or_throw
static std::unique_ptr< BlockCipher > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition block_cipher.cpp:271
Botan::OctetString::size
size_t size() const
Definition symkey.h:29

References BOTAN_ARG_CHECK, Botan::BlockCipher::create_or_throw(), nist_key_unwrap(), and Botan::OctetString::size().

◆ rfc3394_keywrap()

secure_vector< uint8_t > Botan::rfc3394_keywrap ( const secure_vector< uint8_t > & key,
const SymmetricKey & kek )

Encrypt a key under a key encryption key using the algorithm described in RFC 3394

Parameters
keythe plaintext key to encrypt
kekthe key encryption key
Returns
key encrypted under kek

Definition at line 16 of file rfc3394.cpp.

16 {
17 BOTAN_ARG_CHECK(kek.size() == 16 || kek.size() == 24 || kek.size() == 32, "Invalid KEK length for NIST key wrap");
18
19 const std::string cipher_name = "AES-" + std::to_string(8 * kek.size());
20 auto aes = BlockCipher::create_or_throw(cipher_name);
21 aes->set_key(kek);
22
23 std::vector<uint8_t> wrapped = nist_key_wrap(key.data(), key.size(), *aes);
24 return secure_vector<uint8_t>(wrapped.begin(), wrapped.end());
25}

References BOTAN_ARG_CHECK, Botan::BlockCipher::create_or_throw(), nist_key_wrap(), and Botan::OctetString::size().

◆ RFC4880_decode_count()

size_t Botan::RFC4880_decode_count ( uint8_t encoded_iter)

Decode the iteration count from RFC 4880 encoding

Definition at line 61 of file rfc4880.cpp.

61 {
62 return OPENPGP_S2K_ITERS[iter];
63}

Referenced by Botan::OpenPGP_S2K::decode_count(), and RFC4880_round_iterations().

◆ RFC4880_encode_count()

uint8_t Botan::RFC4880_encode_count ( size_t iterations)

RFC 4880 encodes the iteration count to a single-byte value

Definition at line 47 of file rfc4880.cpp.

47 {
48 if(desired_iterations <= OPENPGP_S2K_ITERS[0]) {
49 return 0;
50 }
51
52 if(desired_iterations >= OPENPGP_S2K_ITERS[255]) {
53 return 255;
54 }
55
56 const uint32_t* i = std::lower_bound(OPENPGP_S2K_ITERS, OPENPGP_S2K_ITERS + 256, desired_iterations);
57
58 return static_cast<uint8_t>(i - OPENPGP_S2K_ITERS);
59}

Referenced by Botan::OpenPGP_S2K::encode_count(), and RFC4880_round_iterations().

◆ RFC4880_round_iterations()

size_t Botan::RFC4880_round_iterations ( size_t iterations)
inline

Round an arbitrary iteration count to next largest iteration count supported by RFC4880 encoding.

Definition at line 32 of file rfc4880.h.

32 {
33 return RFC4880_decode_count(RFC4880_encode_count(iterations));
34}
Botan::RFC4880_encode_count
uint8_t RFC4880_encode_count(size_t desired_iterations)
Definition rfc4880.cpp:47
Botan::RFC4880_decode_count
size_t RFC4880_decode_count(uint8_t iter)
Definition rfc4880.cpp:61

References RFC4880_decode_count(), RFC4880_encode_count(), and RFC4880_round_iterations().

Referenced by RFC4880_round_iterations(), and Botan::RFC4880_S2K_Family::tune_params().

◆ rho()

template<size_t R1, size_t R2, size_t R3, std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::rho ( T x)
constexpr

SHA-2 Sigma style function

Definition at line 53 of file rotate.h.

53 {
54 return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
55}
Botan::rotr
BOTAN_FORCE_INLINE constexpr T rotr(T input)
Definition rotate.h:35

References BOTAN_FORCE_INLINE, and rotr().

Referenced by Botan::Dilithium_Algos::decode_public_key(), Botan::Dilithium_Algos::encode_public_key(), Botan::Dilithium_Algos::expand_A(), Botan::Dilithium_Algos::expand_keypair(), Botan::Kyber_Algos::expand_keypair(), Botan::Dilithium_Symmetric_Primitives_Base::H(), Botan::Kyber_KEM_Operation_Base::Kyber_KEM_Operation_Base(), Botan::Kyber_PublicKey::Kyber_PublicKey(), SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

◆ root()

Gf448Elem Botan::root ( const Gf448Elem & elem)

Compute the root of elem in the field.

The root of a in GF(p) is computed as r = a^((p+1)/4) mod p. Note that the root is not unique, i.e. r and p-r are both roots.

Returns
GfPElem The root of this element.

Definition at line 451 of file curve448_gf.cpp.

451 {
452 // Compute elem^((P-3)/4) using an optimized addition chain (cost 457).
453 // (P-3)/4 = 2^446 - 2^222 - 1
454 // return = x223 << 223 + x222
455 std::array<uint64_t, WORDS_448> x222; // NOLINT(*-member-init)
456 std::array<uint64_t, WORDS_448> x223; // NOLINT(*-member-init)
457 gf_pow_2_222m1(x222, x223, elem.words());
458
459 Gf448Elem res(0);
460 gf_sqr_n(res.words(), x223, 223);
461 gf_mul(res.words(), res.words(), x222);
462 return res;
463}

References Botan::Gf448Elem::words().

Referenced by Botan::Ed448Point::decode(), Botan::Sphincs_Hash_Functions::H_msg(), Botan::XMSS_Hash::h_msg(), Botan::Sphincs_Hash_Functions::H_msg_digest(), Botan::XMSS_Hash::h_msg_init(), Botan::SphincsPlus_PrivateKey::SphincsPlus_PrivateKey(), xmss_gen_root(), and Botan::Sphincs_Hash_Functions::~Sphincs_Hash_Functions().

◆ rotl() [1/4]

template<size_t R>
SIMD_16x32 BOTAN_FN_ISA_AVX512 Botan::rotl ( SIMD_16x32 input)
inline

Definition at line 323 of file simd_avx512.h.

323 {
324 return input.rotl<R>();
325}
Botan::SIMD_16x32::rotl
BOTAN_FN_ISA_AVX512 SIMD_16x32 rotl() const
Definition simd_avx512.h:77

References Botan::SIMD_16x32::rotl().

◆ rotl() [2/4]

template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 Botan::rotl ( SIMD_4x32 input)
inline

Definition at line 927 of file simd_4x32.h.

927 {
928 return input.rotl<R>();
929}
Botan::SIMD_4x32::rotl
BOTAN_FN_ISA_SIMD_4X32 SIMD_4x32 rotl() const noexcept
Definition simd_4x32.h:329

References Botan::SIMD_4x32::rotl().

◆ rotl() [3/4]

template<size_t R>
SIMD_8x32 BOTAN_FN_ISA_AVX2 Botan::rotl ( SIMD_8x32 input)
inline

Definition at line 360 of file simd_avx2.h.

360 {
361 return input.rotl<R>();
362}
Botan::SIMD_8x32::rotl
BOTAN_FN_ISA_AVX2 SIMD_8x32 rotl() const noexcept
Definition simd_avx2.h:116

References Botan::SIMD_8x32::rotl().

◆ rotl() [4/4]

template<size_t ROT, std::unsigned_integral T>
requires (ROT > 0 && ROT < 8 * sizeof(T))
BOTAN_FORCE_INLINE constexpr T Botan::rotl ( T input)
constexpr

Bit rotation left by a compile-time constant amount

Parameters
inputthe input word
Returns
input rotated left by ROT bits

Definition at line 23 of file rotate.h.

25{
26 return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
27}

References BOTAN_FORCE_INLINE.

Referenced by Botan::SHA_1::compress_n(), Botan::Noekeon::decrypt_n(), Botan::Noekeon::encrypt_n(), Botan::SHA1_F::F1(), Botan::SHA1_F::F2(), Botan::SHA1_F::F3(), Botan::SHA1_F::F4(), Botan::GOST_28147_89::GOST_28147_89(), Keccak_Permutation_round(), P0(), P1(), R1(), R2(), SM3_E(), and Botan::Serpent_F::transform().

◆ rotl_var()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::rotl_var ( T input,
size_t rot )
constexpr

Bit rotation left, variable rotation amount

Parameters
inputthe input word
rotthe number of bits to rotate, must be between 0 and sizeof(T)*8-1
Returns
input rotated left by rot bits

Definition at line 64 of file rotate.h.

64 {
65 return rot ? static_cast<T>((input << rot) | (input >> (sizeof(T) * 8 - rot))) : input;
66}

References BOTAN_FORCE_INLINE.

◆ rotr() [1/4]

template<size_t R>
SIMD_16x32 BOTAN_FN_ISA_AVX512 Botan::rotr ( SIMD_16x32 input)
inline

Definition at line 328 of file simd_avx512.h.

328 {
329 return input.rotr<R>();
330}
Botan::SIMD_16x32::rotr
BOTAN_FN_ISA_AVX512 SIMD_16x32 rotr() const
Definition simd_avx512.h:84

References Botan::SIMD_16x32::rotr().

◆ rotr() [2/4]

template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 Botan::rotr ( SIMD_4x32 input)
inline

Definition at line 932 of file simd_4x32.h.

932 {
933 return input.rotr<R>();
934}
Botan::SIMD_4x32::rotr
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 rotr() const noexcept
Definition simd_4x32.h:378

References Botan::SIMD_4x32::rotr().

◆ rotr() [3/4]

template<size_t R>
SIMD_8x32 BOTAN_FN_ISA_AVX2 Botan::rotr ( SIMD_8x32 input)
inline

Definition at line 365 of file simd_avx2.h.

365 {
366 return input.rotr<R>();
367}
Botan::SIMD_8x32::rotr
BOTAN_FN_ISA_AVX2 SIMD_8x32 rotr() const noexcept
Definition simd_avx2.h:145

References Botan::SIMD_8x32::rotr().

◆ rotr() [4/4]

template<size_t ROT, std::unsigned_integral T>
requires (ROT > 0 && ROT < 8 * sizeof(T))
BOTAN_FORCE_INLINE constexpr T Botan::rotr ( T input)
constexpr

Bit rotation right by a compile-time constant amount

Parameters
inputthe input word
Returns
input rotated right by ROT bits

Definition at line 35 of file rotate.h.

37{
38 return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
39}

References BOTAN_FORCE_INLINE.

Referenced by Botan::Noekeon::decrypt_n(), Botan::Noekeon::encrypt_n(), Botan::Serpent_F::i_transform(), rho(), and sigma().

◆ rotr_var()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::rotr_var ( T input,
size_t rot )
constexpr

Bit rotation right, variable rotation amount

Parameters
inputthe input word
rotthe number of bits to rotate, must be between 0 and sizeof(T)*8-1
Returns
input rotated right by rot bits

Definition at line 75 of file rotate.h.

75 {
76 return rot ? static_cast<T>((input >> rot) | (input << (sizeof(T) * 8 - rot))) : input;
77}

References BOTAN_FORCE_INLINE.

◆ round_up()

size_t Botan::round_up ( size_t n,
size_t align_to )
inlineconstexpr

Integer rounding

Returns an integer z such that n <= z <= n + align_to and z % align_to == 0

Parameters
nan integer
align_tothe alignment boundary
Returns
n rounded up to a multiple of align_to

Definition at line 26 of file rounding.h.

26 {
27 // Arguably returning n in this case would also be sensible
28 BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
29
30 if(n % align_to > 0) {
31 const size_t adj = align_to - (n % align_to);
32 BOTAN_ARG_CHECK(n + adj >= n, "Integer overflow during rounding");
33 n += adj;
34 }
35 return n;
36}

References BOTAN_ARG_CHECK.

Referenced by Botan::BigInt::bytes(), Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), monty_multi_exp(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::output_length(), Botan::BigInt::randomize(), and Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n().

◆ runtime_version_check()

std::string Botan::runtime_version_check ( uint32_t major,
uint32_t minor,
uint32_t patch )

Usable for checking that the DLL version loaded at runtime exactly matches the compile-time version. Call using BOTAN_VERSION_* macro values, like so:

Botan::runtime_version_check(BOTAN_VERSION_MAJOR, BOTAN_VERSION_MINOR, BOTAN_VERSION_PATCH);
BOTAN_VERSION_PATCH
#define BOTAN_VERSION_PATCH
Definition build.h:34
BOTAN_VERSION_MINOR
#define BOTAN_VERSION_MINOR
Definition build.h:29
BOTAN_VERSION_MAJOR
#define BOTAN_VERSION_MAJOR
Definition build.h:24
Botan::runtime_version_check
std::string runtime_version_check(uint32_t major, uint32_t minor, uint32_t patch)
Definition version.cpp:75

It will return an empty string if the versions match, or otherwise an error message indicating the discrepancy. This only is useful in dynamic libraries, where it is possible to compile and run against different versions.

Definition at line 75 of file version.cpp.

75 {
76 if(major != version_major() || minor != version_minor() || patch != version_patch()) {
77 return fmt("Warning: linked version ({}) does not match version built against ({}.{}.{})\n",
78 short_version_cstr(),
79 major,
80 minor,
81 patch);
82 }
83
84 return "";
85}
Botan::version_minor
uint32_t version_minor()
Definition version.cpp:59
Botan::short_version_cstr
const char * short_version_cstr()
Definition version.cpp:16
Botan::version_major
uint32_t version_major()
Definition version.cpp:55
Botan::version_patch
uint32_t version_patch()
Definition version.cpp:63

References fmt(), short_version_cstr(), version_major(), version_minor(), and version_patch().

◆ same_mem()

template<typename T>
bool Botan::same_mem ( const T * p1,
const T * p2,
size_t n )
inline

Memory comparison, input insensitive

Parameters
p1a pointer to an array
p2a pointer to another array
nthe number of Ts in p1 and p2
Returns
true iff p1[i] == p2[i] forall i in [0...n)

Definition at line 299 of file mem_ops.h.

299 {
300 volatile T difference = 0;
301
302 for(size_t i = 0; i != n; ++i) {
303 difference = difference | (p1[i] ^ p2[i]);
304 }
305
306 return difference == 0;
307}

References same_mem().

Referenced by same_mem().

◆ sc_muladd()

void Botan::sc_muladd ( uint8_t * s,
const uint8_t * a,
const uint8_t * b,
const uint8_t * c )

Definition at line 26 of file sc_muladd.cpp.

26 {
27 const int32_t MASK = 0x1fffff;
28
29 const int64_t a0 = MASK & load_3(a);
30 const int64_t a1 = MASK & (load_4(a + 2) >> 5);
31 const int64_t a2 = MASK & (load_3(a + 5) >> 2);
32 const int64_t a3 = MASK & (load_4(a + 7) >> 7);
33 const int64_t a4 = MASK & (load_4(a + 10) >> 4);
34 const int64_t a5 = MASK & (load_3(a + 13) >> 1);
35 const int64_t a6 = MASK & (load_4(a + 15) >> 6);
36 const int64_t a7 = MASK & (load_3(a + 18) >> 3);
37 const int64_t a8 = MASK & load_3(a + 21);
38 const int64_t a9 = MASK & (load_4(a + 23) >> 5);
39 const int64_t a10 = MASK & (load_3(a + 26) >> 2);
40 const int64_t a11 = (load_4(a + 28) >> 7);
41 const int64_t b0 = MASK & load_3(b);
42 const int64_t b1 = MASK & (load_4(b + 2) >> 5);
43 const int64_t b2 = MASK & (load_3(b + 5) >> 2);
44 const int64_t b3 = MASK & (load_4(b + 7) >> 7);
45 const int64_t b4 = MASK & (load_4(b + 10) >> 4);
46 const int64_t b5 = MASK & (load_3(b + 13) >> 1);
47 const int64_t b6 = MASK & (load_4(b + 15) >> 6);
48 const int64_t b7 = MASK & (load_3(b + 18) >> 3);
49 const int64_t b8 = MASK & load_3(b + 21);
50 const int64_t b9 = MASK & (load_4(b + 23) >> 5);
51 const int64_t b10 = MASK & (load_3(b + 26) >> 2);
52 const int64_t b11 = (load_4(b + 28) >> 7);
53 const int64_t c0 = MASK & load_3(c);
54 const int64_t c1 = MASK & (load_4(c + 2) >> 5);
55 const int64_t c2 = MASK & (load_3(c + 5) >> 2);
56 const int64_t c3 = MASK & (load_4(c + 7) >> 7);
57 const int64_t c4 = MASK & (load_4(c + 10) >> 4);
58 const int64_t c5 = MASK & (load_3(c + 13) >> 1);
59 const int64_t c6 = MASK & (load_4(c + 15) >> 6);
60 const int64_t c7 = MASK & (load_3(c + 18) >> 3);
61 const int64_t c8 = MASK & load_3(c + 21);
62 const int64_t c9 = MASK & (load_4(c + 23) >> 5);
63 const int64_t c10 = MASK & (load_3(c + 26) >> 2);
64 const int64_t c11 = (load_4(c + 28) >> 7);
65
66 int64_t s0 = c0 + a0 * b0;
67 int64_t s1 = c1 + a0 * b1 + a1 * b0;
68 int64_t s2 = c2 + a0 * b2 + a1 * b1 + a2 * b0;
69 int64_t s3 = c3 + a0 * b3 + a1 * b2 + a2 * b1 + a3 * b0;
70 int64_t s4 = c4 + a0 * b4 + a1 * b3 + a2 * b2 + a3 * b1 + a4 * b0;
71 int64_t s5 = c5 + a0 * b5 + a1 * b4 + a2 * b3 + a3 * b2 + a4 * b1 + a5 * b0;
72 int64_t s6 = c6 + a0 * b6 + a1 * b5 + a2 * b4 + a3 * b3 + a4 * b2 + a5 * b1 + a6 * b0;
73 int64_t s7 = c7 + a0 * b7 + a1 * b6 + a2 * b5 + a3 * b4 + a4 * b3 + a5 * b2 + a6 * b1 + a7 * b0;
74 int64_t s8 = c8 + a0 * b8 + a1 * b7 + a2 * b6 + a3 * b5 + a4 * b4 + a5 * b3 + a6 * b2 + a7 * b1 + a8 * b0;
75 int64_t s9 = c9 + a0 * b9 + a1 * b8 + a2 * b7 + a3 * b6 + a4 * b5 + a5 * b4 + a6 * b3 + a7 * b2 + a8 * b1 + a9 * b0;
76 int64_t s10 = c10 + a0 * b10 + a1 * b9 + a2 * b8 + a3 * b7 + a4 * b6 + a5 * b5 + a6 * b4 + a7 * b3 + a8 * b2 +
77 a9 * b1 + a10 * b0;
78 int64_t s11 = c11 + a0 * b11 + a1 * b10 + a2 * b9 + a3 * b8 + a4 * b7 + a5 * b6 + a6 * b5 + a7 * b4 + a8 * b3 +
79 a9 * b2 + a10 * b1 + a11 * b0;
80 int64_t s12 =
81 a1 * b11 + a2 * b10 + a3 * b9 + a4 * b8 + a5 * b7 + a6 * b6 + a7 * b5 + a8 * b4 + a9 * b3 + a10 * b2 + a11 * b1;
82 int64_t s13 = a2 * b11 + a3 * b10 + a4 * b9 + a5 * b8 + a6 * b7 + a7 * b6 + a8 * b5 + a9 * b4 + a10 * b3 + a11 * b2;
83 int64_t s14 = a3 * b11 + a4 * b10 + a5 * b9 + a6 * b8 + a7 * b7 + a8 * b6 + a9 * b5 + a10 * b4 + a11 * b3;
84 int64_t s15 = a4 * b11 + a5 * b10 + a6 * b9 + a7 * b8 + a8 * b7 + a9 * b6 + a10 * b5 + a11 * b4;
85 int64_t s16 = a5 * b11 + a6 * b10 + a7 * b9 + a8 * b8 + a9 * b7 + a10 * b6 + a11 * b5;
86 int64_t s17 = a6 * b11 + a7 * b10 + a8 * b9 + a9 * b8 + a10 * b7 + a11 * b6;
87 int64_t s18 = a7 * b11 + a8 * b10 + a9 * b9 + a10 * b8 + a11 * b7;
88 int64_t s19 = a8 * b11 + a9 * b10 + a10 * b9 + a11 * b8;
89 int64_t s20 = a9 * b11 + a10 * b10 + a11 * b9;
90 int64_t s21 = a10 * b11 + a11 * b10;
91 int64_t s22 = a11 * b11;
92 int64_t s23 = 0;
93
94 carry<21>(s0, s1);
95 carry<21>(s2, s3);
96 carry<21>(s4, s5);
97 carry<21>(s6, s7);
98 carry<21>(s8, s9);
99 carry<21>(s10, s11);
100 carry<21>(s12, s13);
101 carry<21>(s14, s15);
102 carry<21>(s16, s17);
103 carry<21>(s18, s19);
104 carry<21>(s20, s21);
105 carry<21>(s22, s23);
106
107 carry<21>(s1, s2);
108 carry<21>(s3, s4);
109 carry<21>(s5, s6);
110 carry<21>(s7, s8);
111 carry<21>(s9, s10);
112 carry<21>(s11, s12);
113 carry<21>(s13, s14);
114 carry<21>(s15, s16);
115 carry<21>(s17, s18);
116 carry<21>(s19, s20);
117 carry<21>(s21, s22);
118
119 redc_mul(s11, s12, s13, s14, s15, s16, s23);
120 redc_mul(s10, s11, s12, s13, s14, s15, s22);
121 redc_mul(s9, s10, s11, s12, s13, s14, s21);
122 redc_mul(s8, s9, s10, s11, s12, s13, s20);
123 redc_mul(s7, s8, s9, s10, s11, s12, s19);
124 redc_mul(s6, s7, s8, s9, s10, s11, s18);
125
126 carry<21>(s6, s7);
127 carry<21>(s8, s9);
128 carry<21>(s10, s11);
129 carry<21>(s12, s13);
130 carry<21>(s14, s15);
131 carry<21>(s16, s17);
132
133 carry<21>(s7, s8);
134 carry<21>(s9, s10);
135 carry<21>(s11, s12);
136 carry<21>(s13, s14);
137 carry<21>(s15, s16);
138
139 redc_mul(s5, s6, s7, s8, s9, s10, s17);
140 redc_mul(s4, s5, s6, s7, s8, s9, s16);
141 redc_mul(s3, s4, s5, s6, s7, s8, s15);
142 redc_mul(s2, s3, s4, s5, s6, s7, s14);
143 redc_mul(s1, s2, s3, s4, s5, s6, s13);
144 redc_mul(s0, s1, s2, s3, s4, s5, s12);
145
146 carry<21>(s0, s1);
147 carry<21>(s2, s3);
148 carry<21>(s4, s5);
149 carry<21>(s6, s7);
150 carry<21>(s8, s9);
151 carry<21>(s10, s11);
152
153 carry<21>(s1, s2);
154 carry<21>(s3, s4);
155 carry<21>(s5, s6);
156 carry<21>(s7, s8);
157 carry<21>(s9, s10);
158 carry<21>(s11, s12);
159
160 redc_mul(s0, s1, s2, s3, s4, s5, s12);
161
162 carry0<21>(s0, s1);
163 carry0<21>(s1, s2);
164 carry0<21>(s2, s3);
165 carry0<21>(s3, s4);
166 carry0<21>(s4, s5);
167 carry0<21>(s5, s6);
168 carry0<21>(s6, s7);
169 carry0<21>(s7, s8);
170 carry0<21>(s8, s9);
171 carry0<21>(s9, s10);
172 carry0<21>(s10, s11);
173 carry0<21>(s11, s12);
174
175 redc_mul(s0, s1, s2, s3, s4, s5, s12);
176
177 carry0<21>(s0, s1);
178 carry0<21>(s1, s2);
179 carry0<21>(s2, s3);
180 carry0<21>(s3, s4);
181 carry0<21>(s4, s5);
182 carry0<21>(s5, s6);
183 carry0<21>(s6, s7);
184 carry0<21>(s7, s8);
185 carry0<21>(s8, s9);
186 carry0<21>(s9, s10);
187 carry0<21>(s10, s11);
188
189 s[0] = static_cast<uint8_t>(s0 >> 0);
190 s[1] = static_cast<uint8_t>(s0 >> 8);
191 s[2] = static_cast<uint8_t>((s0 >> 16) | (s1 << 5));
192 s[3] = static_cast<uint8_t>(s1 >> 3);
193 s[4] = static_cast<uint8_t>(s1 >> 11);
194 s[5] = static_cast<uint8_t>((s1 >> 19) | (s2 << 2));
195 s[6] = static_cast<uint8_t>(s2 >> 6);
196 s[7] = static_cast<uint8_t>((s2 >> 14) | (s3 << 7));
197 s[8] = static_cast<uint8_t>(s3 >> 1);
198 s[9] = static_cast<uint8_t>(s3 >> 9);
199 s[10] = static_cast<uint8_t>((s3 >> 17) | (s4 << 4));
200 s[11] = static_cast<uint8_t>(s4 >> 4);
201 s[12] = static_cast<uint8_t>(s4 >> 12);
202 s[13] = static_cast<uint8_t>((s4 >> 20) | (s5 << 1));
203 s[14] = static_cast<uint8_t>(s5 >> 7);
204 s[15] = static_cast<uint8_t>((s5 >> 15) | (s6 << 6));
205 s[16] = static_cast<uint8_t>(s6 >> 2);
206 s[17] = static_cast<uint8_t>(s6 >> 10);
207 s[18] = static_cast<uint8_t>((s6 >> 18) | (s7 << 3));
208 s[19] = static_cast<uint8_t>(s7 >> 5);
209 s[20] = static_cast<uint8_t>(s7 >> 13);
210 s[21] = static_cast<uint8_t>(s8 >> 0);
211 s[22] = static_cast<uint8_t>(s8 >> 8);
212 s[23] = static_cast<uint8_t>((s8 >> 16) | (s9 << 5));
213 s[24] = static_cast<uint8_t>(s9 >> 3);
214 s[25] = static_cast<uint8_t>(s9 >> 11);
215 s[26] = static_cast<uint8_t>((s9 >> 19) | (s10 << 2));
216 s[27] = static_cast<uint8_t>(s10 >> 6);
217 s[28] = static_cast<uint8_t>((s10 >> 14) | (s11 << 7));
218 s[29] = static_cast<uint8_t>(s11 >> 1);
219 s[30] = static_cast<uint8_t>(s11 >> 9);
220 s[31] = static_cast<uint8_t>(s11 >> 17);
221}
Botan::redc_mul
void redc_mul(int64_t &s1, int64_t &s2, int64_t &s3, int64_t &s4, int64_t &s5, int64_t &s6, int64_t &X)
Definition ed25519_internal.h:57
Botan::carry0
void carry0(int64_t &h0, int64_t &h1)
Definition ed25519_internal.h:38
Botan::load_3
uint32_t load_3(const uint8_t in[3])
Definition ed25519_internal.h:18
Botan::load_4
uint32_t load_4(const uint8_t *in)
Definition ed25519_internal.h:22

References carry(), carry0(), load_3(), load_4(), and redc_mul().

Referenced by ed25519_sign().

◆ sc_reduce()

void Botan::sc_reduce ( uint8_t * s)

Definition at line 25 of file sc_reduce.cpp.

25 {
26 const uint32_t MASK = 0x1fffff;
27
28 int64_t s0 = MASK & load_3(s);
29 int64_t s1 = MASK & (load_4(s + 2) >> 5);
30 int64_t s2 = MASK & (load_3(s + 5) >> 2);
31 int64_t s3 = MASK & (load_4(s + 7) >> 7);
32 int64_t s4 = MASK & (load_4(s + 10) >> 4);
33 int64_t s5 = MASK & (load_3(s + 13) >> 1);
34 int64_t s6 = MASK & (load_4(s + 15) >> 6);
35 int64_t s7 = MASK & (load_3(s + 18) >> 3);
36 int64_t s8 = MASK & load_3(s + 21);
37 int64_t s9 = MASK & (load_4(s + 23) >> 5);
38 int64_t s10 = MASK & (load_3(s + 26) >> 2);
39 int64_t s11 = MASK & (load_4(s + 28) >> 7);
40 int64_t s12 = MASK & (load_4(s + 31) >> 4);
41 int64_t s13 = MASK & (load_3(s + 34) >> 1);
42 int64_t s14 = MASK & (load_4(s + 36) >> 6);
43 int64_t s15 = MASK & (load_3(s + 39) >> 3);
44 int64_t s16 = MASK & load_3(s + 42);
45 int64_t s17 = MASK & (load_4(s + 44) >> 5);
46 int64_t s18 = MASK & (load_3(s + 47) >> 2);
47 int64_t s19 = MASK & (load_4(s + 49) >> 7);
48 int64_t s20 = MASK & (load_4(s + 52) >> 4);
49 int64_t s21 = MASK & (load_3(s + 55) >> 1);
50 int64_t s22 = MASK & (load_4(s + 57) >> 6);
51 int64_t s23 = (load_4(s + 60) >> 3);
52
53 redc_mul(s11, s12, s13, s14, s15, s16, s23);
54 redc_mul(s10, s11, s12, s13, s14, s15, s22);
55 redc_mul(s9, s10, s11, s12, s13, s14, s21);
56 redc_mul(s8, s9, s10, s11, s12, s13, s20);
57 redc_mul(s7, s8, s9, s10, s11, s12, s19);
58 redc_mul(s6, s7, s8, s9, s10, s11, s18);
59
60 carry<21>(s6, s7);
61 carry<21>(s8, s9);
62 carry<21>(s10, s11);
63 carry<21>(s12, s13);
64 carry<21>(s14, s15);
65 carry<21>(s16, s17);
66
67 carry<21>(s7, s8);
68 carry<21>(s9, s10);
69 carry<21>(s11, s12);
70 carry<21>(s13, s14);
71 carry<21>(s15, s16);
72
73 redc_mul(s5, s6, s7, s8, s9, s10, s17);
74 redc_mul(s4, s5, s6, s7, s8, s9, s16);
75 redc_mul(s3, s4, s5, s6, s7, s8, s15);
76 redc_mul(s2, s3, s4, s5, s6, s7, s14);
77 redc_mul(s1, s2, s3, s4, s5, s6, s13);
78 redc_mul(s0, s1, s2, s3, s4, s5, s12);
79
80 carry<21>(s0, s1);
81 carry<21>(s2, s3);
82 carry<21>(s4, s5);
83 carry<21>(s6, s7);
84 carry<21>(s8, s9);
85 carry<21>(s10, s11);
86
87 carry<21>(s1, s2);
88 carry<21>(s3, s4);
89 carry<21>(s5, s6);
90 carry<21>(s7, s8);
91 carry<21>(s9, s10);
92 carry<21>(s11, s12);
93
94 redc_mul(s0, s1, s2, s3, s4, s5, s12);
95
96 carry0<21>(s0, s1);
97 carry0<21>(s1, s2);
98 carry0<21>(s2, s3);
99 carry0<21>(s3, s4);
100 carry0<21>(s4, s5);
101 carry0<21>(s5, s6);
102 carry0<21>(s6, s7);
103 carry0<21>(s7, s8);
104 carry0<21>(s8, s9);
105 carry0<21>(s9, s10);
106 carry0<21>(s10, s11);
107 carry0<21>(s11, s12);
108
109 redc_mul(s0, s1, s2, s3, s4, s5, s12);
110
111 carry0<21>(s0, s1);
112 carry0<21>(s1, s2);
113 carry0<21>(s2, s3);
114 carry0<21>(s3, s4);
115 carry0<21>(s4, s5);
116 carry0<21>(s5, s6);
117 carry0<21>(s6, s7);
118 carry0<21>(s7, s8);
119 carry0<21>(s8, s9);
120 carry0<21>(s9, s10);
121 carry0<21>(s10, s11);
122 carry0<21>(s11, s12);
123
124 s[0] = static_cast<uint8_t>(s0 >> 0);
125 s[1] = static_cast<uint8_t>(s0 >> 8);
126 s[2] = static_cast<uint8_t>((s0 >> 16) | (s1 << 5));
127 s[3] = static_cast<uint8_t>(s1 >> 3);
128 s[4] = static_cast<uint8_t>(s1 >> 11);
129 s[5] = static_cast<uint8_t>((s1 >> 19) | (s2 << 2));
130 s[6] = static_cast<uint8_t>(s2 >> 6);
131 s[7] = static_cast<uint8_t>((s2 >> 14) | (s3 << 7));
132 s[8] = static_cast<uint8_t>(s3 >> 1);
133 s[9] = static_cast<uint8_t>(s3 >> 9);
134 s[10] = static_cast<uint8_t>((s3 >> 17) | (s4 << 4));
135 s[11] = static_cast<uint8_t>(s4 >> 4);
136 s[12] = static_cast<uint8_t>(s4 >> 12);
137 s[13] = static_cast<uint8_t>((s4 >> 20) | (s5 << 1));
138 s[14] = static_cast<uint8_t>(s5 >> 7);
139 s[15] = static_cast<uint8_t>((s5 >> 15) | (s6 << 6));
140 s[16] = static_cast<uint8_t>(s6 >> 2);
141 s[17] = static_cast<uint8_t>(s6 >> 10);
142 s[18] = static_cast<uint8_t>((s6 >> 18) | (s7 << 3));
143 s[19] = static_cast<uint8_t>(s7 >> 5);
144 s[20] = static_cast<uint8_t>(s7 >> 13);
145 s[21] = static_cast<uint8_t>(s8 >> 0);
146 s[22] = static_cast<uint8_t>(s8 >> 8);
147 s[23] = static_cast<uint8_t>((s8 >> 16) | (s9 << 5));
148 s[24] = static_cast<uint8_t>(s9 >> 3);
149 s[25] = static_cast<uint8_t>(s9 >> 11);
150 s[26] = static_cast<uint8_t>((s9 >> 19) | (s10 << 2));
151 s[27] = static_cast<uint8_t>(s10 >> 6);
152 s[28] = static_cast<uint8_t>((s10 >> 14) | (s11 << 7));
153 s[29] = static_cast<uint8_t>(s11 >> 1);
154 s[30] = static_cast<uint8_t>(s11 >> 9);
155 s[31] = static_cast<uint8_t>(s11 >> 17);
156}

References carry(), carry0(), load_3(), load_4(), and redc_mul().

Referenced by ed25519_sign(), and ed25519_verify().

◆ scalar_blinding_bits()

size_t Botan::scalar_blinding_bits ( size_t scalar_bits)
constexpr

Return number of blinding bits to use

This can return any value between 0 and the scalar bit length.

The field arithmetic and scalar multiplication algorithms are anyway written and tested to be constant time; blinding is just used as a safety net in the case that the compiler rewrites constant time code to include variable time behavior. If utmost performance is of concern and you are in a position to test that your specific compiler for your specific architecture is not inserting variable time behavior where not expected (for example by using the existing valgrind-based CT checking) it is safe to modify this function to just return 0, or some very small blinding factor of 1-4 bits.

Definition at line 41 of file pcurves_mul.h.

41 {
42 // For blinding use 1/8 the order length for most curves; for P-521 we round down a bit
43 // so the masked scalar fits exactly in 9 or 18 words.
44
45 if(scalar_bits == 521) {
46 return 55;
47 } else {
48 return scalar_bits / 8;
49 }
50}

◆ scrypt() [1/2]

void Botan::scrypt ( uint8_t output[],
size_t output_len,
const char * password,
size_t password_len,
const uint8_t salt[],
size_t salt_len,
size_t N,
size_t r,
size_t p )
inline

Scrypt key derivation function (RFC 7914)

Parameters
outputthe output will be placed here
output_lenlength of output
passwordthe user password
password_lenlength of password
saltthe salt
salt_lenlength of salt
Nthe CPU/Memory cost parameter, must be power of 2
rthe block size parameter
pthe parallelization parameter

Suitable parameters for most uses would be N = 32768, r = 8, p = 1

Scrypt uses approximately (p + N + 1) * 128 * r bytes of memory

Definition at line 83 of file scrypt.h.

91 {
92 auto pwdhash_fam = PasswordHashFamily::create_or_throw("Scrypt");
93 auto pwdhash = pwdhash_fam->from_params(N, r, p);
94 pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len);
95}

References Botan::PasswordHashFamily::create_or_throw(), and scrypt().

Referenced by scrypt(), and scrypt().

◆ scrypt() [2/2]

void Botan::scrypt ( uint8_t output[],
size_t output_len,
std::string_view password,
const uint8_t salt[],
size_t salt_len,
size_t N,
size_t r,
size_t p )
inline

Scrypt key derivation function (RFC 7914) Before 2.8 this function was the primary interface for scrypt

Parameters
outputthe output will be placed here
output_lenlength of output
passwordthe user password
saltthe salt
salt_lenlength of salt
Nthe CPU/Memory cost parameter, must be power of 2
rthe block size parameter
pthe parallelization parameter

Suitable parameters for most uses would be N = 32768, r = 8, p = 1

Scrypt uses approximately (p + N + 1) * 128 * r bytes of memory

Definition at line 115 of file scrypt.h.

122 {
123 auto pwdhash_fam = PasswordHashFamily::create_or_throw("Scrypt");
124 auto pwdhash = pwdhash_fam->from_params(N, r, p);
125 pwdhash->derive_key(output, output_len, password.data(), password.size(), salt, salt_len);
126}

References Botan::PasswordHashFamily::create_or_throw(), and scrypt().

◆ secure_scrub_memory() [1/2]

void Botan::secure_scrub_memory ( ranges::contiguous_output_range auto && data)

Zero memory contents in a way that a compiler should not elide, using some system specific technique.

Parameters
datathe data region to be scrubbed

Definition at line 59 of file mem_ops.h.

59 {
60 secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data));
61}

References secure_scrub_memory(), and Botan::ranges::size_bytes().

◆ secure_scrub_memory() [2/2]

void Botan::secure_scrub_memory ( void * ptr,
size_t n )

Scrub memory contents in a way that a compiler should not elide, using some system specific technique. Note that this function might not zero the memory (for example, in some hypothetical implementation it might combine the memory contents with the output of a system PRNG), but if you can detect any difference in behavior at runtime then the clearing is side-effecting and you can just use clear_mem.

Use this function to scrub memory just before deallocating it, or on a stack buffer before returning from the function.

Parameters
ptra pointer to memory to scrub
nthe number of bytes pointed to by ptr

Definition at line 25 of file mem_utils.cpp.

25 {
26 return secure_zeroize_buffer(ptr, n);
27}
Botan::secure_zeroize_buffer
void secure_zeroize_buffer(void *ptr, size_t n)
Definition mem_utils.cpp:29

References secure_zeroize_buffer().

Referenced by botan_scrub_mem(), deallocate_memory(), Botan::GHASH::final(), Botan::OS::free_locked_pages(), Botan::GHASH::reset_state(), secure_scrub_memory(), Botan::Sodium::sodium_free(), Botan::Sodium::sodium_memzero(), Botan::BER_Object::~BER_Object(), and Botan::BLAKE2s::~BLAKE2s().

◆ secure_zeroize_buffer()

BOTAN_TEST_API void Botan::secure_zeroize_buffer ( void * ptr,
size_t n )

Zeroize memory contents in a way that a compiler should not elide, using some system specific technique.

Use this function to scrub memory just before deallocating it, or on a stack buffer before returning from the function.

Parameters
ptra pointer to memory to scrub
nthe number of bytes pointed to by ptr

Definition at line 29 of file mem_utils.cpp.

29 {
30 if(n == 0) {
31 return;
32 }
33
34#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
35 ::RtlSecureZeroMemory(ptr, n);
36
37#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
38 ::explicit_bzero(ptr, n);
39
40#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
41 (void)::explicit_memset(ptr, 0, n);
42
43#else
44 /*
45 * Call memset through a static volatile pointer, which the compiler should
46 * not elide. This construct should be safe in conforming compilers, but who
47 * knows. This has been checked to generate the expected code, which saves the
48 * memset address in the data segment and unconditionally loads and jumps to
49 * that address, with the following targets:
50 *
51 * x86-64: Clang 19, GCC 6, 11, 13, 14
52 * riscv64: GCC 14
53 * aarch64: GCC 14
54 * armv7: GCC 14
55 *
56 * Actually all of them generated the expected jump even without marking the
57 * function pointer as volatile. However this seems worth including as an
58 * additional precaution.
59 */
60 static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
61 (memset_ptr)(ptr, 0, n);
62#endif
63}

Referenced by Botan::PCurve::PrimeOrderCurve::Scalar::_zeroize(), secure_scrub_memory(), Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::~AlignmentBuffer(), and Botan::BlindedScalarBits< C, WindowBits+1 >::~BlindedScalarBits().

◆ set_mem()

void Botan::set_mem ( uint8_t * ptr,
size_t n,
uint8_t val )
inlineconstexpr

Set memory to a fixed value

Parameters
ptra pointer to an array of bytes
nthe number of Ts pointed to by ptr
valthe value to set each byte to

Definition at line 264 of file mem_ops.h.

264 {
265 if(n > 0) {
266 std::memset(ptr, val, n);
267 }
268}

References set_mem().

Referenced by set_mem().

◆ SHA2_32_F() [1/2]

BOTAN_FORCE_INLINE void Botan::SHA2_32_F ( uint32_t A,
uint32_t B,
uint32_t C,
uint32_t & D,
uint32_t E,
uint32_t F,
uint32_t G,
uint32_t & H,
uint32_t & M1,
uint32_t M2,
uint32_t M3,
uint32_t M4,
uint32_t magic )

Definition at line 19 of file sha2_32_f.h.

31 {
32 H += magic + rho<6, 11, 25>(E) + choose(E, F, G) + M1;
33 D += H;
34 H += rho<2, 13, 22>(A) + majority(A, B, C);
35 M1 += sigma<17, 19, 10>(M2) + M3 + sigma<7, 18, 3>(M4);
36}
Botan::rho
BOTAN_FORCE_INLINE constexpr T rho(T x)
Definition rotate.h:53
Botan::sigma
BOTAN_FORCE_INLINE constexpr T sigma(T x)
Definition rotate.h:45

References BOTAN_FORCE_INLINE, choose(), majority(), rho(), and sigma().

Referenced by Botan::SHA_256::compress_digest().

◆ SHA2_32_F() [2/2]

BOTAN_FORCE_INLINE void Botan::SHA2_32_F ( uint32_t A,
uint32_t B,
uint32_t C,
uint32_t & D,
uint32_t E,
uint32_t F,
uint32_t G,
uint32_t & H,
uint32_t M )

Definition at line 41 of file sha2_32_f.h.

42 {
43 H += rho<6, 11, 25>(E) + choose(E, F, G) + M;
44 D += H;
45 H += rho<2, 13, 22>(A) + majority(A, B, C);
46}

References BOTAN_FORCE_INLINE, choose(), majority(), and rho().

◆ SHA2_64_F() [1/2]

BOTAN_FORCE_INLINE void Botan::SHA2_64_F ( uint64_t A,
uint64_t B,
uint64_t C,
uint64_t & D,
uint64_t E,
uint64_t F,
uint64_t G,
uint64_t & H,
uint64_t & M1,
uint64_t M2,
uint64_t M3,
uint64_t M4,
uint64_t magic )

Definition at line 19 of file sha2_64_f.h.

31 {
32 H += magic + rho<14, 18, 41>(E) + choose(E, F, G) + M1;
33 D += H;
34 H += rho<28, 34, 39>(A) + majority(A, B, C);
35 M1 += sigma<19, 61, 6>(M2) + M3 + sigma<1, 8, 7>(M4);
36}

References BOTAN_FORCE_INLINE, choose(), majority(), rho(), and sigma().

Referenced by Botan::SHA_512::compress_digest().

◆ SHA2_64_F() [2/2]

BOTAN_FORCE_INLINE void Botan::SHA2_64_F ( uint64_t A,
uint64_t B,
uint64_t C,
uint64_t & D,
uint64_t E,
uint64_t F,
uint64_t G,
uint64_t & H,
uint64_t M )

Definition at line 41 of file sha2_64_f.h.

42 {
43 H += rho<14, 18, 41>(E) + choose(E, F, G) + M;
44 D += H;
45 H += rho<28, 34, 39>(A) + majority(A, B, C);
46}

References BOTAN_FORCE_INLINE, choose(), majority(), and rho().

◆ shanks_tonelli_c1c2()

template<WordType W, size_t N>
std::pair< size_t, std::array< W, N > > Botan::shanks_tonelli_c1c2 ( const std::array< W, N > & p)
inlineconsteval

Definition at line 215 of file pcurves_util.h.

215 {
216 size_t c1 = 0;
217 auto c2 = p;
218
219 // This assumes p % 2 == 1
220 shift_right<1>(c2);
221 c1++;
222
223 for(;;) {
224 // If we found another one bit past the first, stop
225 // Conditional ok: this function is consteval
226 if(c2[0] % 2 == 1) {
227 break;
228 }
229 shift_right<1>(c2);
230 c1++;
231 }
232
233 std::reverse(c2.begin(), c2.end());
234 return {c1, c2};
235}

References shift_right().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::sqrt().

◆ shanks_tonelli_c3()

template<WordType W, size_t N>
std::array< W, N > Botan::shanks_tonelli_c3 ( const std::array< W, N > & c2)
inlineconsteval

Definition at line 238 of file pcurves_util.h.

238 {
239 auto c3 = c2;
240 std::reverse(c3.begin(), c3.end());
241 shift_right<1>(c3);
242 std::reverse(c3.begin(), c3.end());
243 return c3;
244}

References shift_right().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::sqrt().

◆ shanks_tonelli_c4()

template<typename Z, WordType W, size_t N>
auto Botan::shanks_tonelli_c4 ( const std::array< W, N > & p_minus_1_over_2) ->Z
consteval

Definition at line 247 of file pcurves_util.h.

247 {
248 const auto one = Z::one();
249
250 // This is a silly performance hack; the first non-quadratic root in P-224
251 // is 11 so if we start the search there we save a little time.
252 auto z = Z::constant(11);
253
254 for(;;) {
255 auto c = z.pow_vartime(p_minus_1_over_2);
256
257 auto is_square = c.is_zero() || c.is_one();
258
259 // Conditional ok: this function is consteval
260 if(!is_square.as_bool()) {
261 return z;
262 }
263
264 z = z + one;
265 }
266}
Botan::p_minus_1_over_2
consteval std::array< W, N > p_minus_1_over_2(const std::array< W, N > &p)
Definition pcurves_util.h:196

References p_minus_1_over_2().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::sqrt().

◆ shift_left()

template<size_t S, WordType W, size_t N>
W Botan::shift_left ( std::array< W, N > & x)
inlineconstexpr

Definition at line 712 of file mp_core.h.

712 {
713 static_assert(N >= 1, "Invalid input size");
714 static_assert(S < WordInfo<W>::bits, "Shift too large");
715
716 const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
717
718 for(size_t i = N - 1; i != 0; --i) {
719 x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
720 }
721 x[0] <<= S;
722
723 return carry;
724}

References carry().

Referenced by bytes_to_words(), hex_to_words(), Botan::IntMod< MontgomeryRep< ScalarParams > >::mul2(), and reduce_mod().

◆ shift_right()

template<size_t S, WordType W, size_t N>
W Botan::shift_right ( std::array< W, N > & x)
inlineconstexpr

Definition at line 727 of file mp_core.h.

727 {
728 static_assert(N >= 1, "Invalid input size");
729 static_assert(S < WordInfo<W>::bits, "Shift too large");
730
731 const W carry = x[0] << (WordInfo<W>::bits - S);
732
733 for(size_t i = 0; i != N - 1; ++i) {
734 x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
735 }
736 x[N - 1] >>= S;
737
738 return carry;
739}

References carry().

Referenced by Botan::IntMod< MontgomeryRep< ScalarParams > >::_invert_vartime_div2_helper(), Botan::IntMod< MontgomeryRep< ScalarParams > >::div2(), p_div_2_plus_1(), p_minus_1_over_2(), p_plus_1_over_4(), shanks_tonelli_c1c2(), and shanks_tonelli_c3().

◆ shl() [1/3]

template<size_t S>
SIMD_16x32 BOTAN_FN_ISA_AVX512 Botan::shl ( SIMD_16x32 input)
inline

Definition at line 334 of file simd_avx512.h.

334 {
335 return input.shl<S>();
336}
Botan::SIMD_16x32::shl
BOTAN_FN_ISA_AVX512 SIMD_16x32 shl() const
Definition simd_avx512.h:156

References Botan::SIMD_16x32::shl().

◆ shl() [2/3]

template<size_t S>
SIMD_4x32 Botan::shl ( SIMD_4x32 input)
inline

Definition at line 938 of file simd_4x32.h.

938 {
939 return input.shl<S>();
940}

References Botan::SIMD_4x32::shl().

◆ shl() [3/3]

template<size_t S>
SIMD_8x32 BOTAN_FN_ISA_AVX2 Botan::shl ( SIMD_8x32 input)
inline

Definition at line 371 of file simd_avx2.h.

371 {
372 return input.shl<S>();
373}
Botan::SIMD_8x32::shl
BOTAN_FN_ISA_AVX2 SIMD_8x32 shl() const noexcept
Definition simd_avx2.h:217

References Botan::SIMD_8x32::shl().

◆ short_version_cstr()

const char * Botan::short_version_cstr ( )

Same as version_short_string except returning a pointer to the string.

Definition at line 16 of file version.cpp.

16 {
17 return BOTAN_SHORT_VERSION_STRING;
18}

Referenced by runtime_version_check(), and short_version_string().

◆ short_version_string()

std::string Botan::short_version_string ( )

Return a version string of the form "MAJOR.MINOR.PATCH" where each of the values is an integer.

Definition at line 28 of file version.cpp.

28 {
29 return std::string(short_version_cstr());
30}

References short_version_cstr().

◆ sigma()

template<size_t R1, size_t R2, size_t S, std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr T Botan::sigma ( T x)
constexpr

SHA-2 Sigma style function

Definition at line 45 of file rotate.h.

45 {
46 return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
47}

References BOTAN_FORCE_INLINE, and rotr().

Referenced by Botan::Kyber_Algos::expand_keypair(), SHA2_32_F(), and SHA2_64_F().

◆ sign_message()

std::array< uint8_t, 114 > Botan::sign_message ( std::span< const uint8_t, ED448_LEN > sk,
std::span< const uint8_t, ED448_LEN > pk,
bool f,
std::span< const uint8_t > context,
std::span< const uint8_t > msg )

Sign a message using a keypair (RFC 8032 5.2.6).

Parameters
skthe secret key
pkthe public key
fthe prehash flag (true iff using Ed448ph)
contextthe context string
msgthe message to sign
Returns
the signature

Definition at line 382 of file ed448_internal.cpp.

386 {
387 // 5.2.6. Signature Generation
388 // The inputs to the signing procedure is the private key, a 57-octet
389 // string, a flag F, which is 0 for Ed448, 1 for Ed448ph, context C of
390 // at most 255 octets, and a message M of arbitrary size.
391 // 1. Hash the private key, 57 octets, using SHAKE256(x, 114). Let h
392 // denote the resulting digest. Construct the secret scalar s from
393 // the first half of the digest, and the corresponding public key A,
394 // as described in the previous section. Let prefix denote the
395 // second half of the hash digest, h[57],...,h[113].
396 auto shake_xof = XOF::create_or_throw("SHAKE-256");
397 shake_xof->update(sk);
398 const Scalar448 s = scalar_from_xof(*shake_xof);
399 std::array<uint8_t, ED448_LEN> prefix{};
400 shake_xof->output(prefix);
401 // 2. Compute SHAKE256(dom4(F, C) || prefix || PH(M), 114), where M is
402 // the message to be signed, F is 1 for Ed448ph, 0 for Ed448, and C
403 // is the context to use. Interpret the 114-octet digest as a
404 // little-endian integer r.
405 const Scalar448 r(shake(pgflag, context, prefix, msg));
406 // 3. Compute the point [r]B. For efficiency, do this by first
407 // reducing r modulo L, the group order of B. Let the string R be
408 // the encoding of this point.
409 const auto big_r = Ed448Point::base_point_mul(r).encode();
410 // 4. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114), and
411 // interpret the 114-octet digest as a little-endian integer k.
412 const Scalar448 k(shake(pgflag, context, big_r, pk, msg));
413 // 5. Compute S = (r + k * s) mod L. For efficiency, again reduce k
414 // modulo L first.
415 const auto big_s = r + k * s; //r_plus_ks_mod_L(r, k, s);
416 // 6. Form the signature of the concatenation of R (57 octets) and the
417 // little-endian encoding of S (57 octets; the ten most significant
418 // bits of the final octets are always zero).
419 std::array<uint8_t, 2 * ED448_LEN> sig{};
420 BufferStuffer stuf(sig);
421 stuf.append(big_r);
422 stuf.append(big_s.to_bytes<ED448_LEN>());
423 BOTAN_ASSERT(stuf.full(), "Buffer is full");
424
425 return sig;
426}
Botan::ED448_LEN
constexpr size_t ED448_LEN
Definition ed448_internal.h:18

References Botan::BufferStuffer::append(), Botan::Ed448Point::base_point_mul(), BOTAN_ASSERT, Botan::XOF::create_or_throw(), ED448_LEN, Botan::Ed448Point::encode(), and Botan::BufferStuffer::full().

◆ signature_check()

bool Botan::signature_check ( std::span< const uint8_t, 32 > pk,
const uint8_t h[32],
const uint8_t r[32],
const uint8_t s[32] )

Definition at line 1904 of file ge.cpp.

1904 {
1905 if(auto A = frombytes_negate_vartime(pk)) {
1906 std::array<uint8_t, 32> rcheck{};
1907 ge_double_scalarmult_vartime(rcheck, h, *A, s);
1908 return CT::is_equal(rcheck.data(), r, 32).as_bool();
1909 }
1910 return false;
1911}

References Botan::CT::is_equal().

Referenced by Botan::Ed25519_PublicKey::check_key(), and ed25519_verify().

◆ significant_bytes()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr size_t Botan::significant_bytes ( T n)
constexpr

Return the number of significant bytes in n

Parameters
nan integer value
Returns
number of significant bytes in n

Definition at line 94 of file bit_ops.h.

94 {
95 size_t b = 0;
96
97 for(size_t s = 8 * sizeof(T) / 2; s >= 8; s /= 2) {
98 // Equivalent to: ((n >> s) == 0) ? 0 : s;
99 const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
100 b += z / 8;
101 n >>= z;
102 }
103
104 b += (n != 0);
105
106 return b;
107}

References BOTAN_FORCE_INLINE, and ct_if_is_zero_ret().

◆ sm2_compute_za()

std::vector< uint8_t > Botan::sm2_compute_za ( HashFunction & hash,
std::string_view user_id,
const EC_Group & group,
const EC_AffinePoint & pubkey )

Definition at line 82 of file sm2.cpp.

85 {
86 if(user_id.size() >= 8192) {
87 throw Invalid_Argument("SM2 user id too long to represent");
88 }
89
90 const uint16_t uid_len = static_cast<uint16_t>(8 * user_id.size());
91
92 hash.update(get_byte<0>(uid_len));
93 hash.update(get_byte<1>(uid_len));
94 hash.update(user_id);
95
96 const size_t p_bytes = group.get_p_bytes();
97
98 hash.update(group.get_a().serialize(p_bytes));
99 hash.update(group.get_b().serialize(p_bytes));
100 hash.update(group.get_g_x().serialize(p_bytes));
101 hash.update(group.get_g_y().serialize(p_bytes));
102 hash.update(pubkey.xy_bytes());
103
104 return hash.final<std::vector<uint8_t>>();
105}
Botan::BigInt::serialize
T serialize(size_t len) const
Definition bigint.h:727
Botan::EC_AffinePoint::xy_bytes
T xy_bytes() const
Definition ec_apoint.h:193
Botan::EC_Group::get_b
const BigInt & get_b() const
Definition ec_group.cpp:617
Botan::EC_Group::get_a
const BigInt & get_a() const
Definition ec_group.cpp:613
Botan::EC_Group::get_g_y
const BigInt & get_g_y() const
Definition ec_group.cpp:665
Botan::EC_Group::get_g_x
const BigInt & get_g_x() const
Definition ec_group.cpp:661
Botan::EC_Group::get_p_bytes
size_t get_p_bytes() const
Definition ec_group.cpp:597

References Botan::Buffered_Computation::final(), Botan::EC_Group::get_a(), Botan::EC_Group::get_b(), get_byte(), Botan::EC_Group::get_g_x(), Botan::EC_Group::get_g_y(), Botan::EC_Group::get_p_bytes(), Botan::BigInt::serialize(), Botan::Buffered_Computation::update(), and Botan::EC_AffinePoint::xy_bytes().

Referenced by botan_pubkey_sm2_compute_za().

◆ SM3_E()

uint32_t Botan::SM3_E ( uint32_t W0,
uint32_t W7,
uint32_t W13,
uint32_t W3,
uint32_t W10 )
inline

Definition at line 69 of file sm3_fn.h.

69 {
70 return P1(W0 ^ W7 ^ rotl<15>(W13)) ^ rotl<7>(W3) ^ W10;
71}
Botan::P1
uint32_t P1(uint32_t X)
Definition sm3_fn.h:65

References P1(), and rotl().

Referenced by Botan::SM3::compress_n().

◆ solinas_correct_redc()

template<size_t N, WordType W>
void Botan::solinas_correct_redc ( std::array< W, N > & r,
const std::array< W, N > & P,
const std::array< W, N > & C )
inlineconstexpr

Set r to r - C. Then if r < 0, add P to r

Definition at line 84 of file pcurves_solinas.h.

84 {
85 W borrow = 0;
86 for(size_t i = 0; i != N; ++i) {
87 r[i] = word_sub(r[i], C[i], &borrow);
88 }
89
90 // borrow is either 0 or 1, perfect for setting up a mask without extra work
91 const W mask = CT::value_barrier<W>(0 - borrow);
92
93 W carry = 0;
94
95 for(size_t i = 0; i != N; ++i) {
96 r[i] = word_add(r[i], P[i] & mask, &carry);
97 }
98}

References carry(), Botan::CT::value_barrier(), word_add(), and word_sub().

◆ split_on()

BOTAN_TEST_API std::vector< std::string > Botan::split_on ( std::string_view str,
char delim )

Split a string

Parameters
strthe input string
delimthe delimiter
Returns
string split by delim

Definition at line 111 of file parsing.cpp.

111 {
112 std::vector<std::string> elems;
113 if(str.empty()) {
114 return elems;
115 }
116
117 std::string substr;
118 for(const char c : str) {
119 if(c == delim) {
120 if(!substr.empty()) {
121 elems.push_back(substr);
122 }
123 substr.clear();
124 } else {
125 substr += c;
126 }
127 }
128
129 if(substr.empty()) {
130 throw Invalid_Argument(fmt("Unable to split string '{}", str));
131 }
132 elems.push_back(substr);
133
134 return elems;
135}

References fmt().

Referenced by argon2_check_pwhash(), Botan::AEAD_Mode::create(), Botan::Cipher_Mode::create(), Botan::PKCS11::MechanismWrapper::create_ecdh_mechanism(), create_private_key(), Botan::TLS::Text_Policy::get_list(), load_private_key(), load_public_key(), pbes2_decrypt(), Botan::TLS::Text_Policy::read_cert_type_list(), Botan::TLS::Text_Policy::read_group_list(), read_kv(), Botan::PK_Ops::Verification_with_Hash::Verification_with_Hash(), and Botan::X509_Cert_Options::X509_Cert_Options().

◆ sqrt_field_element()

template<typename C>
CT::Option< typename C::FieldElement > Botan::sqrt_field_element ( const typename C::FieldElement & fe)
inlineconstexpr

Field square root

Uses the specialized fe_sqrt if available, or otherwise the standard square root

Definition at line 60 of file pcurves_algos.h.

60 {
61 if constexpr(curve_supports_fe_sqrt<C>) {
62 auto z = C::fe_sqrt(fe);
63 // Zero out the return value if it would otherwise be incorrect
64 const CT::Choice correct = (z.square() == fe);
65 z.conditional_assign(!correct, C::FieldElement::zero());
66 return CT::Option(z, correct);
67 } else {
68 return fe.sqrt();
69 }
70}
Botan::curve_supports_fe_sqrt
Definition pcurves_algos.h:49

Referenced by Botan::PCurve::PrimeOrderCurveImpl< C >::deserialize_point(), and map_to_curve_sswu().

◆ sqrt_modulo_prime()

BigInt Botan::sqrt_modulo_prime ( const BigInt & x,
const BigInt & p )

Compute the square root of x modulo a prime using the Tonelli-Shanks algorithm. This algorithm is primarily used for EC point decompression which takes only public inputs, as a consequence it is not written to be constant-time and may leak side-channel information about its arguments.

Parameters
xthe input
pthe prime modulus
Returns
y such that (y*y)p == x, or -1 if no such integer

Definition at line 27 of file numthry.cpp.

27 {
28 BOTAN_ARG_CHECK(p > 1, "invalid prime");
29 BOTAN_ARG_CHECK(a < p, "value to solve for must be less than p");
30 BOTAN_ARG_CHECK(a >= 0, "value to solve for must not be negative");
31
32 // some very easy cases
33 if(p == 2 || a <= 1) {
34 return a;
35 }
36
37 BOTAN_ARG_CHECK(p.is_odd(), "invalid prime");
38
39 if(jacobi(a, p) != 1) { // not a quadratic residue
40 return BigInt::from_s32(-1);
41 }
42
43 auto mod_p = Barrett_Reduction::for_public_modulus(p);
44 const Montgomery_Params monty_p(p, mod_p);
45
46 // If p == 3 (mod 4) there is a simple solution
47 if(p % 4 == 3) {
48 return monty_exp_vartime(monty_p, a, ((p + 1) >> 2)).value();
49 }
50
51 // Otherwise we have to use Shanks-Tonelli
52 size_t s = low_zero_bits(p - 1);
53 BigInt q = p >> s;
54
55 q -= 1;
56 q >>= 1;
57
58 BigInt r = monty_exp_vartime(monty_p, a, q).value();
59 BigInt n = mod_p.multiply(a, mod_p.square(r));
60 r = mod_p.multiply(r, a);
61
62 if(n == 1) {
63 return r;
64 }
65
66 // find random quadratic nonresidue z
67 word z = 2;
68 for(;;) {
69 if(jacobi(BigInt::from_word(z), p) == -1) { // found one
70 break;
71 }
72
73 z += 1; // try next z
74
75 /*
76 * The expected number of tests to find a non-residue modulo a
77 * prime is 2. If we have not found one after 256 then almost
78 * certainly we have been given a non-prime p.
79 */
80 if(z >= 256) {
81 return BigInt::from_s32(-1);
82 }
83 }
84
85 BigInt c = monty_exp_vartime(monty_p, BigInt::from_word(z), (q << 1) + 1).value();
86
87 while(n > 1) {
88 q = n;
89
90 size_t i = 0;
91 while(q != 1) {
92 q = mod_p.square(q);
93 ++i;
94
95 if(i >= s) {
96 return BigInt::from_s32(-1);
97 }
98 }
99
100 BOTAN_ASSERT_NOMSG(s >= (i + 1)); // No underflow!
101 c = monty_exp_vartime(monty_p, c, BigInt::power_of_2(s - i - 1)).value();
102 r = mod_p.multiply(r, c);
103 c = mod_p.square(c);
104 n = mod_p.multiply(n, c);
105
106 // s decreases as the algorithm proceeds
107 BOTAN_ASSERT_NOMSG(s >= i);
108 s = i;
109 }
110
111 return r;
112}
Botan::Barrett_Reduction::for_public_modulus
static Barrett_Reduction for_public_modulus(const BigInt &m)
Definition barrett.cpp:34
Botan::BigInt::from_s32
static BigInt from_s32(int32_t n)
Definition bigint.cpp:42
Botan::BigInt::square
BigInt & square(secure_vector< word > &ws)
Definition big_ops2.cpp:175
Botan::monty_exp_vartime
Montgomery_Int monty_exp_vartime(const Montgomery_Params &params_p, const BigInt &g, const BigInt &k)
Definition monty_exp.h:54

References BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::Barrett_Reduction::for_public_modulus(), Botan::BigInt::from_s32(), Botan::BigInt::from_word(), Botan::BigInt::is_odd(), jacobi(), low_zero_bits(), monty_exp_vartime(), Botan::BigInt::power_of_2(), Botan::BigInt::square(), and Botan::Montgomery_Int::value().

◆ square() [1/2]

BigInt Botan::square ( const BigInt & x)
Parameters
xan integer
Returns
(x*x)

Definition at line 184 of file numthry.cpp.

184 {
185 BigInt z = x;
186 secure_vector<word> ws;
187 z.square(ws);
188 return z;
189}

References Botan::BigInt::square().

Referenced by Botan::Ed448Point::decode(), Botan::Ed448Point::double_point(), Botan::Ed448Point::operator+(), Botan::PCurve::GenericPrimeOrderCurve::scalar_square(), Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_square(), and x448().

◆ square() [2/2]

Gf448Elem Botan::square ( const Gf448Elem & elem)

Computes elem^2. Faster than operator*.

Definition at line 445 of file curve448_gf.cpp.

445 {
446 Gf448Elem res(0);
447 gf_square(res.words(), elem.words());
448 return res;
449}

References Botan::Gf448Elem::words().

◆ squeeze_from_sponge() [1/2]

void Botan::squeeze_from_sponge ( detail::SpongeLikeWithTrivialPermute auto & sponge,
std::span< uint8_t > output )
inline

Definition at line 258 of file sponge_processing.h.

258 {
259 squeeze_from_sponge(sponge, output, [&sponge] { sponge.permute(); });
260}
Botan::squeeze_from_sponge
void squeeze_from_sponge(SpongeT &sponge, std::span< uint8_t > output, const detail::PermutationFn auto &permutation_fn)
Definition sponge_processing.h:245

References squeeze_from_sponge().

◆ squeeze_from_sponge() [2/2]

template<detail::SpongeLike SpongeT>
void Botan::squeeze_from_sponge ( SpongeT & sponge,
std::span< uint8_t > output,
const detail::PermutationFn auto & permutation_fn )
inline

Squeezes output data from the sponge state.

Parameters
spongeThe sponge state to squeeze data from.
outputThe output buffer to write the squeezed data into.
permutation_fnThe function to call for the sponge's permutation.

Definition at line 245 of file sponge_processing.h.

247 {
248 using word_t = typename SpongeT::word_t;
249
250 BufferStuffer output_stuffer(output);
251 process_bytes_in_sponge(sponge, output.size(), permutation_fn, [&](word_t state_word, auto bounds) {
252 bounds.write_into(output_stuffer, state_word);
253 return state_word;
254 });
255 BOTAN_ASSERT_NOMSG(output_stuffer.full());
256}

References BOTAN_ASSERT_NOMSG, Botan::BufferStuffer::full(), and process_bytes_in_sponge().

Referenced by Botan::Ascon_p::squeeze(), Botan::Keccak_Permutation::squeeze(), and squeeze_from_sponge().

◆ srp6_client_agree() [1/2]

std::pair< BigInt, SymmetricKey > Botan::srp6_client_agree ( std::string_view username,
std::string_view password,
const DL_Group & group,
std::string_view hash_id,
const std::vector< uint8_t > & salt,
const BigInt & B,
size_t a_bits,
RandomNumberGenerator & rng )

SRP6a Client side

Parameters
usernamethe username we are attempting login for
passwordthe password we are attempting to use
groupspecifies the shared SRP group
hash_idspecifies a secure hash function
saltis the salt value sent by the server
Bis the server's public value
a_bitssize of secret exponent in bits
rngis a random number generator
Returns
(A,K) the client public key and the shared secret key

Definition at line 79 of file srp6.cpp.

86 {
87 BOTAN_ARG_CHECK(a_bits <= group.p_bits(), "Invalid a_bits");
88
89 const BigInt& g = group.get_g();
90 const BigInt& p = group.get_p();
91
92 const size_t p_bytes = group.p_bytes();
93
94 if(B <= 0 || B >= p) {
95 throw Decoding_Error("Invalid SRP parameter from server");
96 }
97
98 auto hash_fn = HashFunction::create_or_throw(hash_id);
99 if(8 * hash_fn->output_length() >= group.p_bits()) {
100 throw Invalid_Argument(fmt("Hash function {} too large for SRP6 with this group", hash_fn->name()));
101 }
102
103 const BigInt k = hash_seq(*hash_fn, p_bytes, p, g);
104
105 const BigInt a(rng, a_bits);
106
107 const BigInt A = group.power_g_p(a, a_bits);
108
109 const BigInt u = hash_seq(*hash_fn, p_bytes, A, B);
110
111 const BigInt x = compute_x(*hash_fn, identifier, password, salt);
112
113 const BigInt g_x_p = group.power_g_p(x, hash_fn->output_length() * 8);
114
115 const BigInt B_k_g_x_p = group.mod_p(B + group.mod_p(p - group.multiply_mod_p(k, g_x_p)));
116
117 const BigInt a_ux = a + u * x;
118
119 const size_t max_aux_bits = std::max<size_t>(a_bits + 1, 2 * 8 * hash_fn->output_length());
120 BOTAN_ASSERT_NOMSG(max_aux_bits >= a_ux.bits());
121
122 const BigInt S = group.power_b_p(B_k_g_x_p, a_ux, max_aux_bits);
123
124 const SymmetricKey Sk(S.serialize<secure_vector<uint8_t>>(p_bytes));
125
126 return std::make_pair(A, Sk);
127}
Botan::DL_Group::power_g_p
BigInt power_g_p(const BigInt &x) const
Definition dl_group.h:263
Botan::DL_Group::mod_p
BigInt mod_p(const BigInt &x) const
Definition dl_group.cpp:531
Botan::DL_Group::multiply_mod_p
BigInt multiply_mod_p(const BigInt &x, const BigInt &y) const
Definition dl_group.cpp:535
Botan::DL_Group::p_bits
size_t p_bits() const
Definition dl_group.cpp:500
Botan::DL_Group::get_p
const BigInt & get_p() const
Definition dl_group.cpp:474
Botan::DL_Group::p_bytes
size_t p_bytes() const
Definition dl_group.cpp:504
Botan::DL_Group::power_b_p
BigInt power_b_p(const BigInt &b, const BigInt &x, size_t max_x_bits) const
Definition dl_group.cpp:581
Botan::DL_Group::get_g
const BigInt & get_g() const
Definition dl_group.cpp:481
Botan::SymmetricKey
OctetString SymmetricKey
Definition symkey.h:140

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::HashFunction::create_or_throw(), fmt(), Botan::DL_Group::get_g(), Botan::DL_Group::get_p(), Botan::DL_Group::mod_p(), Botan::DL_Group::multiply_mod_p(), Botan::DL_Group::p_bits(), Botan::DL_Group::p_bytes(), Botan::DL_Group::power_b_p(), Botan::DL_Group::power_g_p(), and Botan::BigInt::serialize().

◆ srp6_client_agree() [2/2]

std::pair< BigInt, SymmetricKey > Botan::srp6_client_agree ( std::string_view username,
std::string_view password,
std::string_view group_id,
std::string_view hash_id,
const std::vector< uint8_t > & salt,
const BigInt & B,
RandomNumberGenerator & rng )

SRP6a Client side

Parameters
usernamethe username we are attempting login for
passwordthe password we are attempting to use
group_idspecifies the shared SRP group
hash_idspecifies a secure hash function
saltis the salt value sent by the server
Bis the server's public value
rngis a random number generator
Returns
(A,K) the client public key and the shared secret key

Definition at line 66 of file srp6.cpp.

72 {
73 auto group = DL_Group::from_name(group_id);
74 const size_t a_bits = group.exponent_bits();
75
76 return srp6_client_agree(identifier, password, group, hash_id, salt, B, a_bits, rng);
77}
Botan::srp6_client_agree
std::pair< BigInt, SymmetricKey > srp6_client_agree(std::string_view identifier, std::string_view password, std::string_view group_id, std::string_view hash_id, const std::vector< uint8_t > &salt, const BigInt &B, RandomNumberGenerator &rng)
Definition srp6.cpp:66

References Botan::DL_Group::from_name(), and srp6_client_agree().

Referenced by botan_srp6_client_agree(), and srp6_client_agree().

◆ srp6_generate_verifier() [1/2]

BigInt Botan::srp6_generate_verifier ( std::string_view identifier,
std::string_view password,
const std::vector< uint8_t > & salt,
const DL_Group & group,
std::string_view hash_id )

Generate a new SRP-6 verifier

Parameters
identifiera username or other client identifier
passwordthe secret used to authenticate user
salta randomly chosen value, at least 128 bits long
groupspecifies the shared SRP group
hash_idspecifies a secure hash function

Definition at line 138 of file srp6.cpp.

142 {
143 auto hash_fn = HashFunction::create_or_throw(hash_id);
144 if(8 * hash_fn->output_length() >= group.p_bits()) {
145 throw Invalid_Argument(fmt("Hash function {} too large for SRP6 with this group", hash_fn->name()));
146 }
147
148 const BigInt x = compute_x(*hash_fn, identifier, password, salt);
149 return group.power_g_p(x, hash_fn->output_length() * 8);
150}

References Botan::HashFunction::create_or_throw(), fmt(), Botan::DL_Group::p_bits(), and Botan::DL_Group::power_g_p().

◆ srp6_generate_verifier() [2/2]

BigInt Botan::srp6_generate_verifier ( std::string_view identifier,
std::string_view password,
const std::vector< uint8_t > & salt,
std::string_view group_id,
std::string_view hash_id )

Generate a new SRP-6 verifier

Parameters
identifiera username or other client identifier
passwordthe secret used to authenticate user
salta randomly chosen value, at least 128 bits long
group_idspecifies the shared SRP group
hash_idspecifies a secure hash function

Definition at line 129 of file srp6.cpp.

133 {
134 auto group = DL_Group::from_name(group_id);
135 return srp6_generate_verifier(identifier, password, salt, group, hash_id);
136}
Botan::srp6_generate_verifier
BigInt srp6_generate_verifier(std::string_view identifier, std::string_view password, const std::vector< uint8_t > &salt, std::string_view group_id, std::string_view hash_id)
Definition srp6.cpp:129

References Botan::DL_Group::from_name(), and srp6_generate_verifier().

Referenced by botan_srp6_generate_verifier(), and srp6_generate_verifier().

◆ srp6_group_identifier()

std::string Botan::srp6_group_identifier ( const BigInt & N,
const BigInt & g )

Return the group id for this SRP param set, or else thrown an exception

Parameters
Nthe group modulus
gthe group generator
Returns
group identifier

Definition at line 47 of file srp6.cpp.

47 {
48 /*
49 This function assumes that only one 'standard' SRP parameter set has
50 been defined for a particular bitsize. As of this writing that is the case.
51 */
52 try {
53 const std::string group_name = "modp/srp/" + std::to_string(N.bits());
54
55 auto group = DL_Group::from_name(group_name);
56
57 if(group.get_p() == N && group.get_g() == g) {
58 return group_name;
59 }
60 } catch(...) {}
61
62 // If we didn't return, the group was unknown or did not match
63 throw Invalid_Argument("Invalid or unknown SRP group parameters");
64}

References Botan::BigInt::bits(), and Botan::DL_Group::from_name().

◆ SSWU_C1()

template<typename C>
requires C::ValidForSswuHash
const auto & Botan::SSWU_C1 ( )

SSWU constant C1 - (-B / A)

See RFC 9380 section 6.6.2

Definition at line 1660 of file pcurves_impl.h.

1662{
1663 // TODO(Botan4) Make this a constexpr
1664 // We derive it from C2 to avoid a second inversion
1665 static const typename C::FieldElement C1 = (SSWU_C2<C>() * C::SSWU_Z).negate();
1666 return C1;
1667}

References SSWU_C2().

Referenced by map_to_curve_sswu().

◆ SSWU_C2()

template<typename C>
requires C::ValidForSswuHash
const auto & Botan::SSWU_C2 ( )

SSWU constant C2 - (B / (Z * A))

See RFC 9380 section 6.6.2

Definition at line 1646 of file pcurves_impl.h.

1648{
1649 // TODO(Botan4) Make this a constexpr once compilers have caught up
1650 static const typename C::FieldElement C2 = C::B * invert_field_element<C>(C::SSWU_Z * C::A);
1651 return C2;
1652}

References invert_field_element().

Referenced by map_to_curve_sswu(), and SSWU_C1().

◆ store_be()

template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
auto Botan::store_be ( ParamTs &&... params)
inlineconstexpr

Store "something" in big endian byte order See the documentation of this file for more details.

Definition at line 745 of file loadstor.h.

745 {
746 return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
747}
Botan::detail::store_any
constexpr void store_any(WrappedInT wrapped_in, OutR &&out_range)
Definition loadstor.h:525

References Botan::detail::store_any().

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::BigInt::binary_encode(), Botan::GeneralName::binary_name(), Botan::BlindedScalarBits< C, WindowBits+1 >::BlindedScalarBits(), botan_x509_crl_view_binary_values(), Botan::FPE_FE1::decrypt(), Botan::Blowfish::decrypt_n(), Botan::CAST_128::decrypt_n(), Botan::Noekeon::decrypt_n(), Botan::SEED::decrypt_n(), Botan::SHACAL2::decrypt_n(), Botan::SM4::decrypt_n(), Botan::AlternativeName::encode_into(), Botan::CryptoBox::encrypt(), Botan::FPE_FE1::encrypt(), Botan::TLS::Session::encrypt(), Botan::Blowfish::encrypt_n(), Botan::CAST_128::encrypt_n(), Botan::Noekeon::encrypt_n(), Botan::SEED::encrypt_n(), Botan::SHACAL2::encrypt_n(), Botan::SM4::encrypt_n(), Botan::TLS::Connection_Cipher_State::format_ad(), hkdf_expand_label(), Botan::ML_KEM_Symmetric_Primitives::init_PRF(), Botan::ML_KEM_Symmetric_Primitives::init_XOF(), ipv4_to_string(), lmots_compute_pubkey_from_sig(), Botan::LMOTS_Public_Key::LMOTS_Public_Key(), Botan::TLS::make_hello_random(), Botan::TLS::make_server_hello_random(), Botan::TPM2::Context::manufacturer(), Botan::TLS::Cipher_State::next_ticket_nonce(), nist_key_wrap(), nist_key_wrap_padded(), Botan::XMSS_PublicKey::raw_public_key_bits(), Botan::CTR_BE::seek(), Botan::TLS::New_Session_Ticket_12::serialize(), Botan::TLS::New_Session_Ticket_13::serialize(), Botan::IntMod< MontgomeryRep< ScalarParams > >::serialize_to(), Botan::PseudorandomKeyGeneration::set_i(), Botan::PseudorandomKeyGeneration::set_j(), Botan::PseudorandomKeyGeneration::set_q(), Botan::HSS_LMS_PrivateKeyInternal::sign(), Botan::LMOTS_Private_Key::sign(), Botan::LMS_PrivateKey::sign_and_get_pk(), Botan::SIMD_4x32::store_be(), Botan::HSS_LMS_PrivateKeyInternal::to_bytes(), Botan::HSS_LMS_PublicKeyInternal::to_bytes(), Botan::LMS_PublicKey::to_bytes(), Botan::Sphincs_Address::to_bytes(), Botan::Sphincs_Address::to_bytes_compressed(), Botan::Buffered_Computation::update_be(), Botan::Buffered_Computation::update_be(), Botan::Buffered_Computation::update_be(), and Botan::TPM2::Context::vendor().

◆ store_le()

template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
auto Botan::store_le ( ParamTs &&... params)
inlineconstexpr

Store "something" in little endian byte order See the documentation of this file for more details.

Definition at line 736 of file loadstor.h.

736 {
737 return detail::store_any<std::endian::little, ModifierT>(std::forward<ParamTs>(params)...);
738}

References Botan::detail::store_any().

Referenced by Botan::Ascon_AEAD128_Mode::calculate_tag_and_finish(), create_aes_row_generator(), create_shake_row_generator(), Botan::Sodium::crypto_core_hsalsa20(), Botan::GOST_28147_89::decrypt_n(), Botan::Kuznyechik::decrypt_n(), Botan::Serpent::decrypt_n(), Botan::Threefish_512::decrypt_n(), Botan::Twofish::decrypt_n(), Botan::GOST_28147_89::encrypt_n(), Botan::Kuznyechik::encrypt_n(), Botan::Serpent::encrypt_n(), Botan::Threefish_512::encrypt_n(), Botan::Twofish::encrypt_n(), Botan::Streebog::final_result(), generate_mceliece_key(), Botan::CRYSTALS::pack(), Botan::RandomNumberGenerator::randomize_with_ts_input(), Botan::Salsa20::salsa_core(), Botan::ChaCha::seek(), Botan::Salsa20::seek(), Botan::Classic_McEliece_Minimal_Polynomial::serialize(), Botan::FrodoMatrix::serialize(), Botan::Sodium::sodium_malloc(), Botan::SIMD_4x32::store_le(), Botan::bitvector_base< secure_allocator >::subvector_replace(), Botan::Gf448Elem::to_bytes(), Botan::Scalar448::to_bytes(), Botan::Buffered_Computation::update_le(), Botan::Buffered_Computation::update_le(), Botan::Buffered_Computation::update_le(), Botan::ChaCha20Poly1305_Mode::update_len(), Botan::detail::FullWordBounds< SpongeT >::write_into(), and Botan::detail::PartialWordBounds< SpongeT >::write_into().

◆ string_join()

std::string Botan::string_join ( const std::vector< std::string > & strs,
char delim )

Join a string

Parameters
strsstrings to join
delimthe delimiter
Returns
string joined by delim

Definition at line 140 of file parsing.cpp.

140 {
141 std::ostringstream out;
142
143 for(size_t i = 0; i != strs.size(); ++i) {
144 if(i != 0) {
145 out << delim;
146 }
147 out << strs[i];
148 }
149
150 return out.str();
151}

Referenced by Botan::CPUID::to_string(), and Botan::Key_Constraints::to_string().

◆ string_to_ipv4()

std::optional< uint32_t > BOTAN_TEST_API Botan::string_to_ipv4 ( std::string_view ip_str)

Convert a string representation of an IPv4 address to a number

Parameters
ip_strthe string representation
Returns
integer IPv4 address

Definition at line 156 of file parsing.cpp.

156 {
157 // At least 3 dots + 4 1-digit integers
158 // At most 3 dots + 4 3-digit integers
159 if(str.size() < 3 + 4 * 1 || str.size() > 3 + 4 * 3) {
160 return {};
161 }
162
163 // the final result
164 uint32_t ip = 0;
165 // the number of '.' seen so far
166 size_t dots = 0;
167 // accumulates one quad (range 0-255)
168 uint32_t accum = 0;
169 // # of digits pushed to accum since last dot
170 size_t cur_digits = 0;
171
172 for(const char c : str) {
173 if(c == '.') {
174 // . without preceding digit is invalid
175 if(cur_digits == 0) {
176 return {};
177 }
178 dots += 1;
179 // too many dots
180 if(dots > 3) {
181 return {};
182 }
183
184 cur_digits = 0;
185 ip = (ip << 8) | accum;
186 accum = 0;
187 } else if(c >= '0' && c <= '9') {
188 const auto d = static_cast<uint8_t>(c - '0');
189
190 // prohibit leading zero in quad (used for octal)
191 if(cur_digits > 0 && accum == 0) {
192 return {};
193 }
194 accum = (accum * 10) + d;
195
196 if(accum > 255) {
197 return {};
198 }
199
200 cur_digits++;
201 BOTAN_ASSERT_NOMSG(cur_digits <= 3);
202 } else {
203 return {};
204 }
205 }
206
207 // no trailing digits?
208 if(cur_digits == 0) {
209 return {};
210 }
211
212 // insufficient # of dots
213 if(dots != 3) {
214 return {};
215 }
216
217 ip = (ip << 8) | accum;
218
219 return ip;
220}

References BOTAN_ASSERT_NOMSG.

Referenced by Botan::AlternativeName::add_attribute(), Botan::AlternativeName::AlternativeName(), Botan::TLS::Server_Name_Indicator::hostname_acceptable_for_sni(), Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), Botan::GeneralName::matches(), and Botan::X509_Certificate::matches_dns_name().

◆ swap_bits()

template<std::unsigned_integral T>
BOTAN_FORCE_INLINE constexpr void Botan::swap_bits ( T & x,
T & y,
T mask,
size_t shift )
constexpr

Definition at line 202 of file bit_ops.h.

202 {
203 const T swap = ((x >> shift) ^ y) & mask;
204 x ^= swap << shift;
205 y ^= swap;
206}

References BOTAN_FORCE_INLINE.

◆ swar_in_range()

template<std::unsigned_integral T>
T Botan::swar_in_range ( T v,
T lower,
T upper )
constexpr

SWAR (SIMD within a word) byte-by-byte comparison

This individually compares each byte of the provided words. It returns a mask which contains, for each byte, 0x80 if the byte in a was less than the byte in b. Otherwise the mask is 00.

This implementation assumes that the high bits of each byte in both lower and upper are clear! It is possible to support the full range of bytes, but this requires additional comparisons.

Definition at line 114 of file int_utils.h.

114 {
115 // The constant 0x808080... as a T
116 constexpr T hi1 = (static_cast<T>(-1) / 255) << 7;
117 // The constant 0x7F7F7F... as a T
118 constexpr T lo7 = ~hi1;
119
120 const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1);
121 const T a_lo = sub & lo7;
122 const T a_hi = sub & hi1;
123 return (lo7 - a_lo + upper) & hi1 & ~a_hi;
124}

◆ swar_lt()

template<std::unsigned_integral T>
T Botan::swar_lt ( T a,
T b )
constexpr

SWAR (SIMD within a word) byte-by-byte comparison

This individually compares each byte of the provided words. It returns a mask which contains, for each byte, 0xFF if the byte in a was less than the byte in b. Otherwise the mask is 00.

This implementation assumes that the high bits of each byte in both a and b are clear! It is possible to support the full range of bytes, but this requires additional comparisons.

Definition at line 91 of file int_utils.h.

91 {
92 // The constant 0x808080... as a T
93 constexpr T hi1 = (static_cast<T>(-1) / 255) << 7;
94 // The constant 0x7F7F7F... as a T
95 constexpr T lo7 = static_cast<T>(~hi1);
96 T r = (lo7 - a + b) & hi1;
97 // Currently the mask is 80 if lt, otherwise 00. Convert to FF/00
98 return (r << 1) - (r >> 7);
99}

◆ syndrome_init()

std::vector< polyn_gf2m > Botan::syndrome_init ( const polyn_gf2m & generator,
const std::vector< gf2m > & support,
int n )

Definition at line 605 of file polyn_gf2m.cpp.

605 {
606 int i = 0;
607 int j = 0;
608 int t = 0;
609 gf2m a = 0;
610
611 const std::shared_ptr<GF2m_Field> m_sp_field = generator.get_sp_field();
612
613 std::vector<polyn_gf2m> result;
614 t = generator.get_degree();
615
616 //g(z)=g_t+g_(t-1).z^(t-1)+......+g_1.z+g_0
617 //f(z)=f_(t-1).z^(t-1)+......+f_1.z+f_0
618
619 for(j = 0; j < n; j++) {
620 result.push_back(polyn_gf2m(t - 1, m_sp_field));
621
622 (*&result[j]).set_coef(t - 1, 1);
623 for(i = t - 2; i >= 0; i--) {
624 (*&result[j]).set_coef(i, (generator)[i + 1] ^ m_sp_field->gf_mul(lex_to_gray(support[j]), result[j][i + 1]));
625 }
626 a = ((generator)[0] ^ m_sp_field->gf_mul(lex_to_gray(support[j]), result[j][0]));
627 for(i = 0; i < t; i++) {
628 (*&result[j]).set_coef(i, m_sp_field->gf_div(result[j][i], a));
629 }
630 }
631 return result;
632}
Botan::lex_to_gray
gf2m lex_to_gray(gf2m lex)
Definition code_based_util.h:38

References Botan::polyn_gf2m::get_degree(), Botan::polyn_gf2m::get_sp_field(), and lex_to_gray().

Referenced by generate_mceliece_key().

◆ system_rng()

RandomNumberGenerator & Botan::system_rng ( )

Return a shared reference to a global PRNG instance provided by the operating system. For instance might be instantiated by /dev/urandom or CryptGenRandom.

Definition at line 373 of file system_rng.cpp.

373 {
374 static System_RNG_Impl g_system_rng;
375 return g_system_rng;
376}

Referenced by Botan::System_RNG::accepts_input(), Botan::AutoSeeded_RNG::AutoSeeded_RNG(), botan_pk_op_decrypt_create(), botan_pk_op_encrypt_create(), botan_pk_op_kem_decrypt_create(), botan_pk_op_key_agreement_create(), botan_pk_op_sign_create(), botan_rng_reseed(), botan_system_rng_get(), Botan::System_RNG::clear(), Botan::System_RNG::fill_bytes_with_input(), Botan::System_RNG::is_seeded(), Botan::System_RNG::name(), Botan::Sodium::randombytes_buf(), and Botan::RandomNumberGenerator::randomize_with_ts_input().

◆ throw_invalid_argument()

void BOTAN_UNSTABLE_API Botan::throw_invalid_argument ( const char * message,
const char * func,
const char * file )

Called when an invalid argument is used Throws Invalid_Argument

Definition at line 23 of file assert.cpp.

23 {
24 throw Invalid_Argument(fmt("{} in {}:{}", message, func, file));
25}

References fmt().

◆ throw_invalid_state()

void BOTAN_UNSTABLE_API Botan::throw_invalid_state ( const char * message,
const char * func,
const char * file )

Called when an invalid state is encountered Throws Invalid_State

Definition at line 27 of file assert.cpp.

27 {
28 throw Invalid_State(fmt("Invalid state: expr {} was false in {}:{}", expr, func, file));
29}

References fmt().

◆ to_affine()

template<typename C>
auto Botan::to_affine ( const typename C::ProjectivePoint & pt)
inlineconstexpr

Convert a projective point into affine

Definition at line 76 of file pcurves_algos.h.

76 {
77 // Not strictly required right? - default should work as long
78 // as (0,0) is identity and invert returns 0 on 0
79
80 if constexpr(curve_supports_fe_invert2<C>) {
81 const auto z2_inv = C::fe_invert2(pt.z());
82 const auto z3_inv = z2_inv.square() * pt.z();
83 return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv);
84 } else {
85 const auto z_inv = invert_field_element<C>(pt.z());
86 const auto z2_inv = z_inv.square();
87 const auto z3_inv = z_inv * z2_inv;
88 return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv);
89 }
90}

References invert_field_element().

Referenced by Botan::PCurve::GenericPrimeOrderCurve::point_to_affine(), Botan::PCurve::PrimeOrderCurveImpl< C >::point_to_affine(), and to_affine_batch().

◆ to_affine_batch()

template<typename C, bool VariableTime = false>
auto Botan::to_affine_batch ( std::span< const typename C::ProjectivePoint > projective)

Definition at line 107 of file pcurves_algos.h.

107 {
108 using AffinePoint = typename C::AffinePoint;
109
110 const size_t N = projective.size();
111 std::vector<AffinePoint> affine;
112 affine.reserve(N);
113
114 CT::Choice any_identity = CT::Choice::no();
115
116 for(const auto& pt : projective) {
117 any_identity = any_identity || pt.is_identity();
118 }
119
120 // Conditional acceptable: N is public. State of points is not necessarily
121 // public, but we don't leak which point was the identity. In practice with
122 // the algorithms currently in use, the only time an identity can occur is
123 // during mul2 where the two points g/h have a small relation (ie h = g*k for
124 // some k < 16)
125
126 if(N <= 2 || any_identity.as_bool()) {
127 // If there are identity elements, using the batch inversion gets
128 // tricky. It can be done, but this should be a rare situation so
129 // just punt to the serial conversion if it occurs
130 for(size_t i = 0; i != N; ++i) {
131 affine.push_back(to_affine<C>(projective[i]));
132 }
133 } else {
134 std::vector<typename C::FieldElement> c;
135 c.reserve(N);
136
137 /*
138 Batch projective->affine using Montgomery's trick
139
140 See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
141 (Hankerson, Menezes, Vanstone)
142 */
143
144 c.push_back(projective[0].z());
145 for(size_t i = 1; i != N; ++i) {
146 c.push_back(c[i - 1] * projective[i].z());
147 }
148
149 auto s_inv = [&]() {
150 if constexpr(VariableTime) {
151 return c[N - 1].invert_vartime();
152 } else {
153 return invert_field_element<C>(c[N - 1]);
154 }
155 }();
156
157 for(size_t i = N - 1; i > 0; --i) {
158 const auto& p = projective[i];
159
160 const auto z_inv = s_inv * c[i - 1];
161 const auto z2_inv = z_inv.square();
162 const auto z3_inv = z_inv * z2_inv;
163
164 s_inv = s_inv * p.z();
165
166 affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
167 }
168
169 const auto z2_inv = s_inv.square();
170 const auto z3_inv = s_inv * z2_inv;
171 affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
172 std::reverse(affine.begin(), affine.end());
173 return affine;
174 }
175
176 return affine;
177}
Botan::CT::Choice::no
static constexpr Choice no()
Definition ct_utils.h:307
Botan::CT::Choice::as_bool
constexpr bool as_bool() const
Definition ct_utils.h:329
Botan::to_affine
constexpr auto to_affine(const typename C::ProjectivePoint &pt)
Definition pcurves_algos.h:76

References Botan::CT::Choice::as_bool(), invert_field_element(), Botan::CT::Choice::no(), and to_affine().

Referenced by Botan::AffinePointTable< C, R >::AffinePointTable(), basemul_booth_setup(), basemul_setup(), and Botan::VartimeMul2Table< C, W >::VartimeMul2Table().

◆ to_affine_x()

template<typename C>
auto Botan::to_affine_x ( const typename C::ProjectivePoint & pt)

Convert a projective point into affine and return x coordinate only

Definition at line 96 of file pcurves_algos.h.

96 {
97 if constexpr(curve_supports_fe_invert2<C>) {
98 return pt.x() * C::fe_invert2(pt.z());
99 } else {
100 const auto z_inv = invert_field_element<C>(pt.z());
101 const auto z2_inv = z_inv.square();
102 return pt.x() * z2_inv;
103 }
104}

References invert_field_element().

Referenced by Botan::PCurve::GenericPrimeOrderCurve::base_point_mul_x_mod_order(), Botan::PCurve::PrimeOrderCurveImpl< C >::base_point_mul_x_mod_order(), Botan::PCurve::GenericPrimeOrderCurve::mul_x_only(), and Botan::PCurve::PrimeOrderCurveImpl< C >::mul_x_only().

◆ to_string() [1/2]

const char * Botan::to_string ( Certificate_Status_Code code)

Convert a status code to a human readable diagnostic message

Parameters
codethe certificate status
Returns
string literal constant, or nullptr if code unknown

Definition at line 11 of file cert_status.cpp.

11 {
12 switch(code) {
13 case Certificate_Status_Code::VERIFIED:
14 return "Verified";
15 case Certificate_Status_Code::OCSP_RESPONSE_GOOD:
16 return "OCSP response accepted as affirming unrevoked status for certificate";
17 case Certificate_Status_Code::OCSP_SIGNATURE_OK:
18 return "Signature on OCSP response was found valid";
19 case Certificate_Status_Code::VALID_CRL_CHECKED:
20 return "Valid CRL examined";
21
22 case Certificate_Status_Code::CERT_SERIAL_NEGATIVE:
23 return "Certificate serial number is negative";
24 case Certificate_Status_Code::DN_TOO_LONG:
25 return "Distinguished name too long";
26 case Certificate_Status_Code::OCSP_NO_REVOCATION_URL:
27 return "OCSP URL not available";
28 case Certificate_Status_Code::OCSP_SERVER_NOT_AVAILABLE:
29 return "OCSP server not available";
30 case Certificate_Status_Code::TRUSTED_CERT_NOT_YET_VALID:
31 return "Trusted certificate is not yet valid";
32 case Certificate_Status_Code::TRUSTED_CERT_HAS_EXPIRED:
33 return "Trusted certificate has expired";
34 case Certificate_Status_Code::OCSP_ISSUER_NOT_TRUSTED:
35 return "OCSP issuer is not trustworthy";
36
37 case Certificate_Status_Code::NO_REVOCATION_DATA:
38 return "No revocation data";
39 case Certificate_Status_Code::SIGNATURE_METHOD_TOO_WEAK:
40 return "Signature method too weak";
41 case Certificate_Status_Code::UNTRUSTED_HASH:
42 return "Hash function used is considered too weak for security";
43
44 case Certificate_Status_Code::CERT_NOT_YET_VALID:
45 return "Certificate is not yet valid";
46 case Certificate_Status_Code::CERT_HAS_EXPIRED:
47 return "Certificate has expired";
48 case Certificate_Status_Code::OCSP_NOT_YET_VALID:
49 return "OCSP is not yet valid";
50 case Certificate_Status_Code::OCSP_HAS_EXPIRED:
51 return "OCSP response has expired";
52 case Certificate_Status_Code::OCSP_IS_TOO_OLD:
53 return "OCSP response is too old";
54 case Certificate_Status_Code::CRL_NOT_YET_VALID:
55 return "CRL response is not yet valid";
56 case Certificate_Status_Code::CRL_HAS_EXPIRED:
57 return "CRL has expired";
58
59 case Certificate_Status_Code::CERT_ISSUER_NOT_FOUND:
60 return "Certificate issuer not found";
61 case Certificate_Status_Code::CANNOT_ESTABLISH_TRUST:
62 return "Cannot establish trust";
63 case Certificate_Status_Code::CERT_CHAIN_LOOP:
64 return "Loop in certificate chain";
65 case Certificate_Status_Code::CHAIN_LACKS_TRUST_ROOT:
66 return "Certificate chain does not end in a CA certificate";
67 case Certificate_Status_Code::CHAIN_NAME_MISMATCH:
68 return "Certificate issuer does not match subject of issuing cert";
69
70 case Certificate_Status_Code::POLICY_ERROR:
71 return "Certificate policy error";
72 case Certificate_Status_Code::DUPLICATE_CERT_POLICY:
73 return "Certificate contains duplicate policy";
74 case Certificate_Status_Code::INVALID_USAGE:
75 return "Certificate does not allow the requested usage";
76 case Certificate_Status_Code::CERT_CHAIN_TOO_LONG:
77 return "Certificate chain too long";
78 case Certificate_Status_Code::CA_CERT_NOT_FOR_CERT_ISSUER:
79 return "CA certificate not allowed to issue certs";
80 case Certificate_Status_Code::CA_CERT_NOT_FOR_CRL_ISSUER:
81 return "CA certificate not allowed to issue CRLs";
82 case Certificate_Status_Code::NO_MATCHING_CRLDP:
83 return "No CRL with matching distribution point for certificate";
84 case Certificate_Status_Code::OCSP_CERT_NOT_LISTED:
85 return "OCSP cert not listed";
86 case Certificate_Status_Code::OCSP_BAD_STATUS:
87 return "OCSP bad status";
88 case Certificate_Status_Code::CERT_NAME_NOMATCH:
89 return "Certificate does not match provided name";
90 case Certificate_Status_Code::NAME_CONSTRAINT_ERROR:
91 return "Certificate does not pass name constraint";
92 case Certificate_Status_Code::IPADDR_BLOCKS_ERROR:
93 return "IP Address Blocks extension invalid";
94 case Certificate_Status_Code::AS_BLOCKS_ERROR:
95 return "AS Number Blocks extension invalid";
96 case Certificate_Status_Code::UNKNOWN_CRITICAL_EXTENSION:
97 return "Unknown critical extension encountered";
98 case Certificate_Status_Code::DUPLICATE_CERT_EXTENSION:
99 return "Duplicate certificate extension encountered";
100 case Certificate_Status_Code::EXT_IN_V1_V2_CERT:
101 return "Encountered extension in certificate with version that does not allow it";
102 case Certificate_Status_Code::V2_IDENTIFIERS_IN_V1_CERT:
103 return "Encountered v2 identifiers in v1 certificate";
104 case Certificate_Status_Code::OCSP_SIGNATURE_ERROR:
105 return "OCSP signature error";
106 case Certificate_Status_Code::OCSP_ISSUER_NOT_FOUND:
107 return "Unable to find certificate issuing OCSP response";
108 case Certificate_Status_Code::OCSP_RESPONSE_MISSING_KEYUSAGE:
109 return "OCSP issuer's keyusage prohibits OCSP";
110 case Certificate_Status_Code::OCSP_RESPONSE_INVALID:
111 return "OCSP parsing valid";
112 case Certificate_Status_Code::OCSP_NO_HTTP:
113 return "OCSP requests not available, no HTTP support compiled in";
114 case Certificate_Status_Code::CERT_IS_REVOKED:
115 return "Certificate is revoked";
116 case Certificate_Status_Code::CRL_BAD_SIGNATURE:
117 return "CRL bad signature";
118 case Certificate_Status_Code::SIGNATURE_ERROR:
119 return "Signature error";
120 case Certificate_Status_Code::CERT_PUBKEY_INVALID:
121 return "Certificate public key invalid";
122 case Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN:
123 return "Certificate signed with unknown/unavailable algorithm";
124 case Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS:
125 return "Certificate signature has invalid parameters";
126
127 // intentionally no default so we are warned if new enum values are added
128 }
129
130 return nullptr;
131}

References AS_BLOCKS_ERROR, CA_CERT_NOT_FOR_CERT_ISSUER, CA_CERT_NOT_FOR_CRL_ISSUER, CANNOT_ESTABLISH_TRUST, CERT_CHAIN_LOOP, CERT_CHAIN_TOO_LONG, CERT_HAS_EXPIRED, CERT_IS_REVOKED, CERT_ISSUER_NOT_FOUND, CERT_NAME_NOMATCH, CERT_NOT_YET_VALID, CERT_PUBKEY_INVALID, CERT_SERIAL_NEGATIVE, CHAIN_LACKS_TRUST_ROOT, CHAIN_NAME_MISMATCH, CRL_BAD_SIGNATURE, CRL_HAS_EXPIRED, CRL_NOT_YET_VALID, DN_TOO_LONG, DUPLICATE_CERT_EXTENSION, DUPLICATE_CERT_POLICY, EXT_IN_V1_V2_CERT, INVALID_USAGE, IPADDR_BLOCKS_ERROR, NAME_CONSTRAINT_ERROR, NO_MATCHING_CRLDP, NO_REVOCATION_DATA, OCSP_BAD_STATUS, OCSP_CERT_NOT_LISTED, OCSP_HAS_EXPIRED, OCSP_IS_TOO_OLD, OCSP_ISSUER_NOT_FOUND, OCSP_ISSUER_NOT_TRUSTED, OCSP_NO_HTTP, OCSP_NO_REVOCATION_URL, OCSP_NOT_YET_VALID, OCSP_RESPONSE_GOOD, OCSP_RESPONSE_INVALID, OCSP_RESPONSE_MISSING_KEYUSAGE, OCSP_SERVER_NOT_AVAILABLE, OCSP_SIGNATURE_ERROR, OCSP_SIGNATURE_OK, POLICY_ERROR, SIGNATURE_ALGO_BAD_PARAMS, SIGNATURE_ALGO_UNKNOWN, SIGNATURE_ERROR, SIGNATURE_METHOD_TOO_WEAK, TRUSTED_CERT_HAS_EXPIRED, TRUSTED_CERT_NOT_YET_VALID, UNKNOWN_CRITICAL_EXTENSION, UNTRUSTED_HASH, V2_IDENTIFIERS_IN_V1_CERT, VALID_CRL_CHECKED, and VERIFIED.

◆ to_string() [2/2]

std::string Botan::to_string ( ErrorType type)

Convert an ErrorType to string.

Definition at line 13 of file exceptn.cpp.

13 {
14 switch(type) {
15 case ErrorType::Unknown:
16 return "Unknown";
17 case ErrorType::SystemError:
18 return "SystemError";
19 case ErrorType::NotImplemented:
20 return "NotImplemented";
21 case ErrorType::OutOfMemory:
22 return "OutOfMemory";
23 case ErrorType::InternalError:
24 return "InternalError";
25 case ErrorType::IoError:
26 return "IoError";
27 case ErrorType::InvalidObjectState:
28 return "InvalidObjectState";
29 case ErrorType::KeyNotSet:
30 return "KeyNotSet";
31 case ErrorType::InvalidArgument:
32 return "InvalidArgument";
33 case ErrorType::InvalidKeyLength:
34 return "InvalidKeyLength";
35 case ErrorType::InvalidNonceLength:
36 return "InvalidNonceLength";
37 case ErrorType::LookupError:
38 return "LookupError";
39 case ErrorType::EncodingFailure:
40 return "EncodingFailure";
41 case ErrorType::DecodingFailure:
42 return "DecodingFailure";
43 case ErrorType::TLSError:
44 return "TLSError";
45 case ErrorType::HttpError:
46 return "HttpError";
47 case ErrorType::InvalidTag:
48 return "InvalidTag";
49 case ErrorType::RoughtimeError:
50 return "RoughtimeError";
51 case ErrorType::CommonCryptoError:
52 return "CommonCryptoError";
53 case ErrorType::Pkcs11Error:
54 return "Pkcs11Error";
55 case ErrorType::TPMError:
56 return "TPMError";
57 case ErrorType::DatabaseError:
58 return "DatabaseError";
59 case ErrorType::ZlibError:
60 return "ZlibError";
61 case ErrorType::Bzip2Error:
62 return "Bzip2Error";
63 case ErrorType::LzmaError:
64 return "LzmaError";
65 }
66
67 // No default case in above switch so compiler warns
68 return "Unrecognized Botan error";
69}

References Bzip2Error, CommonCryptoError, DatabaseError, DecodingFailure, EncodingFailure, HttpError, InternalError, InvalidArgument, InvalidKeyLength, InvalidNonceLength, InvalidObjectState, InvalidTag, IoError, KeyNotSet, LookupError, LzmaError, NotImplemented, OutOfMemory, Pkcs11Error, RoughtimeError, SystemError, TLSError, TPMError, Unknown, and ZlibError.

Referenced by Botan::TLS::Server_Hello_13::basic_validation(), botan_x509_cert_validation_status(), Botan::PKCS11::PKCS11_ReturnError::PKCS11_ReturnError(), and Botan::Path_Validation_Result::status_string().

◆ to_u32bit()

BOTAN_TEST_API uint32_t Botan::to_u32bit ( std::string_view str)

Convert a decimal string to a number

Parameters
strthe string to convert
Returns
number value of the string

Definition at line 32 of file parsing.cpp.

32 {
33 const std::string str(str_view);
34
35 // std::stoul is not strict enough. Ensure that str is digit only [0-9]*
36 for(const char chr : str) {
37 if(chr < '0' || chr > '9') {
38 throw Invalid_Argument("to_u32bit invalid decimal string '" + str + "'");
39 }
40 }
41
42 const unsigned long int x = std::stoul(str);
43
44 if constexpr(sizeof(unsigned long int) > 4) {
45 // x might be uint64
46 if(x > std::numeric_limits<uint32_t>::max()) {
47 throw Invalid_Argument("Integer value of " + str + " exceeds 32 bit range");
48 }
49 }
50
51 return static_cast<uint32_t>(x);
52}

Referenced by Botan::SCAN_Name::arg_as_integer(), Botan::SCAN_Name::arg_as_integer(), argon2_check_pwhash(), create_private_key(), Botan::TLS::Text_Policy::get_len(), Botan::HTTP::http_sync(), and to_uint16().

◆ to_uint16()

uint16_t Botan::to_uint16 ( std::string_view str)

Convert a decimal string to a number

Parameters
strthe string to convert
Returns
number value of the string

Definition at line 22 of file parsing.cpp.

22 {
23 const uint32_t x = to_u32bit(str);
24
25 if(x != static_cast<uint16_t>(x)) {
26 throw Invalid_Argument("Integer value exceeds 16 bit range");
27 }
28
29 return static_cast<uint16_t>(x);
30}

References to_u32bit().

Referenced by check_bcrypt(), and Botan::TLS::Text_Policy::srtp_profiles().

◆ to_underlying()

template<typename T>
requires std::is_enum_v<T>
auto Botan::to_underlying ( T e)
noexcept

Definition at line 121 of file stl_util.h.

121 {
122 return static_cast<std::underlying_type_t<T>>(e);
123}

◆ tolower_string()

std::string Botan::tolower_string ( std::string_view str)

Definition at line 241 of file parsing.cpp.

241 {
242 std::string lower(str);
243 for(char& c : lower) {
244 const int cu = static_cast<unsigned char>(c);
245 if(std::isalpha(cu) != 0) {
246 c = static_cast<char>(std::tolower(cu));
247 }
248 }
249 return lower;
250}

Referenced by Botan::AlternativeName::add_dns(), and host_wildcard_match().

◆ treehash() [1/2]

BOTAN_TEST_API void Botan::treehash ( StrongSpan< SphincsTreeNode > out_root,
StrongSpan< SphincsAuthenticationPath > out_auth_path,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes,
std::optional< TreeNodeIndex > leaf_idx,
uint32_t idx_offset,
uint32_t tree_height,
const GenerateLeafFunction & gen_leaf,
Sphincs_Address & tree_address )

Implements a generic Merkle tree hash. Will be used for both FORS and XMSS signatures. gen_leaf is used to create leaf nodes in the respective trees. Additionally XMSS uses the gen_leaf logic to store the WOTS Signature in the main SLH-DSA signature. The leaf_idx is the index of leaf to sign. If only the root node must be computed (without a signature), the leaf_idx is set to std::nullopt.

Definition at line 17 of file sp_treehash.cpp.

25 {
26 BOTAN_ASSERT_NOMSG(out_root.size() == params.n());
27 BOTAN_ASSERT_NOMSG(out_auth_path.size() == params.n() * total_tree_height);
28
29 const TreeNodeIndex max_idx(uint32_t((1 << total_tree_height) - 1));
30
31 std::vector<uint8_t> stack(total_tree_height * params.n());
32 SphincsTreeNode current_node(params.n()); // Current logical node
33
34 /* Traverse the tree from the left-most leaf, matching siblings and up until
35 * the root (Post-order traversal). Collect the adjacent nodes (A) to build
36 * the authentication path (X) along the way.
37 *
38 * 7R
39 * / \
40 * 3X 6A
41 * / \ / \
42 * 1X 2A 4 5
43 */
44 for(TreeNodeIndex idx(0); true; ++idx) {
45 tree_address.set_tree_height(TreeLayerIndex(0));
46 gen_leaf(current_node, idx + idx_offset);
47
48 // Now combine the freshly generated right node with previously generated
49 // left ones
50 uint32_t internal_idx_offset = idx_offset;
51 TreeNodeIndex internal_idx = idx;
52 auto internal_leaf = leaf_idx;
53
54 for(TreeLayerIndex h(0); true; ++h) {
55 // Check if we hit the top of the tree
56 if(h.get() == total_tree_height) {
57 copy_mem(out_root, current_node);
58 return;
59 }
60
61 // Check if the node we have is a part of the authentication path; if
62 // it is, write it out. The XOR sum of both nodes (at internal_idx and internal_leaf)
63 // is 1 iff they have the same parent node in the FORS tree
64 if(internal_leaf.has_value() && (internal_idx ^ internal_leaf.value()) == 0x01U) {
65 auto auth_path_location = out_auth_path.get().subspan(h.get() * params.n(), params.n());
66 copy_mem(auth_path_location, current_node);
67 }
68
69 // At this point we know that we'll need to use the stack. Get a
70 // reference to the correct location.
71 auto stack_location = std::span(stack).subspan(h.get() * params.n(), params.n());
72
73 // Check if we're at a left child; if so, stop going up the stack
74 // Exception: if we've reached the end of the tree, keep on going (so
75 // we combine the last 4 nodes into the one root node in two more
76 // iterations)
77 if((internal_idx & 1) == 0U && idx < max_idx) {
78 // We've hit a left child; save the current for when we get the
79 // corresponding right child.
80 copy_mem(stack_location, current_node);
81 break;
82 }
83
84 // Ok, we're at a right node. Now combine the left and right logical
85 // nodes together.
86
87 // Set the address of the node we're creating.
88 internal_idx_offset /= 2;
89 tree_address.set_tree_height(h + 1);
90 tree_address.set_tree_index(internal_idx / 2 + internal_idx_offset);
91
92 hashes.T(current_node, tree_address, stack_location, current_node);
93
94 internal_idx /= 2;
95 if(internal_leaf.has_value()) {
96 internal_leaf.value() /= 2;
97 }
98 }
99 }
100}
Botan::StrongSpan::get
underlying_span get() const
Definition strong_type.h:703

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::StrongSpan< T >::get(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_tree_height(), Botan::Sphincs_Address::set_tree_index(), Botan::StrongSpan< T >::size(), and Botan::Sphincs_Hash_Functions::T().

Referenced by fors_sign_and_pkgen(), and xmss_sign_and_pkgen().

◆ treehash() [2/2]

template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void Botan::treehash ( StrongSpan< TreeNode > out_root,
std::optional< AuthPathSS > out_auth_path,
std::optional< TreeNodeIndex > leaf_idx,
size_t node_size,
TreeLayerIndex total_tree_height,
uint32_t idx_offset,
concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash,
concepts::tree_gen_leaf< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto gen_leaf,
Address & tree_address )
inline

Treehash logic to build up a merkle hash tree.

Computes the root of the merkle tree. Can also output an authentication path necessary for a hash based signature.

Given the following tree: Layer: 2 7R / \ 1 3X 6A / \ / \ 0 1X 2A 4 5

The treehash logic traverses the tree (Post-order traversal), i.e., the nodes are discovered in order 1,2,3,...,7. If we want to create a signature using leaf node 1, the authentication path is (Node 2, Node 6), since we need those to compute the root.

Parameters
out_rootAn output buffer to store the root node in (size: node_size ).
out_auth_pathOptional buffer to store the authentication path in (size: node_size * total_tree_height).
leaf_idxThe optional index of the leaf used to sign in the bottom tree layer beginning with index 0. nullopt if no node is signed, so we need no auth path.
node_sizeThe size of each node in the tree.
total_tree_heightThe height of the merkle tree to construct.
idx_offsetIf we compute a subtree this marks the index of the leftmost leaf node in the bottom layer
node_pair_hashThe function to process two child nodes to compute their parent node.
gen_leafThe logic to create a leaf node given the address in the tree. Probably this function creates a one-time/few-time-signature's public key which is hashed to be the leaf node.
tree_addressThe address that is passed to gen_leaf or node_pair hash. This function will update the address accordings to the currently processed node. This object may contain further algorithm specific information, like the position of this merkle tree in a hypertree.

Definition at line 110 of file tree_hash.h.

119 {
120 BOTAN_ASSERT_NOMSG(out_root.size() == node_size);
121 BOTAN_ASSERT(out_auth_path.has_value() == leaf_idx.has_value(),
122 "Both leaf index and auth path buffer is given or neither.");
123 const bool is_signing = leaf_idx.has_value();
124 BOTAN_ASSERT_NOMSG(!is_signing || out_auth_path.value().size() == node_size * total_tree_height.get());
125
126 const TreeNodeIndex max_idx(uint32_t((1 << total_tree_height.get()) - 1));
127
128 std::vector<TreeNode> last_visited_left_child_at_layer(total_tree_height.get(), TreeNode(node_size));
129
130 TreeNode current_node(node_size); // Current logical node
131
132 // Traverse the tree from the left-most leaf, matching siblings and up until
133 // the root (Post-order traversal). Collect the adjacent nodes to build
134 // the authentication path along the way.
135 for(TreeNodeIndex idx(0); true; ++idx) {
136 tree_address.set_address(TreeLayerIndex(0), idx + idx_offset);
137 gen_leaf(StrongSpan<TreeNode>(current_node), tree_address);
138
139 // Now combine the freshly generated right node with previously generated
140 // left ones
141 uint32_t internal_idx_offset = idx_offset;
142 TreeNodeIndex internal_idx = idx;
143 auto internal_leaf = leaf_idx;
144
145 for(TreeLayerIndex h(0); true; ++h) {
146 // Check if we hit the top of the tree
147 if(h == total_tree_height) {
148 copy_mem(out_root, current_node);
149 return;
150 }
151
152 // Check if the node we have is a part of the authentication path; if
153 // it is, write it out. The XOR sum of both nodes (at internal_idx and internal_leaf)
154 // is 1 iff they have the same parent node in the FORS tree
155 if(is_signing && (internal_idx ^ internal_leaf.value()) == 0x01U) {
156 auto auth_path_location = out_auth_path.value().get().subspan(h.get() * node_size, node_size);
157 copy_mem(auth_path_location, current_node);
158 }
159
160 // Check if we're at a left child; if so, stop going up the tree
161 // Exception: if we've reached the end of the tree, keep on going (so
162 // we combine the last 4 nodes into the one root node in two more
163 // iterations)
164 if((internal_idx & 1) == 0U && idx < max_idx) {
165 // We've hit a left child; save the current for when we get the
166 // corresponding right child.
167 copy_mem(last_visited_left_child_at_layer.at(h.get()), current_node);
168 break;
169 }
170
171 // Ok, we're at a right node. Now combine the left and right logical
172 // nodes together.
173
174 // Set the address of the node we're creating.
175 internal_idx_offset /= 2;
176 tree_address.set_address(h + 1, internal_idx / 2 + internal_idx_offset);
177
178 node_pair_hash(current_node, tree_address, last_visited_left_child_at_layer.at(h.get()), current_node);
179
180 internal_idx /= 2;
181 if(internal_leaf.has_value()) {
182 internal_leaf.value() /= 2;
183 }
184 }
185 }
186}

References BOTAN_ASSERT, BOTAN_ASSERT_NOMSG, copy_mem(), Botan::detail::Strong_Base< T >::get(), and Botan::StrongSpan< T >::size().

◆ typecast_copy() [1/9]

template<typename ToT, ranges::contiguous_range FromR>
requires std::is_default_constructible_v<ToT> && std::is_trivially_copyable_v<ToT> && std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>>
ToT Botan::typecast_copy ( const FromR & src)
inlineconstexpr

Create a trivial type by bit-casting a range of trivially copyable type with matching length into it.

Definition at line 210 of file mem_ops.h.

210 {
211 ToT dst; // NOLINT(*-member-init)
212 typecast_copy(dst, src);
213 return dst;
214}

References typecast_copy().

◆ typecast_copy() [2/9]

template<typename To>
requires std::is_trivial_v<To>
To Botan::typecast_copy ( const uint8_t src[])
inlineconstexprnoexcept

Definition at line 252 of file mem_ops.h.

252 {
253 // asserts that *src points to the correct amount of memory
254 return typecast_copy<To>(std::span<const uint8_t, sizeof(To)>(src, sizeof(To)));
255}

References typecast_copy().

◆ typecast_copy() [3/9]

template<typename T>
requires std::is_trivial_v<std::decay_t<T>>
void Botan::typecast_copy ( T & out,
const uint8_t in[] )
inlineconstexpr

Definition at line 244 of file mem_ops.h.

244 {
245 // asserts that *in points to the correct amount of memory
246 typecast_copy(out, std::span<const uint8_t, sizeof(T)>(in, sizeof(T)));
247}

References typecast_copy().

◆ typecast_copy() [4/9]

template<typename T>
requires std::is_trivial_v<T>
void Botan::typecast_copy ( T out[],
const uint8_t in[],
size_t N )
inlineconstexpr

Definition at line 227 of file mem_ops.h.

229{
230 // asserts that *in and *out point to the correct amount of memory
231 typecast_copy(std::span<T>(out, N), std::span<const uint8_t>(in, N * sizeof(T)));
232}

References typecast_copy().

◆ typecast_copy() [5/9]

template<ranges::contiguous_output_range ToR, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
void Botan::typecast_copy ( ToR && out,
const FromR & in )
inlineconstexpr

Copy a range of a trivially copyable type into another range of trivially copyable type of matching byte length.

Definition at line 176 of file mem_ops.h.

176 {
177 ranges::assert_equal_byte_lengths(out, in);
178 std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
179}

References Botan::ranges::assert_equal_byte_lengths(), and Botan::ranges::size_bytes().

Referenced by decode_point(), decode_scalar(), Botan::bitvector_base< secure_allocator >::from_bytes(), Botan::detail::load_any(), Botan::detail::load_any(), Botan::Roughtime::Nonce::Nonce(), Botan::detail::store_any(), Botan::detail::store_any(), Botan::bitvector_base< secure_allocator >::to_bytes(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), xor_buf(), and xor_buf().

◆ typecast_copy() [6/9]

template<ranges::contiguous_output_range ToR, typename FromT>
requires std::is_trivially_copyable_v<FromT> && (!std::ranges::range<FromT>) && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
void Botan::typecast_copy ( ToR && out,
const FromT & in )
inlineconstexpr

Copy an instance of trivially copyable type into a range of trivially copyable type with matching length.

Definition at line 199 of file mem_ops.h.

199 {
200 typecast_copy(out, std::span<const FromT, 1>(&in, 1));
201}

References typecast_copy().

◆ typecast_copy() [7/9]

template<typename ToT, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<ToT> && (!std::ranges::range<ToT>)
void Botan::typecast_copy ( ToT & out,
const FromR & in )
inlineconstexpr

Copy a range of trivially copyable type into an instance of trivially copyable type with matching length.

Definition at line 188 of file mem_ops.h.

188 {
189 typecast_copy(std::span<ToT, 1>(&out, 1), in);
190}

References typecast_copy().

◆ typecast_copy() [8/9]

template<typename T>
void Botan::typecast_copy ( uint8_t out[],
const T & in )
inlineconstexpr

Definition at line 236 of file mem_ops.h.

236 {
237 // asserts that *out points to the correct amount of memory
238 typecast_copy(std::span<uint8_t, sizeof(T)>(out, sizeof(T)), in);
239}

References typecast_copy().

◆ typecast_copy() [9/9]

template<typename T>
requires std::is_trivially_copyable_v<T>
void Botan::typecast_copy ( uint8_t out[],
T in[],
size_t N )
inlineconstexpr

Definition at line 218 of file mem_ops.h.

220{
221 // asserts that *in and *out point to the correct amount of memory
222 typecast_copy(std::span<uint8_t>(out, sizeof(T) * N), std::span<const T>(in, N));
223}

References typecast_copy().

◆ ucs2_to_utf8()

BOTAN_TEST_API std::string Botan::ucs2_to_utf8 ( const uint8_t ucs2[],
size_t len )

Convert a sequence of UCS-2 (big endian) characters to a UTF-8 string This is used for ASN.1 BMPString type

Parameters
ucs2the sequence of UCS-2 characters
lenlength of ucs2 in bytes, must be a multiple of 2

Definition at line 54 of file charset.cpp.

54 {
55 if(len % 2 != 0) {
56 throw Decoding_Error("Invalid length for UCS-2 string");
57 }
58
59 const size_t chars = len / 2;
60
61 std::string s;
62 for(size_t i = 0; i != chars; ++i) {
63 const uint32_t c = load_be<uint16_t>(ucs2, i);
64 append_utf8_for(s, c);
65 }
66
67 return s;
68}

References load_be().

Referenced by Botan::ASN1_String::decode_from().

◆ ucs4_to_utf8()

BOTAN_TEST_API std::string Botan::ucs4_to_utf8 ( const uint8_t ucs4[],
size_t len )

Convert a sequence of UCS-4 (big endian) characters to a UTF-8 string This is used for ASN.1 UniversalString type

Parameters
ucs4the sequence of UCS-4 characters
lenlength of ucs4 in bytes, must be a multiple of 4

Definition at line 70 of file charset.cpp.

70 {
71 if(len % 4 != 0) {
72 throw Decoding_Error("Invalid length for UCS-4 string");
73 }
74
75 const size_t chars = len / 4;
76
77 std::string s;
78 for(size_t i = 0; i != chars; ++i) {
79 const uint32_t c = load_be<uint32_t>(ucs4, i);
80 append_utf8_for(s, c);
81 }
82
83 return s;
84}

References load_be().

Referenced by Botan::ASN1_String::decode_from().

◆ unchecked_copy_memory()

template<std::unsigned_integral T>
void Botan::unchecked_copy_memory ( T * out,
const T * in,
size_t n )
inline

Definition at line 44 of file mem_utils.h.

44 {
45 if(in != nullptr && out != nullptr && n > 0) {
46 std::memmove(out, in, sizeof(T) * n);
47 }
48}

Referenced by bigint_shl1(), bigint_shl2(), bigint_shr1(), bigint_shr2(), and Botan::BigInt::mod_sub().

◆ unlock()

template<typename T>
std::vector< T > Botan::unlock ( const secure_vector< T > & in)

Definition at line 85 of file secmem.h.

85 {
86 return std::vector<T>(in.begin(), in.end());
87}

Referenced by Botan::OCSP::CertID::CertID(), Botan::Roughtime::Chain::Chain(), Botan::DL_Group::DL_Group(), Botan::KeyPair::encryption_consistency_check(), Botan::DL_Group::from_PEM(), Botan::OCSP::CertID::is_id_for(), and Botan::Cipher_Mode_Filter::set_iv().

◆ unsafe_for_production_build()

bool Botan::unsafe_for_production_build ( )

Certain build-time options, used for testing, result in a binary which is not safe for use in a production system. This function can be used to test for such a configuration at runtime.

Currently these unsafe conditions include:

  • Unsafe fuzzer mode (–unsafe-fuzzer-mode) which intentionally disables various checks in order to improve the effectiveness of fuzzing.
  • Terminate on asserts (–unsafe-terminate-on-asserts) which intentionally aborts if any internal assertion failure occurs, rather than throwing an exception.

Definition at line 67 of file version.cpp.

67 {
68#if defined(BOTAN_UNSAFE_FUZZER_MODE) || defined(BOTAN_TERMINATE_ON_ASSERTS)
69 return true;
70#else
71 return false;
72#endif
73}

◆ unwrap_strong_type()

template<typename T>
decltype(auto) Botan::unwrap_strong_type ( T && t)
nodiscardconstexpr

Generically unwraps a strong type to its underlying type.

If the provided type is not a strong type, it is returned as is.

Note
This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary get() method if you know that you are dealing with a strong type.
Parameters
tvalue to be unwrapped
Returns
the unwrapped value

Definition at line 243 of file strong_type.h.

243 {
244 if constexpr(!concepts::strong_type<std::remove_cvref_t<T>>) {
245 // If the parameter type isn't a strong type, return it as is.
246 return std::forward<T>(t);
247 } else {
248 // Unwrap the strong type and return the underlying value.
249 return std::forward<T>(t).get();
250 }
251}
Botan::concepts::strong_type
Definition strong_type.h:37

Referenced by checked_cast_to_or_throw(), Botan::detail::concatenate(), Botan::bitvector_base< secure_allocator >::ct_conditional_xor(), Botan::bitvector_base< secure_allocator >::equals_vartime(), Botan::bitvector_base< secure_allocator >::operator&=(), Botan::bitvector_base< secure_allocator >::operator^=(), Botan::bitvector_base< secure_allocator >::operator|=(), Botan::bitvector_base< secure_allocator >::subvector(), Botan::bitvector_base< secure_allocator >::subvector_replace(), and Botan::detail::unwrap_strong_type_or_enum().

◆ value_exists()

template<typename T, typename V>
bool Botan::value_exists ( const std::vector< T > & vec,
const V & val )

Existence check for values

Definition at line 43 of file stl_util.h.

43 {
44 for(const auto& elem : vec) {
45 if(elem == val) {
46 return true;
47 }
48 }
49 return false;
50}

Referenced by Botan::TLS::Policy::acceptable_ciphersuite(), Botan::TLS::Policy::allowed_signature_hash(), Botan::TLS::Policy::allowed_signature_method(), Botan::TLS::Certificate_Type_Base::Certificate_Type_Base(), Botan::TLS::Policy::choose_key_exchange_group(), Botan::TLS::Policy::ciphersuite_list(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Server_Hello_13::create(), Botan::TPM2::Context::find_free_persistent_handle(), Botan::TLS::Hello_Retry_Request::Hello_Retry_Request(), Botan::TLS::Signature_Scheme::is_available(), Botan::TLS::Server_Impl_13::new_session_ticket_supported(), Botan::TPM2::Context::persist(), Botan::TLS::Key_Share::retry_offer(), Botan::TLS::Supported_Groups::Supported_Groups(), and Botan::TLS::Certificate_Type_Base::validate_selection().

◆ var_ctz32()

BOTAN_FORCE_INLINE constexpr size_t Botan::var_ctz32 ( uint32_t n)
constexpr

Definition at line 180 of file bit_ops.h.

180 {
181#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_ctz)
182 if(n == 0) {
183 return 32;
184 }
185 return __builtin_ctz(n);
186#else
187 return ctz<uint32_t>(n);
188#endif
189}

References BOTAN_FORCE_INLINE, and ctz().

◆ varpoint_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint Botan::varpoint_exec ( const AffinePointTable< C > & table,
const BlindedScalar & scalar,
RandomNumberGenerator & rng )

Definition at line 371 of file pcurves_mul.h.

373 {
374 const size_t windows = (scalar.bits() + WindowBits - 1) / WindowBits;
375
376 auto accum = [&]() {
377 const size_t w_0 = scalar.get_window((windows - 1) * WindowBits);
378 auto pt = C::ProjectivePoint::from_affine(table.ct_select(w_0));
379 CT::poison(pt);
380 pt.randomize_rep(rng);
381 return pt;
382 }();
383
384 for(size_t i = 1; i != windows; ++i) {
385 accum = accum.dbl_n(WindowBits);
386 auto w_i = scalar.get_window((windows - i - 1) * WindowBits);
387
388 /*
389 This point addition cannot be a doubling (except once)
390
391 Consider the sequence of points that are operated on, and specifically
392 their discrete logarithms. We start out at the point at infinity
393 (dlog 0) and then add the initial window which is precisely P*w_0
394
395 We then perform WindowBits doublings, so accum's dlog at the point
396 of the addition in the first iteration of the loop (when i == 1) is
397 at least 2^W * w_0.
398
399 Since we know w_0 > 0, then in every iteration of the loop, accums
400 dlog will always be greater than the dlog of the table element we
401 just looked up (something between 0 and 2^W-1), and thus the
402 addition into accum cannot be a doubling.
403
404 However due to blinding this argument fails, since we perform
405 multiplications using a scalar that is larger than the group
406 order. In this case it's possible that the dlog of accum becomes
407 `order + x` (or, effectively, `x`) and `x` is smaller than 2^W.
408 In this case, a doubling may occur. Future iterations of the loop
409 cannot be doublings by the same argument above. Since the blinding
410 factor is always less than the group order (substantially so),
411 it is not possible for the dlog of accum to overflow a second time.
412 */
413
414 accum += table.ct_select(w_i);
415
416 // Conditional ok: loop iteration count is public
417 if(i <= 3) {
418 accum.randomize_rep(rng);
419 }
420 }
421
422 CT::unpoison(accum);
423 return accum;
424}

References Botan::AffinePointTable< C, R >::ct_select(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by Botan::WindowedMulTable< C, W >::mul().

◆ varpoint_setup()

template<typename C, size_t TableSize>
AffinePointTable< C > Botan::varpoint_setup ( const typename C::AffinePoint & p)

Definition at line 351 of file pcurves_mul.h.

351 {
352 static_assert(TableSize > 2);
353
354 std::vector<typename C::ProjectivePoint> table;
355 table.reserve(TableSize);
356 table.push_back(C::ProjectivePoint::from_affine(p));
357
358 for(size_t i = 1; i != TableSize; ++i) {
359 // Conditional ok: loop iteration count is public
360 if(i % 2 == 1) {
361 table.push_back(table[i / 2].dbl());
362 } else {
363 table.push_back(table[i - 1] + p);
364 }
365 }
366
367 return AffinePointTable<C>(table);
368}

Referenced by Botan::WindowedBoothMulTable< C, W >::WindowedBoothMulTable(), and Botan::WindowedMulTable< C, W >::WindowedMulTable().

◆ vartime_divide()

BOTAN_TEST_API void Botan::vartime_divide ( const BigInt & x,
const BigInt & y,
BigInt & q,
BigInt & r )

BigInt Division

Parameters
xan integer
ya non-zero integer
qwill be set to x / y
rwill be set to x % y

Definition at line 325 of file divide.cpp.

325 {
326 constexpr size_t WB = WordInfo<word>::bits;
327
328 if(y_arg.is_zero()) {
329 throw Invalid_Argument("vartime_divide: cannot divide by zero");
330 }
331
332 const size_t y_words = y_arg.sig_words();
333
334 BOTAN_ASSERT_NOMSG(y_words > 0);
335
336 BigInt y = y_arg;
337
338 BigInt r = x;
339 BigInt q = BigInt::zero();
340 secure_vector<word> ws;
341
342 r.set_sign(BigInt::Positive);
343 y.set_sign(BigInt::Positive);
344
345 // Calculate shifts needed to normalize y with high bit set
346 const size_t shifts = y.top_bits_free();
347
348 if(shifts > 0) {
349 y <<= shifts;
350 r <<= shifts;
351 }
352
353 // we know y has not changed size, since we only shifted up to set high bit
354 const size_t t = y_words - 1;
355 const size_t n = std::max(y_words, r.sig_words()) - 1; // r may have changed size however
356
357 BOTAN_ASSERT_NOMSG(n >= t);
358
359 q.grow_to(n - t + 1);
360
361 word* q_words = q.mutable_data();
362
363 BigInt shifted_y = y << (WB * (n - t));
364
365 // Set q_{n-t} to number of times r > shifted_y
366 q_words[n - t] = r.reduce_below(shifted_y, ws);
367
368 const word y_t0 = y.word_at(t);
369 const word y_t1 = y.word_at(t - 1);
370 BOTAN_DEBUG_ASSERT((y_t0 >> (WB - 1)) == 1);
371
372 const divide_precomp div_y_t0(y_t0);
373
374 for(size_t i = n; i != t; --i) {
375 const word x_i0 = r.word_at(i);
376 const word x_i1 = r.word_at(i - 1);
377 const word x_i2 = r.word_at(i - 2);
378
379 word qit = (x_i0 == y_t0) ? WordInfo<word>::max : div_y_t0.vartime_div_2to1(x_i0, x_i1);
380
381 // Per HAC 14.23, this operation is required at most twice
382 for(size_t j = 0; j != 2; ++j) {
383 if(division_check_vartime(qit, y_t0, y_t1, x_i0, x_i1, x_i2)) {
384 BOTAN_ASSERT_NOMSG(qit > 0);
385 qit--;
386 } else {
387 break;
388 }
389 }
390
391 shifted_y >>= WB;
392 // Now shifted_y == y << (WB * (i-t-1))
393
394 if(qit != 0) {
395 r -= qit * shifted_y;
396 if(r.is_negative()) {
397 BOTAN_ASSERT_NOMSG(qit > 0);
398 qit--;
399 r += shifted_y;
400 BOTAN_ASSERT_NOMSG(r.is_positive());
401 }
402 }
403
404 q_words[i - t - 1] = qit;
405 }
406
407 if(shifts > 0) {
408 r >>= shifts;
409 }
410
411 sign_fixup(x, y_arg, q, r);
412
413 r_out = r;
414 q_out = q;
415}
Botan::BigInt::reduce_below
size_t reduce_below(const BigInt &mod, secure_vector< word > &ws)
Definition bigint.cpp:329

References BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, Botan::BigInt::grow_to(), Botan::BigInt::is_negative(), Botan::BigInt::is_positive(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::Positive, Botan::BigInt::reduce_below(), Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::top_bits_free(), Botan::divide_precomp< W >::vartime_div_2to1(), Botan::BigInt::word_at(), and Botan::BigInt::zero().

Referenced by botan_mp_div(), operator%(), and operator/().

◆ vartime_divide_pow2k()

BOTAN_TEST_API BigInt Botan::vartime_divide_pow2k ( size_t k,
const BigInt & y )

BigInt division, variable time, 2^k variant

This is identical to ct_divide_pow2k in functionality, but leaks both k and y to side channels, so it should only be used with public inputs.

Parameters
kan integer
ya positive integer
Returns
q equal to 2**k / y

Definition at line 225 of file divide.cpp.

225 {
226 constexpr size_t WB = WordInfo<word>::bits;
227
228 BOTAN_ARG_CHECK(!y_arg.is_zero(), "Cannot divide by zero");
229 BOTAN_ARG_CHECK(!y_arg.is_negative(), "Negative divisor not supported");
230 BOTAN_ARG_CHECK(k > 1, "Invalid k");
231
232 BigInt y = y_arg;
233
234 const size_t y_words = y.sig_words();
235
236 BOTAN_ASSERT_NOMSG(y_words > 0);
237
238 // Calculate shifts needed to normalize y with high bit set
239 const size_t shifts = y.top_bits_free();
240
241 if(shifts > 0) {
242 y <<= shifts;
243 }
244
245 BigInt r;
246 r.set_bit(k + shifts); // (2^k) << shifts
247
248 // we know y has not changed size, since we only shifted up to set high bit
249 const size_t t = y_words - 1;
250 const size_t n = std::max(y_words, r.sig_words()) - 1;
251
252 BOTAN_ASSERT_NOMSG(n >= t);
253
254 BigInt q = BigInt::zero();
255 q.grow_to(n - t + 1);
256
257 word* q_words = q.mutable_data();
258
259 BigInt shifted_y = y << (WB * (n - t));
260
261 // Set q_{n-t} to number of times r > shifted_y
262 secure_vector<word> ws;
263 q_words[n - t] = r.reduce_below(shifted_y, ws);
264
265 const word y_t0 = y.word_at(t);
266 const word y_t1 = y.word_at(t - 1);
267 BOTAN_DEBUG_ASSERT((y_t0 >> (WB - 1)) == 1);
268
269 const divide_precomp div_y_t0(y_t0);
270
271 for(size_t i = n; i != t; --i) {
272 const word x_i0 = r.word_at(i);
273 const word x_i1 = r.word_at(i - 1);
274 const word x_i2 = r.word_at(i - 2);
275
276 word qit = (x_i0 == y_t0) ? WordInfo<word>::max : div_y_t0.vartime_div_2to1(x_i0, x_i1);
277
278 // Per HAC 14.23, this operation is required at most twice
279 for(size_t j = 0; j != 2; ++j) {
280 if(division_check_vartime(qit, y_t0, y_t1, x_i0, x_i1, x_i2)) {
281 BOTAN_ASSERT_NOMSG(qit > 0);
282 qit--;
283 } else {
284 break;
285 }
286 }
287
288 shifted_y >>= WB;
289 // Now shifted_y == y << (WB * (i-t-1))
290
291 /*
292 * Special case qit == 0 and qit == 1 which occurs relatively often here due to a
293 * combination of the fixed 2^k and in many cases the typical structure of
294 * public moduli (as this function is called by Barrett_Reduction::for_public_modulus).
295 *
296 * Over the test suite, about 5% of loop iterations have qit == 1 and 10% have qit == 0
297 */
298
299 if(qit != 0) {
300 if(qit == 1) {
301 r -= shifted_y;
302 } else {
303 r -= qit * shifted_y;
304 }
305
306 if(r.is_negative()) {
307 BOTAN_ASSERT_NOMSG(qit > 0);
308 qit--;
309 r += shifted_y;
310 BOTAN_ASSERT_NOMSG(r.is_positive());
311 }
312 }
313
314 q_words[i - t - 1] = qit;
315 }
316
317 return q;
318}
Botan::BigInt::top_bits_free
size_t top_bits_free() const
Definition bigint.cpp:298

References BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, Botan::BigInt::grow_to(), Botan::BigInt::is_negative(), Botan::BigInt::is_positive(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::reduce_below(), Botan::BigInt::set_bit(), Botan::BigInt::sig_words(), Botan::BigInt::top_bits_free(), Botan::divide_precomp< W >::vartime_div_2to1(), Botan::BigInt::word_at(), and Botan::BigInt::zero().

Referenced by Botan::Barrett_Reduction::for_public_modulus().

◆ verify_signature()

bool Botan::verify_signature ( std::span< const uint8_t, ED448_LEN > pk,
bool phflag,
std::span< const uint8_t > context,
std::span< const uint8_t > sig,
std::span< const uint8_t > msg )

Verify a signature(RFC 8032 5.2.7).

Parameters
pkthe public key
phflagthe prehash flag (true iff using Ed448ph)
contextthe context string
sigthe signature
msgthe message to verify
Exceptions
Decoding_Errorif the public key or signature is malformed
Returns
true if the signature is valid

Definition at line 428 of file ed448_internal.cpp.

432 {
433 // RFC 8032 5.2.7. Verify
434 // 1. To verify a signature on a message M using context C and public
435 // key A, with F being 0 for Ed448 and 1 for Ed448ph, first split
436 // the signature into two 57-octet halves. Decode the first half as
437 // a point R, and the second half as an integer S, in the range 0 <=
438 // s < L. Decode the public key A as point A’. If any of the
439 // decodings fail (including S being out of range), the signature is
440 // invalid.
441 if(sig.size() != 2 * ED448_LEN) {
442 // Wrong signature size
443 throw Decoding_Error("Ed448 signature has wrong size");
444 }
445 const auto [big_r_bytes, big_s_bytes] = split(sig.first<2 * ED448_LEN>());
446 const auto big_r = Ed448Point::decode(big_r_bytes);
447 if(!Scalar448::bytes_are_reduced(big_s_bytes)) {
448 // S not in range 0 <= s < L
449 throw Decoding_Error("Ed448 signature has invalid S");
450 }
451 const Scalar448 big_s(big_s_bytes);
452 // 2. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114), and
453 // interpret the 114-octet digest as a little-endian integer k.
454 const Scalar448 k(shake(phflag, context, big_r_bytes, pk, msg));
455 // 3. Check the group equation [4][S]B = [4]R + [4][k]A’. It’s
456 // sufficient, but not required, to instead check [S]B = R + [k]A’.
457 // Rearranged as [S]B + [k](-A’) = R, computed via Shamir’s trick.
458 const auto neg_A = Ed448Point::decode(pk).negate();
459 return Ed448Point::double_scalar_mul_vartime(big_s, Ed448Point::base_point(), k, neg_A) == big_r;
460}
Botan::Ed448Point::negate
Ed448Point negate() const
Negate the point.
Definition ed448_internal.h:65
Botan::Ed448Point::double_scalar_mul_vartime
static Ed448Point double_scalar_mul_vartime(const Scalar448 &s1, const Ed448Point &p1, const Scalar448 &s2, const Ed448Point &p2)
Variable-time double scalar multiplication using Shamir's trick: [s1]P + [s2]Q.
Definition ed448_internal.cpp:293
Botan::Ed448Point::decode
static Ed448Point decode(std::span< const uint8_t, ED448_LEN > enc)
Decode a point from its 57-byte encoding (RFC 8032 5.2.3).
Definition ed448_internal.cpp:73
Botan::Ed448Point::base_point
static Ed448Point base_point()
Create the curve's base point ('B' in RFC 8032 5.2).
Definition ed448_internal.cpp:122
Botan::Scalar448::bytes_are_reduced
static bool bytes_are_reduced(std::span< const uint8_t > x)
Definition curve448_scalar.cpp:211

References Botan::Ed448Point::base_point(), Botan::Scalar448::bytes_are_reduced(), Botan::Ed448Point::decode(), Botan::Ed448Point::double_scalar_mul_vartime(), ED448_LEN, and Botan::Ed448Point::negate().

Referenced by Botan::Roughtime::Response::from_bits().

◆ version_cstr()

const char * Botan::version_cstr ( )

Same as version_string() except returning a pointer to a statically allocated string.

Returns
version string

Definition at line 20 of file version.cpp.

20 {
21 return BOTAN_FULL_VERSION_STRING;
22}

Referenced by botan_version_string(), and version_string().

◆ version_datestamp()

uint32_t Botan::version_datestamp ( )

Return the date this version of botan was released, in an integer of the form YYYYMMDD. For instance a version released on May 21, 2013 would return the integer 20130521. If the currently running version is not an official release, this function will return 0 instead.

Returns
release date, or zero if unreleased

Definition at line 32 of file version.cpp.

32 {
33 return BOTAN_VERSION_DATESTAMP;
34}
BOTAN_VERSION_DATESTAMP
#define BOTAN_VERSION_DATESTAMP
Definition build.h:45

References BOTAN_VERSION_DATESTAMP.

Referenced by botan_version_datestamp().

◆ version_distribution_info()

std::optional< std::string > Botan::version_distribution_info ( )

Return any string that is set at build time using the --distribution-info option. It allows a packager of the library to specify any distribution-specific patches. If no value is given at build time, returns nullopt.

Returns
distribution info

Definition at line 44 of file version.cpp.

44 {
45#if defined(BOTAN_DISTRIBUTION_INFO_STRING)
46 return std::string(BOTAN_DISTRIBUTION_INFO_STRING);
47#else
48 return std::nullopt;
49#endif
50}

◆ version_major()

uint32_t Botan::version_major ( )

Get the major version number.

Returns
major version number

Definition at line 55 of file version.cpp.

55 {
56 return BOTAN_VERSION_MAJOR;
57}

References BOTAN_VERSION_MAJOR.

Referenced by botan_version_major(), and runtime_version_check().

◆ version_minor()

uint32_t Botan::version_minor ( )

Get the minor version number.

Returns
minor version number

Definition at line 59 of file version.cpp.

59 {
60 return BOTAN_VERSION_MINOR;
61}

References BOTAN_VERSION_MINOR.

Referenced by botan_version_minor(), and runtime_version_check().

◆ version_patch()

uint32_t Botan::version_patch ( )

Get the patch number.

Returns
patch number

Definition at line 63 of file version.cpp.

63 {
64 return BOTAN_VERSION_PATCH;
65}

References BOTAN_VERSION_PATCH.

Referenced by botan_version_patch(), and runtime_version_check().

◆ version_string()

std::string Botan::version_string ( )

Get a human-readable single-line string identifying the version of Botan. No particular format should be assumed.

Returns
version string

Definition at line 24 of file version.cpp.

24 {
25 return std::string(version_cstr());
26}
Botan::version_cstr
const char * version_cstr()
Definition version.cpp:20

References version_cstr().

◆ version_vc_revision()

std::optional< std::string > Botan::version_vc_revision ( )

Returns a string that is set to a revision identifier corresponding to the source, or nullopt if this could not be determined. It is set for all official releases, and for builds that originated from within a git checkout.

Returns
VC revision

Definition at line 36 of file version.cpp.

36 {
37#if defined(BOTAN_VC_REVISION)
38 return std::string(BOTAN_VC_REVISION);
39#else
40 return std::nullopt;
41#endif
42}

◆ word8_add2()

template<WordType W>
auto Botan::word8_add2 ( W x[8],
const W y[8],
W carry )->W
inlineconstexpr

Definition at line 268 of file mp_asmi.h.

268 {
269#if defined(BOTAN_MP_USE_X86_64_ASM)
270 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
271 asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
272 : [carry] "=r"(carry)
273 : [x] "r"(x), [y] "r"(y), "0"(carry)
274 : "cc", "memory");
275 return carry;
276 }
277#endif
278
279 x[0] = word_add(x[0], y[0], &carry);
280 x[1] = word_add(x[1], y[1], &carry);
281 x[2] = word_add(x[2], y[2], &carry);
282 x[3] = word_add(x[3], y[3], &carry);
283 x[4] = word_add(x[4], y[4], &carry);
284 x[5] = word_add(x[5], y[5], &carry);
285 x[6] = word_add(x[6], y[6], &carry);
286 x[7] = word_add(x[7], y[7], &carry);
287 return carry;
288}

References carry(), and word_add().

Referenced by bigint_add2().

◆ word8_add3()

template<WordType W>
auto Botan::word8_add3 ( W z[8],
const W x[8],
const W y[8],
W carry )->W
inlineconstexpr

Definition at line 294 of file mp_asmi.h.

294 {
295#if defined(BOTAN_MP_USE_X86_64_ASM)
296 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
297 asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
298 : [carry] "=r"(carry)
299 : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
300 : "cc", "memory");
301 return carry;
302 }
303#endif
304
305 z[0] = word_add(x[0], y[0], &carry);
306 z[1] = word_add(x[1], y[1], &carry);
307 z[2] = word_add(x[2], y[2], &carry);
308 z[3] = word_add(x[3], y[3], &carry);
309 z[4] = word_add(x[4], y[4], &carry);
310 z[5] = word_add(x[5], y[5], &carry);
311 z[6] = word_add(x[6], y[6], &carry);
312 z[7] = word_add(x[7], y[7], &carry);
313 return carry;
314}

References carry(), and word_add().

Referenced by bigint_add3().

◆ word8_linmul3()

template<WordType W>
auto Botan::word8_linmul3 ( W z[8],
const W x[8],
W y,
W carry )->W
inlineconstexpr

Definition at line 397 of file mp_asmi.h.

397 {
398#if defined(BOTAN_MP_USE_X86_64_ASM)
399 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
400 asm(DO_8_TIMES(LINMUL_OP, "z")
401 : [carry] "=r"(carry)
402 : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
403 : "cc", "%rax", "%rdx");
404 return carry;
405 }
406#endif
407
408 z[0] = word_madd2(x[0], y, &carry);
409 z[1] = word_madd2(x[1], y, &carry);
410 z[2] = word_madd2(x[2], y, &carry);
411 z[3] = word_madd2(x[3], y, &carry);
412 z[4] = word_madd2(x[4], y, &carry);
413 z[5] = word_madd2(x[5], y, &carry);
414 z[6] = word_madd2(x[6], y, &carry);
415 z[7] = word_madd2(x[7], y, &carry);
416 return carry;
417}

References carry(), and word_madd2().

Referenced by bigint_linmul3().

◆ word8_madd3()

template<WordType W>
auto Botan::word8_madd3 ( W z[8],
const W x[8],
W y,
W carry )->W
inlineconstexpr

Definition at line 423 of file mp_asmi.h.

423 {
424#if defined(BOTAN_MP_USE_X86_64_ASM)
425 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
426 asm(DO_8_TIMES(MULADD_OP, "")
427 : [carry] "=r"(carry)
428 : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
429 : "cc", "%rax", "%rdx");
430 return carry;
431 }
432#endif
433
434 z[0] = word_madd3(x[0], y, z[0], &carry);
435 z[1] = word_madd3(x[1], y, z[1], &carry);
436 z[2] = word_madd3(x[2], y, z[2], &carry);
437 z[3] = word_madd3(x[3], y, z[3], &carry);
438 z[4] = word_madd3(x[4], y, z[4], &carry);
439 z[5] = word_madd3(x[5], y, z[5], &carry);
440 z[6] = word_madd3(x[6], y, z[6], &carry);
441 z[7] = word_madd3(x[7], y, z[7], &carry);
442 return carry;
443}

References carry(), and word_madd3().

Referenced by basecase_mul(), and basecase_sqr().

◆ word8_sub2()

template<WordType W>
auto Botan::word8_sub2 ( W x[8],
const W y[8],
W carry )->W
inlineconstexpr

Definition at line 345 of file mp_asmi.h.

345 {
346#if defined(BOTAN_MP_USE_X86_64_ASM)
347 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
348 asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
349 : [carry] "=r"(carry)
350 : [x] "r"(x), [y] "r"(y), "0"(carry)
351 : "cc", "memory");
352 return carry;
353 }
354#endif
355
356 x[0] = word_sub(x[0], y[0], &carry);
357 x[1] = word_sub(x[1], y[1], &carry);
358 x[2] = word_sub(x[2], y[2], &carry);
359 x[3] = word_sub(x[3], y[3], &carry);
360 x[4] = word_sub(x[4], y[4], &carry);
361 x[5] = word_sub(x[5], y[5], &carry);
362 x[6] = word_sub(x[6], y[6], &carry);
363 x[7] = word_sub(x[7], y[7], &carry);
364 return carry;
365}

References carry(), and word_sub().

Referenced by bigint_sub2().

◆ word8_sub3()

template<WordType W>
auto Botan::word8_sub3 ( W z[8],
const W x[8],
const W y[8],
W carry )->W
inlineconstexpr

Definition at line 371 of file mp_asmi.h.

371 {
372#if defined(BOTAN_MP_USE_X86_64_ASM)
373 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
374 asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
375 : [carry] "=r"(carry)
376 : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
377 : "cc", "memory");
378 return carry;
379 }
380#endif
381
382 z[0] = word_sub(x[0], y[0], &carry);
383 z[1] = word_sub(x[1], y[1], &carry);
384 z[2] = word_sub(x[2], y[2], &carry);
385 z[3] = word_sub(x[3], y[3], &carry);
386 z[4] = word_sub(x[4], y[4], &carry);
387 z[5] = word_sub(x[5], y[5], &carry);
388 z[6] = word_sub(x[6], y[6], &carry);
389 z[7] = word_sub(x[7], y[7], &carry);
390 return carry;
391}

References carry(), and word_sub().

Referenced by bigint_monty_maybe_sub(), bigint_sub3(), and bigint_sub_abs().

◆ word_add()

template<WordType W>
auto Botan::word_add ( W x,
W y,
W * carry )->W
inlineconstexpr

Definition at line 231 of file mp_asmi.h.

231 {
232#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
233 if(!std::is_constant_evaluated()) {
234 if constexpr(std::same_as<W, unsigned int>) {
235 return __builtin_addc(x, y, *carry & 1, carry);
236 } else if constexpr(std::same_as<W, unsigned long>) {
237 return __builtin_addcl(x, y, *carry & 1, carry);
238 } else if constexpr(std::same_as<W, unsigned long long>) {
239 return __builtin_addcll(x, y, *carry & 1, carry);
240 }
241 }
242#endif
243
244 if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
245 /*
246 TODO(Botan4) this is largely a performance hack for GCCs that don't
247 support __builtin_addc, if we increase the minimum supported version of
248 GCC to GCC 14 then we can remove this and not worry about it
249 */
250 const W cb = *carry & 1;
251 const auto s = typename WordInfo<W>::dword(x) + y + cb;
252 *carry = static_cast<W>(s >> WordInfo<W>::bits);
253 return static_cast<W>(s);
254 } else {
255 const W cb = *carry & 1;
256 W z = x + y;
257 W c1 = (z < x);
258 z += cb;
259 *carry = c1 | (z < cb);
260 return z;
261 }
262}

References carry().

Referenced by Botan::word3< W >::add(), bigint_add2(), bigint_add3(), bigint_cnd_abs(), bigint_cnd_add(), Botan::BigInt::ct_cond_add(), Botan::IntMod< MontgomeryRep< ScalarParams > >::div2(), Botan::word3< W >::mul(), Botan::word3< W >::mul_x2(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator+, Botan::IntMod< MontgomeryRep< ScalarParams > >::operator-, solinas_correct_redc(), word8_add2(), and word8_add3().

◆ word_madd2()

template<WordType W>
auto Botan::word_madd2 ( W a,
W b,
W * c )->W
inlineconstexpr

Definition at line 90 of file mp_asmi.h.

90 {
91#if defined(BOTAN_MP_USE_X86_64_ASM)
92 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
93 asm(R"(
94 mulq %[b]
95 addq %[c],%[a]
96 adcq $0,%[carry]
97 )"
98 : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
99 : "0"(a), "1"(b), [c] "g"(*c)
100 : "cc");
101
102 return a;
103 }
104#elif defined(BOTAN_MP_USE_AARCH64_ASM)
105 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
106 W lo = 0;
107 W hi = 0;
108 asm(R"(
109 mul %[lo], %[a], %[b]
110 umulh %[hi], %[a], %[b]
111 adds %[lo], %[lo], %[c]
112 adc %[hi], %[hi], xzr
113 )"
114 : [lo] "=&r"(lo), [hi] "=&r"(hi)
115 : [a] "r"(a), [b] "r"(b), [c] "r"(*c)
116 : "cc");
117
118 *c = hi;
119 return lo;
120 }
121#endif
122
123 typedef typename WordInfo<W>::dword dword;
124 const dword s = dword(a) * b + *c;
125 *c = static_cast<W>(s >> WordInfo<W>::bits);
126 return static_cast<W>(s);
127}

References carry().

Referenced by bigint_linmul2(), bigint_linmul3(), redc_crandall(), Botan::divide_precomp< W >::vartime_mod_2to1(), and word8_linmul3().

◆ word_madd3()

template<WordType W>
auto Botan::word_madd3 ( W a,
W b,
W c,
W * d )->W
inlineconstexpr

Definition at line 133 of file mp_asmi.h.

133 {
134#if defined(BOTAN_MP_USE_X86_64_ASM)
135 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
136 asm(R"(
137 mulq %[b]
138
139 addq %[c],%[a]
140 adcq $0,%[carry]
141
142 addq %[d],%[a]
143 adcq $0,%[carry]
144 )"
145 : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
146 : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
147 : "cc");
148
149 return a;
150 }
151#elif defined(BOTAN_MP_USE_AARCH64_ASM)
152 if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
153 W lo = 0;
154 W hi = 0;
155 asm(R"(
156 mul %[lo], %[a], %[b]
157 umulh %[hi], %[a], %[b]
158 adds %[lo], %[lo], %[c]
159 adc %[hi], %[hi], xzr
160 adds %[lo], %[lo], %[d]
161 adc %[hi], %[hi], xzr
162 )"
163 : [lo] "=&r"(lo), [hi] "=&r"(hi)
164 : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d)
165 : "cc");
166
167 *d = hi;
168 return lo;
169 }
170#endif
171
172 typedef typename WordInfo<W>::dword dword;
173 const dword s = dword(a) * b + c + *d;
174 *d = static_cast<W>(s >> WordInfo<W>::bits);
175 return static_cast<W>(s);
176}

References carry().

Referenced by basecase_mul(), basecase_sqr(), redc_crandall(), and word8_madd3().

◆ word_sub()

template<WordType W>
auto Botan::word_sub ( W x,
W y,
W * carry )->W
inlineconstexpr

Definition at line 320 of file mp_asmi.h.

320 {
321#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
322 if(!std::is_constant_evaluated()) {
323 if constexpr(std::same_as<W, unsigned int>) {
324 return __builtin_subc(x, y, *carry & 1, carry);
325 } else if constexpr(std::same_as<W, unsigned long>) {
326 return __builtin_subcl(x, y, *carry & 1, carry);
327 } else if constexpr(std::same_as<W, unsigned long long>) {
328 return __builtin_subcll(x, y, *carry & 1, carry);
329 }
330 }
331#endif
332
333 const W cb = *carry & 1;
334 W t0 = x - y;
335 W c1 = (t0 > x);
336 W z = t0 - cb;
337 *carry = c1 | (z > t0);
338 return z;
339}

References carry().

Referenced by bigint_cnd_sub(), bigint_monty_maybe_sub(), bigint_monty_maybe_sub(), bigint_sub2(), bigint_sub2_rev(), bigint_sub3(), bigint_sub_abs(), Botan::IntMod< MontgomeryRep< ScalarParams > >::negate(), Botan::IntMod< MontgomeryRep< ScalarParams > >::operator-, redc_crandall(), solinas_correct_redc(), word8_sub2(), and word8_sub3().

◆ words_for_bits()

size_t Botan::words_for_bits ( size_t x)
constexpr

Definition at line 18 of file curve448_scalar.h.

18 {
19 constexpr size_t word_bits = sizeof(word) * 8;
20 return (x + word_bits - 1) / word_bits;
21}

◆ wots_public_key_from_signature()

BOTAN_TEST_API WotsPublicKey Botan::wots_public_key_from_signature ( const SphincsTreeNode & hashed_message,
StrongSpan< const WotsSignature > signature,
Sphincs_Address & address,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 8: wots_pkFromSig.

Reconstructs the WOTS public key from a given WOTS signature and message. This is tailored for the use case in the SLH-DSA implementation and is not meant for general usability in non SLH-DSA algorithms.

Definition at line 104 of file sp_wots.cpp.

108 {
109 const std::vector<WotsHashIndex> lengths = chain_lengths(hashed_message, params);
110 WotsPublicKey pk_buffer(params.wots_len() * params.n());
111 BufferSlicer sig(signature);
112 BufferStuffer pk(pk_buffer);
113
114 for(WotsChainIndex i(0); i < params.wots_len(); i++) {
115 address.set_chain_address(i);
116
117 // params.w() can be one of {4, 8, 256}
118 const WotsHashIndex start_index = lengths[i.get()];
119 const uint8_t steps_to_take = static_cast<uint8_t>(params.w() - 1) - start_index.get();
120
121 chain(pk.next<WotsPublicKeyNode>(params.n()),
122 sig.take<WotsNode>(params.n()),
123 start_index,
124 steps_to_take,
125 address,
126 hashes,
127 params);
128 }
129
130 return pk_buffer;
131}
Botan::Sphincs_Address::set_chain_address
Sphincs_Address & set_chain_address(WotsChainIndex chain)
Definition sp_address.h:81
Botan::Sphincs_Parameters::wots_len
uint32_t wots_len() const
Definition sp_parameters.h:165
Botan::Sphincs_Parameters::w
uint32_t w() const
Definition sp_parameters.h:124
Botan::WotsHashIndex
Strong< uint8_t, struct WotsHashIndex_, EnableArithmeticWithPlainNumber > WotsHashIndex
Index of a hash application inside a single WOTS chain (integers in "base_w").
Definition sp_types.h:98
Botan::WotsNode
Strong< secure_vector< uint8_t >, struct WotsNode_ > WotsNode
Start (or intermediate) node of a WOTS+ chain.
Definition sp_types.h:79
Botan::WotsPublicKey
Strong< std::vector< uint8_t >, struct WotsPublicKey_ > WotsPublicKey
Definition sp_types.h:73
Botan::WotsChainIndex
Strong< uint32_t, struct WotsChainIndex_ > WotsChainIndex
Index of a WOTS chain within a single usage of WOTS.
Definition sp_types.h:95
Botan::WotsPublicKeyNode
Strong< std::vector< uint8_t >, struct WotsPublicKeyNode_ > WotsPublicKeyNode
End node of a WOTS+ chain (part of the WOTS+ public key).
Definition sp_types.h:76
Botan::chain_lengths
std::vector< WotsHashIndex > chain_lengths(const SphincsTreeNode &msg, const Sphincs_Parameters &params)
Definition sp_wots.cpp:92

References chain_lengths(), Botan::detail::Strong_Base< T >::get(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_chain_address(), Botan::BufferSlicer::take(), Botan::Sphincs_Parameters::w(), and Botan::Sphincs_Parameters::wots_len().

Referenced by ht_verify().

◆ wots_sign_and_pkgen()

BOTAN_TEST_API void Botan::wots_sign_and_pkgen ( StrongSpan< WotsSignature > sig_out,
StrongSpan< SphincsTreeNode > leaf_out,
const SphincsSecretSeed & secret_seed,
TreeNodeIndex leaf_idx,
std::optional< TreeNodeIndex > sign_leaf_idx,
const std::vector< WotsHashIndex > & wots_steps,
Sphincs_Address & leaf_addr,
Sphincs_Address & pk_addr,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 6 and 7: wots_pkGen and wots_sign.

Implements a domain specific wrapper for the one-time signature scheme WOTS+ (Winternitz OTS). It is meant to be used inside SLH-DSA and does not aim to be applicable for other use cases. If this function is not used in a signing operation (i.e. sign_leaf_idx is not set), wots_steps may be empty.

Definition at line 133 of file sp_wots.cpp.

142 {
143 // `wots_steps` are needed only if `sign_leaf_idx` is set
144 BOTAN_ASSERT_NOMSG(!sign_leaf_idx.has_value() || wots_steps.size() == params.wots_len());
145 BOTAN_ASSERT_NOMSG(pk_addr.get_type() == Sphincs_Address_Type::WotsPublicKeyCompression);
146
147 const secure_vector<uint8_t> wots_sig;
148 WotsPublicKey wots_pk_buffer(params.wots_bytes());
149
150 BufferStuffer wots_pk(wots_pk_buffer);
151 BufferStuffer sig(sig_out);
152
153 leaf_addr.set_keypair_address(leaf_idx);
154 pk_addr.set_keypair_address(leaf_idx);
155
156 for(WotsChainIndex i(0); i < params.wots_len(); i++) {
157 // If the current leaf is part of the signature wots_k stores the chain index
158 // of the value necessary for the signature. Otherwise: nullopt (no signature)
159 const auto wots_k = [&]() -> std::optional<WotsHashIndex> {
160 if(sign_leaf_idx.has_value() && leaf_idx == sign_leaf_idx.value()) {
161 return wots_steps[i.get()];
162 } else {
163 return std::nullopt;
164 }
165 }();
166
167 // Start with the secret seed
168 leaf_addr.set_chain_address(i);
169 leaf_addr.set_hash_address(WotsHashIndex(0));
170 leaf_addr.set_type(Sphincs_Address_Type::WotsKeyGeneration);
171
172 auto buffer_s = wots_pk.next<WotsNode>(params.n());
173
174 hashes.PRF(buffer_s, secret_seed, leaf_addr);
175
176 leaf_addr.set_type(Sphincs_Address_Type::WotsHash);
177
178 // Iterates down the WOTS chain
179 for(WotsHashIndex k(0);; k++) {
180 // Check if this is the value that needs to be saved as a part of the WOTS signature
181 if(wots_k.has_value() && k == wots_k.value()) {
182 std::copy(buffer_s.begin(), buffer_s.end(), sig.next<WotsNode>(params.n()).begin());
183 }
184
185 // Check if the top of the chain was hit
186 if(k == params.w() - 1) {
187 break;
188 }
189
190 // Iterate one step on the chain
191 leaf_addr.set_hash_address(k);
192
193 hashes.T(buffer_s, leaf_addr, buffer_s);
194 }
195 }
196
197 // Do the final thash to generate the public keys
198 hashes.T(leaf_out, pk_addr, wots_pk_buffer);
199}
Botan::Sphincs_Address::get_type
Sphincs_Address_Type get_type() const
Definition sp_address.h:134
Botan::Sphincs_Address::set_hash_address
Sphincs_Address & set_hash_address(WotsHashIndex hash)
Definition sp_address.h:91
Botan::Sphincs_Address::set_keypair_address
Sphincs_Address & set_keypair_address(TreeNodeIndex keypair)
Definition sp_address.h:76

References BOTAN_ASSERT_NOMSG, Botan::Sphincs_Address::get_type(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Hash_Functions::PRF(), Botan::Sphincs_Address::set_chain_address(), Botan::Sphincs_Address::set_hash_address(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_type(), Botan::Sphincs_Hash_Functions::T(), Botan::Sphincs_Parameters::w(), Botan::Sphincs_Parameters::wots_bytes(), Botan::Sphincs_Parameters::wots_len(), WotsHash, WotsKeyGeneration, and WotsPublicKeyCompression.

Referenced by xmss_sign_and_pkgen().

◆ wrap_strong_type()

template<typename T, typename ParamT>
requires std::constructible_from<T, ParamT> || (concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>)
decltype(auto) Botan::wrap_strong_type ( ParamT && t)
nodiscardconstexpr

Wraps a value into a caller-defined (strong) type.

If the provided object t is already of type T, it is returned as is.

Note
This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary constructor if you know that you are dealing with a bare value type.
Parameters
tvalue to be wrapped
Returns
the wrapped value

Definition at line 268 of file strong_type.h.

268 {
269 if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
270 // Noop, if the parameter type already is the desired return type.
271 return std::forward<ParamT>(t);
272 } else if constexpr(std::constructible_from<T, ParamT>) {
273 // Implicit conversion from the parameter type to the return type.
274 return T{std::forward<ParamT>(t)};
275 } else {
276 // Explicitly calling the wrapped type's constructor to support
277 // implicit conversions on types that mark their constructors as explicit.
278 static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
279 return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
280 }
281}

Referenced by checked_cast_to_or_throw(), Botan::detail::load_any(), Botan::bitvector_base< secure_allocator >::subvector(), and Botan::detail::wrap_strong_type_or_enum().

◆ x448()

Point448 Botan::x448 ( const ScalarX448 & k,
const Point448 & u )

Multiply a scalar k with a point u.

Parameters
kscalar
upoint on curve
Returns
k * u

Definition at line 48 of file x448_internal.cpp.

48 {
49 const Gf448Elem x_1 = Gf448Elem(u.get());
50 Gf448Elem x_2 = Gf448Elem::one();
51 Gf448Elem z_2 = Gf448Elem::zero();
52 Gf448Elem x_3 = Gf448Elem(u.get());
53 Gf448Elem z_3 = Gf448Elem::one();
54 auto swap = CT::Mask<uint64_t>::cleared();
55
56 for(int16_t t = 448 - 1; t >= 0; --t) {
57 auto k_t = CT::Mask<uint64_t>::expand(get_bit(k, t));
58 swap ^= k_t;
59
60 x_2.ct_cond_swap(swap, x_3);
61 z_2.ct_cond_swap(swap, z_3);
62 swap = k_t;
63
64 const auto A = x_2 + z_2;
65 const auto AA = square(A);
66 const auto B = x_2 - z_2;
67 const auto BB = square(B);
68 const auto E = AA - BB;
69 const auto C = x_3 + z_3;
70 const auto D = x_3 - z_3;
71 const auto DA = D * A;
72 const auto CB = C * B;
73 x_3 = square(DA + CB);
74 z_3 = x_1 * square(DA - CB);
75 x_2 = AA * BB;
76 z_2 = E * (AA + mul_a24(E));
77 }
78
79 x_2.ct_cond_swap(swap, x_3);
80 z_2.ct_cond_swap(swap, z_3);
81
82 const auto res = x_2 / z_2;
83
84 return Point448(res.to_bytes());
85}
Botan::Gf448Elem::zero
static Gf448Elem zero()
Definition curve448_gf.h:59
Botan::Gf448Elem::ct_cond_swap
void ct_cond_swap(CT::Mask< uint64_t > mask, Gf448Elem &other)
Swap this and other if mask is set. Constant time.
Definition curve448_gf.cpp:375
Botan::Gf448Elem::one
static Gf448Elem one()
Definition curve448_gf.h:64
Botan::mul_a24
Gf448Elem mul_a24(const Gf448Elem &a)
Multiply a field element by the Curve448 constant a24 = 39081.
Definition curve448_gf.cpp:439
Botan::square
BigInt square(const BigInt &x)
Definition numthry.cpp:184
Botan::Point448
Strong< std::array< uint8_t, X448_LEN >, struct Point448_ > Point448
Definition x448_internal.h:18

References Botan::CT::Mask< T >::cleared(), Botan::Gf448Elem::ct_cond_swap(), Botan::CT::Mask< T >::expand(), Botan::detail::Strong_Base< T >::get(), mul_a24(), Botan::Gf448Elem::one(), square(), and Botan::Gf448Elem::zero().

Referenced by x448_basepoint().

◆ x448_basepoint()

Point448 Botan::x448_basepoint ( const ScalarX448 & k)

Multiply a scalar with the base group element (5).

Multiply a scalar with the standard group element (5).

Parameters
kscalar
Returns
encoded point

Definition at line 41 of file x448_internal.cpp.

41 {
42 const Point448 u({5});
43 return x448(k, u);
44}
Botan::x448
Point448 x448(const ScalarX448 &k, const Point448 &u)
Multiply a scalar k with a point u.
Definition x448_internal.cpp:48

References x448().

◆ x500_name_cmp()

bool Botan::x500_name_cmp ( std::string_view name1,
std::string_view name2 )

Definition at line 32 of file x509_dn.cpp.

32 {
33 // MSVC uses an actual iterator type for string_view, so we must use plain `auto` here
34 auto p1 = name1.begin(); // NOLINT(readability-qualified-auto)
35 auto p2 = name2.begin(); // NOLINT(readability-qualified-auto)
36
37 while((p1 != name1.end()) && is_space(*p1)) {
38 ++p1;
39 }
40 while((p2 != name2.end()) && is_space(*p2)) {
41 ++p2;
42 }
43
44 while(p1 != name1.end() && p2 != name2.end()) {
45 if(is_space(*p1)) {
46 if(!is_space(*p2)) {
47 return false;
48 }
49
50 while((p1 != name1.end()) && is_space(*p1)) {
51 ++p1;
52 }
53 while((p2 != name2.end()) && is_space(*p2)) {
54 ++p2;
55 }
56
57 if(p1 == name1.end() && p2 == name2.end()) {
58 return true;
59 }
60 if(p1 == name1.end() || p2 == name2.end()) {
61 return false;
62 }
63 }
64
65 if(!caseless_eq(*p1, *p2)) {
66 return false;
67 }
68 ++p1;
69 ++p2;
70 }
71
72 // Accept/ignore trailing spaces
73 while((p1 != name1.end()) && is_space(*p1)) {
74 ++p1;
75 }
76 if(p1 != name1.end()) {
77 return false;
78 }
79
80 while((p2 != name2.end()) && is_space(*p2)) {
81 ++p2;
82 }
83 if(p2 != name2.end()) {
84 return false;
85 }
86
87 // accept:
88 return true;
89}

Referenced by operator<(), and operator==().

◆ x509_path_validate() [1/4]

Path_Validation_Result Botan::x509_path_validate ( const std::vector< X509_Certificate > & end_certs,
const Path_Validation_Restrictions & restrictions,
const Certificate_Store & store,
std::string_view hostname = "",
Usage_Type usage = Usage_Type::UNSPECIFIED,
std::chrono::system_clock::time_point validation_time = std::chrono::system_clock::now(),
std::chrono::milliseconds ocsp_timeout = std::chrono::milliseconds(0),
const std::vector< std::optional< OCSP::Response > > & ocsp_resp = {} )

PKIX Path Validation

Parameters
end_certscertificate chain to validate
restrictionspath validation restrictions
storestore that contains trusted certificates
hostnameif not empty, compared against the DNS name in end_certs[0]
usageif not set to UNSPECIFIED, compared against the key usage in end_certs[0]
validation_timewhat reference time to use for validation
ocsp_timeouttimeout for OCSP operations, 0 disables OCSP check
ocsp_respadditional OCSP responses to consider (eg from peer)
Returns
result of the path validation

Definition at line 954 of file x509path.cpp.

961 {
962 std::vector<Certificate_Store*> trusted_roots;
963 trusted_roots.push_back(const_cast<Certificate_Store*>(&store));
964
965 return x509_path_validate(end_certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
966}
Botan::Certificate_Store
Definition certstor.h:20
Botan::x509_path_validate
Path_Validation_Result x509_path_validate(const std::vector< X509_Certificate > &end_certs, const Path_Validation_Restrictions &restrictions, const std::vector< Certificate_Store * > &trusted_roots, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point ref_time, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Definition x509path.cpp:868

References x509_path_validate().

◆ x509_path_validate() [2/4]

Path_Validation_Result Botan::x509_path_validate ( const std::vector< X509_Certificate > & end_certs,
const Path_Validation_Restrictions & restrictions,
const std::vector< Certificate_Store * > & trusted_roots,
std::string_view hostname = "",
Usage_Type usage = Usage_Type::UNSPECIFIED,
std::chrono::system_clock::time_point validation_time = std::chrono::system_clock::now(),
std::chrono::milliseconds ocsp_timeout = std::chrono::milliseconds(0),
const std::vector< std::optional< OCSP::Response > > & ocsp_resp = {} )

PKIX Path Validation

Parameters
end_certscertificate chain to validate (with end entity certificate in end_certs[0])
restrictionspath validation restrictions
trusted_rootslist of certificate stores that contain trusted certificates
hostnameif not empty, compared against the DNS name in end_certs[0]
usageif not set to UNSPECIFIED, compared against the key usage in end_certs[0]
validation_timewhat reference time to use for validation
ocsp_timeouttimeout for OCSP operations, 0 disables OCSP check
ocsp_respadditional OCSP responses to consider (eg from peer)
Returns
result of the path validation note: when enabled, OCSP check is softfail by default: if the OCSP server is not reachable, Path_Validation_Result::successful_validation() will return true. Hardfail OCSP check can be achieve by also calling Path_Validation_Result::no_warnings().

Definition at line 868 of file x509path.cpp.

875 {
876 if(end_certs.empty()) {
877 throw Invalid_Argument("x509_path_validate called with no subjects");
878 }
879
880 const X509_Certificate& end_entity = end_certs[0];
881 std::vector<X509_Certificate> end_entity_extra;
882 for(size_t i = 1; i < end_certs.size(); ++i) {
883 end_entity_extra.push_back(end_certs[i]);
884 }
885
886 std::vector<std::vector<X509_Certificate>> cert_paths;
887 const Certificate_Status_Code path_building_result =
888 PKIX::build_all_certificate_paths(cert_paths, trusted_roots, end_entity, end_entity_extra);
889
890 // If we cannot successfully build a chain to a trusted self-signed root, stop now
891 if(path_building_result != Certificate_Status_Code::OK) {
892 return Path_Validation_Result(path_building_result);
893 }
894
895 // If we require trust anchors to be self-signed we need to filter all paths
896 // not ending in a self-signed certificate.
897 if(restrictions.require_self_signed_trust_anchors()) {
898 auto has_non_self_signed_trust_anchor = [](const auto& cert_path) {
899 return cert_path.empty() || !cert_path.back().is_self_signed();
900 };
901 std::erase_if(cert_paths, has_non_self_signed_trust_anchor);
902 }
903 if(cert_paths.empty()) {
904 return Path_Validation_Result(Certificate_Status_Code::CANNOT_ESTABLISH_TRUST);
905 }
906
907 std::vector<Path_Validation_Result> error_results;
908 // Try validating all the potentially valid paths and return the first one to validate properly
909 for(auto cert_path : cert_paths) {
910 CertificatePathStatusCodes status = PKIX::check_chain(cert_path, ref_time, hostname, usage, restrictions);
911
912 const CertificatePathStatusCodes crl_status = PKIX::check_crl(cert_path, trusted_roots, ref_time);
913
914 CertificatePathStatusCodes ocsp_status;
915
916 if(!ocsp_resp.empty()) {
917 ocsp_status = PKIX::check_ocsp(cert_path, ocsp_resp, trusted_roots, ref_time, restrictions);
918 }
919
920 if(ocsp_status.empty() && ocsp_timeout != std::chrono::milliseconds(0)) {
921#if defined(BOTAN_TARGET_OS_HAS_THREADS) && defined(BOTAN_HAS_HTTP_UTIL)
922 ocsp_status = PKIX::check_ocsp_online(cert_path, trusted_roots, ref_time, ocsp_timeout, restrictions);
923#else
924 ocsp_status.resize(1);
925 ocsp_status[0].insert(Certificate_Status_Code::OCSP_NO_HTTP);
926#endif
927 }
928
929 PKIX::merge_revocation_status(status, crl_status, ocsp_status, restrictions);
930
931 Path_Validation_Result pvd(status, std::move(cert_path));
932 if(pvd.successful_validation()) {
933 return pvd;
934 } else {
935 error_results.push_back(std::move(pvd));
936 }
937 }
938 return error_results[0];
939}
Botan::Path_Validation_Restrictions::require_self_signed_trust_anchors
bool require_self_signed_trust_anchors() const
Definition x509path.h:159
Botan::Path_Validation_Result
Definition x509path.h:175
Botan::PKIX::build_all_certificate_paths
Certificate_Status_Code build_all_certificate_paths(std::vector< std::vector< X509_Certificate > > &cert_paths, const std::vector< Certificate_Store * > &trusted_certstores, const X509_Certificate &end_entity, const std::vector< X509_Certificate > &end_entity_extra)
Definition x509path.cpp:680
Botan::PKIX::merge_revocation_status
void merge_revocation_status(CertificatePathStatusCodes &chain_status, const CertificatePathStatusCodes &crl_status, const CertificatePathStatusCodes &ocsp_status, const Path_Validation_Restrictions &restrictions)
Definition x509path.cpp:805
Botan::PKIX::check_ocsp
CertificatePathStatusCodes check_ocsp(const std::vector< X509_Certificate > &cert_path, const std::vector< std::optional< OCSP::Response > > &ocsp_responses, const std::vector< Certificate_Store * > &certstores, std::chrono::system_clock::time_point ref_time, const Path_Validation_Restrictions &restrictions)
Definition x509path.cpp:357
Botan::PKIX::check_chain
CertificatePathStatusCodes check_chain(const std::vector< X509_Certificate > &cert_path, std::chrono::system_clock::time_point ref_time, std::string_view hostname, Usage_Type usage, const Path_Validation_Restrictions &restrictions)
Definition x509path.cpp:33
Botan::PKIX::check_crl
CertificatePathStatusCodes check_crl(const std::vector< X509_Certificate > &cert_path, const std::vector< std::optional< X509_CRL > > &crls, std::chrono::system_clock::time_point ref_time)
Definition x509path.cpp:390
Botan::CertificatePathStatusCodes
std::vector< std::set< Certificate_Status_Code > > CertificatePathStatusCodes
Definition x509path.h:28
Botan::Certificate_Status_Code
Certificate_Status_Code
Definition pkix_enums.h:20

References Botan::PKIX::build_all_certificate_paths(), CANNOT_ESTABLISH_TRUST, Botan::PKIX::check_chain(), Botan::PKIX::check_crl(), Botan::PKIX::check_ocsp(), Botan::PKIX::merge_revocation_status(), OCSP_NO_HTTP, OK, Botan::Path_Validation_Restrictions::require_self_signed_trust_anchors(), and Botan::Path_Validation_Result::successful_validation().

Referenced by botan_x509_cert_verify(), botan_x509_cert_verify_with_crl(), Botan::TLS::Callbacks::tls_verify_cert_chain(), x509_path_validate(), x509_path_validate(), and x509_path_validate().

◆ x509_path_validate() [3/4]

Path_Validation_Result Botan::x509_path_validate ( const X509_Certificate & end_cert,
const Path_Validation_Restrictions & restrictions,
const Certificate_Store & store,
std::string_view hostname = "",
Usage_Type usage = Usage_Type::UNSPECIFIED,
std::chrono::system_clock::time_point validation_time = std::chrono::system_clock::now(),
std::chrono::milliseconds ocsp_timeout = std::chrono::milliseconds(0),
const std::vector< std::optional< OCSP::Response > > & ocsp_resp = {} )

PKIX Path Validation

Parameters
end_certcertificate to validate
restrictionspath validation restrictions
storestore that contains trusted certificates
hostnameif not empty, compared against the DNS name in end_cert
usageif not set to UNSPECIFIED, compared against the key usage in end_cert
validation_timewhat reference time to use for validation
ocsp_timeouttimeout for OCSP operations, 0 disables OCSP check
ocsp_respadditional OCSP responses to consider (eg from peer)
Returns
result of the path validation

Definition at line 968 of file x509path.cpp.

975 {
976 std::vector<X509_Certificate> certs;
977 certs.push_back(end_cert);
978
979 std::vector<Certificate_Store*> trusted_roots;
980 trusted_roots.push_back(const_cast<Certificate_Store*>(&store));
981
982 return x509_path_validate(certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
983}

References x509_path_validate().

◆ x509_path_validate() [4/4]

Path_Validation_Result Botan::x509_path_validate ( const X509_Certificate & end_cert,
const Path_Validation_Restrictions & restrictions,
const std::vector< Certificate_Store * > & trusted_roots,
std::string_view hostname = "",
Usage_Type usage = Usage_Type::UNSPECIFIED,
std::chrono::system_clock::time_point validation_time = std::chrono::system_clock::now(),
std::chrono::milliseconds ocsp_timeout = std::chrono::milliseconds(0),
const std::vector< std::optional< OCSP::Response > > & ocsp_resp = {} )

PKIX Path Validation

Parameters
end_certcertificate to validate
restrictionspath validation restrictions
trusted_rootslist of stores that contain trusted certificates
hostnameif not empty, compared against the DNS name in end_cert
usageif not set to UNSPECIFIED, compared against the key usage in end_cert
validation_timewhat reference time to use for validation
ocsp_timeouttimeout for OCSP operations, 0 disables OCSP check
ocsp_respadditional OCSP responses to consider (eg from peer)
Returns
result of the path validation

Definition at line 941 of file x509path.cpp.

948 {
949 std::vector<X509_Certificate> certs;
950 certs.push_back(end_cert);
951 return x509_path_validate(certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
952}

References x509_path_validate().

◆ xmss_concat() [1/2]

template<std::unsigned_integral T>
void Botan::xmss_concat ( secure_vector< uint8_t > & target,
const T & src )

Concatenates the byte representation in big-endian order of any integral value to a secure_vector.

Parameters
targetVector to concatenate the byte representation of the integral value to.
srcintegral value to concatenate.

Definition at line 28 of file xmss_tools.h.

28 {
29 const uint8_t* src_bytes = reinterpret_cast<const uint8_t*>(&src);
30 if constexpr(std::endian::native == std::endian::little) {
31 std::reverse_copy(src_bytes, src_bytes + sizeof(src), std::back_inserter(target));
32 } else {
33 std::copy(src_bytes, src_bytes + sizeof(src), std::back_inserter(target));
34 }
35}

Referenced by Botan::XMSS_WOTS_Parameters::base_w().

◆ xmss_concat() [2/2]

template<std::unsigned_integral T>
void Botan::xmss_concat ( secure_vector< uint8_t > & target,
const T & src,
size_t len )

Concatenates the last n bytes of the byte representation in big-endian order of any integral value to a to a secure_vector.

Parameters
targetVector to concatenate the byte representation of the integral value to.
srcIntegral value to concatenate.
lennumber of bytes to concatenate. This value must be smaller or equal to the size of type T.

Definition at line 48 of file xmss_tools.h.

48 {
49 const size_t c = static_cast<size_t>(std::min(len, sizeof(src)));
50 if(len > sizeof(src)) {
51 target.resize(target.size() + len - sizeof(src), 0);
52 }
53
54 const uint8_t* src_bytes = reinterpret_cast<const uint8_t*>(&src);
55 if constexpr(std::endian::native == std::endian::little) {
56 std::reverse_copy(src_bytes, src_bytes + c, std::back_inserter(target));
57 } else {
58 std::copy(src_bytes + sizeof(src) - c, src_bytes + sizeof(src), std::back_inserter(target));
59 }
60}

◆ xmss_gen_root()

SphincsTreeNode Botan::xmss_gen_root ( const Sphincs_Parameters & params,
const SphincsSecretSeed & secret_seed,
Sphincs_Hash_Functions & hashes )

Compute the XMSS public key (root node) of the top-most subtree. Contains logic of FIPS 205, Algorithm 18: slh_keygen_internal

Definition at line 58 of file sp_xmss.cpp.

60 {
61 // We do not need the a sig/auth path in key generation, but it simplifies the
62 // code to have just one treehash routine that computes both root and path
63 // in one function.
64 SphincsXmssSignature dummy_sig(params.xmss_tree_height() * params.n() + params.wots_bytes());
65 const SphincsTreeNode dummy_root(params.n());
66
67 Sphincs_Address top_tree_addr(Sphincs_Address_Type::HashTree);
68 Sphincs_Address wots_addr(Sphincs_Address_Type::WotsPublicKeyCompression);
69
70 top_tree_addr.set_layer_address(HypertreeLayerIndex(params.d() - 1));
71 wots_addr.set_layer_address(HypertreeLayerIndex(params.d() - 1));
72
73 SphincsTreeNode root =
74 xmss_sign_and_pkgen(dummy_sig, dummy_root, secret_seed, wots_addr, top_tree_addr, std::nullopt, params, hashes);
75
76 return root;
77}
Botan::root
Gf448Elem root(const Gf448Elem &elem)
Compute the root of elem in the field.
Definition curve448_gf.cpp:451

References Botan::Sphincs_Parameters::d(), HashTree, Botan::Sphincs_Parameters::n(), root(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Parameters::wots_bytes(), WotsPublicKeyCompression, xmss_sign_and_pkgen(), and Botan::Sphincs_Parameters::xmss_tree_height().

Referenced by Botan::SphincsPlus_PrivateKey::SphincsPlus_PrivateKey().

◆ xmss_sign_and_pkgen()

SphincsTreeNode Botan::xmss_sign_and_pkgen ( StrongSpan< SphincsXmssSignature > out_sig,
const SphincsTreeNode & message,
const SphincsSecretSeed & secret_seed,
Sphincs_Address & wots_addr,
Sphincs_Address & tree_addr,
std::optional< TreeNodeIndex > idx_leaf,
const Sphincs_Parameters & params,
Sphincs_Hash_Functions & hashes )

FIPS 205, Algorithm 10: xmss_sign.

This generates a Merkle signature of message (i.e. a FORS public key (bottom layer) or an XMSS root node). The Merkle authentication path logic is mostly hidden in treehash_spec. The WOTS signature followed by the Merkle authentication path are stored in out_sig. Set idx_leaf to std::nullopt if no signature is desired.

Returns
the XMSS public key (i.e. the root of the XMSS merkle tree)

Definition at line 19 of file sp_xmss.cpp.

26 {
27 BufferStuffer sig(out_sig);
28 auto wots_bytes_s = sig.next<WotsSignature>(params.wots_bytes());
29 auto auth_path_s = sig.next<SphincsAuthenticationPath>(sig.remaining_capacity());
30
31 const auto steps = [&]() -> std::vector<WotsHashIndex> {
32 // if `idx_leaf` is not set, we don't want to calculate a signature and
33 // therefore won't need to bother preparing the chain lengths either.
34 if(idx_leaf.has_value()) {
35 return chain_lengths(message, params);
36 } else {
37 return {};
38 };
39 }();
40
41 Sphincs_Address leaf_addr = Sphincs_Address::as_subtree_from(wots_addr);
42 Sphincs_Address pk_addr = Sphincs_Address::as_subtree_from(wots_addr);
43
44 pk_addr.set_type(Sphincs_Address_Type::WotsPublicKeyCompression);
45
46 const GenerateLeafFunction xmss_gen_leaf = [&](StrongSpan<SphincsTreeNode> out_root, TreeNodeIndex address_index) {
47 wots_sign_and_pkgen(
48 wots_bytes_s, out_root, secret_seed, address_index, idx_leaf, steps, leaf_addr, pk_addr, params, hashes);
49 };
50
51 SphincsTreeNode next_root(params.n());
52 BOTAN_ASSERT_NOMSG(tree_addr.get_type() == Sphincs_Address_Type::HashTree);
53 treehash(next_root, auth_path_s, params, hashes, idx_leaf, 0, params.xmss_tree_height(), xmss_gen_leaf, tree_addr);
54
55 return next_root;
56}
Botan::Sphincs_Address::as_subtree_from
static Sphincs_Address as_subtree_from(const Sphincs_Address &other)
Definition sp_address.h:112
Botan::wots_sign_and_pkgen
void wots_sign_and_pkgen(StrongSpan< WotsSignature > sig_out, StrongSpan< SphincsTreeNode > leaf_out, const SphincsSecretSeed &secret_seed, TreeNodeIndex leaf_idx, std::optional< TreeNodeIndex > sign_leaf_idx, const std::vector< WotsHashIndex > &wots_steps, Sphincs_Address &leaf_addr, Sphincs_Address &pk_addr, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
FIPS 205, Algorithm 6 and 7: wots_pkGen and wots_sign.
Definition sp_wots.cpp:133

References Botan::Sphincs_Address::as_subtree_from(), BOTAN_ASSERT_NOMSG, chain_lengths(), Botan::Sphincs_Address::get_type(), HashTree, Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::BufferStuffer::remaining_capacity(), Botan::Sphincs_Address::set_type(), treehash(), Botan::Sphincs_Parameters::wots_bytes(), wots_sign_and_pkgen(), WotsPublicKeyCompression, and Botan::Sphincs_Parameters::xmss_tree_height().

Referenced by ht_sign(), and xmss_gen_root().

◆ xor_buf() [1/7]

void Botan::xor_buf ( ranges::contiguous_output_range< uint8_t > auto && out,
ranges::contiguous_range< uint8_t > auto && in )
inlineconstexpr

XOR arrays. Postcondition out[i] = in[i] ^ out[i] forall i = 0...length

Parameters
outthe input/output range
inthe read-only input range

Definition at line 341 of file mem_ops.h.

342 {
343 ranges::assert_equal_byte_lengths(out, in);
344
345 std::span<uint8_t> o(out);
346 std::span<const uint8_t> i(in);
347
348 for(; o.size_bytes() >= 32; o = o.subspan(32), i = i.subspan(32)) {
349 auto x = typecast_copy<std::array<uint64_t, 4>>(o.template first<32>());
350 const auto y = typecast_copy<std::array<uint64_t, 4>>(i.template first<32>());
351
352 x[0] ^= y[0];
353 x[1] ^= y[1];
354 x[2] ^= y[2];
355 x[3] ^= y[3];
356
357 typecast_copy(o.template first<32>(), x);
358 }
359
360 for(size_t off = 0; off != o.size_bytes(); ++off) {
361 o[off] ^= i[off];
362 }
363}

References Botan::ranges::assert_equal_byte_lengths(), and typecast_copy().

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::Salsa20::cipher_bytes(), Botan::Lion::decrypt_n(), Botan::Lion::encrypt_n(), Botan::GHASH::final(), mgf1_mask(), operator^(), Botan::OctetString::operator^=(), operator^=(), pbkdf2(), Botan::SIV_Mode::S2V(), xor_buf(), xor_buf(), xor_buf(), xor_buf(), and xor_buf().

◆ xor_buf() [2/7]

void Botan::xor_buf ( ranges::contiguous_output_range< uint8_t > auto && out,
ranges::contiguous_range< uint8_t > auto && in1,
ranges::contiguous_range< uint8_t > auto && in2 )
inlineconstexpr

XOR arrays. Postcondition out[i] = in1[i] ^ in2[i] forall i = 0...length

Parameters
outthe output range
in1the first input range
in2the second input range

Definition at line 371 of file mem_ops.h.

373 {
374 ranges::assert_equal_byte_lengths(out, in1, in2);
375
376 std::span o{out};
377 std::span i1{in1};
378 std::span i2{in2};
379
380 for(; o.size_bytes() >= 32; o = o.subspan(32), i1 = i1.subspan(32), i2 = i2.subspan(32)) {
381 auto x = typecast_copy<std::array<uint64_t, 4>>(i1.template first<32>());
382 const auto y = typecast_copy<std::array<uint64_t, 4>>(i2.template first<32>());
383
384 x[0] ^= y[0];
385 x[1] ^= y[1];
386 x[2] ^= y[2];
387 x[3] ^= y[3];
388
389 typecast_copy(o.template first<32>(), x);
390 }
391
392 for(size_t off = 0; off != o.size_bytes(); ++off) {
393 o[off] = i1[off] ^ i2[off];
394 }
395}

References Botan::ranges::assert_equal_byte_lengths(), and typecast_copy().

◆ xor_buf() [3/7]

void Botan::xor_buf ( std::span< uint8_t > out,
std::span< const uint8_t > in,
size_t n )
inline

Definition at line 421 of file mem_ops.h.

421 {
422 BOTAN_ARG_CHECK(out.size() >= n, "output span is too small");
423 BOTAN_ARG_CHECK(in.size() >= n, "input span is too small");
424 xor_buf(out.first(n), in.first(n));
425}

References BOTAN_ARG_CHECK, and xor_buf().

◆ xor_buf() [4/7]

template<typename Alloc, typename Alloc2>
void Botan::xor_buf ( std::vector< uint8_t, Alloc > & out,
const uint8_t * in,
const std::vector< uint8_t, Alloc2 > & in2,
size_t n )

Definition at line 437 of file mem_ops.h.

437 {
438 BOTAN_ARG_CHECK(out.size() >= n, "output vector is too small");
439 BOTAN_ARG_CHECK(in2.size() >= n, "input vector is too small");
440 // simply assumes that *in points to "n" allocated bytes at least
441 xor_buf(std::span{out}.first(n), std::span{in, n}, std::span{in2}.first(n));
442}

References BOTAN_ARG_CHECK, and xor_buf().

◆ xor_buf() [5/7]

template<typename Alloc>
void Botan::xor_buf ( std::vector< uint8_t, Alloc > & out,
const uint8_t * in,
size_t n )

Definition at line 429 of file mem_ops.h.

429 {
430 BOTAN_ARG_CHECK(out.size() >= n, "output vector is too small");
431 // simply assumes that *in points to "n" allocated bytes at least
432 xor_buf(std::span{out}.first(n), std::span{in, n});
433}

References BOTAN_ARG_CHECK, and xor_buf().

◆ xor_buf() [6/7]

void Botan::xor_buf ( uint8_t out[],
const uint8_t in[],
const uint8_t in2[],
size_t length )
inline

XOR arrays. Postcondition out[i] = in[i] ^ in2[i] forall i = 0...length

Parameters
outthe output buffer
inthe first input buffer
in2the second input buffer
lengththe length of the three buffers

Definition at line 415 of file mem_ops.h.

415 {
416 // simply assumes that *out, *in, and *in2 point to "length" allocated bytes at least
417 xor_buf(std::span{out, length}, std::span{in, length}, std::span{in2, length});
418}

References xor_buf().

◆ xor_buf() [7/7]

void Botan::xor_buf ( uint8_t out[],
const uint8_t in[],
size_t length )
inline

XOR arrays. Postcondition out[i] = in[i] ^ out[i] forall i = 0...length

Parameters
outthe input/output buffer
inthe read-only input buffer
lengththe length of the buffers

Definition at line 403 of file mem_ops.h.

403 {
404 // simply assumes that *out and *in point to "length" allocated bytes at least
405 xor_buf(std::span{out, length}, std::span{in, length});
406}

References xor_buf().

◆ xts_compute_tweak_block()

void Botan::xts_compute_tweak_block ( uint8_t tweak[],
size_t BS,
size_t blocks_in_tweak )

Definition at line 119 of file poly_dbl.cpp.

119 {
120 BOTAN_ASSERT_NOMSG(blocks_in_tweak > 0);
121
122 if(BS == 16) {
123 constexpr size_t LIMBS = 2;
124
125 uint64_t W[LIMBS];
126 load_le(W, &tweak[0], LIMBS);
127
128 for(size_t i = 1; i < blocks_in_tweak; ++i) {
129 const uint64_t carry = return_carry<MinWeightPolynomial::P128>(W[1]);
130 W[1] = (W[1] << 1) ^ (W[0] >> 63);
131 W[0] = (W[0] << 1) ^ carry;
132 copy_out_le(std::span(&tweak[i * BS], 2 * 8), W);
133 }
134 } else {
135 for(size_t i = 1; i < blocks_in_tweak; ++i) {
136 const uint8_t* prev = &tweak[(i - 1) * BS];
137 uint8_t* cur = &tweak[i * BS];
138 poly_double_n_le(cur, prev, BS);
139 }
140 }
141}
Botan::copy_out_le
void copy_out_le(std::span< uint8_t > out, const InR &in)
Definition loadstor.h:789
Botan::poly_double_n_le
void poly_double_n_le(uint8_t out[], const uint8_t in[], size_t n)
Definition poly_dbl.cpp:100

References BOTAN_ASSERT_NOMSG, carry(), copy_out_le(), load_le(), and poly_double_n_le().

Referenced by Botan::XTS_Mode::update_tweak().

◆ zap()

template<typename T, typename Alloc>
void Botan::zap ( std::vector< T, Alloc > & vec)

Zeroise the values then free the memory

Parameters
vecthe vector to zeroise and free

Definition at line 133 of file secmem.h.

133 {
134 zeroise(vec);
135 vec.clear();
136 vec.shrink_to_fit();
137}
Botan::zeroise
void zeroise(std::vector< T, Alloc > &vec)
Definition secmem.h:124

References zeroise().

Referenced by Botan::TLS::Cipher_State::advance_with_client_finished(), Botan::TLS::Cipher_State::advance_with_client_hello(), Botan::AES_128::clear(), Botan::AES_192::clear(), Botan::AES_256::clear(), Botan::ANSI_X919_MAC::clear(), Botan::ARIA_128::clear(), Botan::ARIA_192::clear(), Botan::ARIA_256::clear(), Botan::Blowfish::clear(), Botan::Camellia_128::clear(), Botan::Camellia_192::clear(), Botan::Camellia_256::clear(), Botan::CAST_128::clear(), Botan::ChaCha::clear(), Botan::CTR_BE::clear(), Botan::DES::clear(), Botan::GHASH::clear(), Botan::GOST_28147_89::clear(), Botan::HMAC::clear(), Botan::IDEA::clear(), Botan::KMAC::clear(), Botan::Kuznyechik::clear(), Botan::Lion::clear(), Botan::Noekeon::clear(), Botan::Poly1305::clear(), Botan::RC4::clear(), Botan::Salsa20::clear(), Botan::SEED::clear(), Botan::Serpent::clear(), Botan::SHACAL2::clear(), Botan::SipHash::clear(), Botan::SM4::clear(), Botan::Threefish_512::clear(), Botan::TripleDES::clear(), Botan::Twofish::clear(), Botan::TLS::Record_Layer::clear_read_buffer(), Botan::TLS::Cipher_State::clear_read_keys(), and Botan::TLS::Cipher_State::clear_write_keys().

◆ zeroise()

template<typename T, typename Alloc>
void Botan::zeroise ( std::vector< T, Alloc > & vec)

Zeroise the values; length remains unchanged

Parameters
vecthe vector to zeroise

Definition at line 124 of file secmem.h.

124 {
125 std::fill(vec.begin(), vec.end(), static_cast<T>(0));
126}

Referenced by Botan::BLAKE2b::clear(), Botan::CMAC::clear(), Botan::CTR_BE::clear(), Botan::GMAC::clear(), Botan::GOST_34_11::clear(), Botan::OFB::clear(), Botan::SHAKE_Cipher::clear(), Botan::Streebog::clear(), Botan::Whirlpool::init(), Botan::OctetString::operator^=(), Botan::CBC_Decryption::reset(), Botan::CFB_Mode::reset(), Botan::OCB_Mode::reset(), Botan::CTR_BE::seek(), and zap().

◆ zeroize_buffer()

template<std::unsigned_integral T>
void Botan::zeroize_buffer ( T buf[],
size_t n )
inline
Parameters
bufa pointer to the start of the region
nthe number of elements in buf

Definition at line 37 of file mem_utils.h.

37 {
38 if(n > 0) {
39 std::memset(buf, 0, sizeof(T) * n);
40 }
41}

Referenced by basecase_mul(), basecase_sqr(), bigint_monty_redc_inplace(), bigint_mul(), bigint_shl1(), bigint_shr1(), bigint_sqr(), Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::clear(), and Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::fill_up_with_zeros().

Variable Documentation

◆ BLAKE2B_BLOCKBYTES

size_t Botan::BLAKE2B_BLOCKBYTES = 128
constexpr

Definition at line 18 of file blake2b.h.

Referenced by Botan::BLAKE2b::add_data().

◆ BYTES_448

size_t Botan::BYTES_448 = ceil_tobytes<size_t>(448)
constexpr

Definition at line 21 of file curve448_gf.h.

◆ DefaultBufferSize

size_t Botan::DefaultBufferSize = 4096
constexpr

How much to allocate for a buffer of no particular size

Definition at line 137 of file types.h.

Referenced by operator<<(), operator<<(), operator>>(), operator>>(), Botan::Pipe::read_all_as_string(), and Botan::Pipe::write().

◆ ED448_LEN

size_t Botan::ED448_LEN = 57
constexpr

Definition at line 18 of file ed448_internal.h.

Referenced by Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PublicKey::Ed448_PublicKey(), Botan::Ed448_PrivateKey::private_key_bits(), sign_message(), and verify_signature().

◆ HEX_CODEC_BUFFER_SIZE

const size_t Botan::HEX_CODEC_BUFFER_SIZE = 256

Size used for internal buffer in hex encoder/decoder

Definition at line 20 of file hex_filt.cpp.

Referenced by Botan::Hex_Decoder::Hex_Decoder(), Botan::Hex_Encoder::Hex_Encoder(), and Botan::Hex_Encoder::Hex_Encoder().

◆ is_strong_span_v

template<typename T>
bool Botan::is_strong_span_v = is_strong_span<T>::value
constexpr

Definition at line 739 of file strong_type.h.

◆ is_strong_type_v

template<typename... Ts>
bool Botan::is_strong_type_v = is_strong_type<std::remove_const_t<Ts>...>::value
constexpr

Definition at line 29 of file strong_type.h.

◆ LMS_IDENTIFIER_LEN

size_t Botan::LMS_IDENTIFIER_LEN = 16
constexpr

The length in bytes of the LMS identifier (I).

Definition at line 69 of file lms.h.

Referenced by Botan::HSS_LMS_PrivateKeyInternal::from_bytes_or_throw(), Botan::LMS_PublicKey::from_bytes_or_throw(), Botan::HSS_LMS_PrivateKeyInternal::HSS_LMS_PrivateKeyInternal(), Botan::LMS_PublicKey::LMS_PublicKey(), and Botan::LMS_PublicKey::size().

◆ MAX_EXT_DEG

const size_t Botan::MAX_EXT_DEG = 16

Definition at line 19 of file gf2m_small_m.cpp.

◆ PRIME_TABLE_SIZE

const size_t Botan::PRIME_TABLE_SIZE = 6541

The size of the PRIMES[] array

Definition at line 175 of file numthry.h.

Referenced by is_prime(), and random_prime().

◆ PRIMES

const uint16_t Botan::PRIMES

A const array of all odd primes less than 65535

Definition at line 12 of file primes.cpp.

12 {
13 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59,
14 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137,
15 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227,
16 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313,
17 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419,
18 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509,
19 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617,
20 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727,
21 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829,
22 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947,
23 953, 967, 971, 977, 983, 991, 997, 1009, 1013, 1019, 1021, 1031, 1033, 1039, 1049, 1051,
24 1061, 1063, 1069, 1087, 1091, 1093, 1097, 1103, 1109, 1117, 1123, 1129, 1151, 1153, 1163, 1171,
25 1181, 1187, 1193, 1201, 1213, 1217, 1223, 1229, 1231, 1237, 1249, 1259, 1277, 1279, 1283, 1289,
26 1291, 1297, 1301, 1303, 1307, 1319, 1321, 1327, 1361, 1367, 1373, 1381, 1399, 1409, 1423, 1427,
27 1429, 1433, 1439, 1447, 1451, 1453, 1459, 1471, 1481, 1483, 1487, 1489, 1493, 1499, 1511, 1523,
28 1531, 1543, 1549, 1553, 1559, 1567, 1571, 1579, 1583, 1597, 1601, 1607, 1609, 1613, 1619, 1621,
29 1627, 1637, 1657, 1663, 1667, 1669, 1693, 1697, 1699, 1709, 1721, 1723, 1733, 1741, 1747, 1753,
30 1759, 1777, 1783, 1787, 1789, 1801, 1811, 1823, 1831, 1847, 1861, 1867, 1871, 1873, 1877, 1879,
31 1889, 1901, 1907, 1913, 1931, 1933, 1949, 1951, 1973, 1979, 1987, 1993, 1997, 1999, 2003, 2011,
32 2017, 2027, 2029, 2039, 2053, 2063, 2069, 2081, 2083, 2087, 2089, 2099, 2111, 2113, 2129, 2131,
33 2137, 2141, 2143, 2153, 2161, 2179, 2203, 2207, 2213, 2221, 2237, 2239, 2243, 2251, 2267, 2269,
34 2273, 2281, 2287, 2293, 2297, 2309, 2311, 2333, 2339, 2341, 2347, 2351, 2357, 2371, 2377, 2381,
35 2383, 2389, 2393, 2399, 2411, 2417, 2423, 2437, 2441, 2447, 2459, 2467, 2473, 2477, 2503, 2521,
36 2531, 2539, 2543, 2549, 2551, 2557, 2579, 2591, 2593, 2609, 2617, 2621, 2633, 2647, 2657, 2659,
37 2663, 2671, 2677, 2683, 2687, 2689, 2693, 2699, 2707, 2711, 2713, 2719, 2729, 2731, 2741, 2749,
38 2753, 2767, 2777, 2789, 2791, 2797, 2801, 2803, 2819, 2833, 2837, 2843, 2851, 2857, 2861, 2879,
39 2887, 2897, 2903, 2909, 2917, 2927, 2939, 2953, 2957, 2963, 2969, 2971, 2999, 3001, 3011, 3019,
40 3023, 3037, 3041, 3049, 3061, 3067, 3079, 3083, 3089, 3109, 3119, 3121, 3137, 3163, 3167, 3169,
41 3181, 3187, 3191, 3203, 3209, 3217, 3221, 3229, 3251, 3253, 3257, 3259, 3271, 3299, 3301, 3307,
42 3313, 3319, 3323, 3329, 3331, 3343, 3347, 3359, 3361, 3371, 3373, 3389, 3391, 3407, 3413, 3433,
43 3449, 3457, 3461, 3463, 3467, 3469, 3491, 3499, 3511, 3517, 3527, 3529, 3533, 3539, 3541, 3547,
44 3557, 3559, 3571, 3581, 3583, 3593, 3607, 3613, 3617, 3623, 3631, 3637, 3643, 3659, 3671, 3673,
45 3677, 3691, 3697, 3701, 3709, 3719, 3727, 3733, 3739, 3761, 3767, 3769, 3779, 3793, 3797, 3803,
46 3821, 3823, 3833, 3847, 3851, 3853, 3863, 3877, 3881, 3889, 3907, 3911, 3917, 3919, 3923, 3929,
47 3931, 3943, 3947, 3967, 3989, 4001, 4003, 4007, 4013, 4019, 4021, 4027, 4049, 4051, 4057, 4073,
48 4079, 4091, 4093, 4099, 4111, 4127, 4129, 4133, 4139, 4153, 4157, 4159, 4177, 4201, 4211, 4217,
49 4219, 4229, 4231, 4241, 4243, 4253, 4259, 4261, 4271, 4273, 4283, 4289, 4297, 4327, 4337, 4339,
50 4349, 4357, 4363, 4373, 4391, 4397, 4409, 4421, 4423, 4441, 4447, 4451, 4457, 4463, 4481, 4483,
51 4493, 4507, 4513, 4517, 4519, 4523, 4547, 4549, 4561, 4567, 4583, 4591, 4597, 4603, 4621, 4637,
52 4639, 4643, 4649, 4651, 4657, 4663, 4673, 4679, 4691, 4703, 4721, 4723, 4729, 4733, 4751, 4759,
53 4783, 4787, 4789, 4793, 4799, 4801, 4813, 4817, 4831, 4861, 4871, 4877, 4889, 4903, 4909, 4919,
54 4931, 4933, 4937, 4943, 4951, 4957, 4967, 4969, 4973, 4987, 4993, 4999, 5003, 5009, 5011, 5021,
55 5023, 5039, 5051, 5059, 5077, 5081, 5087, 5099, 5101, 5107, 5113, 5119, 5147, 5153, 5167, 5171,
56 5179, 5189, 5197, 5209, 5227, 5231, 5233, 5237, 5261, 5273, 5279, 5281, 5297, 5303, 5309, 5323,
57 5333, 5347, 5351, 5381, 5387, 5393, 5399, 5407, 5413, 5417, 5419, 5431, 5437, 5441, 5443, 5449,
58 5471, 5477, 5479, 5483, 5501, 5503, 5507, 5519, 5521, 5527, 5531, 5557, 5563, 5569, 5573, 5581,
59 5591, 5623, 5639, 5641, 5647, 5651, 5653, 5657, 5659, 5669, 5683, 5689, 5693, 5701, 5711, 5717,
60 5737, 5741, 5743, 5749, 5779, 5783, 5791, 5801, 5807, 5813, 5821, 5827, 5839, 5843, 5849, 5851,
61 5857, 5861, 5867, 5869, 5879, 5881, 5897, 5903, 5923, 5927, 5939, 5953, 5981, 5987, 6007, 6011,
62 6029, 6037, 6043, 6047, 6053, 6067, 6073, 6079, 6089, 6091, 6101, 6113, 6121, 6131, 6133, 6143,
63 6151, 6163, 6173, 6197, 6199, 6203, 6211, 6217, 6221, 6229, 6247, 6257, 6263, 6269, 6271, 6277,
64 6287, 6299, 6301, 6311, 6317, 6323, 6329, 6337, 6343, 6353, 6359, 6361, 6367, 6373, 6379, 6389,
65 6397, 6421, 6427, 6449, 6451, 6469, 6473, 6481, 6491, 6521, 6529, 6547, 6551, 6553, 6563, 6569,
66 6571, 6577, 6581, 6599, 6607, 6619, 6637, 6653, 6659, 6661, 6673, 6679, 6689, 6691, 6701, 6703,
67 6709, 6719, 6733, 6737, 6761, 6763, 6779, 6781, 6791, 6793, 6803, 6823, 6827, 6829, 6833, 6841,
68 6857, 6863, 6869, 6871, 6883, 6899, 6907, 6911, 6917, 6947, 6949, 6959, 6961, 6967, 6971, 6977,
69 6983, 6991, 6997, 7001, 7013, 7019, 7027, 7039, 7043, 7057, 7069, 7079, 7103, 7109, 7121, 7127,
70 7129, 7151, 7159, 7177, 7187, 7193, 7207, 7211, 7213, 7219, 7229, 7237, 7243, 7247, 7253, 7283,
71 7297, 7307, 7309, 7321, 7331, 7333, 7349, 7351, 7369, 7393, 7411, 7417, 7433, 7451, 7457, 7459,
72 7477, 7481, 7487, 7489, 7499, 7507, 7517, 7523, 7529, 7537, 7541, 7547, 7549, 7559, 7561, 7573,
73 7577, 7583, 7589, 7591, 7603, 7607, 7621, 7639, 7643, 7649, 7669, 7673, 7681, 7687, 7691, 7699,
74 7703, 7717, 7723, 7727, 7741, 7753, 7757, 7759, 7789, 7793, 7817, 7823, 7829, 7841, 7853, 7867,
75 7873, 7877, 7879, 7883, 7901, 7907, 7919, 7927, 7933, 7937, 7949, 7951, 7963, 7993, 8009, 8011,
76 8017, 8039, 8053, 8059, 8069, 8081, 8087, 8089, 8093, 8101, 8111, 8117, 8123, 8147, 8161, 8167,
77 8171, 8179, 8191, 8209, 8219, 8221, 8231, 8233, 8237, 8243, 8263, 8269, 8273, 8287, 8291, 8293,
78 8297, 8311, 8317, 8329, 8353, 8363, 8369, 8377, 8387, 8389, 8419, 8423, 8429, 8431, 8443, 8447,
79 8461, 8467, 8501, 8513, 8521, 8527, 8537, 8539, 8543, 8563, 8573, 8581, 8597, 8599, 8609, 8623,
80 8627, 8629, 8641, 8647, 8663, 8669, 8677, 8681, 8689, 8693, 8699, 8707, 8713, 8719, 8731, 8737,
81 8741, 8747, 8753, 8761, 8779, 8783, 8803, 8807, 8819, 8821, 8831, 8837, 8839, 8849, 8861, 8863,
82 8867, 8887, 8893, 8923, 8929, 8933, 8941, 8951, 8963, 8969, 8971, 8999, 9001, 9007, 9011, 9013,
83 9029, 9041, 9043, 9049, 9059, 9067, 9091, 9103, 9109, 9127, 9133, 9137, 9151, 9157, 9161, 9173,
84 9181, 9187, 9199, 9203, 9209, 9221, 9227, 9239, 9241, 9257, 9277, 9281, 9283, 9293, 9311, 9319,
85 9323, 9337, 9341, 9343, 9349, 9371, 9377, 9391, 9397, 9403, 9413, 9419, 9421, 9431, 9433, 9437,
86 9439, 9461, 9463, 9467, 9473, 9479, 9491, 9497, 9511, 9521, 9533, 9539, 9547, 9551, 9587, 9601,
87 9613, 9619, 9623, 9629, 9631, 9643, 9649, 9661, 9677, 9679, 9689, 9697, 9719, 9721, 9733, 9739,
88 9743, 9749, 9767, 9769, 9781, 9787, 9791, 9803, 9811, 9817, 9829, 9833, 9839, 9851, 9857, 9859,
89 9871, 9883, 9887, 9901, 9907, 9923, 9929, 9931, 9941, 9949, 9967, 9973, 10007, 10009, 10037, 10039,
90 10061, 10067, 10069, 10079, 10091, 10093, 10099, 10103, 10111, 10133, 10139, 10141, 10151, 10159, 10163, 10169,
91 10177, 10181, 10193, 10211, 10223, 10243, 10247, 10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303, 10313,
92 10321, 10331, 10333, 10337, 10343, 10357, 10369, 10391, 10399, 10427, 10429, 10433, 10453, 10457, 10459, 10463,
93 10477, 10487, 10499, 10501, 10513, 10529, 10531, 10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627, 10631,
94 10639, 10651, 10657, 10663, 10667, 10687, 10691, 10709, 10711, 10723, 10729, 10733, 10739, 10753, 10771, 10781,
95 10789, 10799, 10831, 10837, 10847, 10853, 10859, 10861, 10867, 10883, 10889, 10891, 10903, 10909, 10937, 10939,
96 10949, 10957, 10973, 10979, 10987, 10993, 11003, 11027, 11047, 11057, 11059, 11069, 11071, 11083, 11087, 11093,
97 11113, 11117, 11119, 11131, 11149, 11159, 11161, 11171, 11173, 11177, 11197, 11213, 11239, 11243, 11251, 11257,
98 11261, 11273, 11279, 11287, 11299, 11311, 11317, 11321, 11329, 11351, 11353, 11369, 11383, 11393, 11399, 11411,
99 11423, 11437, 11443, 11447, 11467, 11471, 11483, 11489, 11491, 11497, 11503, 11519, 11527, 11549, 11551, 11579,
100 11587, 11593, 11597, 11617, 11621, 11633, 11657, 11677, 11681, 11689, 11699, 11701, 11717, 11719, 11731, 11743,
101 11777, 11779, 11783, 11789, 11801, 11807, 11813, 11821, 11827, 11831, 11833, 11839, 11863, 11867, 11887, 11897,
102 11903, 11909, 11923, 11927, 11933, 11939, 11941, 11953, 11959, 11969, 11971, 11981, 11987, 12007, 12011, 12037,
103 12041, 12043, 12049, 12071, 12073, 12097, 12101, 12107, 12109, 12113, 12119, 12143, 12149, 12157, 12161, 12163,
104 12197, 12203, 12211, 12227, 12239, 12241, 12251, 12253, 12263, 12269, 12277, 12281, 12289, 12301, 12323, 12329,
105 12343, 12347, 12373, 12377, 12379, 12391, 12401, 12409, 12413, 12421, 12433, 12437, 12451, 12457, 12473, 12479,
106 12487, 12491, 12497, 12503, 12511, 12517, 12527, 12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589, 12601,
107 12611, 12613, 12619, 12637, 12641, 12647, 12653, 12659, 12671, 12689, 12697, 12703, 12713, 12721, 12739, 12743,
108 12757, 12763, 12781, 12791, 12799, 12809, 12821, 12823, 12829, 12841, 12853, 12889, 12893, 12899, 12907, 12911,
109 12917, 12919, 12923, 12941, 12953, 12959, 12967, 12973, 12979, 12983, 13001, 13003, 13007, 13009, 13033, 13037,
110 13043, 13049, 13063, 13093, 13099, 13103, 13109, 13121, 13127, 13147, 13151, 13159, 13163, 13171, 13177, 13183,
111 13187, 13217, 13219, 13229, 13241, 13249, 13259, 13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337, 13339,
112 13367, 13381, 13397, 13399, 13411, 13417, 13421, 13441, 13451, 13457, 13463, 13469, 13477, 13487, 13499, 13513,
113 13523, 13537, 13553, 13567, 13577, 13591, 13597, 13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681, 13687,
114 13691, 13693, 13697, 13709, 13711, 13721, 13723, 13729, 13751, 13757, 13759, 13763, 13781, 13789, 13799, 13807,
115 13829, 13831, 13841, 13859, 13873, 13877, 13879, 13883, 13901, 13903, 13907, 13913, 13921, 13931, 13933, 13963,
116 13967, 13997, 13999, 14009, 14011, 14029, 14033, 14051, 14057, 14071, 14081, 14083, 14087, 14107, 14143, 14149,
117 14153, 14159, 14173, 14177, 14197, 14207, 14221, 14243, 14249, 14251, 14281, 14293, 14303, 14321, 14323, 14327,
118 14341, 14347, 14369, 14387, 14389, 14401, 14407, 14411, 14419, 14423, 14431, 14437, 14447, 14449, 14461, 14479,
119 14489, 14503, 14519, 14533, 14537, 14543, 14549, 14551, 14557, 14561, 14563, 14591, 14593, 14621, 14627, 14629,
120 14633, 14639, 14653, 14657, 14669, 14683, 14699, 14713, 14717, 14723, 14731, 14737, 14741, 14747, 14753, 14759,
121 14767, 14771, 14779, 14783, 14797, 14813, 14821, 14827, 14831, 14843, 14851, 14867, 14869, 14879, 14887, 14891,
122 14897, 14923, 14929, 14939, 14947, 14951, 14957, 14969, 14983, 15013, 15017, 15031, 15053, 15061, 15073, 15077,
123 15083, 15091, 15101, 15107, 15121, 15131, 15137, 15139, 15149, 15161, 15173, 15187, 15193, 15199, 15217, 15227,
124 15233, 15241, 15259, 15263, 15269, 15271, 15277, 15287, 15289, 15299, 15307, 15313, 15319, 15329, 15331, 15349,
125 15359, 15361, 15373, 15377, 15383, 15391, 15401, 15413, 15427, 15439, 15443, 15451, 15461, 15467, 15473, 15493,
126 15497, 15511, 15527, 15541, 15551, 15559, 15569, 15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643, 15647,
127 15649, 15661, 15667, 15671, 15679, 15683, 15727, 15731, 15733, 15737, 15739, 15749, 15761, 15767, 15773, 15787,
128 15791, 15797, 15803, 15809, 15817, 15823, 15859, 15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919, 15923,
129 15937, 15959, 15971, 15973, 15991, 16001, 16007, 16033, 16057, 16061, 16063, 16067, 16069, 16073, 16087, 16091,
130 16097, 16103, 16111, 16127, 16139, 16141, 16183, 16187, 16189, 16193, 16217, 16223, 16229, 16231, 16249, 16253,
131 16267, 16273, 16301, 16319, 16333, 16339, 16349, 16361, 16363, 16369, 16381, 16411, 16417, 16421, 16427, 16433,
132 16447, 16451, 16453, 16477, 16481, 16487, 16493, 16519, 16529, 16547, 16553, 16561, 16567, 16573, 16603, 16607,
133 16619, 16631, 16633, 16649, 16651, 16657, 16661, 16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747, 16759,
134 16763, 16787, 16811, 16823, 16829, 16831, 16843, 16871, 16879, 16883, 16889, 16901, 16903, 16921, 16927, 16931,
135 16937, 16943, 16963, 16979, 16981, 16987, 16993, 17011, 17021, 17027, 17029, 17033, 17041, 17047, 17053, 17077,
136 17093, 17099, 17107, 17117, 17123, 17137, 17159, 17167, 17183, 17189, 17191, 17203, 17207, 17209, 17231, 17239,
137 17257, 17291, 17293, 17299, 17317, 17321, 17327, 17333, 17341, 17351, 17359, 17377, 17383, 17387, 17389, 17393,
138 17401, 17417, 17419, 17431, 17443, 17449, 17467, 17471, 17477, 17483, 17489, 17491, 17497, 17509, 17519, 17539,
139 17551, 17569, 17573, 17579, 17581, 17597, 17599, 17609, 17623, 17627, 17657, 17659, 17669, 17681, 17683, 17707,
140 17713, 17729, 17737, 17747, 17749, 17761, 17783, 17789, 17791, 17807, 17827, 17837, 17839, 17851, 17863, 17881,
141 17891, 17903, 17909, 17911, 17921, 17923, 17929, 17939, 17957, 17959, 17971, 17977, 17981, 17987, 17989, 18013,
142 18041, 18043, 18047, 18049, 18059, 18061, 18077, 18089, 18097, 18119, 18121, 18127, 18131, 18133, 18143, 18149,
143 18169, 18181, 18191, 18199, 18211, 18217, 18223, 18229, 18233, 18251, 18253, 18257, 18269, 18287, 18289, 18301,
144 18307, 18311, 18313, 18329, 18341, 18353, 18367, 18371, 18379, 18397, 18401, 18413, 18427, 18433, 18439, 18443,
145 18451, 18457, 18461, 18481, 18493, 18503, 18517, 18521, 18523, 18539, 18541, 18553, 18583, 18587, 18593, 18617,
146 18637, 18661, 18671, 18679, 18691, 18701, 18713, 18719, 18731, 18743, 18749, 18757, 18773, 18787, 18793, 18797,
147 18803, 18839, 18859, 18869, 18899, 18911, 18913, 18917, 18919, 18947, 18959, 18973, 18979, 19001, 19009, 19013,
148 19031, 19037, 19051, 19069, 19073, 19079, 19081, 19087, 19121, 19139, 19141, 19157, 19163, 19181, 19183, 19207,
149 19211, 19213, 19219, 19231, 19237, 19249, 19259, 19267, 19273, 19289, 19301, 19309, 19319, 19333, 19373, 19379,
150 19381, 19387, 19391, 19403, 19417, 19421, 19423, 19427, 19429, 19433, 19441, 19447, 19457, 19463, 19469, 19471,
151 19477, 19483, 19489, 19501, 19507, 19531, 19541, 19543, 19553, 19559, 19571, 19577, 19583, 19597, 19603, 19609,
152 19661, 19681, 19687, 19697, 19699, 19709, 19717, 19727, 19739, 19751, 19753, 19759, 19763, 19777, 19793, 19801,
153 19813, 19819, 19841, 19843, 19853, 19861, 19867, 19889, 19891, 19913, 19919, 19927, 19937, 19949, 19961, 19963,
154 19973, 19979, 19991, 19993, 19997, 20011, 20021, 20023, 20029, 20047, 20051, 20063, 20071, 20089, 20101, 20107,
155 20113, 20117, 20123, 20129, 20143, 20147, 20149, 20161, 20173, 20177, 20183, 20201, 20219, 20231, 20233, 20249,
156 20261, 20269, 20287, 20297, 20323, 20327, 20333, 20341, 20347, 20353, 20357, 20359, 20369, 20389, 20393, 20399,
157 20407, 20411, 20431, 20441, 20443, 20477, 20479, 20483, 20507, 20509, 20521, 20533, 20543, 20549, 20551, 20563,
158 20593, 20599, 20611, 20627, 20639, 20641, 20663, 20681, 20693, 20707, 20717, 20719, 20731, 20743, 20747, 20749,
159 20753, 20759, 20771, 20773, 20789, 20807, 20809, 20849, 20857, 20873, 20879, 20887, 20897, 20899, 20903, 20921,
160 20929, 20939, 20947, 20959, 20963, 20981, 20983, 21001, 21011, 21013, 21017, 21019, 21023, 21031, 21059, 21061,
161 21067, 21089, 21101, 21107, 21121, 21139, 21143, 21149, 21157, 21163, 21169, 21179, 21187, 21191, 21193, 21211,
162 21221, 21227, 21247, 21269, 21277, 21283, 21313, 21317, 21319, 21323, 21341, 21347, 21377, 21379, 21383, 21391,
163 21397, 21401, 21407, 21419, 21433, 21467, 21481, 21487, 21491, 21493, 21499, 21503, 21517, 21521, 21523, 21529,
164 21557, 21559, 21563, 21569, 21577, 21587, 21589, 21599, 21601, 21611, 21613, 21617, 21647, 21649, 21661, 21673,
165 21683, 21701, 21713, 21727, 21737, 21739, 21751, 21757, 21767, 21773, 21787, 21799, 21803, 21817, 21821, 21839,
166 21841, 21851, 21859, 21863, 21871, 21881, 21893, 21911, 21929, 21937, 21943, 21961, 21977, 21991, 21997, 22003,
167 22013, 22027, 22031, 22037, 22039, 22051, 22063, 22067, 22073, 22079, 22091, 22093, 22109, 22111, 22123, 22129,
168 22133, 22147, 22153, 22157, 22159, 22171, 22189, 22193, 22229, 22247, 22259, 22271, 22273, 22277, 22279, 22283,
169 22291, 22303, 22307, 22343, 22349, 22367, 22369, 22381, 22391, 22397, 22409, 22433, 22441, 22447, 22453, 22469,
170 22481, 22483, 22501, 22511, 22531, 22541, 22543, 22549, 22567, 22571, 22573, 22613, 22619, 22621, 22637, 22639,
171 22643, 22651, 22669, 22679, 22691, 22697, 22699, 22709, 22717, 22721, 22727, 22739, 22741, 22751, 22769, 22777,
172 22783, 22787, 22807, 22811, 22817, 22853, 22859, 22861, 22871, 22877, 22901, 22907, 22921, 22937, 22943, 22961,
173 22963, 22973, 22993, 23003, 23011, 23017, 23021, 23027, 23029, 23039, 23041, 23053, 23057, 23059, 23063, 23071,
174 23081, 23087, 23099, 23117, 23131, 23143, 23159, 23167, 23173, 23189, 23197, 23201, 23203, 23209, 23227, 23251,
175 23269, 23279, 23291, 23293, 23297, 23311, 23321, 23327, 23333, 23339, 23357, 23369, 23371, 23399, 23417, 23431,
176 23447, 23459, 23473, 23497, 23509, 23531, 23537, 23539, 23549, 23557, 23561, 23563, 23567, 23581, 23593, 23599,
177 23603, 23609, 23623, 23627, 23629, 23633, 23663, 23669, 23671, 23677, 23687, 23689, 23719, 23741, 23743, 23747,
178 23753, 23761, 23767, 23773, 23789, 23801, 23813, 23819, 23827, 23831, 23833, 23857, 23869, 23873, 23879, 23887,
179 23893, 23899, 23909, 23911, 23917, 23929, 23957, 23971, 23977, 23981, 23993, 24001, 24007, 24019, 24023, 24029,
180 24043, 24049, 24061, 24071, 24077, 24083, 24091, 24097, 24103, 24107, 24109, 24113, 24121, 24133, 24137, 24151,
181 24169, 24179, 24181, 24197, 24203, 24223, 24229, 24239, 24247, 24251, 24281, 24317, 24329, 24337, 24359, 24371,
182 24373, 24379, 24391, 24407, 24413, 24419, 24421, 24439, 24443, 24469, 24473, 24481, 24499, 24509, 24517, 24527,
183 24533, 24547, 24551, 24571, 24593, 24611, 24623, 24631, 24659, 24671, 24677, 24683, 24691, 24697, 24709, 24733,
184 24749, 24763, 24767, 24781, 24793, 24799, 24809, 24821, 24841, 24847, 24851, 24859, 24877, 24889, 24907, 24917,
185 24919, 24923, 24943, 24953, 24967, 24971, 24977, 24979, 24989, 25013, 25031, 25033, 25037, 25057, 25073, 25087,
186 25097, 25111, 25117, 25121, 25127, 25147, 25153, 25163, 25169, 25171, 25183, 25189, 25219, 25229, 25237, 25243,
187 25247, 25253, 25261, 25301, 25303, 25307, 25309, 25321, 25339, 25343, 25349, 25357, 25367, 25373, 25391, 25409,
188 25411, 25423, 25439, 25447, 25453, 25457, 25463, 25469, 25471, 25523, 25537, 25541, 25561, 25577, 25579, 25583,
189 25589, 25601, 25603, 25609, 25621, 25633, 25639, 25643, 25657, 25667, 25673, 25679, 25693, 25703, 25717, 25733,
190 25741, 25747, 25759, 25763, 25771, 25793, 25799, 25801, 25819, 25841, 25847, 25849, 25867, 25873, 25889, 25903,
191 25913, 25919, 25931, 25933, 25939, 25943, 25951, 25969, 25981, 25997, 25999, 26003, 26017, 26021, 26029, 26041,
192 26053, 26083, 26099, 26107, 26111, 26113, 26119, 26141, 26153, 26161, 26171, 26177, 26183, 26189, 26203, 26209,
193 26227, 26237, 26249, 26251, 26261, 26263, 26267, 26293, 26297, 26309, 26317, 26321, 26339, 26347, 26357, 26371,
194 26387, 26393, 26399, 26407, 26417, 26423, 26431, 26437, 26449, 26459, 26479, 26489, 26497, 26501, 26513, 26539,
195 26557, 26561, 26573, 26591, 26597, 26627, 26633, 26641, 26647, 26669, 26681, 26683, 26687, 26693, 26699, 26701,
196 26711, 26713, 26717, 26723, 26729, 26731, 26737, 26759, 26777, 26783, 26801, 26813, 26821, 26833, 26839, 26849,
197 26861, 26863, 26879, 26881, 26891, 26893, 26903, 26921, 26927, 26947, 26951, 26953, 26959, 26981, 26987, 26993,
198 27011, 27017, 27031, 27043, 27059, 27061, 27067, 27073, 27077, 27091, 27103, 27107, 27109, 27127, 27143, 27179,
199 27191, 27197, 27211, 27239, 27241, 27253, 27259, 27271, 27277, 27281, 27283, 27299, 27329, 27337, 27361, 27367,
200 27397, 27407, 27409, 27427, 27431, 27437, 27449, 27457, 27479, 27481, 27487, 27509, 27527, 27529, 27539, 27541,
201 27551, 27581, 27583, 27611, 27617, 27631, 27647, 27653, 27673, 27689, 27691, 27697, 27701, 27733, 27737, 27739,
202 27743, 27749, 27751, 27763, 27767, 27773, 27779, 27791, 27793, 27799, 27803, 27809, 27817, 27823, 27827, 27847,
203 27851, 27883, 27893, 27901, 27917, 27919, 27941, 27943, 27947, 27953, 27961, 27967, 27983, 27997, 28001, 28019,
204 28027, 28031, 28051, 28057, 28069, 28081, 28087, 28097, 28099, 28109, 28111, 28123, 28151, 28163, 28181, 28183,
205 28201, 28211, 28219, 28229, 28277, 28279, 28283, 28289, 28297, 28307, 28309, 28319, 28349, 28351, 28387, 28393,
206 28403, 28409, 28411, 28429, 28433, 28439, 28447, 28463, 28477, 28493, 28499, 28513, 28517, 28537, 28541, 28547,
207 28549, 28559, 28571, 28573, 28579, 28591, 28597, 28603, 28607, 28619, 28621, 28627, 28631, 28643, 28649, 28657,
208 28661, 28663, 28669, 28687, 28697, 28703, 28711, 28723, 28729, 28751, 28753, 28759, 28771, 28789, 28793, 28807,
209 28813, 28817, 28837, 28843, 28859, 28867, 28871, 28879, 28901, 28909, 28921, 28927, 28933, 28949, 28961, 28979,
210 29009, 29017, 29021, 29023, 29027, 29033, 29059, 29063, 29077, 29101, 29123, 29129, 29131, 29137, 29147, 29153,
211 29167, 29173, 29179, 29191, 29201, 29207, 29209, 29221, 29231, 29243, 29251, 29269, 29287, 29297, 29303, 29311,
212 29327, 29333, 29339, 29347, 29363, 29383, 29387, 29389, 29399, 29401, 29411, 29423, 29429, 29437, 29443, 29453,
213 29473, 29483, 29501, 29527, 29531, 29537, 29567, 29569, 29573, 29581, 29587, 29599, 29611, 29629, 29633, 29641,
214 29663, 29669, 29671, 29683, 29717, 29723, 29741, 29753, 29759, 29761, 29789, 29803, 29819, 29833, 29837, 29851,
215 29863, 29867, 29873, 29879, 29881, 29917, 29921, 29927, 29947, 29959, 29983, 29989, 30011, 30013, 30029, 30047,
216 30059, 30071, 30089, 30091, 30097, 30103, 30109, 30113, 30119, 30133, 30137, 30139, 30161, 30169, 30181, 30187,
217 30197, 30203, 30211, 30223, 30241, 30253, 30259, 30269, 30271, 30293, 30307, 30313, 30319, 30323, 30341, 30347,
218 30367, 30389, 30391, 30403, 30427, 30431, 30449, 30467, 30469, 30491, 30493, 30497, 30509, 30517, 30529, 30539,
219 30553, 30557, 30559, 30577, 30593, 30631, 30637, 30643, 30649, 30661, 30671, 30677, 30689, 30697, 30703, 30707,
220 30713, 30727, 30757, 30763, 30773, 30781, 30803, 30809, 30817, 30829, 30839, 30841, 30851, 30853, 30859, 30869,
221 30871, 30881, 30893, 30911, 30931, 30937, 30941, 30949, 30971, 30977, 30983, 31013, 31019, 31033, 31039, 31051,
222 31063, 31069, 31079, 31081, 31091, 31121, 31123, 31139, 31147, 31151, 31153, 31159, 31177, 31181, 31183, 31189,
223 31193, 31219, 31223, 31231, 31237, 31247, 31249, 31253, 31259, 31267, 31271, 31277, 31307, 31319, 31321, 31327,
224 31333, 31337, 31357, 31379, 31387, 31391, 31393, 31397, 31469, 31477, 31481, 31489, 31511, 31513, 31517, 31531,
225 31541, 31543, 31547, 31567, 31573, 31583, 31601, 31607, 31627, 31643, 31649, 31657, 31663, 31667, 31687, 31699,
226 31721, 31723, 31727, 31729, 31741, 31751, 31769, 31771, 31793, 31799, 31817, 31847, 31849, 31859, 31873, 31883,
227 31891, 31907, 31957, 31963, 31973, 31981, 31991, 32003, 32009, 32027, 32029, 32051, 32057, 32059, 32063, 32069,
228 32077, 32083, 32089, 32099, 32117, 32119, 32141, 32143, 32159, 32173, 32183, 32189, 32191, 32203, 32213, 32233,
229 32237, 32251, 32257, 32261, 32297, 32299, 32303, 32309, 32321, 32323, 32327, 32341, 32353, 32359, 32363, 32369,
230 32371, 32377, 32381, 32401, 32411, 32413, 32423, 32429, 32441, 32443, 32467, 32479, 32491, 32497, 32503, 32507,
231 32531, 32533, 32537, 32561, 32563, 32569, 32573, 32579, 32587, 32603, 32609, 32611, 32621, 32633, 32647, 32653,
232 32687, 32693, 32707, 32713, 32717, 32719, 32749, 32771, 32779, 32783, 32789, 32797, 32801, 32803, 32831, 32833,
233 32839, 32843, 32869, 32887, 32909, 32911, 32917, 32933, 32939, 32941, 32957, 32969, 32971, 32983, 32987, 32993,
234 32999, 33013, 33023, 33029, 33037, 33049, 33053, 33071, 33073, 33083, 33091, 33107, 33113, 33119, 33149, 33151,
235 33161, 33179, 33181, 33191, 33199, 33203, 33211, 33223, 33247, 33287, 33289, 33301, 33311, 33317, 33329, 33331,
236 33343, 33347, 33349, 33353, 33359, 33377, 33391, 33403, 33409, 33413, 33427, 33457, 33461, 33469, 33479, 33487,
237 33493, 33503, 33521, 33529, 33533, 33547, 33563, 33569, 33577, 33581, 33587, 33589, 33599, 33601, 33613, 33617,
238 33619, 33623, 33629, 33637, 33641, 33647, 33679, 33703, 33713, 33721, 33739, 33749, 33751, 33757, 33767, 33769,
239 33773, 33791, 33797, 33809, 33811, 33827, 33829, 33851, 33857, 33863, 33871, 33889, 33893, 33911, 33923, 33931,
240 33937, 33941, 33961, 33967, 33997, 34019, 34031, 34033, 34039, 34057, 34061, 34123, 34127, 34129, 34141, 34147,
241 34157, 34159, 34171, 34183, 34211, 34213, 34217, 34231, 34253, 34259, 34261, 34267, 34273, 34283, 34297, 34301,
242 34303, 34313, 34319, 34327, 34337, 34351, 34361, 34367, 34369, 34381, 34403, 34421, 34429, 34439, 34457, 34469,
243 34471, 34483, 34487, 34499, 34501, 34511, 34513, 34519, 34537, 34543, 34549, 34583, 34589, 34591, 34603, 34607,
244 34613, 34631, 34649, 34651, 34667, 34673, 34679, 34687, 34693, 34703, 34721, 34729, 34739, 34747, 34757, 34759,
245 34763, 34781, 34807, 34819, 34841, 34843, 34847, 34849, 34871, 34877, 34883, 34897, 34913, 34919, 34939, 34949,
246 34961, 34963, 34981, 35023, 35027, 35051, 35053, 35059, 35069, 35081, 35083, 35089, 35099, 35107, 35111, 35117,
247 35129, 35141, 35149, 35153, 35159, 35171, 35201, 35221, 35227, 35251, 35257, 35267, 35279, 35281, 35291, 35311,
248 35317, 35323, 35327, 35339, 35353, 35363, 35381, 35393, 35401, 35407, 35419, 35423, 35437, 35447, 35449, 35461,
249 35491, 35507, 35509, 35521, 35527, 35531, 35533, 35537, 35543, 35569, 35573, 35591, 35593, 35597, 35603, 35617,
250 35671, 35677, 35729, 35731, 35747, 35753, 35759, 35771, 35797, 35801, 35803, 35809, 35831, 35837, 35839, 35851,
251 35863, 35869, 35879, 35897, 35899, 35911, 35923, 35933, 35951, 35963, 35969, 35977, 35983, 35993, 35999, 36007,
252 36011, 36013, 36017, 36037, 36061, 36067, 36073, 36083, 36097, 36107, 36109, 36131, 36137, 36151, 36161, 36187,
253 36191, 36209, 36217, 36229, 36241, 36251, 36263, 36269, 36277, 36293, 36299, 36307, 36313, 36319, 36341, 36343,
254 36353, 36373, 36383, 36389, 36433, 36451, 36457, 36467, 36469, 36473, 36479, 36493, 36497, 36523, 36527, 36529,
255 36541, 36551, 36559, 36563, 36571, 36583, 36587, 36599, 36607, 36629, 36637, 36643, 36653, 36671, 36677, 36683,
256 36691, 36697, 36709, 36713, 36721, 36739, 36749, 36761, 36767, 36779, 36781, 36787, 36791, 36793, 36809, 36821,
257 36833, 36847, 36857, 36871, 36877, 36887, 36899, 36901, 36913, 36919, 36923, 36929, 36931, 36943, 36947, 36973,
258 36979, 36997, 37003, 37013, 37019, 37021, 37039, 37049, 37057, 37061, 37087, 37097, 37117, 37123, 37139, 37159,
259 37171, 37181, 37189, 37199, 37201, 37217, 37223, 37243, 37253, 37273, 37277, 37307, 37309, 37313, 37321, 37337,
260 37339, 37357, 37361, 37363, 37369, 37379, 37397, 37409, 37423, 37441, 37447, 37463, 37483, 37489, 37493, 37501,
261 37507, 37511, 37517, 37529, 37537, 37547, 37549, 37561, 37567, 37571, 37573, 37579, 37589, 37591, 37607, 37619,
262 37633, 37643, 37649, 37657, 37663, 37691, 37693, 37699, 37717, 37747, 37781, 37783, 37799, 37811, 37813, 37831,
263 37847, 37853, 37861, 37871, 37879, 37889, 37897, 37907, 37951, 37957, 37963, 37967, 37987, 37991, 37993, 37997,
264 38011, 38039, 38047, 38053, 38069, 38083, 38113, 38119, 38149, 38153, 38167, 38177, 38183, 38189, 38197, 38201,
265 38219, 38231, 38237, 38239, 38261, 38273, 38281, 38287, 38299, 38303, 38317, 38321, 38327, 38329, 38333, 38351,
266 38371, 38377, 38393, 38431, 38447, 38449, 38453, 38459, 38461, 38501, 38543, 38557, 38561, 38567, 38569, 38593,
267 38603, 38609, 38611, 38629, 38639, 38651, 38653, 38669, 38671, 38677, 38693, 38699, 38707, 38711, 38713, 38723,
268 38729, 38737, 38747, 38749, 38767, 38783, 38791, 38803, 38821, 38833, 38839, 38851, 38861, 38867, 38873, 38891,
269 38903, 38917, 38921, 38923, 38933, 38953, 38959, 38971, 38977, 38993, 39019, 39023, 39041, 39043, 39047, 39079,
270 39089, 39097, 39103, 39107, 39113, 39119, 39133, 39139, 39157, 39161, 39163, 39181, 39191, 39199, 39209, 39217,
271 39227, 39229, 39233, 39239, 39241, 39251, 39293, 39301, 39313, 39317, 39323, 39341, 39343, 39359, 39367, 39371,
272 39373, 39383, 39397, 39409, 39419, 39439, 39443, 39451, 39461, 39499, 39503, 39509, 39511, 39521, 39541, 39551,
273 39563, 39569, 39581, 39607, 39619, 39623, 39631, 39659, 39667, 39671, 39679, 39703, 39709, 39719, 39727, 39733,
274 39749, 39761, 39769, 39779, 39791, 39799, 39821, 39827, 39829, 39839, 39841, 39847, 39857, 39863, 39869, 39877,
275 39883, 39887, 39901, 39929, 39937, 39953, 39971, 39979, 39983, 39989, 40009, 40013, 40031, 40037, 40039, 40063,
276 40087, 40093, 40099, 40111, 40123, 40127, 40129, 40151, 40153, 40163, 40169, 40177, 40189, 40193, 40213, 40231,
277 40237, 40241, 40253, 40277, 40283, 40289, 40343, 40351, 40357, 40361, 40387, 40423, 40427, 40429, 40433, 40459,
278 40471, 40483, 40487, 40493, 40499, 40507, 40519, 40529, 40531, 40543, 40559, 40577, 40583, 40591, 40597, 40609,
279 40627, 40637, 40639, 40693, 40697, 40699, 40709, 40739, 40751, 40759, 40763, 40771, 40787, 40801, 40813, 40819,
280 40823, 40829, 40841, 40847, 40849, 40853, 40867, 40879, 40883, 40897, 40903, 40927, 40933, 40939, 40949, 40961,
281 40973, 40993, 41011, 41017, 41023, 41039, 41047, 41051, 41057, 41077, 41081, 41113, 41117, 41131, 41141, 41143,
282 41149, 41161, 41177, 41179, 41183, 41189, 41201, 41203, 41213, 41221, 41227, 41231, 41233, 41243, 41257, 41263,
283 41269, 41281, 41299, 41333, 41341, 41351, 41357, 41381, 41387, 41389, 41399, 41411, 41413, 41443, 41453, 41467,
284 41479, 41491, 41507, 41513, 41519, 41521, 41539, 41543, 41549, 41579, 41593, 41597, 41603, 41609, 41611, 41617,
285 41621, 41627, 41641, 41647, 41651, 41659, 41669, 41681, 41687, 41719, 41729, 41737, 41759, 41761, 41771, 41777,
286 41801, 41809, 41813, 41843, 41849, 41851, 41863, 41879, 41887, 41893, 41897, 41903, 41911, 41927, 41941, 41947,
287 41953, 41957, 41959, 41969, 41981, 41983, 41999, 42013, 42017, 42019, 42023, 42043, 42061, 42071, 42073, 42083,
288 42089, 42101, 42131, 42139, 42157, 42169, 42179, 42181, 42187, 42193, 42197, 42209, 42221, 42223, 42227, 42239,
289 42257, 42281, 42283, 42293, 42299, 42307, 42323, 42331, 42337, 42349, 42359, 42373, 42379, 42391, 42397, 42403,
290 42407, 42409, 42433, 42437, 42443, 42451, 42457, 42461, 42463, 42467, 42473, 42487, 42491, 42499, 42509, 42533,
291 42557, 42569, 42571, 42577, 42589, 42611, 42641, 42643, 42649, 42667, 42677, 42683, 42689, 42697, 42701, 42703,
292 42709, 42719, 42727, 42737, 42743, 42751, 42767, 42773, 42787, 42793, 42797, 42821, 42829, 42839, 42841, 42853,
293 42859, 42863, 42899, 42901, 42923, 42929, 42937, 42943, 42953, 42961, 42967, 42979, 42989, 43003, 43013, 43019,
294 43037, 43049, 43051, 43063, 43067, 43093, 43103, 43117, 43133, 43151, 43159, 43177, 43189, 43201, 43207, 43223,
295 43237, 43261, 43271, 43283, 43291, 43313, 43319, 43321, 43331, 43391, 43397, 43399, 43403, 43411, 43427, 43441,
296 43451, 43457, 43481, 43487, 43499, 43517, 43541, 43543, 43573, 43577, 43579, 43591, 43597, 43607, 43609, 43613,
297 43627, 43633, 43649, 43651, 43661, 43669, 43691, 43711, 43717, 43721, 43753, 43759, 43777, 43781, 43783, 43787,
298 43789, 43793, 43801, 43853, 43867, 43889, 43891, 43913, 43933, 43943, 43951, 43961, 43963, 43969, 43973, 43987,
299 43991, 43997, 44017, 44021, 44027, 44029, 44041, 44053, 44059, 44071, 44087, 44089, 44101, 44111, 44119, 44123,
300 44129, 44131, 44159, 44171, 44179, 44189, 44201, 44203, 44207, 44221, 44249, 44257, 44263, 44267, 44269, 44273,
301 44279, 44281, 44293, 44351, 44357, 44371, 44381, 44383, 44389, 44417, 44449, 44453, 44483, 44491, 44497, 44501,
302 44507, 44519, 44531, 44533, 44537, 44543, 44549, 44563, 44579, 44587, 44617, 44621, 44623, 44633, 44641, 44647,
303 44651, 44657, 44683, 44687, 44699, 44701, 44711, 44729, 44741, 44753, 44771, 44773, 44777, 44789, 44797, 44809,
304 44819, 44839, 44843, 44851, 44867, 44879, 44887, 44893, 44909, 44917, 44927, 44939, 44953, 44959, 44963, 44971,
305 44983, 44987, 45007, 45013, 45053, 45061, 45077, 45083, 45119, 45121, 45127, 45131, 45137, 45139, 45161, 45179,
306 45181, 45191, 45197, 45233, 45247, 45259, 45263, 45281, 45289, 45293, 45307, 45317, 45319, 45329, 45337, 45341,
307 45343, 45361, 45377, 45389, 45403, 45413, 45427, 45433, 45439, 45481, 45491, 45497, 45503, 45523, 45533, 45541,
308 45553, 45557, 45569, 45587, 45589, 45599, 45613, 45631, 45641, 45659, 45667, 45673, 45677, 45691, 45697, 45707,
309 45737, 45751, 45757, 45763, 45767, 45779, 45817, 45821, 45823, 45827, 45833, 45841, 45853, 45863, 45869, 45887,
310 45893, 45943, 45949, 45953, 45959, 45971, 45979, 45989, 46021, 46027, 46049, 46051, 46061, 46073, 46091, 46093,
311 46099, 46103, 46133, 46141, 46147, 46153, 46171, 46181, 46183, 46187, 46199, 46219, 46229, 46237, 46261, 46271,
312 46273, 46279, 46301, 46307, 46309, 46327, 46337, 46349, 46351, 46381, 46399, 46411, 46439, 46441, 46447, 46451,
313 46457, 46471, 46477, 46489, 46499, 46507, 46511, 46523, 46549, 46559, 46567, 46573, 46589, 46591, 46601, 46619,
314 46633, 46639, 46643, 46649, 46663, 46679, 46681, 46687, 46691, 46703, 46723, 46727, 46747, 46751, 46757, 46769,
315 46771, 46807, 46811, 46817, 46819, 46829, 46831, 46853, 46861, 46867, 46877, 46889, 46901, 46919, 46933, 46957,
316 46993, 46997, 47017, 47041, 47051, 47057, 47059, 47087, 47093, 47111, 47119, 47123, 47129, 47137, 47143, 47147,
317 47149, 47161, 47189, 47207, 47221, 47237, 47251, 47269, 47279, 47287, 47293, 47297, 47303, 47309, 47317, 47339,
318 47351, 47353, 47363, 47381, 47387, 47389, 47407, 47417, 47419, 47431, 47441, 47459, 47491, 47497, 47501, 47507,
319 47513, 47521, 47527, 47533, 47543, 47563, 47569, 47581, 47591, 47599, 47609, 47623, 47629, 47639, 47653, 47657,
320 47659, 47681, 47699, 47701, 47711, 47713, 47717, 47737, 47741, 47743, 47777, 47779, 47791, 47797, 47807, 47809,
321 47819, 47837, 47843, 47857, 47869, 47881, 47903, 47911, 47917, 47933, 47939, 47947, 47951, 47963, 47969, 47977,
322 47981, 48017, 48023, 48029, 48049, 48073, 48079, 48091, 48109, 48119, 48121, 48131, 48157, 48163, 48179, 48187,
323 48193, 48197, 48221, 48239, 48247, 48259, 48271, 48281, 48299, 48311, 48313, 48337, 48341, 48353, 48371, 48383,
324 48397, 48407, 48409, 48413, 48437, 48449, 48463, 48473, 48479, 48481, 48487, 48491, 48497, 48523, 48527, 48533,
325 48539, 48541, 48563, 48571, 48589, 48593, 48611, 48619, 48623, 48647, 48649, 48661, 48673, 48677, 48679, 48731,
326 48733, 48751, 48757, 48761, 48767, 48779, 48781, 48787, 48799, 48809, 48817, 48821, 48823, 48847, 48857, 48859,
327 48869, 48871, 48883, 48889, 48907, 48947, 48953, 48973, 48989, 48991, 49003, 49009, 49019, 49031, 49033, 49037,
328 49043, 49057, 49069, 49081, 49103, 49109, 49117, 49121, 49123, 49139, 49157, 49169, 49171, 49177, 49193, 49199,
329 49201, 49207, 49211, 49223, 49253, 49261, 49277, 49279, 49297, 49307, 49331, 49333, 49339, 49363, 49367, 49369,
330 49391, 49393, 49409, 49411, 49417, 49429, 49433, 49451, 49459, 49463, 49477, 49481, 49499, 49523, 49529, 49531,
331 49537, 49547, 49549, 49559, 49597, 49603, 49613, 49627, 49633, 49639, 49663, 49667, 49669, 49681, 49697, 49711,
332 49727, 49739, 49741, 49747, 49757, 49783, 49787, 49789, 49801, 49807, 49811, 49823, 49831, 49843, 49853, 49871,
333 49877, 49891, 49919, 49921, 49927, 49937, 49939, 49943, 49957, 49991, 49993, 49999, 50021, 50023, 50033, 50047,
334 50051, 50053, 50069, 50077, 50087, 50093, 50101, 50111, 50119, 50123, 50129, 50131, 50147, 50153, 50159, 50177,
335 50207, 50221, 50227, 50231, 50261, 50263, 50273, 50287, 50291, 50311, 50321, 50329, 50333, 50341, 50359, 50363,
336 50377, 50383, 50387, 50411, 50417, 50423, 50441, 50459, 50461, 50497, 50503, 50513, 50527, 50539, 50543, 50549,
337 50551, 50581, 50587, 50591, 50593, 50599, 50627, 50647, 50651, 50671, 50683, 50707, 50723, 50741, 50753, 50767,
338 50773, 50777, 50789, 50821, 50833, 50839, 50849, 50857, 50867, 50873, 50891, 50893, 50909, 50923, 50929, 50951,
339 50957, 50969, 50971, 50989, 50993, 51001, 51031, 51043, 51047, 51059, 51061, 51071, 51109, 51131, 51133, 51137,
340 51151, 51157, 51169, 51193, 51197, 51199, 51203, 51217, 51229, 51239, 51241, 51257, 51263, 51283, 51287, 51307,
341 51329, 51341, 51343, 51347, 51349, 51361, 51383, 51407, 51413, 51419, 51421, 51427, 51431, 51437, 51439, 51449,
342 51461, 51473, 51479, 51481, 51487, 51503, 51511, 51517, 51521, 51539, 51551, 51563, 51577, 51581, 51593, 51599,
343 51607, 51613, 51631, 51637, 51647, 51659, 51673, 51679, 51683, 51691, 51713, 51719, 51721, 51749, 51767, 51769,
344 51787, 51797, 51803, 51817, 51827, 51829, 51839, 51853, 51859, 51869, 51871, 51893, 51899, 51907, 51913, 51929,
345 51941, 51949, 51971, 51973, 51977, 51991, 52009, 52021, 52027, 52051, 52057, 52067, 52069, 52081, 52103, 52121,
346 52127, 52147, 52153, 52163, 52177, 52181, 52183, 52189, 52201, 52223, 52237, 52249, 52253, 52259, 52267, 52289,
347 52291, 52301, 52313, 52321, 52361, 52363, 52369, 52379, 52387, 52391, 52433, 52453, 52457, 52489, 52501, 52511,
348 52517, 52529, 52541, 52543, 52553, 52561, 52567, 52571, 52579, 52583, 52609, 52627, 52631, 52639, 52667, 52673,
349 52691, 52697, 52709, 52711, 52721, 52727, 52733, 52747, 52757, 52769, 52783, 52807, 52813, 52817, 52837, 52859,
350 52861, 52879, 52883, 52889, 52901, 52903, 52919, 52937, 52951, 52957, 52963, 52967, 52973, 52981, 52999, 53003,
351 53017, 53047, 53051, 53069, 53077, 53087, 53089, 53093, 53101, 53113, 53117, 53129, 53147, 53149, 53161, 53171,
352 53173, 53189, 53197, 53201, 53231, 53233, 53239, 53267, 53269, 53279, 53281, 53299, 53309, 53323, 53327, 53353,
353 53359, 53377, 53381, 53401, 53407, 53411, 53419, 53437, 53441, 53453, 53479, 53503, 53507, 53527, 53549, 53551,
354 53569, 53591, 53593, 53597, 53609, 53611, 53617, 53623, 53629, 53633, 53639, 53653, 53657, 53681, 53693, 53699,
355 53717, 53719, 53731, 53759, 53773, 53777, 53783, 53791, 53813, 53819, 53831, 53849, 53857, 53861, 53881, 53887,
356 53891, 53897, 53899, 53917, 53923, 53927, 53939, 53951, 53959, 53987, 53993, 54001, 54011, 54013, 54037, 54049,
357 54059, 54083, 54091, 54101, 54121, 54133, 54139, 54151, 54163, 54167, 54181, 54193, 54217, 54251, 54269, 54277,
358 54287, 54293, 54311, 54319, 54323, 54331, 54347, 54361, 54367, 54371, 54377, 54401, 54403, 54409, 54413, 54419,
359 54421, 54437, 54443, 54449, 54469, 54493, 54497, 54499, 54503, 54517, 54521, 54539, 54541, 54547, 54559, 54563,
360 54577, 54581, 54583, 54601, 54617, 54623, 54629, 54631, 54647, 54667, 54673, 54679, 54709, 54713, 54721, 54727,
361 54751, 54767, 54773, 54779, 54787, 54799, 54829, 54833, 54851, 54869, 54877, 54881, 54907, 54917, 54919, 54941,
362 54949, 54959, 54973, 54979, 54983, 55001, 55009, 55021, 55049, 55051, 55057, 55061, 55073, 55079, 55103, 55109,
363 55117, 55127, 55147, 55163, 55171, 55201, 55207, 55213, 55217, 55219, 55229, 55243, 55249, 55259, 55291, 55313,
364 55331, 55333, 55337, 55339, 55343, 55351, 55373, 55381, 55399, 55411, 55439, 55441, 55457, 55469, 55487, 55501,
365 55511, 55529, 55541, 55547, 55579, 55589, 55603, 55609, 55619, 55621, 55631, 55633, 55639, 55661, 55663, 55667,
366 55673, 55681, 55691, 55697, 55711, 55717, 55721, 55733, 55763, 55787, 55793, 55799, 55807, 55813, 55817, 55819,
367 55823, 55829, 55837, 55843, 55849, 55871, 55889, 55897, 55901, 55903, 55921, 55927, 55931, 55933, 55949, 55967,
368 55987, 55997, 56003, 56009, 56039, 56041, 56053, 56081, 56087, 56093, 56099, 56101, 56113, 56123, 56131, 56149,
369 56167, 56171, 56179, 56197, 56207, 56209, 56237, 56239, 56249, 56263, 56267, 56269, 56299, 56311, 56333, 56359,
370 56369, 56377, 56383, 56393, 56401, 56417, 56431, 56437, 56443, 56453, 56467, 56473, 56477, 56479, 56489, 56501,
371 56503, 56509, 56519, 56527, 56531, 56533, 56543, 56569, 56591, 56597, 56599, 56611, 56629, 56633, 56659, 56663,
372 56671, 56681, 56687, 56701, 56711, 56713, 56731, 56737, 56747, 56767, 56773, 56779, 56783, 56807, 56809, 56813,
373 56821, 56827, 56843, 56857, 56873, 56891, 56893, 56897, 56909, 56911, 56921, 56923, 56929, 56941, 56951, 56957,
374 56963, 56983, 56989, 56993, 56999, 57037, 57041, 57047, 57059, 57073, 57077, 57089, 57097, 57107, 57119, 57131,
375 57139, 57143, 57149, 57163, 57173, 57179, 57191, 57193, 57203, 57221, 57223, 57241, 57251, 57259, 57269, 57271,
376 57283, 57287, 57301, 57329, 57331, 57347, 57349, 57367, 57373, 57383, 57389, 57397, 57413, 57427, 57457, 57467,
377 57487, 57493, 57503, 57527, 57529, 57557, 57559, 57571, 57587, 57593, 57601, 57637, 57641, 57649, 57653, 57667,
378 57679, 57689, 57697, 57709, 57713, 57719, 57727, 57731, 57737, 57751, 57773, 57781, 57787, 57791, 57793, 57803,
379 57809, 57829, 57839, 57847, 57853, 57859, 57881, 57899, 57901, 57917, 57923, 57943, 57947, 57973, 57977, 57991,
380 58013, 58027, 58031, 58043, 58049, 58057, 58061, 58067, 58073, 58099, 58109, 58111, 58129, 58147, 58151, 58153,
381 58169, 58171, 58189, 58193, 58199, 58207, 58211, 58217, 58229, 58231, 58237, 58243, 58271, 58309, 58313, 58321,
382 58337, 58363, 58367, 58369, 58379, 58391, 58393, 58403, 58411, 58417, 58427, 58439, 58441, 58451, 58453, 58477,
383 58481, 58511, 58537, 58543, 58549, 58567, 58573, 58579, 58601, 58603, 58613, 58631, 58657, 58661, 58679, 58687,
384 58693, 58699, 58711, 58727, 58733, 58741, 58757, 58763, 58771, 58787, 58789, 58831, 58889, 58897, 58901, 58907,
385 58909, 58913, 58921, 58937, 58943, 58963, 58967, 58979, 58991, 58997, 59009, 59011, 59021, 59023, 59029, 59051,
386 59053, 59063, 59069, 59077, 59083, 59093, 59107, 59113, 59119, 59123, 59141, 59149, 59159, 59167, 59183, 59197,
387 59207, 59209, 59219, 59221, 59233, 59239, 59243, 59263, 59273, 59281, 59333, 59341, 59351, 59357, 59359, 59369,
388 59377, 59387, 59393, 59399, 59407, 59417, 59419, 59441, 59443, 59447, 59453, 59467, 59471, 59473, 59497, 59509,
389 59513, 59539, 59557, 59561, 59567, 59581, 59611, 59617, 59621, 59627, 59629, 59651, 59659, 59663, 59669, 59671,
390 59693, 59699, 59707, 59723, 59729, 59743, 59747, 59753, 59771, 59779, 59791, 59797, 59809, 59833, 59863, 59879,
391 59887, 59921, 59929, 59951, 59957, 59971, 59981, 59999, 60013, 60017, 60029, 60037, 60041, 60077, 60083, 60089,
392 60091, 60101, 60103, 60107, 60127, 60133, 60139, 60149, 60161, 60167, 60169, 60209, 60217, 60223, 60251, 60257,
393 60259, 60271, 60289, 60293, 60317, 60331, 60337, 60343, 60353, 60373, 60383, 60397, 60413, 60427, 60443, 60449,
394 60457, 60493, 60497, 60509, 60521, 60527, 60539, 60589, 60601, 60607, 60611, 60617, 60623, 60631, 60637, 60647,
395 60649, 60659, 60661, 60679, 60689, 60703, 60719, 60727, 60733, 60737, 60757, 60761, 60763, 60773, 60779, 60793,
396 60811, 60821, 60859, 60869, 60887, 60889, 60899, 60901, 60913, 60917, 60919, 60923, 60937, 60943, 60953, 60961,
397 61001, 61007, 61027, 61031, 61043, 61051, 61057, 61091, 61099, 61121, 61129, 61141, 61151, 61153, 61169, 61211,
398 61223, 61231, 61253, 61261, 61283, 61291, 61297, 61331, 61333, 61339, 61343, 61357, 61363, 61379, 61381, 61403,
399 61409, 61417, 61441, 61463, 61469, 61471, 61483, 61487, 61493, 61507, 61511, 61519, 61543, 61547, 61553, 61559,
400 61561, 61583, 61603, 61609, 61613, 61627, 61631, 61637, 61643, 61651, 61657, 61667, 61673, 61681, 61687, 61703,
401 61717, 61723, 61729, 61751, 61757, 61781, 61813, 61819, 61837, 61843, 61861, 61871, 61879, 61909, 61927, 61933,
402 61949, 61961, 61967, 61979, 61981, 61987, 61991, 62003, 62011, 62017, 62039, 62047, 62053, 62057, 62071, 62081,
403 62099, 62119, 62129, 62131, 62137, 62141, 62143, 62171, 62189, 62191, 62201, 62207, 62213, 62219, 62233, 62273,
404 62297, 62299, 62303, 62311, 62323, 62327, 62347, 62351, 62383, 62401, 62417, 62423, 62459, 62467, 62473, 62477,
405 62483, 62497, 62501, 62507, 62533, 62539, 62549, 62563, 62581, 62591, 62597, 62603, 62617, 62627, 62633, 62639,
406 62653, 62659, 62683, 62687, 62701, 62723, 62731, 62743, 62753, 62761, 62773, 62791, 62801, 62819, 62827, 62851,
407 62861, 62869, 62873, 62897, 62903, 62921, 62927, 62929, 62939, 62969, 62971, 62981, 62983, 62987, 62989, 63029,
408 63031, 63059, 63067, 63073, 63079, 63097, 63103, 63113, 63127, 63131, 63149, 63179, 63197, 63199, 63211, 63241,
409 63247, 63277, 63281, 63299, 63311, 63313, 63317, 63331, 63337, 63347, 63353, 63361, 63367, 63377, 63389, 63391,
410 63397, 63409, 63419, 63421, 63439, 63443, 63463, 63467, 63473, 63487, 63493, 63499, 63521, 63527, 63533, 63541,
411 63559, 63577, 63587, 63589, 63599, 63601, 63607, 63611, 63617, 63629, 63647, 63649, 63659, 63667, 63671, 63689,
412 63691, 63697, 63703, 63709, 63719, 63727, 63737, 63743, 63761, 63773, 63781, 63793, 63799, 63803, 63809, 63823,
413 63839, 63841, 63853, 63857, 63863, 63901, 63907, 63913, 63929, 63949, 63977, 63997, 64007, 64013, 64019, 64033,
414 64037, 64063, 64067, 64081, 64091, 64109, 64123, 64151, 64153, 64157, 64171, 64187, 64189, 64217, 64223, 64231,
415 64237, 64271, 64279, 64283, 64301, 64303, 64319, 64327, 64333, 64373, 64381, 64399, 64403, 64433, 64439, 64451,
416 64453, 64483, 64489, 64499, 64513, 64553, 64567, 64577, 64579, 64591, 64601, 64609, 64613, 64621, 64627, 64633,
417 64661, 64663, 64667, 64679, 64693, 64709, 64717, 64747, 64763, 64781, 64783, 64793, 64811, 64817, 64849, 64853,
418 64871, 64877, 64879, 64891, 64901, 64919, 64921, 64927, 64937, 64951, 64969, 64997, 65003, 65011, 65027, 65029,
419 65033, 65053, 65063, 65071, 65089, 65099, 65101, 65111, 65119, 65123, 65129, 65141, 65147, 65167, 65171, 65173,
420 65179, 65183, 65203, 65213, 65239, 65257, 65267, 65269, 65287, 65293, 65309, 65323, 65327, 65353, 65357, 65371,
421 65381, 65393, 65407, 65413, 65419, 65423, 65437, 65447, 65449, 65479, 65497, 65519, 65521, 0};

Referenced by is_prime(), and random_prime().

◆ WORDS_448

size_t Botan::WORDS_448 = 7
constexpr

Definition at line 23 of file curve448_gf.h.

Referenced by Botan::Gf448Elem::bytes_are_canonical_representation(), Botan::Gf448Elem::ct_cond_assign(), Botan::Gf448Elem::ct_cond_swap(), Botan::Ed448Point::decode(), Botan::Gf448Elem::is_zero(), and Botan::Gf448Elem::operator==().

◆ X448_LEN

size_t Botan::X448_LEN = 56
constexpr

Definition at line 16 of file x448_internal.h.

Referenced by Botan::X448_PrivateKey::check_key(), decode_point(), decode_scalar(), Botan::X448_PrivateKey::X448_PrivateKey(), Botan::X448_PrivateKey::X448_PrivateKey(), and Botan::X448_PublicKey::X448_PublicKey().

Generated by doxygen 1.15.0