Botan Namespace Reference

Namespaces
namespace	AES_AARCH64
namespace	ARIA_F
namespace	ASN1
namespace	Camellia_F
namespace	Cert_Extension
namespace	CMCE_CT
namespace	concepts
namespace	CryptoBox
namespace	CRYSTALS
namespace	CT
namespace	detail
namespace	Dilithium_Algos
namespace	fmt_detail
namespace	FPE
namespace	HTTP
namespace	KeyPair
namespace	Kuznyechik_F
namespace	Kyber_Algos
namespace	OCSP
namespace	OIDS
namespace	OS
namespace	PCurve
namespace	PEM_Code
namespace	PK_Ops
namespace	PKCS11
namespace	PKCS8
namespace	PKIX
namespace	ranges
namespace	Roughtime
namespace	Serpent_F
namespace	SHA1_F
namespace	SHA1_SIMD_F
namespace	Sodium
namespace	Threefish_F
namespace	TLS
namespace	TPM2
namespace	X509

Classes
class	Adler32
class	AEAD_Mode
class	AES_128
class	AES_192
class	AES_256
class	AES_256_CTR_XOF
class	AffinePointTable
class	Algorithm_Not_Found
class	AlgorithmIdentifier
class	AlignmentBuffer
	Alignment buffer helper. More...
struct	all_same
class	Allocator_Initializer
class	AlternativeName
class	ANSI_X919_MAC
class	ANSI_X923_Padding
class	Argon2
class	Argon2_Family
class	ARIA_128
class	ARIA_192
class	ARIA_256
class	ASN1_Formatter
class	ASN1_Object
class	ASN1_Pretty_Printer
class	ASN1_String
class	ASN1_Time
class	Asymmetric_Key
class	Atomic
class	Attribute
class	AutoSeeded_RNG
class	Barrett_Reduction
class	Barrier
class	Base64_Decoder
class	Base64_Encoder
class	Bcrypt_PBKDF
class	Bcrypt_PBKDF_Family
class	BER_Bad_Tag
class	BER_Decoder
class	BER_Decoding_Error
class	BER_Object
class	BigInt
class	BitBucket
class	bitvector_base
class	BLAKE2b
class	BLAKE2bMAC
class	BLAKE2s
class	Blinder
class	Block_Cipher_Fixed_Params
class	BlockCipher
class	BlockCipherModePaddingMethod
class	Blowfish
class	Buffered_Computation
class	Buffered_Filter
class	BufferSlicer
class	BufferStuffer
	Helper class to ease in-place marshalling of concatenated fixed-length values. More...
class	Bzip2_Compression
class	Bzip2_Decompression
class	calendar_point
class	Camellia_128
class	Camellia_192
class	Camellia_256
class	Cascade_Cipher
class	CAST_128
class	CBC_Decryption
class	CBC_Encryption
class	CBC_Mode
class	CCM_Decryption
class	CCM_Encryption
class	CCM_Mode
class	Certificate_Extension
class	Certificate_Store
class	Certificate_Store_In_Memory
class	Certificate_Store_In_SQL
class	Certificate_Store_In_SQLite
class	Certificate_Store_MacOS
class	Certificate_Store_Windows
class	CFB_Decryption
class	CFB_Encryption
class	CFB_Mode
class	ChaCha
class	ChaCha20Poly1305_Decryption
class	ChaCha20Poly1305_Encryption
class	ChaCha20Poly1305_Mode
class	ChaCha_RNG
class	Chain
class	Cipher_Mode
class	Cipher_Mode_Filter
class	Classic_McEliece_Decryptor
class	Classic_McEliece_Encryptor
class	Classic_McEliece_Field_Ordering
	Represents a field ordering for the Classic McEliece cryptosystem. More...
class	Classic_McEliece_GF
	Represents an element of the finite field GF(q) for q = 2^m. More...
struct	Classic_McEliece_KeyPair_Internal
	Representation of a Classic McEliece key pair. More...
class	Classic_McEliece_Matrix
	Representation of the binary Classic McEliece matrix H, with H = (I_mt | T). More...
class	Classic_McEliece_Minimal_Polynomial
	Representation of a minimal polynomial in GF(q)[y]. More...
class	Classic_McEliece_Parameter_Set
class	Classic_McEliece_Parameters
class	Classic_McEliece_Polynomial
	Representation of a Classic McEliece polynomial. More...
class	Classic_McEliece_Polynomial_Ring
	Represents the polynomial ring GF(q)[y]/F(y) where F(y) is the modulus polynomial in GF(q)[y] of degree t. More...
class	Classic_McEliece_PrivateKey
class	Classic_McEliece_PrivateKeyInternal
	Representation of a Classic McEliece private key. More...
class	Classic_McEliece_PublicKey
class	Classic_McEliece_PublicKeyInternal
	Representation of a Classic McEliece public key. More...
class	CMAC
class	Comb4P
class	CommonCrypto_Error
struct	CommonCryptor_Opts
class	Compression_Algorithm
class	Compression_Alloc_Info
class	Compression_Error
class	Compression_Stream
class	CPUFeature
class	CPUID
class	CRC24
class	CRC32
class	Credentials_Manager
class	CRL_Entry
class	cSHAKE_128_XOF
class	cSHAKE_256_XOF
class	cSHAKE_XOF
class	CTR_BE
class	CTS_Decryption
class	CTS_Encryption
class	CurveGFp
class	DataSink
class	DataSink_Stream
class	DataSource
class	DataSource_Memory
class	DataSource_Stream
class	Decoding_Error
class	Decompression_Algorithm
class	Deflate_Compression
class	Deflate_Decompression
class	DER_Encoder
class	DES
class	DH_PrivateKey
class	DH_PublicKey
class	Dilithium_AES_Symmetric_Primitives
class	Dilithium_Expanded_Keypair_Codec
class	Dilithium_Keypair_Codec
class	Dilithium_PrivateKey
class	Dilithium_PrivateKeyInternal
class	Dilithium_PublicKey
class	Dilithium_PublicKeyInternal
class	Dilithium_Round3_Symmetric_Primitives
class	Dilithium_Symmetric_Primitives
class	Dilithium_Symmetric_Primitives_Base
class	DilithiumConstants
class	DilithiumMessageHash
class	DilithiumMode
class	DilithiumPolyTraits
class	DilithiumShakeXOF
class	DilithiumXOF
class	DL_Group
class	DL_PrivateKey
class	DL_PublicKey
class	DLIES_Decryptor
class	DLIES_Encryptor
class	donna128
class	DSA_PrivateKey
class	DSA_PublicKey
class	Dynamically_Loaded_Library
class	EAX_Decryption
class	EAX_Encryption
class	EAX_Mode
class	EC_AffinePoint
class	EC_AffinePoint_Data
class	EC_AffinePoint_Data_BN
class	EC_AffinePoint_Data_PC
class	EC_Group
class	EC_Group_Data
class	EC_Mul2Table_Data
class	EC_Mul2Table_Data_BN
class	EC_Mul2Table_Data_PC
class	EC_Point
class	EC_Point_Base_Point_Precompute
class	EC_Point_Multi_Point_Precompute
class	EC_Point_Var_Point_Precompute
class	EC_PrivateKey
class	EC_PrivateKey_Data
class	EC_PublicKey
class	EC_PublicKey_Data
class	EC_Scalar
class	EC_Scalar_Data
class	EC_Scalar_Data_BN
class	EC_Scalar_Data_PC
class	ECDH_PrivateKey
class	ECDH_PublicKey
class	ECDSA_PrivateKey
class	ECDSA_PublicKey
class	ECGDSA_PrivateKey
class	ECGDSA_PublicKey
class	ECIES_Decryptor
class	ECIES_Encryptor
class	ECIES_KA_Operation
class	ECIES_KA_Params
class	ECIES_System_Params
class	ECKCDSA_PrivateKey
class	ECKCDSA_PublicKey
class	Ed25519_PrivateKey
class	Ed25519_PublicKey
class	Ed448_PrivateKey
	A private key for Ed448/Ed448ph according to RFC 8032. More...
class	Ed448_PublicKey
	A public key for Ed448/Ed448ph according to RFC 8032. More...
class	Ed448Point
	Representation of a point on the Ed448 curve. More...
struct	eea_result
class	ElGamal_PrivateKey
class	ElGamal_PublicKey
class	EME
class	EME_PKCS1v15
class	EME_Raw
class	EMSA
class	EMSA_PKCS1v15
class	EMSA_PKCS1v15_Raw
class	EMSA_Raw
class	EMSA_X931
struct	EnableArithmeticWithPlainNumber
class	Encoding_Error
class	Encrypted_PSK_Database
class	Encrypted_PSK_Database_SQL
class	Entropy_Source
class	Entropy_Sources
class	ESDM_RNG
class	ESP_Padding
class	Exception
class	Expanded_Keypair_Codec
	Codec for expanded private keys (as specified in FIPS 203) More...
class	Extensions
class	Fanout_Filter
class	FE_25519
class	Filter
class	Flatfile_Certificate_Store
class	Fork
class	FPE_FE1
class	FrodoKEM_PrivateKey
class	FrodoKEM_PublicKey
class	FrodoKEMConstants
class	FrodoKEMMode
class	FrodoMatrix
class	GCM_Decryption
class	GCM_Encryption
class	GCM_Mode
struct	ge_p3
class	GeneralName
	X.509 GeneralName Type. More...
class	GeneralSubtree
	A single Name Constraint. More...
class	Getentropy
class	GF2m_Field
class	Gf448Elem
class	GF_Mask
	Constant time mask wrapper for GF(q) elements. More...
class	GHASH
class	GMAC
class	GOST_28147_89
class	GOST_28147_89_Params
class	GOST_3410_PrivateKey
class	GOST_3410_PublicKey
class	GOST_34_11
class	Gzip_Compression
class	Gzip_Decompression
class	Hardware_RNG
class	HashFunction
class	Hex_Decoder
class	Hex_Encoder
class	HKDF
class	HKDF_Expand
class	HKDF_Extract
class	HMAC
class	HMAC_DRBG
class	HOTP
class	HSS_LMS_Params
	The HSS-LMS parameters. More...
class	HSS_LMS_PrivateKey
	An HSS/LMS private key. More...
class	HSS_LMS_PrivateKeyInternal
	The internal HSS-LMS private key. More...
class	HSS_LMS_PublicKey
	An HSS/LMS public key. More...
class	HSS_LMS_PublicKeyInternal
	The internal HSS-LMS public key. More...
class	HSS_Signature
	A HSS-LMS signature. More...
class	Hybrid_PrivateKey
	Abstraction for a combined KEM private key. More...
class	Hybrid_PublicKey
	Abstraction for a combined KEM public key. More...
class	IDEA
class	Intel_Rdseed
class	Internal_Error
class	Invalid_Algorithm_Name
class	Invalid_Argument
class	Invalid_Authentication_Tag
class	Invalid_IV_Length
class	Invalid_Key_Length
class	Invalid_State
struct	is_bitvector
struct	is_bitvector< bitvector_base< T > >
struct	is_strong_span
struct	is_strong_span< StrongSpan< T > >
struct	is_strong_type
struct	is_strong_type< Strong< Ts... > >
class	ISO_9796_DS2
class	ISO_9796_DS3
class	Jitter_RNG
class	KDF
class	KDF1
class	KDF1_18033
class	KDF2
class	Keccak_1600
class	Keccak_Permutation
class	KEM_Decryption_with_Combiner
	Abstract interface for a KEM decryption operation for KEM combiners. More...
class	KEM_Encapsulation
class	KEM_Encryption_with_Combiner
	Abstract interface for a KEM encryption operation for KEM combiners. More...
class	KEX_to_KEM_Adapter_PrivateKey
class	KEX_to_KEM_Adapter_PublicKey
class	Key_Constraints
class	Key_Length_Specification
class	Key_Not_Set
class	Keyed_Filter
class	KMAC
class	KMAC128
class	KMAC256
class	Kuznyechik
class	Kyber_90s_Symmetric_Primitives
class	Kyber_KEM_Decryptor
class	Kyber_KEM_Decryptor_Base
class	Kyber_KEM_Encryptor
class	Kyber_KEM_Encryptor_Base
class	Kyber_KEM_Operation_Base
class	Kyber_Keypair_Codec
class	Kyber_Modern_Symmetric_Primitives
class	Kyber_PrivateKey
class	Kyber_PrivateKeyInternal
class	Kyber_PublicKey
class	Kyber_PublicKeyInternal
class	Kyber_Symmetric_Primitives
class	KyberConstants
class	KyberMode
class	KyberPolyTraits
struct	KyberPrivateKeySeed
class	Lion
class	LMOTS_Params
	The LM-OTS parameters. More...
class	LMOTS_Private_Key
	Representation of an LMOTS private key. More...
class	LMOTS_Public_Key
	Representation of an OTS public key. More...
class	LMOTS_Signature
	Representation of a LM-OTS signature. More...
class	LMS_Instance
	Base class for LMS private and public key. Contains public data associated with this LMS instance. More...
class	LMS_Params
	The LMS parameters. More...
class	LMS_PrivateKey
	Representation of an LMS Private key. More...
class	LMS_PublicKey
	The LMS public key. More...
class	LMS_Signature
	Container for LMS Signature data. More...
class	lock_guard
class	Lookup_Error
class	LZMA_Compression
class	LZMA_Decompression
class	McEliece_PrivateKey
class	McEliece_PublicKey
class	MD4
class	MD5
class	Memory_Pool
class	MerkleDamgard_Hash
class	MessageAuthenticationCode
class	ML_DSA_Expanding_Keypair_Codec
class	ML_DSA_MessageHash
class	ML_DSA_Symmetric_Primitives
class	ML_KEM_Decryptor
class	ML_KEM_Encryptor
class	ML_KEM_Symmetric_Primitives
class	mlock_allocator
class	Modular_Reducer
class	Montgomery_Int
class	Montgomery_Params
class	NameConstraints
	Name Constraints. More...
class	No_Filesystem_Access
class	Noekeon
class	noop_mutex
class	Not_Implemented
class	Null_Padding
class	Null_RNG
class	OAEP
class	OCB_Decryption
class	OCB_Encryption
class	OCB_Mode
class	OctetString
class	OFB
class	OID
class	OID_Map
class	OneAndZeros_Padding
class	OpenPGP_S2K
class	OTS_Instance
	Base class for LMOTS private and public key. Contains the parameters for the specific OTS instance. More...
class	Output_Buffers
struct	overloaded
class	Parallel
class	PasswordHash
class	PasswordHashFamily
class	Path_Validation_Restrictions
class	Path_Validation_Result
class	PBKDF
class	PBKDF2
class	PBKDF2_Family
class	Pipe
class	PK_Decryptor
class	PK_Decryptor_EME
class	PK_Encryptor
class	PK_Encryptor_EME
class	PK_KEM_Decryptor
class	PK_KEM_Encryptor
class	PK_Key_Agreement
class	PK_Key_Agreement_Key
class	PK_Signer
class	PK_Verifier
class	PKCS10_Request
class	PKCS5_PBKDF2
class	PKCS7_Padding
class	PKCS8_Exception
class	Poly1305
class	polyn_gf2m
class	Private_Key
class	PRNG_Unseeded
class	Processor_RNG
class	Provider_Not_Found
class	PseudorandomKeyGeneration
	Helper class used to derive secret values based in the pseudorandom key generation described in RFC 8554 Appendix A. More...
class	PSK_Database
class	PSS_Params
class	PSSR
class	PSSR_Raw
class	Public_Key
class	RandomNumberGenerator
class	RawHashFunction
class	RC4
class	RFC4880_S2K
class	RFC4880_S2K_Family
class	RFC6979_Nonce_Generator
class	RIPEMD_160
class	RSA_PrivateKey
class	RSA_PublicKey
class	RTSS_Share
class	RWLock
class	Salsa20
class	Scalar448
	Representation of a scalar for X448. More...
class	SCAN_Name
class	scoped_cleanup
	Helper class to create a RAII-style cleanup callback. More...
class	Scrypt
class	Scrypt_Family
class	secure_allocator
class	SecureQueue
class	SEED
class	Seed_Expanding_Keypair_Codec
	Codec for private keys as 64-byte seeds: d || z. More...
class	Semaphore
class	Serpent
class	SHA_1
class	SHA_224
class	SHA_256
class	SHA_3
class	SHA_384
class	SHA_3_224
class	SHA_3_256
class	SHA_3_384
class	SHA_3_512
class	SHA_512
class	SHA_512_256
class	SHACAL2
class	SHAKE_128
class	SHAKE_128_Cipher
class	SHAKE_128_XOF
class	SHAKE_256
class	SHAKE_256_Cipher
class	SHAKE_256_XOF
class	SHAKE_Cipher
class	SHAKE_XOF
class	SIMD_16x32
class	SIMD_2x64
class	SIMD_4x32
class	SIMD_4x64
class	SIMD_8x32
class	SIMD_8x64
class	SipHash
class	SIV_Decryption
class	SIV_Encryption
class	SIV_Mode
class	Skein_512
class	SM2_PrivateKey
class	SM2_PublicKey
class	SM3
class	SM4
class	SolinasAccum
class	SP800_108_Counter
class	SP800_108_Feedback
class	SP800_108_Pipeline
class	SP800_56A_One_Step_KMAC_Abstract
class	SP800_56C_One_Step_Hash
class	SP800_56C_One_Step_HMAC
class	SP800_56C_One_Step_KMAC128
class	SP800_56C_One_Step_KMAC256
class	SP800_56C_Two_Step
class	Sphincs_Address
class	Sphincs_Hash_Functions
class	Sphincs_Hash_Functions_Sha2
class	Sphincs_Hash_Functions_Shake
class	Sphincs_Parameters
struct	SphincsMessageInternal
	M' representation of FIPS 205 (the input to slh_sign_internal and slh_verify_internal) More...
class	SphincsPlus_PrivateKey
	An SLH-DSA private key. More...
class	SphincsPlus_PublicKey
	An SLH-DSA (or SPHINCS+ Round 3.1) public key. More...
class	SQL_Database
class	Sqlite3_Database
class	SRP6_Server_Session
class	Stateful_RNG
class	Stream_Compression
class	Stream_Decompression
class	Stream_IO_Error
class	StreamCipher
class	Streebog
class	StringLiteral
class	Strong
class	StrongSpan
class	SymmetricAlgorithm
class	System_Certificate_Store
class	System_Error
class	System_RNG
class	Thread_Pool
class	Threefish_512
class	TLS_12_PRF
class	TOTP
class	TPM_Context
class	TPM_Error
class	TPM_PrivateKey
class	TPM_RNG
class	TripleDES
class	Truncated_Hash
class	Tweakable_Block_Cipher
class	Twofish
class	Unknown_PK_Field_Name
class	URI
class	UUID
class	Whirlpool
class	Win32_EntropySource
class	word3
struct	WordInfo
struct	WordInfo< uint32_t >
struct	WordInfo< uint64_t >
class	X25519_PrivateKey
class	X25519_PublicKey
class	X448_PrivateKey
	A private key for the X448 key agreement scheme according to RFC 7748. More...
class	X448_PublicKey
	A public key for the X448 key agreement scheme according to RFC 7748. More...
class	X509_CA
class	X509_Cert_Options
class	X509_Certificate
class	X509_CRL
class	X509_DN
class	X509_Object
class	X942_PRF
class	XMSS_Address
class	XMSS_Common_Ops
class	XMSS_Hash
class	XMSS_Index_Registry
class	XMSS_Parameters
class	XMSS_PrivateKey
class	XMSS_PublicKey
class	XMSS_Signature
class	XMSS_Signature_Operation
class	XMSS_Tools
class	XMSS_Verification_Operation
class	XMSS_WOTS_Base
class	XMSS_WOTS_Parameters
class	XMSS_WOTS_PrivateKey
class	XMSS_WOTS_PublicKey
class	XOF
class	XTS_Decryption
class	XTS_Encryption
class	XTS_Mode
class	ZFEC
class	Zlib_Compression
class	Zlib_Decompression
class	Zlib_Style_Stream

Concepts
concept	md_hash_implementation
concept	WordType
concept	curve_supports_fe_invert2
concept	updatable_object
concept	appendable_object
concept	absorbing_object
concept	bitvectorish

Typedefs
typedef __vector unsigned int	Altivec32x4
typedef __vector unsigned long long	Altivec64x2
typedef __vector unsigned char	Altivec8x16
using	bitvector = bitvector_base<std::allocator>
template<size_t bound>
using	Bounded_XOF = detail::Bounded_XOF<XOF&, bound>
using	byte = std::uint8_t
typedef int32_t	CCCryptorStatus
typedef std::vector< std::set< Certificate_Status_Code > >	CertificatePathStatusCodes
using	CmceCodeWord = Strong<secure_bitvector, struct CmceCodeWord_>
	Represents C of decapsulation.
using	CmceColumnSelection = Strong<secure_bitvector, struct CmceColumnSelection_>
	Represents c of private key.
using	CmceErrorVector = Strong<secure_bitvector, struct CmceErrorVector_>
	Represents e of encapsulation.
using	CmceGfElem = Strong<uint16_t, struct CmceGfElem_>
	Represents a GF(q) element.
using	CmceGfMod = Strong<uint16_t, struct CmceGfMod_>
	Represents a GF(q) modulus.
using	CmceInitialSeed = Strong<secure_vector<uint8_t>, struct CmceInitialSeed_>
	Represents initial delta of keygen.
using	CmceIrreducibleBits = Strong<secure_vector<uint8_t>, struct CmceIrreducibleBits_>
using	CmceKeyGenSeed = Strong<secure_vector<uint8_t>, struct CmceKeyGenSeed_>
	Represents a delta (can be altered; final value stored in private key)
using	CmceOrderingBits = Strong<secure_vector<uint8_t>, struct CmceOrderingBits_>
using	CmcePermutation = Strong<secure_vector<uint16_t>, struct CmcePermutation_>
	Represents a permutation (pi in spec). Used in field ordering creation.
using	CmcePermutationElement = Strong<uint16_t, struct CmcePermutationElement_>
	Represents an element of a permuation (pi in spec). Used in field ordering creation.
using	CmceRejectionSeed = Strong<secure_vector<uint8_t>, struct CmceRejectionSeed_>
	Represents s of private key.
typedef X25519_PrivateKey	Curve25519_PrivateKey
typedef X25519_PublicKey	Curve25519_PublicKey
using	DilithiumCommitmentHash = Strong<std::vector<uint8_t>, struct DilithiumCommitmentHash_>
	Hash of the message representative and the signer's commitment.
using	DilithiumHashedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumHashedPublicKey_>
using	DilithiumInternalKeypair
	Internal representation of a Dilithium key pair.
using	DilithiumMessageRepresentative = Strong<std::vector<uint8_t>, struct DilithiumMessageRepresentative_>
	Representation of the message to be signed.
using	DilithiumOptionalRandomness = Strong<secure_vector<uint8_t>, struct DilithiumOptionalRandomness_>
	Optional randomness 'rnd' used for rho prime computation in ML-DSA.
using	DilithiumPoly = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>
using	DilithiumPolyMatNTT = Botan::CRYSTALS::PolynomialMatrix<DilithiumPolyTraits>
using	DilithiumPolyNTT = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>
using	DilithiumPolyVec = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>
using	DilithiumPolyVecNTT = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>
using	DilithiumSeedRandomness = Strong<secure_vector<uint8_t>, struct DilithiumSeedRandomness_>
	Principal seed used to generate Dilithium key pairs.
using	DilithiumSeedRho = Strong<std::vector<uint8_t>, struct DilithiumPublicSeed_>
	Public seed to sample the polynomial matrix A from.
using	DilithiumSeedRhoPrime = Strong<secure_vector<uint8_t>, struct DilithiumSeedRhoPrime_>
	Private seed to sample the polynomial vectors s1 and s2 from.
using	DilithiumSerializedCommitment = Strong<std::vector<uint8_t>, struct DilithiumSerializedCommitment_>
	Serialized representation of a commitment w1.
using	DilithiumSerializedPrivateKey = Strong<secure_vector<uint8_t>, struct DilithiumSerializedPrivateKey_>
	Serialized private key data.
using	DilithiumSerializedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumSerializedPublicKey_>
	Serialized public key data (result of pkEncode(pk))
using	DilithiumSerializedSignature = Strong<std::vector<uint8_t>, struct DilithiumSerializedSignature_>
	Serialized signature data.
using	DilithiumSigningSeedK = Strong<secure_vector<uint8_t>, struct DilithiumSeedK_>
	Private seed K used during signing.
using	ForsLeafSecret = Strong<secure_vector<uint8_t>, struct ForsLeafSecret_>
using	ForsSignature = Strong<std::vector<uint8_t>, struct ForsSignature_>
using	FrodoDomainSeparator = Strong<std::array<uint8_t, 1>, struct FrodoDoaminSeparator_>
using	FrodoIntermediateSharedSecret = Strong<secure_vector<uint8_t>, struct FrodoIntermediateSharedSecret_>
using	FrodoPackedMatrix = Strong<std::vector<uint8_t>, struct FrodoPackedMatrix_>
using	FrodoPlaintext = Strong<secure_vector<uint8_t>, struct FrodoPlaintext_>
using	FrodoPublicKeyHash = Strong<std::vector<uint8_t>, struct FrodoPublicKeyHash_>
using	FrodoSalt = Strong<std::vector<uint8_t>, struct FrodoSalt_>
using	FrodoSampleR = Strong<secure_vector<uint8_t>, struct FrodoSampleR_>
using	FrodoSeedA = Strong<std::vector<uint8_t>, struct FrodoSeedA_>
using	FrodoSeedS = Strong<secure_vector<uint8_t>, struct FrodoSeedS_>
using	FrodoSeedSE = Strong<secure_vector<uint8_t>, struct FrodoSeedSE_>
using	FrodoSeedZ = Strong<std::vector<uint8_t>, struct FrodoSeedZ_>
using	FrodoSerializedMatrix = Strong<secure_vector<uint8_t>, struct FrodoSerializedMatrix_>
using	GenerateLeafFunction = std::function<void(StrongSpan<SphincsTreeNode> , TreeNodeIndex)>
typedef uint16_t	gf2m
using	HSS_Level = Strong<uint32_t, struct HSS_Level_, EnableArithmeticWithPlainNumber>
	The HSS layer in the HSS multi tree starting at 0 from the root.
using	HSS_Sig_Idx = Strong<uint64_t, struct HSS_Sig_Idx_, EnableArithmeticWithPlainNumber>
	The index of a node within a specific LMS tree layer.
using	HypertreeLayerIndex = Strong<uint32_t, struct HypertreeLayerIndex_>
	Index of a layer in the XMSS hyper-tree.
using	InitializationVector = OctetString
typedef Invalid_Authentication_Tag	Integrity_Failure
using	KyberCompressedCiphertext = Strong<std::vector<uint8_t>, struct KyberCompressedCiphertext_>
	Compressed and serialized ciphertext value.
using	KyberEncryptionRandomness = Strong<secure_vector<uint8_t>, struct KyberEncryptionRandomness_>
	Random value used to generate the Kyber ciphertext.
using	KyberHashedCiphertext = Strong<std::vector<uint8_t>, struct KyberHashedCiphertext_>
using	KyberHashedPublicKey = Strong<std::vector<uint8_t>, struct KyberHashedPublicKey_>
	Hash value of the serialized public key.
using	KyberImplicitRejectionValue = Strong<secure_vector<uint8_t>, struct KyberImplicitRejectionValue_>
	Secret random value (called Z in the spec), used for implicit rejection in the decapsulation.
using	KyberInternalKeypair
using	KyberMessage = Strong<secure_vector<uint8_t>, struct KyberMessage_>
	Random message value to be encrypted by the CPA-secure Kyber encryption scheme.
using	KyberPoly = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>
using	KyberPolyMat = Botan::CRYSTALS::PolynomialMatrix<KyberPolyTraits>
using	KyberPolyNTT = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>
using	KyberPolyVec = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>
using	KyberPolyVecNTT = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>
using	KyberSamplingRandomness = Strong<secure_vector<uint8_t>, struct KyberSamplingRandomness_>
	PRF value used for sampling of error polynomials.
using	KyberSeedRandomness = Strong<secure_vector<uint8_t>, struct KyberSeedRandomness_>
	Principal seed used to generate Kyber key pairs.
using	KyberSeedRho = Strong<std::vector<uint8_t>, struct KyberSeedRho_>
	Public seed value to generate the Kyber matrix A.
using	KyberSeedSigma = Strong<secure_vector<uint8_t>, struct KyberSeedSigma_>
	Private seed used to generate polynomial vectors s and e during key generation.
using	KyberSerializedPublicKey = Strong<std::vector<uint8_t>, struct KyberSerializedPublicKey_>
	Public key in serialized form (t || rho)
using	KyberSharedSecret = Strong<secure_vector<uint8_t>, struct KyberSharedSecret_>
	Shared secret value generated during encapsulation and recovered during decapsulation.
using	KyberSigmaOrEncryptionRandomness
	Variant value of either a KyberSeedSigma or a KyberEncryptionRandomness.
using	LMOTS_K = Strong<std::vector<uint8_t>, struct LMOTS_K_>
	The K value from the LM-OTS public key.
using	LMOTS_Node = Strong<secure_vector<uint8_t>, struct LMOTS_Node_>
	One node within one LM-OTS hash chain.
using	LMOTS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMOTS_Signature_Bytes_>
	Byte vector of an LM-OTS signature.
using	LMS_AuthenticationPath = Strong<std::vector<uint8_t>, struct LMS_AuthenticationPath_>
	The authentication path of an LMS signature.
using	LMS_Identifier = Strong<std::vector<uint8_t>, struct LMS_Identifier_>
	The identifier of an LMS tree (I in RFC 8554)
using	LMS_Message = Strong<std::vector<uint8_t>, struct LMS_Message_>
	A message that is signed with an LMS tree.
using	LMS_Seed = Strong<secure_vector<uint8_t>, struct LMS_SEED_>
	Seed of the LMS tree, used to generate the LM-OTS private keys.
using	LMS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMS_Signature_Bytes_>
	Raw bytes of an LMS signature.
using	LMS_Tree_Node = Strong<std::vector<uint8_t>, struct LMS_Tree_Node_>
	A node with the LMS tree.
using	LMS_Tree_Node_Idx = Strong<uint32_t, struct LMS_Tree_Node_Idx_, EnableArithmeticWithPlainNumber>
	The index of a node within a specific LMS tree layer.
template<typename T>
using	lock_guard_type = lock_guard<T>
typedef MessageAuthenticationCode	MAC
using	ML_DSA_Mode = DilithiumMode
using	ML_DSA_PrivateKey = Dilithium_PrivateKey
using	ML_DSA_PublicKey = Dilithium_PublicKey
using	ML_KEM_Mode = KyberMode
using	ML_KEM_PrivateKey = Kyber_PrivateKey
using	ML_KEM_PublicKey = Kyber_PublicKey
using	mutex_type = noop_mutex
template<std::signed_integral T>
using	next_longer_int_t
template<std::unsigned_integral T>
using	next_longer_uint_t
using	Point448 = Strong<std::array<uint8_t, X448_LEN>, struct Point448_>
typedef EC_Point	PointGFp
using	recursive_mutex_type = noop_mutex
typedef RandomNumberGenerator	RNG
typedef PBKDF	S2K
using	s32bit = std::int32_t
using	ScalarX448 = Strong<std::array<uint8_t, X448_LEN>, struct ScalarX448_>
using	secure_bitvector = bitvector_base<secure_allocator>
template<typename T>
using	secure_deque = std::deque<T, secure_allocator<T>>
template<typename T>
using	secure_vector = std::vector<T, secure_allocator<T>>
template<typename T>
using	SecureVector = secure_vector<T>
typedef SM2_PrivateKey	SM2_Encryption_PrivateKey
typedef SM2_PublicKey	SM2_Encryption_PublicKey
typedef SM2_PrivateKey	SM2_Signature_PrivateKey
typedef SM2_PublicKey	SM2_Signature_PublicKey
using	SphincsAuthenticationPath = Strong<std::vector<uint8_t>, struct SphincsAuthenticationPath_>
using	SphincsContext = Strong<std::vector<uint8_t>, struct SphincsContext_>
using	SphincsHashedMessage = Strong<std::vector<uint8_t>, struct SphincsHashedMessage_>
using	SphincsHypertreeSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>
using	SphincsInputMessage = Strong<std::vector<uint8_t>, struct SphincsInputMessage_>
using	SphincsMessagePrefix = Strong<std::vector<uint8_t>, struct SphincsMessagePrefix_>
using	SphincsMessageRandomness = Strong<secure_vector<uint8_t>, struct SphincsMessageRandomness_>
using	SphincsOptionalRandomness = Strong<secure_vector<uint8_t>, struct SphincsOptionalRandomness_>
using	SphincsPublicSeed = Strong<std::vector<uint8_t>, struct SphincsPublicSeed_>
using	SphincsSecretPRF = Strong<secure_vector<uint8_t>, struct SphincsSecretPRF_>
using	SphincsSecretSeed = Strong<secure_vector<uint8_t>, struct SphincsSecretSeed_>
using	SphincsTreeNode = Strong<std::vector<uint8_t>, struct SphincsTreeNode_>
	Either an XMSS or FORS tree node or leaf.
using	SphincsXmssSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>
template<typename T>
using	strong_type_wrapped_type = typename detail::wrapped_type_helper<std::remove_cvref_t<T>>::type
	Extracts the wrapped type from a strong type.
using	SymmetricKey = OctetString
using	TreeLayerIndex = Strong<uint32_t, struct TreeLayerIndex_, EnableArithmeticWithPlainNumber>
	Index of the layer within a FORS/XMSS tree.
using	TreeNodeIndex = Strong<uint32_t, struct TreeNodeIndex_, EnableArithmeticWithPlainNumber>
	Index of an individual node inside an XMSS or FORS tree.
using	u16bit = std::uint16_t
using	u32bit = std::uint32_t
using	u64bit = std::uint64_t
using	word = std::conditional_t<HasNative64BitRegisters, std::uint64_t, uint32_t>
typedef std::vector< secure_vector< uint8_t > >	wots_keysig_t
using	WotsChainIndex = Strong<uint32_t, struct WotsChainIndex_>
	Index of a WOTS chain within a single usage of WOTS.
using	WotsHashIndex = Strong<uint8_t, struct WotsHashIndex_, EnableArithmeticWithPlainNumber>
	Index of a hash application inside a single WOTS chain (integers in "base_w")
using	WotsNode = Strong<secure_vector<uint8_t>, struct WotsNode_>
	Start (or intermediate) node of a WOTS+ chain.
using	WotsPublicKey = Strong<std::vector<uint8_t>, struct WotsPublicKey_>
using	WotsPublicKeyNode = Strong<std::vector<uint8_t>, struct WotsPublicKeyNode_>
	End node of a WOTS+ chain (part of the WOTS+ public key)
using	WotsSignature = Strong<secure_vector<uint8_t>, struct WotsSignature_>
typedef ASN1_Time	X509_Time
using	XmssTreeIndexInLayer = Strong<uint64_t, struct XmssTreeIndexInLayer_, EnableArithmeticWithPlainNumber>
	Index of an XMSS tree (unique for just the local hyper-tree layer)

Enumerations
enum class	AlignmentBufferFinalBlock : size_t { is_not_special = 0 , must_be_deferred = 1 }
enum class	ASN1_Class : uint32_t {   Universal = 0b0000'0000 , Application = 0b0100'0000 , ContextSpecific = 0b1000'0000 , Private = 0b1100'0000 ,   Constructed = 0b0010'0000 , ExplicitContextSpecific = Constructed | ContextSpecific , NoObject = 0xFF00 }
enum class	ASN1_Type : uint32_t {   Eoc = 0x00 , Boolean = 0x01 , Integer = 0x02 , BitString = 0x03 ,   OctetString = 0x04 , Null = 0x05 , ObjectId = 0x06 , Enumerated = 0x0A ,   Sequence = 0x10 , Set = 0x11 , Utf8String = 0x0C , NumericString = 0x12 ,   PrintableString = 0x13 , TeletexString = 0x14 , Ia5String = 0x16 , VisibleString = 0x1A ,   UniversalString = 0x1C , BmpString = 0x1E , UtcTime = 0x17 , GeneralizedTime = 0x18 ,   NoObject = 0xFF00 }
enum class	Certificate_Status_Code {   OK = 0 , VERIFIED = 0 , OCSP_RESPONSE_GOOD = 1 , OCSP_SIGNATURE_OK = 2 ,   VALID_CRL_CHECKED = 3 , OCSP_NO_HTTP = 4 , FIRST_WARNING_STATUS = 500 , CERT_SERIAL_NEGATIVE = 500 ,   DN_TOO_LONG = 501 , OCSP_NO_REVOCATION_URL = 502 , OCSP_SERVER_NOT_AVAILABLE = 503 , TRUSTED_CERT_HAS_EXPIRED = 504 ,   TRUSTED_CERT_NOT_YET_VALID = 505 , FIRST_ERROR_STATUS = 1000 , SIGNATURE_METHOD_TOO_WEAK = 1000 , UNTRUSTED_HASH = 1001 ,   NO_REVOCATION_DATA = 1002 , NO_MATCHING_CRLDP = 1003 , OCSP_ISSUER_NOT_TRUSTED = 1004 , CERT_NOT_YET_VALID = 2000 ,   CERT_HAS_EXPIRED = 2001 , OCSP_NOT_YET_VALID = 2002 , OCSP_HAS_EXPIRED = 2003 , CRL_NOT_YET_VALID = 2004 ,   CRL_HAS_EXPIRED = 2005 , OCSP_IS_TOO_OLD = 2006 , CERT_ISSUER_NOT_FOUND = 3000 , CANNOT_ESTABLISH_TRUST = 3001 ,   CERT_CHAIN_LOOP = 3002 , CHAIN_LACKS_TRUST_ROOT = 3003 , CHAIN_NAME_MISMATCH = 3004 , POLICY_ERROR = 4000 ,   INVALID_USAGE = 4001 , CERT_CHAIN_TOO_LONG = 4002 , CA_CERT_NOT_FOR_CERT_ISSUER = 4003 , NAME_CONSTRAINT_ERROR = 4004 ,   CA_CERT_NOT_FOR_CRL_ISSUER = 4005 , OCSP_CERT_NOT_LISTED = 4006 , OCSP_BAD_STATUS = 4007 , CERT_NAME_NOMATCH = 4008 ,   UNKNOWN_CRITICAL_EXTENSION = 4009 , DUPLICATE_CERT_EXTENSION = 4010 , OCSP_SIGNATURE_ERROR = 4501 , OCSP_ISSUER_NOT_FOUND = 4502 ,   OCSP_RESPONSE_MISSING_KEYUSAGE = 4503 , OCSP_RESPONSE_INVALID = 4504 , EXT_IN_V1_V2_CERT = 4505 , DUPLICATE_CERT_POLICY = 4506 ,   V2_IDENTIFIERS_IN_V1_CERT = 4507 , CERT_IS_REVOKED = 5000 , CRL_BAD_SIGNATURE = 5001 , SIGNATURE_ERROR = 5002 ,   CERT_PUBKEY_INVALID = 5003 , SIGNATURE_ALGO_UNKNOWN = 5004 , SIGNATURE_ALGO_BAD_PARAMS = 5005 }
enum class	Cipher_Dir : int { Encryption , Decryption , ENCRYPTION = Encryption , DECRYPTION = Decryption }
enum class	CRL_Code : uint32_t {   Unspecified = 0 , KeyCompromise = 1 , CaCompromise = 2 , AffiliationChanged = 3 ,   Superseded = 4 , CessationOfOperation = 5 , CertificateHold = 6 , RemoveFromCrl = 8 ,   PrivilegeWithdrawn = 9 , AaCompromise = 10 }
enum	Decoder_Checking { NONE , IGNORE_WS , FULL_CHECK }
enum class	DL_Group_Format {   ANSI_X9_42 , ANSI_X9_57 , PKCS_3 , DSA_PARAMETERS = ANSI_X9_57 ,   DH_PARAMETERS = ANSI_X9_42 , ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42 , PKCS3_DH_PARAMETERS = PKCS_3 }
enum class	DL_Group_Source { Builtin , RandomlyGenerated , ExternalSource }
enum class	EC_Group_Encoding {   Explicit , ImplicitCA , NamedCurve , EC_DOMPAR_ENC_EXPLICIT = Explicit ,   EC_DOMPAR_ENC_IMPLICITCA = ImplicitCA , EC_DOMPAR_ENC_OID = NamedCurve }
enum class	EC_Group_Engine { Optimized , Generic , Legacy }
enum class	EC_Group_Source { Builtin , ExternalSource }
enum class	EC_Point_Format {   Uncompressed = 0 , Compressed = 1 , UNCOMPRESSED = Uncompressed , COMPRESSED = Compressed ,   Hybrid = 2 , HYBRID = 2 }
enum class	ECIES_Flags : uint32_t {   None = 0 , SingleHashMode = 1 , CofactorMode = 2 , OldCofactorMode = 4 ,   CheckMode = 8 , NONE = None , SINGLE_HASH_MODE = SingleHashMode , COFACTOR_MODE = CofactorMode ,   OLD_COFACTOR_MODE = OldCofactorMode , CHECK_MODE = CheckMode }
enum class	ErrorType {   Unknown = 1 , SystemError , NotImplemented , OutOfMemory ,   InternalError , IoError , InvalidObjectState = 100 , KeyNotSet ,   InvalidArgument , InvalidKeyLength , InvalidNonceLength , LookupError ,   EncodingFailure , DecodingFailure , TLSError , HttpError ,   InvalidTag , RoughtimeError , CommonCryptoError = 201 , Pkcs11Error ,   TPMError , DatabaseError , ZlibError = 300 , Bzip2Error ,   LzmaError }
enum class	LMOTS_Algorithm_Type : uint32_t {   RESERVED = 0x00 , SHA256_N32_W1 = 0x01 , SHA256_N32_W2 = 0x02 , SHA256_N32_W4 = 0x03 ,   SHA256_N32_W8 = 0x04 , SHA256_N24_W1 = 0x05 , SHA256_N24_W2 = 0x06 , SHA256_N24_W4 = 0x07 ,   SHA256_N24_W8 = 0x08 , SHAKE_N32_W1 = 0x09 , SHAKE_N32_W2 = 0x0a , SHAKE_N32_W4 = 0x0b ,   SHAKE_N32_W8 = 0x0c , SHAKE_N24_W1 = 0x0d , SHAKE_N24_W2 = 0x0e , SHAKE_N24_W4 = 0x0f ,   SHAKE_N24_W8 = 0x10 }
	Enum of available LM-OTS algorithm types. More...
enum class	LMS_Algorithm_Type : uint32_t {   RESERVED = 0x00 , SHA256_M32_H5 = 0x05 , SHA256_M32_H10 = 0x06 , SHA256_M32_H15 = 0x07 ,   SHA256_M32_H20 = 0x08 , SHA256_M32_H25 = 0x09 , SHA256_M24_H5 = 0x0a , SHA256_M24_H10 = 0x0b ,   SHA256_M24_H15 = 0x0c , SHA256_M24_H20 = 0x0d , SHA256_M24_H25 = 0x0e , SHAKE_M32_H5 = 0x0f ,   SHAKE_M32_H10 = 0x10 , SHAKE_M32_H15 = 0x11 , SHAKE_M32_H20 = 0x12 , SHAKE_M32_H25 = 0x13 ,   SHAKE_M24_H5 = 0x14 , SHAKE_M24_H10 = 0x15 , SHAKE_M24_H15 = 0x16 , SHAKE_M24_H20 = 0x17 ,   SHAKE_M24_H25 = 0x18 }
	Enum of available LMS algorithm types. More...
enum class	MD_Endian { Little , Big }
enum class	MlPrivateKeyFormat { Seed , Expanded }
	Byte encoding format of ML-KEM and ML-DSA the private key. More...
enum class	PublicKeyOperation { Encryption , Signature , KeyEncapsulation , KeyAgreement }
enum class	Signature_Format { Standard , DerSequence , IEEE_1363 = Standard , DER_SEQUENCE = DerSequence }
enum class	Sphincs_Address_Type : uint32_t {   WotsHash = 0 , WotsPublicKeyCompression = 1 , HashTree = 2 , ForsTree = 3 ,   ForsTreeRootsCompression = 4 , WotsKeyGeneration = 5 , ForsKeyGeneration = 6 }
enum class	Sphincs_Hash_Type { Shake256 , Sha256 , Haraka }
enum class	Sphincs_Parameter_Set {   Sphincs128Small , Sphincs128Fast , Sphincs192Small , Sphincs192Fast ,   Sphincs256Small , Sphincs256Fast , SLHDSA128Small , SLHDSA128Fast ,   SLHDSA192Small , SLHDSA192Fast , SLHDSA256Small , SLHDSA256Fast }
enum class	TPM_Storage_Type { User , System }
enum class	Usage_Type {   UNSPECIFIED , TLS_SERVER_AUTH , TLS_CLIENT_AUTH , CERTIFICATE_AUTHORITY ,   OCSP_RESPONDER , ENCRYPTION }
enum class	WOTS_Derivation_Method { Botan2x = 1 , NIST_SP800_208 = 2 }

Functions
BigInt	abs (const BigInt &n)
BOTAN_MALLOC_FN void *	allocate_memory (size_t elems, size_t elem_size)
void	argon2 (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, const uint8_t key[], size_t key_len, const uint8_t ad[], size_t ad_len, uint8_t y, size_t p, size_t M, size_t t)
bool	argon2_check_pwhash (const char *password, size_t password_len, std::string_view input_hash)
std::string	argon2_generate_pwhash (const char *password, size_t password_len, RandomNumberGenerator &rng, size_t p, size_t M, size_t t, uint8_t y, size_t salt_len, size_t output_len)
std::string	asn1_class_to_string (ASN1_Class type)
std::string	asn1_tag_to_string (ASN1_Type type)
template<typename T>
T	assert_is_some (std::optional< T > v, const char *expr, const char *func, const char *file, int line)
void	assert_unreachable (const char *file, int line)
void	assertion_failure (const char *expr_str, const char *assertion_made, const char *func, const char *file, int line)
secure_vector< uint8_t >	base32_decode (const char input[], size_t input_length, bool ignore_ws)
secure_vector< uint8_t >	base32_decode (std::string_view input, bool ignore_ws)
size_t	base32_decode (uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
size_t	base32_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t	base32_decode (uint8_t output[], std::string_view input, bool ignore_ws)
size_t	base32_decode_max_output (size_t input_length)
size_t	base32_encode (char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
std::string	base32_encode (const uint8_t input[], size_t input_length)
std::string	base32_encode (std::span< const uint8_t > input)
size_t	base32_encode_max_output (size_t input_length)
std::vector< uint8_t >	base58_check_decode (const char input[], size_t input_length)
std::vector< uint8_t >	base58_check_decode (std::string_view s)
std::string	base58_check_encode (const uint8_t input[], size_t input_length)
std::string	base58_check_encode (std::span< const uint8_t > vec)
std::vector< uint8_t >	base58_decode (const char input[], size_t input_length)
std::vector< uint8_t >	base58_decode (std::string_view s)
std::string	base58_encode (const uint8_t input[], size_t input_length)
std::string	base58_encode (std::span< const uint8_t > vec)
secure_vector< uint8_t >	base64_decode (const char input[], size_t input_length, bool ignore_ws)
size_t	base64_decode (std::span< uint8_t > output, std::string_view input, bool ignore_ws)
secure_vector< uint8_t >	base64_decode (std::string_view input, bool ignore_ws)
size_t	base64_decode (uint8_t out[], const char in[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws)
size_t	base64_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t	base64_decode (uint8_t output[], std::string_view input, bool ignore_ws)
size_t	base64_decode_max_output (size_t input_length)
size_t	base64_encode (char out[], const uint8_t in[], size_t input_length, size_t &input_consumed, bool final_inputs)
std::string	base64_encode (const uint8_t input[], size_t input_length)
std::string	base64_encode (std::span< const uint8_t > input)
size_t	base64_encode_max_output (size_t input_length)
template<typename Base>
size_t	base_decode (Base &&base, uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool final_inputs, bool ignore_ws=true)
template<typename Base>
size_t	base_decode_full (Base &&base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
template<typename Vector, typename Base>
Vector	base_decode_to_vec (Base &&base, const char input[], size_t input_length, bool ignore_ws)
template<class Base>
size_t	base_encode (Base &&base, char output[], const uint8_t input[], size_t input_length, size_t &input_consumed, bool final_inputs)
template<typename Base>
std::string	base_encode_to_string (Base &&base, const uint8_t input[], size_t input_length)
BOTAN_FUZZER_API void	basecase_mul (word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size)
BOTAN_FUZZER_API void	basecase_sqr (word z[], size_t z_size, const word x[], size_t x_size)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint	basemul_exec (std::span< const typename C::AffinePoint > table, const BlindedScalar &scalar, RandomNumberGenerator &rng)
template<typename C, size_t WindowBits>
std::vector< typename C::AffinePoint >	basemul_setup (const typename C::AffinePoint &p, size_t max_scalar_bits)
void	bcrypt_pbkdf (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t rounds)
template<WordType W>
constexpr void	bigint_add2 (W x[], size_t x_size, const W y[], size_t y_size)
template<WordType W>
constexpr auto	bigint_add2_nc (W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr void	bigint_add3 (W z[], const W x[], size_t x_size, const W y[], size_t y_size)
template<WordType W>
constexpr auto	bigint_add3_nc (W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr int32_t	bigint_cmp (const W x[], size_t x_size, const W y[], size_t y_size)
template<WordType W>
constexpr void	bigint_cnd_abs (W cnd, W x[], size_t size)
template<WordType W>
constexpr W	bigint_cnd_add (W cnd, W x[], const W y[], size_t size)
template<WordType W>
constexpr W	bigint_cnd_add (W cnd, W x[], size_t x_size, const W y[], size_t y_size)
template<WordType W>
constexpr void	bigint_cnd_add_or_sub (CT::Mask< W > mask, W x[], const W y[], size_t size)
template<WordType W>
constexpr auto	bigint_cnd_addsub (CT::Mask< W > mask, W x[], const W y[], const W z[], size_t size) -> W
template<WordType W>
constexpr auto	bigint_cnd_sub (W cnd, W x[], const W y[], size_t size) -> W
template<WordType W>
constexpr auto	bigint_cnd_sub (W cnd, W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr void	bigint_cnd_swap (W cnd, W x[], W y[], size_t size)
void	bigint_comba_mul16 (word z[32], const word x[16], const word y[16])
void	bigint_comba_mul24 (word z[48], const word x[24], const word y[24])
void	bigint_comba_mul4 (word z[8], const word x[4], const word y[4])
void	bigint_comba_mul6 (word z[12], const word x[6], const word y[6])
void	bigint_comba_mul7 (word z[14], const word x[7], const word y[7])
void	bigint_comba_mul8 (word z[16], const word x[8], const word y[8])
void	bigint_comba_mul9 (word z[18], const word x[9], const word y[9])
void	bigint_comba_sqr16 (word z[32], const word x[16])
void	bigint_comba_sqr24 (word z[48], const word x[24])
void	bigint_comba_sqr4 (word z[8], const word x[4])
void	bigint_comba_sqr6 (word z[12], const word x[6])
void	bigint_comba_sqr7 (word z[14], const word x[7])
void	bigint_comba_sqr8 (word z[16], const word x[8])
void	bigint_comba_sqr9 (word z[18], const word x[9])
template<size_t N, WordType W>
constexpr void	bigint_correct_redc (std::array< W, N > &r, const std::array< W, N > &P, const std::array< W, N > &C)
template<WordType W>
constexpr auto	bigint_ct_is_eq (const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask< W >
template<WordType W>
constexpr auto	bigint_ct_is_lt (const W x[], size_t x_size, const W y[], size_t y_size, bool lt_or_equal=false) -> CT::Mask< W >
template<WordType W>
constexpr auto	bigint_divop_vartime (W n1, W n0, W d) -> W
template<WordType W>
constexpr auto	bigint_linmul2 (W x[], size_t x_size, W y) -> W
template<WordType W>
constexpr void	bigint_linmul3 (W z[], const W x[], size_t x_size, W y)
template<WordType W>
constexpr void	bigint_mod_sub (W t[], const W s[], const W mod[], size_t mod_sw, W ws[])
template<WordType W>
constexpr auto	bigint_modop_vartime (W n1, W n0, W d) -> W
template<WordType W>
constexpr void	bigint_monty_maybe_sub (size_t N, W z[], W x0, const W x[], const W p[])
template<size_t N, WordType W>
constexpr void	bigint_monty_maybe_sub (W z[N], W x0, const W x[N], const W y[N])
void	bigint_monty_redc (word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size)
BOTAN_FUZZER_API void	bigint_monty_redc_12 (word r[12], const word z[24], const word p[12], word p_dash, word ws[12])
BOTAN_FUZZER_API void	bigint_monty_redc_16 (word r[16], const word z[32], const word p[16], word p_dash, word ws[16])
BOTAN_FUZZER_API void	bigint_monty_redc_24 (word r[24], const word z[48], const word p[24], word p_dash, word ws[24])
BOTAN_FUZZER_API void	bigint_monty_redc_32 (word r[32], const word z[64], const word p[32], word p_dash, word ws[32])
BOTAN_FUZZER_API void	bigint_monty_redc_4 (word r[4], const word z[8], const word p[4], word p_dash, word ws[4])
BOTAN_FUZZER_API void	bigint_monty_redc_6 (word r[6], const word z[12], const word p[6], word p_dash, word ws[6])
BOTAN_FUZZER_API void	bigint_monty_redc_8 (word r[8], const word z[16], const word p[8], word p_dash, word ws[8])
BOTAN_FUZZER_API void	bigint_monty_redc_generic (word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[])
void	bigint_monty_redc_inplace (word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size)
void	bigint_mul (word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, const word y[], size_t y_size, size_t y_sw, word workspace[], size_t ws_size)
template<WordType W>
constexpr void	bigint_shl1 (W x[], size_t x_size, size_t x_words, size_t shift)
template<WordType W>
constexpr void	bigint_shl2 (W y[], const W x[], size_t x_size, size_t shift)
template<WordType W>
constexpr void	bigint_shr1 (W x[], size_t x_size, size_t shift)
template<WordType W>
constexpr void	bigint_shr2 (W y[], const W x[], size_t x_size, size_t shift)
void	bigint_sqr (word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size)
template<WordType W>
constexpr auto	bigint_sub2 (W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr void	bigint_sub2_rev (W x[], const W y[], size_t y_size)
template<WordType W>
constexpr auto	bigint_sub3 (W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W
template<WordType W>
constexpr auto	bigint_sub_abs (W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask< W >
template<WordType W>
constexpr int32_t	bigint_sub_abs (W z[], const W x[], size_t x_size, const W y[], size_t y_size)
template<typename T>
constexpr T	bit_permute_step (T x, T mask, size_t shift)
size_t	bit_size_to_32bit_size (size_t bit_size)
size_t	bit_size_to_byte_size (size_t bit_size)
constexpr auto	bitlen (size_t x)
template<typename T, typename Alloc, typename Alloc2>
size_t	buffer_insert (std::vector< T, Alloc > &buf, size_t buf_offset, const std::vector< T, Alloc2 > &input)
template<typename T, typename Alloc>
size_t	buffer_insert (std::vector< T, Alloc > &buf, size_t buf_offset, const T input[], size_t input_length)
template<size_t S, int64_t MUL = 1> requires (S > 0 && S < 64)
void	carry (int64_t &h0, int64_t &h1)
template<size_t S> requires (S > 0 && S < 32)
void	carry0 (int32_t &h0, int32_t &h1)
template<size_t S> requires (S > 0 && S < 64)
void	carry0 (int64_t &h0, int64_t &h1)
constexpr uint64_t	carry_shift (const donna128 &a, size_t shift)
uint8_t *	cast_char_ptr_to_uint8 (char *s)
const uint8_t *	cast_char_ptr_to_uint8 (const char *s)
const char *	cast_uint8_ptr_to_char (const uint8_t *b)
char *	cast_uint8_ptr_to_char (uint8_t *b)
template<std::unsigned_integral T>
constexpr T	ceil_division (T a, T b)
template<typename T> requires (std::is_integral<T>::value && sizeof(T) < 32)
constexpr uint8_t	ceil_log2 (T x)
template<typename T> requires (std::is_integral<T>::value)
constexpr T	ceil_tobytes (T bits)
std::vector< WotsHashIndex >	chain_lengths (const SphincsTreeNode &msg, const Sphincs_Parameters &params)
std::string	check_and_canonicalize_dns_name (std::string_view name)
bool	check_bcrypt (std::string_view pass, std::string_view hash)
bool	check_passhash9 (std::string_view pass, std::string_view hash)
template<std::unsigned_integral T>
constexpr std::optional< T >	checked_add (T a, T b)
template<std::unsigned_integral T, std::unsigned_integral... Ts> requires all_same_v<T, Ts...>
constexpr std::optional< T >	checked_add (T a, T b, Ts... rest)
template<typename RT, typename AT> requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
constexpr RT	checked_cast_to (AT i)
template<typename RT, typename ExceptionType, typename AT> requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>
constexpr RT	checked_cast_to_or_throw (AT i, std::string_view error_msg_on_fail)
template<std::unsigned_integral T>
constexpr std::optional< T >	checked_mul (T a, T b)
template<std::unsigned_integral T>
constexpr std::optional< T >	checked_sub (T a, T b)
template<typename T>
constexpr T	choose (T mask, T a, T b)
constexpr void	clear_bytes (void *ptr, size_t bytes)
template<ranges::contiguous_output_range R> requires std::is_trivially_copyable_v<std::ranges::range_value_t<R>>
constexpr void	clear_mem (R &&mem)
template<typename T>
constexpr void	clear_mem (T *ptr, size_t n)
template<size_t N, WordType W>
constexpr void	comba_mul (W z[2 *N], const W x[N], const W y[N])
template<size_t N, WordType W>
constexpr void	comba_sqr (W z[2 *N], const W x[N])
constexpr uint64_t	combine_lower (const donna128 &a, size_t s1, const donna128 &b, size_t s2)
void	commoncrypto_adjust_key_size (const uint8_t key[], size_t length, const CommonCryptor_Opts &opts, secure_vector< uint8_t > &full_key)
CommonCryptor_Opts	commoncrypto_opts_from_algo (std::string_view algo)
CommonCryptor_Opts	commoncrypto_opts_from_algo_name (std::string_view algo_name)
void	compute_root (StrongSpan< SphincsTreeNode > out, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, const SphincsTreeNode &leaf, TreeNodeIndex leaf_idx, uint32_t idx_offset, StrongSpan< const SphincsAuthenticationPath > authentication_path, uint32_t total_tree_height, Sphincs_Address &tree_address)
template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address> requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void	compute_root (StrongSpan< TreeNode > out_root, AuthPathSS authentication_path, TreeNodeIndex leaf_idx, StrongSpan< const TreeNode > leaf, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, Address &tree_address)
	Uses an authentication path and a leaf node to reconstruct the root node of a merkle tree.
BigInt	compute_rsa_secret_exponent (const BigInt &e, const BigInt &phi_n, const BigInt &p, const BigInt &q)
template<typename OutR = detail::AutoDetect, ranges::spanable_range... Rs> requires (all_same_v<std::ranges::range_value_t<Rs>...>)
constexpr auto	concat (Rs &&... ranges)
bool	constant_time_compare (const uint8_t x[], const uint8_t y[], size_t len)
bool	constant_time_compare (std::span< const uint8_t > x, std::span< const uint8_t > y)
template<ranges::contiguous_output_range OutR, ranges::contiguous_range InR> requires std::is_same_v<std::ranges::range_value_t<OutR>, std::ranges::range_value_t<InR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<InR>>
constexpr void	copy_mem (OutR &&out, InR &&in)
template<typename T> requires std::is_trivial<typename std::decay<T>::type>::value
constexpr void	copy_mem (T *out, const T *in, size_t n)
template<ranges::spanable_range InR>
void	copy_out_be (std::span< uint8_t > out, InR &&in)
template<ranges::spanable_range InR>
void	copy_out_le (std::span< uint8_t > out, InR &&in)
auto	create_aes_row_generator (const FrodoKEMConstants &constants, StrongSpan< const FrodoSeedA > seed_a)
std::unique_ptr< Private_Key >	create_ec_private_key (std::string_view alg_name, const EC_Group &ec_group, RandomNumberGenerator &rng)
std::string	create_hex_fingerprint (const uint8_t bits[], size_t bits_len, std::string_view hash_name)
std::string	create_hex_fingerprint (std::span< const uint8_t > vec, std::string_view hash_name)
std::array< uint8_t, ED448_LEN >	create_pk_from_sk (std::span< const uint8_t, ED448_LEN > sk)
	Create a public key point from a secret key (RFC 8032 5.2.5)
std::unique_ptr< Private_Key >	create_private_key (std::string_view alg_name, RandomNumberGenerator &rng, std::string_view params, std::string_view provider)
auto	create_shake_row_generator (const FrodoKEMConstants &constants, StrongSpan< const FrodoSeedA > seed_a)
uint8_t	ct_compare_u8 (const uint8_t x[], const uint8_t y[], size_t len)
BigInt	ct_divide (const BigInt &x, const BigInt &y)
void	ct_divide (const BigInt &x, const BigInt &y, BigInt &q_out, BigInt &r_out)
BigInt	ct_divide_pow2k (size_t k, const BigInt &y)
BigInt	ct_divide_word (const BigInt &x, word y)
void	ct_divide_word (const BigInt &x, word y, BigInt &q_out, word &r_out)
template<typename T> requires (std::is_integral<T>::value)
constexpr T	ct_is_zero (T x)
word	ct_mod_word (const BigInt &x, word y)
BigInt	ct_modulo (const BigInt &x, const BigInt &y)
template<std::unsigned_integral T>
constexpr uint8_t	ct_popcount (T x)
template<std::unsigned_integral T>
constexpr T	ct_reverse_bits (T b)
template<typename T> requires (std::is_integral<T>::value)
constexpr size_t	ctz (T n)
void	curve25519_basepoint (uint8_t mypublic[32], const uint8_t secret[32])
void	curve25519_donna (uint8_t mypublic[32], const uint8_t secret[32], const uint8_t basepoint[32])
template<typename ProjectivePoint>
constexpr ProjectivePoint	dbl_a_minus_3 (const ProjectivePoint &pt)
template<typename ProjectivePoint>
constexpr ProjectivePoint	dbl_a_zero (const ProjectivePoint &pt)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint	dbl_generic (const ProjectivePoint &pt, const FieldElement &A)
template<typename ProjectivePoint>
constexpr ProjectivePoint	dbl_n_a_minus_3 (const ProjectivePoint &pt, size_t n)
template<typename ProjectivePoint>
constexpr ProjectivePoint	dbl_n_a_zero (const ProjectivePoint &pt, size_t n)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint	dbl_n_generic (const ProjectivePoint &pt, const FieldElement &A, size_t n)
void	deallocate_memory (void *p, size_t elems, size_t elem_size)
gf2m	decode_gf2m (const uint8_t *mem)
Point448	decode_point (std::span< const uint8_t > p_bytes)
	Decode a point from a byte array. RFC 7748 Section 5 (decodeUCoordinate)
ScalarX448	decode_scalar (std::span< const uint8_t > scalar_bytes)
	Decode a scalar from a byte array. RFC 7748 Section 5 (decodeScalar448)
size_t	dl_exponent_size (size_t bits)
size_t	dl_work_factor (size_t bits)
template<typename E, typename... Args>
void	do_throw_error (const char *file, int line, const char *func, Args... args)
size_t	ecp_work_factor (size_t bits)
void	ed25519_gen_keypair (uint8_t *pk, uint8_t *sk, const uint8_t seed[32])
void	ed25519_gen_keypair (uint8_t pk[32], uint8_t sk[64], const uint8_t seed[32])
void	ed25519_sign (uint8_t sig[64], const uint8_t m[], size_t mlen, const uint8_t sk[64], const uint8_t domain_sep[], size_t domain_sep_len)
bool	ed25519_verify (const uint8_t *m, size_t mlen, const uint8_t sig[64], const uint8_t *pk, const uint8_t domain_sep[], size_t domain_sep_len)
bool	ed25519_verify (const uint8_t msg[], size_t msg_len, const uint8_t sig[64], const uint8_t pk[32], const uint8_t domain_sep[], size_t domain_sep_len)
uint32_t	encode_gf2m (gf2m to_enc, uint8_t *mem)
secure_vector< uint8_t >	encode_point (const Point448 &p)
	Encode a point to a 56 byte vector. RFC 7748 Section 5 (encodeUCoordinate)
RandomNumberGenerator &	esdm_rng ()
template<typename T>
uint16_t	expand_mask_16bit (T tst)
void	expand_message_xmd (std::string_view hash_fn, std::span< uint8_t > output, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep)
void	expand_message_xmd (std::string_view hash_fn, std::span< uint8_t > output, std::string_view input_str, std::string_view domain_sep_str)
template<typename T> requires (std::is_integral<T>::value)
constexpr T	expand_top_bit (T a)
template<std::integral T>
consteval eea_result< T >	extended_euclidean_algorithm (T a, T b)
void	fe_0 (FE_25519 &x)
void	fe_1 (FE_25519 &x)
void	fe_add (FE_25519 &x, const FE_25519 &a, const FE_25519 &b)
void	fe_copy (FE_25519 &a, const FE_25519 &b)
void	fe_frombytes (FE_25519 &x, const uint8_t *b)
void	fe_invert (FE_25519 &x, const FE_25519 &z)
int	fe_isnegative (const FE_25519 &x)
int	fe_isnonzero (const FE_25519 &x)
void	fe_mul (FE_25519 &x, const FE_25519 &a, const FE_25519 &b)
void	fe_neg (FE_25519 &x, const FE_25519 &z)
void	fe_pow22523 (FE_25519 &x, const FE_25519 &y)
void	fe_sq (FE_25519 &x, const FE_25519 &z)
void	fe_sq2 (FE_25519 &x, const FE_25519 &z)
void	fe_sq_iter (FE_25519 &x, const FE_25519 &z, size_t iter)
void	fe_sub (FE_25519 &x, const FE_25519 &a, const FE_25519 &b)
void	fe_tobytes (uint8_t *b, const FE_25519 &x)
secure_vector< gf2m >	find_roots_gf2m_decomp (const polyn_gf2m &polyn, size_t code_length)
template<typename T> requires (std::is_unsigned<T>::value)
constexpr T	floor_log2 (T n)
template<typename... T>
std::string	fmt (std::string_view format, const T &... args)
std::string	format_char_for_display (char c)
SphincsTreeNode	fors_public_key_from_signature (const SphincsHashedMessage &hashed_message, StrongSpan< const ForsSignature > signature, const Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hash)
	FIPS 205, Algorithm 17: fors_pkFromSig.
SphincsTreeNode	fors_sign_and_pkgen (StrongSpan< ForsSignature > sig_out, const SphincsHashedMessage &hashed_message, const SphincsSecretSeed &secret_seed, const Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 16: fors_sign (with simultaneous FORS pk generation)
BigInt	gcd (const BigInt &a, const BigInt &b)
void	ge_double_scalarmult_vartime (uint8_t out[32], const uint8_t *a, const ge_p3 *A, const uint8_t *b)
void	ge_double_scalarmult_vartime (uint8_t out[32], const uint8_t a[], const ge_p3 *A, const uint8_t b[])
int	ge_frombytes_negate_vartime (ge_p3 *v, const uint8_t *)
void	ge_scalarmult_base (uint8_t out[32], const uint8_t in[32])
template<typename GeneralVariantT, typename SpecialT> requires (std::is_constructible_v<GeneralVariantT, std::decay_t<SpecialT>>)
constexpr GeneralVariantT	generalize_to (SpecialT &&specific) noexcept
	Converts a given variant into another variant-ish whose type states are a super set of the given variant.
template<typename GeneralVariantT, typename... SpecialTs>
constexpr GeneralVariantT	generalize_to (std::variant< SpecialTs... > specific) noexcept
	Converts a given variant into another variant-ish whose type states are a super set of the given variant.
std::string	generate_bcrypt (std::string_view pass, RandomNumberGenerator &rng, uint16_t work_factor, char version)
std::vector< uint8_t >	generate_dsa_primes (RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits)
bool	generate_dsa_primes (RandomNumberGenerator &rng, BigInt &p, BigInt &q, size_t pbits, size_t qbits, const std::vector< uint8_t > &seed_c, size_t offset)
McEliece_PrivateKey	generate_mceliece_key (RandomNumberGenerator &rng, size_t ext_deg, size_t code_length, size_t t)
std::string	generate_passhash9 (std::string_view pass, RandomNumberGenerator &rng, uint16_t work_factor, uint8_t alg_id)
BigInt	generate_rfc6979_nonce (const BigInt &x, const BigInt &q, const BigInt &h, std::string_view hash)
BigInt	generate_rsa_prime (RandomNumberGenerator &keygen_rng, RandomNumberGenerator &prime_test_rng, size_t bits, const BigInt &coprime, size_t prob)
AEAD_Mode *	get_aead (std::string_view name, Cipher_Dir direction)
template<size_t B, typename T> requires (B < sizeof(T))
constexpr uint8_t	get_byte (T input)
template<typename T>
constexpr uint8_t	get_byte_var (size_t byte_num, T input)
Keyed_Filter *	get_cipher (std::string_view algo_spec, Cipher_Dir direction)
Keyed_Filter *	get_cipher (std::string_view algo_spec, const SymmetricKey &key, Cipher_Dir direction)
Keyed_Filter *	get_cipher (std::string_view algo_spec, const SymmetricKey &key, const InitializationVector &iv, Cipher_Dir direction)
Cipher_Mode *	get_cipher_mode (std::string_view algo_spec, Cipher_Dir direction, std::string_view provider="")
std::vector< std::string >	get_files_recursive (std::string_view dir)
KDF *	get_kdf (std::string_view algo_spec)
PBKDF *	get_pbkdf (std::string_view algo_spec, std::string_view provider="")
PBKDF *	get_s2k (std::string_view algo_spec)
template<WordType W>
constexpr uint32_t	get_uint32 (const W xw[], size_t i)
template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32	gf2p8affine (const SIMD_8x32 &x)
template<uint64_t A, uint8_t B>
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32	gf2p8affineinv (const SIMD_8x32 &x)
BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32	gf2p8mul (const SIMD_8x32 &a, const SIMD_8x32 &b)
consteval uint64_t	gfni_matrix (std::string_view s)
gf2m	gray_to_lex (gf2m gray)
bool	has_filesystem_impl ()
std::vector< uint8_t >	hex_decode (const char input[], size_t input_length, bool ignore_ws)
size_t	hex_decode (std::span< uint8_t > output, std::string_view input, bool ignore_ws)
std::vector< uint8_t >	hex_decode (std::string_view input, bool ignore_ws)
size_t	hex_decode (uint8_t output[], const char input[], size_t input_length, bool ignore_ws)
size_t	hex_decode (uint8_t output[], const char input[], size_t input_length, size_t &input_consumed, bool ignore_ws)
size_t	hex_decode (uint8_t output[], std::string_view input, bool ignore_ws)
secure_vector< uint8_t >	hex_decode_locked (const char input[], size_t input_length, bool ignore_ws)
secure_vector< uint8_t >	hex_decode_locked (std::string_view input, bool ignore_ws)
void	hex_encode (char output[], const uint8_t input[], size_t input_length, bool uppercase)
std::string	hex_encode (const uint8_t input[], size_t input_length, bool uppercase)
std::string	hex_encode (std::span< const uint8_t > input, bool uppercase=true)
template<WordType W, size_t N>
constexpr auto	hex_to_words (const char(&s)[N])
template<typename T> requires (std::is_unsigned<T>::value)
constexpr size_t	high_bit (T n)
secure_vector< uint8_t >	hkdf_expand_label (std::string_view hash_fn, std::span< const uint8_t > secret, std::string_view label, std::span< const uint8_t > hash_val, size_t length)
template<typename... Alts, typename... Ts>
constexpr bool	holds_any_of (const std::variant< Ts... > &v) noexcept
bool	host_wildcard_match (std::string_view issued_, std::string_view host_)
void	ht_sign (StrongSpan< SphincsHypertreeSignature > out_sig, const SphincsTreeNode &message_to_sign, const SphincsSecretSeed &secret_seed, XmssTreeIndexInLayer tree_index_in_layer, TreeNodeIndex idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 12: ht_sign.
bool	ht_verify (const SphincsTreeNode &signed_msg, StrongSpan< const SphincsHypertreeSignature > ht_sig, const SphincsTreeNode &pk_root, XmssTreeIndexInLayer tree_index_in_layer, TreeNodeIndex idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 13: ht_verify.
uint8_t	ieee1363_hash_id (std::string_view name)
size_t	if_work_factor (size_t bits)
template<typename T>
constexpr void	ignore_param (T &&)
template<typename... T>
constexpr void	ignore_params (T &&... args)
template<std::unsigned_integral T>
constexpr size_t	index_of_first_set_byte (T v)
void	initialize_allocator ()
bool	intersects (ASN1_Class x, ASN1_Class y)
BigInt	inverse_mod (const BigInt &n, const BigInt &mod)
std::optional< BigInt >	inverse_mod_general (const BigInt &x, const BigInt &mod)
BigInt	inverse_mod_public_prime (const BigInt &x, const BigInt &p)
BigInt	inverse_mod_rsa_public_modulus (const BigInt &x, const BigInt &n)
BigInt	inverse_mod_secret_prime (const BigInt &x, const BigInt &p)
template<typename C>
constexpr auto	invert_field_element (const typename C::FieldElement &fe)
std::string	ipv4_to_string (uint32_t ip)
bool	is_bailie_psw_probable_prime (const BigInt &n, const Barrett_Reduction &mod_n)
template<typename GeneralVariantT, typename SpecialT>
constexpr bool	is_generalizable_to (const SpecialT &) noexcept
template<typename GeneralVariantT, typename... SpecialTs>
constexpr bool	is_generalizable_to (const std::variant< SpecialTs... > &) noexcept
bool	is_lucas_probable_prime (const BigInt &C, const Barrett_Reduction &mod_C)
bool	is_miller_rabin_probable_prime (const BigInt &n, const Barrett_Reduction &mod_n, RandomNumberGenerator &rng, size_t test_iterations)
bool	is_passhash9_alg_supported (uint8_t alg_id)
BigInt	is_perfect_square (const BigInt &C)
template<typename T> requires (std::is_unsigned<T>::value)
constexpr bool	is_power_of_2 (T arg)
bool	is_prime (const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
std::optional< uint32_t >	is_sub_element_of (const OID &oid, std::initializer_list< uint32_t > prefix)
int32_t	jacobi (const BigInt &a, const BigInt &n)
template<absorbing_object T, typename... Ts> requires (std::constructible_from<std::span<const uint8_t>, Ts> && ...)
size_t	keccak_absorb_padded_strings_encoding (T &sink, size_t padding_mod, Ts... byte_strings)
size_t	keccak_int_encoding_size (size_t x)
std::span< const uint8_t >	keccak_int_left_encode (std::span< uint8_t > out, size_t x)
std::span< const uint8_t >	keccak_int_right_encode (std::span< uint8_t > out, size_t x)
constexpr size_t	keccak_max_int_encoding_size ()
void	Keccak_Permutation_round (uint64_t T[25], const uint64_t A[25], uint64_t RC)
std::string	key_constraints_to_string (Key_Constraints c)
std::string	latin1_to_utf8 (const uint8_t chars[], size_t len)
BigInt	lcm (const BigInt &a, const BigInt &b)
gf2m	lex_to_gray (gf2m lex)
LMOTS_K	lmots_compute_pubkey_from_sig (const LMOTS_Signature &sig, const LMS_Message &msg, const LMS_Identifier &identifier, LMS_Tree_Node_Idx q)
	Compute a public key candidate for an OTS-signature-message pair and the OTS instance parameters.
uint64_t	load_3 (const uint8_t in[3])
uint64_t	load_4 (const uint8_t *in)
template<typename OutT = detail::AutoDetect, typename... ParamTs>
constexpr auto	load_be (ParamTs &&... params)
template<typename OutT = detail::AutoDetect, typename... ParamTs>
constexpr auto	load_le (ParamTs &&... params)
std::unique_ptr< Private_Key >	load_private_key (const AlgorithmIdentifier &alg_id, std::span< const uint8_t > key_bits)
std::unique_ptr< Public_Key >	load_public_key (const AlgorithmIdentifier &alg_id, std::span< const uint8_t > key_bits)
template<typename T>
secure_vector< T >	lock (const std::vector< T > &in)
size_t	low_zero_bits (const BigInt &n)
template<typename T>
constexpr T	majority (T a, T b, T c)
std::unique_ptr< BlockCipher >	make_commoncrypto_block_cipher (std::string_view name)
std::unique_ptr< Cipher_Mode >	make_commoncrypto_cipher_mode (std::string_view name, Cipher_Dir direction)
std::unique_ptr< HashFunction >	make_commoncrypto_hash (std::string_view name)
Compression_Algorithm *	make_compressor (std::string_view type)
Decompression_Algorithm *	make_decompressor (std::string_view type)
constexpr uint16_t	make_uint16 (uint8_t i0, uint8_t i1)
constexpr uint32_t	make_uint32 (uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3)
constexpr uint64_t	make_uint64 (uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3, uint8_t i4, uint8_t i5, uint8_t i6, uint8_t i7)
template<typename T, typename Pred>
void	map_remove_if (Pred pred, T &assoc)
secure_vector< uint8_t >	mceliece_decrypt (secure_vector< gf2m > &error_pos, const uint8_t *ciphertext, size_t ciphertext_len, const McEliece_PrivateKey &key)
void	mceliece_decrypt (secure_vector< uint8_t > &plaintext, secure_vector< uint8_t > &error_mask, const uint8_t ciphertext[], size_t ciphertext_len, const McEliece_PrivateKey &key)
void	mceliece_decrypt (secure_vector< uint8_t > &plaintext_out, secure_vector< uint8_t > &error_mask_out, const secure_vector< uint8_t > &ciphertext, const McEliece_PrivateKey &key)
void	mceliece_encrypt (secure_vector< uint8_t > &ciphertext_out, secure_vector< uint8_t > &error_mask_out, const secure_vector< uint8_t > &plaintext, const McEliece_PublicKey &key, RandomNumberGenerator &rng)
size_t	mceliece_work_factor (size_t n, size_t t)
template<typename F>
uint64_t	measure_cost (std::chrono::milliseconds trial_msec, F func)
void	mgf1_mask (HashFunction &hash, const uint8_t in[], size_t in_len, uint8_t out[], size_t out_len)
void	mgf1_mask (HashFunction &hash, std::span< const uint8_t > input, std::span< uint8_t > output)
size_t	miller_rabin_test_iterations (size_t n_bits, size_t prob, bool random)
template<std::integral T, std::integral T2 = next_longer_int_t<T>> requires (sizeof(T) <= 4)
consteval T	modular_inverse (T q, T2 m=T2(1)<< sizeof(T) *8)
template<std::integral T> requires (size_t(sizeof(T)) <= 4)
consteval T	montgomery_R (T q)
template<std::integral T> requires (size_t(sizeof(T)) <= 4)
consteval T	montgomery_R2 (T q)
Montgomery_Int	monty_execute (const Montgomery_Exponentation_State &precomputed_state, const BigInt &k, size_t max_k_bits)
Montgomery_Int	monty_execute_vartime (const Montgomery_Exponentation_State &precomputed_state, const BigInt &k)
Montgomery_Int	monty_exp (const std::shared_ptr< const Montgomery_Params > &params_p, const BigInt &g, const BigInt &k, size_t max_k_bits)
Montgomery_Int	monty_exp_vartime (const std::shared_ptr< const Montgomery_Params > &params_p, const BigInt &g, const BigInt &k)
template<WordType W>
constexpr auto	monty_inverse (W a) -> W
Montgomery_Int	monty_multi_exp (const std::shared_ptr< const Montgomery_Params > &params_p, const BigInt &x_bn, const BigInt &z1, const BigInt &y_bn, const BigInt &z2)
std::shared_ptr< const Montgomery_Exponentation_State >	monty_precompute (const Montgomery_Int &g, size_t window_bits, bool const_time)
std::shared_ptr< const Montgomery_Exponentation_State >	monty_precompute (const std::shared_ptr< const Montgomery_Params > &params, const BigInt &g, size_t window_bits, bool const_time)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint	mul2_exec (const AffinePointTable< C > &table, const BlindedScalar &x, const BlindedScalar &y, RandomNumberGenerator &rng)
template<typename C, size_t WindowBits>
std::vector< typename C::ProjectivePoint >	mul2_setup (const typename C::AffinePoint &p, const typename C::AffinePoint &q)
constexpr void	mul64x64_128 (uint64_t a, uint64_t b, uint64_t *lo, uint64_t *hi)
EC_Point	multi_exponentiate (const EC_Point &p1, const BigInt &z1, const EC_Point &p2, const BigInt &z2)
secure_vector< uint8_t >	nist_key_unwrap (const uint8_t input[], size_t input_len, const BlockCipher &bc)
secure_vector< uint8_t >	nist_key_unwrap_padded (const uint8_t input[], size_t input_len, const BlockCipher &bc)
std::vector< uint8_t >	nist_key_wrap (const uint8_t input[], size_t input_len, const BlockCipher &bc)
std::vector< uint8_t >	nist_key_wrap_padded (const uint8_t input[], size_t input_len, const BlockCipher &bc)
CT::Option< size_t >	oaep_find_delim (std::span< const uint8_t > input, std::span< const uint8_t > phash)
bool	operator!= (const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
bool	operator!= (const ASN1_Time &, const ASN1_Time &)
bool	operator!= (const BigInt &a, const BigInt &b)
bool	operator!= (const BigInt &a, word b)
bool	operator!= (const CRL_Entry &a1, const CRL_Entry &a2)
bool	operator!= (const EC_Group &lhs, const EC_Group &rhs)
bool	operator!= (const OctetString &s1, const OctetString &s2)
bool	operator!= (const OID &a, const OID &b)
template<typename T, typename U>
bool	operator!= (const secure_allocator< T > &, const secure_allocator< U > &)
template<bitvectorish T1, bitvectorish T2>
bool	operator!= (const T1 &lhs, const T2 &rhs)
bool	operator!= (const X509_Certificate &cert1, const X509_Certificate &cert2)
bool	operator!= (const X509_DN &dn1, const X509_DN &dn2)
BigInt	operator% (const BigInt &n, const BigInt &mod)
word	operator% (const BigInt &n, word mod)
template<bitvectorish T1, bitvectorish T2>
auto	operator& (const T1 &lhs, const T2 &rhs)
ECIES_Flags	operator& (ECIES_Flags a, ECIES_Flags b)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator& (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator& (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator& (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator&= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator&= (Strong< T1, Tags... > &a, T2 b)
EC_Point	operator* (const BigInt &scalar, const EC_Point &point)
BigInt	operator* (const BigInt &x, const BigInt &y)
BigInt	operator* (const BigInt &x, word y)
template<std::unsigned_integral T>
constexpr donna128	operator* (const donna128 &x, T y)
EC_Point	operator* (const EC_Point &point, const BigInt &scalar)
Ed448Point	operator* (const Scalar448 &lhs, const Ed448Point &rhs)
	Syntax sugar for scalar multiplication.
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator* (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator* (Strong< T1, Tags... > a, T2 b)
template<std::unsigned_integral T>
constexpr donna128	operator* (T y, const donna128 &x)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator* (T1 a, Strong< T2, Tags... > b)
BigInt	operator* (word x, const BigInt &y)
template<std::integral T, typename... Tags>
constexpr auto	operator*= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator*= (Strong< T1, Tags... > &a, T2 b)
BigInt	operator+ (const BigInt &x, const BigInt &y)
BigInt	operator+ (const BigInt &x, word y)
constexpr donna128	operator+ (const donna128 &x, const donna128 &y)
constexpr donna128	operator+ (const donna128 &x, uint64_t y)
EC_Point	operator+ (const EC_Point &lhs, const EC_Point &rhs)
OctetString	operator+ (const OctetString &k1, const OctetString &k2)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator+ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator+ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator+ (T1 a, Strong< T2, Tags... > b)
BigInt	operator+ (word x, const BigInt &y)
template<std::integral T, typename... Tags>
constexpr auto	operator++ (Strong< T, Tags... > &a)
template<std::integral T, typename... Tags>
constexpr auto	operator++ (Strong< T, Tags... > &a, int)
template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > &	operator+= (std::vector< T, Alloc > &out, const std::pair< const T *, L > &in)
template<typename T, typename Alloc, typename L>
std::vector< T, Alloc > &	operator+= (std::vector< T, Alloc > &out, const std::pair< T *, L > &in)
template<typename T, typename Alloc, typename Alloc2>
std::vector< T, Alloc > &	operator+= (std::vector< T, Alloc > &out, const std::vector< T, Alloc2 > &in)
template<typename T, typename Alloc>
std::vector< T, Alloc > &	operator+= (std::vector< T, Alloc > &out, T in)
template<std::integral T, typename... Tags>
constexpr auto	operator+= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator+= (Strong< T1, Tags... > &a, T2 b)
BigInt	operator- (const BigInt &x, const BigInt &y)
BigInt	operator- (const BigInt &x, word y)
EC_Point	operator- (const EC_Point &lhs)
EC_Point	operator- (const EC_Point &lhs, const EC_Point &rhs)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator- (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator- (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator- (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator-- (Strong< T, Tags... > &a)
template<std::integral T, typename... Tags>
constexpr auto	operator-- (Strong< T, Tags... > &a, int)
template<std::integral T, typename... Tags>
constexpr auto	operator-= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator-= (Strong< T1, Tags... > &a, T2 b)
BigInt	operator/ (const BigInt &x, const BigInt &y)
BigInt	operator/ (const BigInt &x, word y)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator/ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator/ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator/ (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator/= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator/= (Strong< T1, Tags... > &a, T2 b)
bool	operator< (const ASN1_Time &, const ASN1_Time &)
bool	operator< (const BigInt &a, const BigInt &b)
bool	operator< (const BigInt &a, word b)
bool	operator< (const OID &a, const OID &b)
bool	operator< (const X509_DN &dn1, const X509_DN &dn2)
BigInt	operator<< (const BigInt &x, size_t shift)
int	operator<< (int fd, Pipe &pipe)
std::ostream &	operator<< (std::ostream &os, const GeneralName &gn)
std::ostream &	operator<< (std::ostream &os, const GeneralSubtree &gs)
template<typename T, typename... Tags> requires (concepts::streamable<T>)
decltype(auto)	operator<< (std::ostream &os, const Strong< T, Tags... > &v)
std::ostream &	operator<< (std::ostream &out, const OID &oid)
std::ostream &	operator<< (std::ostream &out, const X509_DN &dn)
std::ostream &	operator<< (std::ostream &out, Pipe &pipe)
std::ostream &	operator<< (std::ostream &stream, const BigInt &n)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator<< (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator<< (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator<< (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator<<= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator<<= (Strong< T1, Tags... > &a, T2 b)
bool	operator<= (const ASN1_Time &, const ASN1_Time &)
bool	operator<= (const BigInt &a, const BigInt &b)
bool	operator<= (const BigInt &a, word b)
template<typename T, typename... Tags> requires (std::three_way_comparable<T>)
auto	operator<=> (const Strong< T, Tags... > &lhs, const Strong< T, Tags... > &rhs)
template<std::integral T1, std::integral T2, typename... Tags>
auto	operator<=> (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
auto	operator<=> (T1 a, Strong< T2, Tags... > b)
bool	operator== (const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
bool	operator== (const ASN1_Time &, const ASN1_Time &)
bool	operator== (const BigInt &a, const BigInt &b)
bool	operator== (const BigInt &a, word b)
bool	operator== (const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &lhs, const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &rhs)
bool	operator== (const CRL_Entry &a1, const CRL_Entry &a2)
bool	operator== (const OctetString &s1, const OctetString &s2)
template<typename T, typename U>
bool	operator== (const secure_allocator< T > &, const secure_allocator< U > &)
template<typename T, typename... Tags> requires (std::equality_comparable<T>)
bool	operator== (const Strong< T, Tags... > &lhs, const Strong< T, Tags... > &rhs)
template<bitvectorish T1, bitvectorish T2>
bool	operator== (const T1 &lhs, const T2 &rhs)
bool	operator== (const X509_DN &dn1, const X509_DN &dn2)
template<std::integral T1, std::integral T2, typename... Tags>
auto	operator== (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags>
auto	operator== (T1 a, Strong< T2, Tags... > b)
bool	operator> (const ASN1_Time &, const ASN1_Time &)
bool	operator> (const BigInt &a, const BigInt &b)
bool	operator> (const BigInt &a, word b)
bool	operator>= (const ASN1_Time &, const ASN1_Time &)
bool	operator>= (const BigInt &a, const BigInt &b)
bool	operator>= (const BigInt &a, word b)
BigInt	operator>> (const BigInt &x, size_t shift)
int	operator>> (int fd, Pipe &pipe)
std::istream &	operator>> (std::istream &in, Pipe &pipe)
std::istream &	operator>> (std::istream &in, X509_DN &dn)
std::istream &	operator>> (std::istream &stream, BigInt &n)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator>> (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator>> (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator>> (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator>>= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator>>= (Strong< T1, Tags... > &a, T2 b)
OctetString	operator^ (const OctetString &k1, const OctetString &k2)
template<bitvectorish T1, bitvectorish T2>
auto	operator^ (const T1 &lhs, const T2 &rhs)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator^ (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator^ (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator^ (T1 a, Strong< T2, Tags... > b)
template<typename Alloc, typename Alloc2>
std::vector< uint8_t, Alloc > &	operator^= (std::vector< uint8_t, Alloc > &out, const std::vector< uint8_t, Alloc2 > &in)
template<std::integral T, typename... Tags>
constexpr auto	operator^= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator^= (Strong< T1, Tags... > &a, T2 b)
ASN1_Class	operator| (ASN1_Class x, ASN1_Class y)
uint32_t	operator| (ASN1_Class x, ASN1_Type y)
uint32_t	operator| (ASN1_Type x, ASN1_Class y)
ASN1_Type	operator| (ASN1_Type x, ASN1_Type y)
constexpr donna128	operator| (const donna128 &x, const donna128 &y)
constexpr donna128	operator| (const donna128 &x, uint64_t y)
template<bitvectorish T1, bitvectorish T2>
auto	operator| (const T1 &lhs, const T2 &rhs)
ECIES_Flags	operator| (ECIES_Flags a, ECIES_Flags b)
template<std::integral T, typename... Tags>
constexpr decltype(auto)	operator| (Strong< T, Tags... > a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator| (Strong< T1, Tags... > a, T2 b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr decltype(auto)	operator| (T1 a, Strong< T2, Tags... > b)
template<std::integral T, typename... Tags>
constexpr auto	operator|= (Strong< T, Tags... > &a, Strong< T, Tags... > b)
template<std::integral T1, std::integral T2, typename... Tags> requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)
constexpr auto	operator|= (Strong< T1, Tags... > &a, T2 b)
EC_Point	OS2ECP (const uint8_t data[], size_t data_len, const CurveGFp &curve)
std::pair< BigInt, BigInt >	OS2ECP (const uint8_t pt[], size_t pt_len, const BigInt &p, const BigInt &a, const BigInt &b)
EC_Point	OS2ECP (std::span< const uint8_t > data, const CurveGFp &curve)
template<typename T> requires std::is_default_constructible_v<T>
constexpr auto	out_opt (std::optional< T > &outopt) noexcept
template<typename T>
constexpr auto	out_ptr (T &outptr) noexcept
template<class... Ts>
	overloaded (Ts...) -> overloaded< Ts... >
std::vector< std::string >	parse_algorithm_name (std::string_view namex)
bool	passes_miller_rabin_test (const BigInt &n, const Barrett_Reduction &mod_n, const std::shared_ptr< Montgomery_Params > &monty_n, const BigInt &a)
secure_vector< uint8_t >	pbes2_decrypt (std::span< const uint8_t > key_bits, std::string_view passphrase, const std::vector< uint8_t > &params)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > >	pbes2_encrypt (std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > >	pbes2_encrypt_iter (std::span< const uint8_t > key_bits, std::string_view passphrase, size_t pbkdf_iter, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > >	pbes2_encrypt_msec (std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, size_t *out_iterations_if_nonnull, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
void	pbkdf2 (MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, const uint8_t salt[], size_t salt_len, size_t iterations)
size_t	pbkdf2 (MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t iterations, std::chrono::milliseconds msec)
std::vector< uint8_t >	pkcs_hash_id (std::string_view name)
template<typename ProjectivePoint, typename FieldElement>
constexpr ProjectivePoint	point_add (const ProjectivePoint &a, const ProjectivePoint &b)
template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
constexpr ProjectivePoint	point_add_mixed (const ProjectivePoint &a, const AffinePoint &b, const FieldElement &one)
template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>
constexpr ProjectivePoint	point_add_or_sub_mixed (const ProjectivePoint &a, const AffinePoint &b, CT::Choice sub, const FieldElement &one)
void	poly_double_n (uint8_t buf[], size_t n)
void	poly_double_n (uint8_t out[], const uint8_t in[], size_t n)
void	poly_double_n_le (uint8_t out[], const uint8_t in[], size_t n)
bool	poly_double_supported_size (size_t n)
BigInt	power_mod (const BigInt &base, const BigInt &exp, const BigInt &mod)
uint64_t	prefetch_array_raw (size_t bytes, const void *arrayv) noexcept
template<typename T, size_t... Ns> requires std::is_integral<T>::value
T	prefetch_arrays (T(&... arr)[Ns]) noexcept
std::vector< std::string >	probe_provider_private_key (std::string_view alg_name, const std::vector< std::string > &possible)
template<typename T>
std::vector< std::string >	probe_providers_of (std::string_view algo_spec, const std::vector< std::string > &possible={"base"})
gf2m	random_code_element (uint16_t code_length, RandomNumberGenerator &rng)
gf2m	random_gf2m (RandomNumberGenerator &rng)
BigInt	random_prime (RandomNumberGenerator &rng, size_t bits, const BigInt &coprime, size_t equiv, size_t modulo, size_t prob)
BigInt	random_safe_prime (RandomNumberGenerator &rng, size_t bits)
std::map< std::string, std::string >	read_cfg (std::istream &is)
BOTAN_TEST_API std::map< std::string, std::string >	read_kv (std::string_view kv)
template<size_t WindowBits, typename W, size_t N>
constexpr size_t	read_window_bits (std::span< const W, N > words, size_t offset)
template<WordType W, size_t N, W C>
constexpr std::array< W, N >	redc_crandall (std::span< const W, 2 *N > z)
void	redc_mul (int64_t &s1, int64_t &s2, int64_t &s3, int64_t &s4, int64_t &s5, int64_t &s6, int64_t &X)
template<typename RetT, typename KeyT, typename ReducerT> requires std::is_convertible_v<ReducerT, std::function<RetT(RetT, const KeyT&)>>
RetT	reduce (const std::vector< KeyT > &keys, RetT acc, ReducerT reducer)
template<std::unsigned_integral T> requires (sizeof(T) == 1 || sizeof(T) == 2 || sizeof(T) == 4 || sizeof(T) == 8)
constexpr T	reverse_bytes (T x)
secure_vector< uint8_t >	rfc3394_keyunwrap (const secure_vector< uint8_t > &key, const SymmetricKey &kek)
secure_vector< uint8_t >	rfc3394_keywrap (const secure_vector< uint8_t > &key, const SymmetricKey &kek)
size_t	RFC4880_decode_count (uint8_t iter)
uint8_t	RFC4880_encode_count (size_t desired_iterations)
size_t	RFC4880_round_iterations (size_t iterations)
template<size_t R1, size_t R2, size_t R3, typename T>
constexpr T	rho (T x)
Gf448Elem	root (const Gf448Elem &elem)
	Compute the root of elem in the field.
template<size_t R>
SIMD_16x32	rotl (SIMD_16x32 input)
template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32	rotl (SIMD_4x32 input)
template<size_t R>
SIMD_8x32	rotl (SIMD_8x32 input)
template<size_t ROT, typename T> requires (ROT > 0 && ROT < 8 * sizeof(T))
constexpr T	rotl (T input)
template<typename T>
constexpr T	rotl_var (T input, size_t rot)
template<size_t R>
SIMD_16x32	rotr (SIMD_16x32 input)
template<size_t R>
SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32	rotr (SIMD_4x32 input)
template<size_t R>
SIMD_8x32	rotr (SIMD_8x32 input)
template<size_t ROT, typename T> requires (ROT > 0 && ROT < 8 * sizeof(T))
constexpr T	rotr (T input)
template<typename T>
constexpr T	rotr_var (T input, size_t rot)
constexpr size_t	round_up (size_t n, size_t align_to)
std::string	runtime_version_check (uint32_t major, uint32_t minor, uint32_t patch)
template<typename T>
bool	same_mem (const T *p1, const T *p2, size_t n)
void	sc_muladd (uint8_t *, const uint8_t *, const uint8_t *, const uint8_t *)
void	sc_reduce (uint8_t *)
void	scrypt (uint8_t output[], size_t output_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p)
void	scrypt (uint8_t output[], size_t output_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p)
void	secure_scrub_memory (ranges::contiguous_output_range auto &&data)
void	secure_scrub_memory (void *ptr, size_t n)
constexpr void	set_mem (uint8_t *ptr, size_t n, uint8_t val)
BOTAN_FORCE_INLINE void	SHA2_32_F (uint32_t A, uint32_t B, uint32_t C, uint32_t &D, uint32_t E, uint32_t F, uint32_t G, uint32_t &H, uint32_t &M1, uint32_t M2, uint32_t M3, uint32_t M4, uint32_t magic)
BOTAN_FORCE_INLINE void	SHA2_32_F (uint32_t A, uint32_t B, uint32_t C, uint32_t &D, uint32_t E, uint32_t F, uint32_t G, uint32_t &H, uint32_t M)
BOTAN_FORCE_INLINE void	SHA2_64_F (uint64_t A, uint64_t B, uint64_t C, uint64_t &D, uint64_t E, uint64_t F, uint64_t G, uint64_t &H, uint64_t &M1, uint64_t M2, uint64_t M3, uint64_t M4, uint64_t magic)
BOTAN_FORCE_INLINE void	SHA2_64_F (uint64_t A, uint64_t B, uint64_t C, uint64_t &D, uint64_t E, uint64_t F, uint64_t G, uint64_t &H, uint64_t M)
template<size_t S, WordType W, size_t N>
constexpr W	shift_left (std::array< W, N > &x)
template<size_t S, WordType W, size_t N>
constexpr W	shift_right (std::array< W, N > &x)
template<size_t S>
SIMD_16x32	shl (SIMD_16x32 input)
template<size_t S>
SIMD_4x32	shl (SIMD_4x32 input)
template<size_t S>
SIMD_8x32	shl (SIMD_8x32 input)
const char *	short_version_cstr ()
std::string	short_version_string ()
template<size_t R1, size_t R2, size_t S, typename T>
constexpr T	sigma (T x)
std::array< uint8_t, 2 *ED448_LEN >	sign_message (std::span< const uint8_t, ED448_LEN > sk, std::span< const uint8_t, ED448_LEN > pk, bool f, std::span< const uint8_t > context, std::span< const uint8_t > msg)
	Sign a message using a keypair (RFC 8032 5.2.6)
template<typename T> requires (std::is_integral<T>::value)
constexpr size_t	significant_bytes (T n)
std::vector< uint8_t >	sm2_compute_za (HashFunction &hash, std::string_view user_id, const EC_Group &group, const EC_AffinePoint &pubkey)
std::vector< std::string >	split_on (std::string_view str, char delim)
BigInt	sqrt_modulo_prime (const BigInt &a, const BigInt &p)
BigInt	square (const BigInt &x)
Gf448Elem	square (const Gf448Elem &elem)
	Computes elem^2. Faster than operator*.
std::pair< BigInt, SymmetricKey >	srp6_client_agree (std::string_view identifier, std::string_view password, const DL_Group &group, std::string_view hash_id, const std::vector< uint8_t > &salt, const BigInt &B, const size_t a_bits, RandomNumberGenerator &rng)
std::pair< BigInt, SymmetricKey >	srp6_client_agree (std::string_view identifier, std::string_view password, std::string_view group_id, std::string_view hash_id, const std::vector< uint8_t > &salt, const BigInt &B, RandomNumberGenerator &rng)
BigInt	srp6_generate_verifier (std::string_view identifier, std::string_view password, const std::vector< uint8_t > &salt, const DL_Group &group, std::string_view hash_id)
BigInt	srp6_generate_verifier (std::string_view identifier, std::string_view password, const std::vector< uint8_t > &salt, std::string_view group_id, std::string_view hash_id)
std::string	srp6_group_identifier (const BigInt &N, const BigInt &g)
template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
constexpr auto	store_be (ParamTs &&... params)
template<typename ModifierT = detail::AutoDetect, typename... ParamTs>
constexpr auto	store_le (ParamTs &&... params)
std::string	string_join (const std::vector< std::string > &strs, char delim)
std::optional< uint32_t >	string_to_ipv4 (std::string_view str)
template<typename T>
constexpr void	swap_bits (T &x, T &y, T mask, size_t shift)
template<std::unsigned_integral T>
constexpr T	swar_in_range (T v, T lower, T upper)
template<std::unsigned_integral T>
constexpr T	swar_lt (T a, T b)
std::vector< polyn_gf2m >	syndrome_init (const polyn_gf2m &generator, const std::vector< gf2m > &support, int n)
RandomNumberGenerator &	system_rng ()
void	throw_invalid_argument (const char *message, const char *func, const char *file)
void	throw_invalid_state (const char *expr, const char *func, const char *file)
template<typename C>
constexpr auto	to_affine (const typename C::ProjectivePoint &pt)
template<typename C>
auto	to_affine_batch (std::span< const typename C::ProjectivePoint > projective)
template<typename C>
auto	to_affine_x (const typename C::ProjectivePoint &pt)
template<concepts::contiguous_container T = std::vector<uint8_t>>
T	to_byte_vector (std::string_view s)
const char *	to_string (Certificate_Status_Code code)
std::string	to_string (ErrorType type)
	Convert an ErrorType to string.
std::string	to_string (std::span< const uint8_t > bytes)
uint32_t	to_u32bit (std::string_view str_view)
uint16_t	to_uint16 (std::string_view str)
template<typename T> requires std::is_enum_v<T>
auto	to_underlying (T e) noexcept
std::string	tolower_string (std::string_view in)
void	treehash (StrongSpan< SphincsTreeNode > out_root, StrongSpan< SphincsAuthenticationPath > out_auth_path, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes, std::optional< TreeNodeIndex > leaf_idx, uint32_t idx_offset, uint32_t total_tree_height, const GenerateLeafFunction &gen_leaf, Sphincs_Address &tree_address)
template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address> requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>
void	treehash (StrongSpan< TreeNode > out_root, std::optional< AuthPathSS > out_auth_path, std::optional< TreeNodeIndex > leaf_idx, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, concepts::tree_gen_leaf< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto gen_leaf, Address &tree_address)
	Treehash logic to build up a merkle hash tree.
template<typename To> requires std::is_trivial<To>::value
constexpr To	typecast_copy (const uint8_t src[]) noexcept
template<typename ToT, ranges::contiguous_range FromR> requires std::is_default_constructible_v<ToT> && std::is_trivially_copyable_v<ToT> && std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>>
constexpr ToT	typecast_copy (FromR &&src) noexcept
template<typename T> requires std::is_trivial<typename std::decay<T>::type>::value
constexpr void	typecast_copy (T &out, const uint8_t in[])
template<typename T> requires std::is_trivial<T>::value
constexpr void	typecast_copy (T out[], const uint8_t in[], size_t N)
template<ranges::contiguous_output_range ToR, typename FromT> requires std::is_trivially_copyable_v<FromT> && (!std::ranges::range<FromT>) && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
constexpr void	typecast_copy (ToR &&out, const FromT &in)
template<ranges::contiguous_output_range ToR, ranges::contiguous_range FromR> requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>
constexpr void	typecast_copy (ToR &&out, FromR &&in)
template<typename ToT, ranges::contiguous_range FromR> requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<ToT> && (!std::ranges::range<ToT>)
constexpr void	typecast_copy (ToT &out, FromR &&in) noexcept
template<typename T>
constexpr void	typecast_copy (uint8_t out[], const T &in)
template<typename T> requires std::is_trivially_copyable<T>::value
constexpr void	typecast_copy (uint8_t out[], T in[], size_t N)
std::string	ucs2_to_utf8 (const uint8_t ucs2[], size_t len)
std::string	ucs4_to_utf8 (const uint8_t ucs4[], size_t len)
template<typename T>
std::vector< T >	unlock (const secure_vector< T > &in)
bool	unsafe_for_production_build ()
template<typename T>
constexpr decltype(auto)	unwrap_strong_type (T &&t)
	Generically unwraps a strong type to its underlying type.
template<typename T, typename OT>
bool	value_exists (const std::vector< T > &vec, const OT &val)
constexpr size_t	var_ctz32 (uint32_t n)
template<typename C, size_t WindowBits, typename BlindedScalar>
C::ProjectivePoint	varpoint_exec (const AffinePointTable< C > &table, const BlindedScalar &scalar, RandomNumberGenerator &rng)
template<typename C, size_t TableSize>
AffinePointTable< C >	varpoint_setup (const typename C::AffinePoint &p)
void	vartime_divide (const BigInt &x, const BigInt &y_arg, BigInt &q_out, BigInt &r_out)
bool	verify_signature (std::span< const uint8_t, ED448_LEN > pk, bool phflag, std::span< const uint8_t > context, std::span< const uint8_t > sig, std::span< const uint8_t > msg)
	Verify a signature(RFC 8032 5.2.7)
const char *	version_cstr ()
uint32_t	version_datestamp ()
std::optional< std::string >	version_distribution_info ()
uint32_t	version_major ()
uint32_t	version_minor ()
uint32_t	version_patch ()
std::string	version_string ()
std::optional< std::string >	version_vc_revision ()
template<WordType W>
constexpr auto	word8_add2 (W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto	word8_add3 (W z[8], const W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto	word8_linmul2 (W x[8], W y, W carry) -> W
template<WordType W>
constexpr auto	word8_linmul3 (W z[8], const W x[8], W y, W carry) -> W
template<WordType W>
constexpr auto	word8_madd3 (W z[8], const W x[8], W y, W carry) -> W
template<WordType W>
constexpr auto	word8_sub2 (W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto	word8_sub2_rev (W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto	word8_sub3 (W z[8], const W x[8], const W y[8], W carry) -> W
template<WordType W>
constexpr auto	word_add (W x, W y, W *carry) -> W
template<WordType W>
constexpr auto	word_madd2 (W a, W b, W *c) -> W
template<WordType W>
constexpr auto	word_madd3 (W a, W b, W c, W *d) -> W
template<WordType W>
constexpr auto	word_sub (W x, W y, W *carry) -> W
constexpr size_t	words_for_bits (size_t x)
WotsPublicKey	wots_public_key_from_signature (const SphincsTreeNode &hashed_message, StrongSpan< const WotsSignature > signature, Sphincs_Address &address, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 8: wots_pkFromSig.
void	wots_sign_and_pkgen (StrongSpan< WotsSignature > sig_out, StrongSpan< SphincsTreeNode > leaf_out, const SphincsSecretSeed &secret_seed, TreeNodeIndex leaf_idx, std::optional< TreeNodeIndex > sign_leaf_idx, const std::vector< WotsHashIndex > &wots_steps, Sphincs_Address &leaf_addr, Sphincs_Address &pk_addr, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 6 and 7: wots_pkGen and wots_sign.
template<typename T, typename ParamT> requires std::constructible_from<T, ParamT> || (concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>)
constexpr decltype(auto)	wrap_strong_type (ParamT &&t)
	Wraps a value into a caller-defined (strong) type.
Point448	x448 (const ScalarX448 &k, const Point448 &u)
	Multiply a scalar k with a point u.
Point448	x448_basepoint (const ScalarX448 &k)
	Multiply a scalar with the base group element (5)
Path_Validation_Result	x509_path_validate (const std::vector< X509_Certificate > &end_certs, const Path_Validation_Restrictions &restrictions, const Certificate_Store &store, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result	x509_path_validate (const std::vector< X509_Certificate > &end_certs, const Path_Validation_Restrictions &restrictions, const std::vector< Certificate_Store * > &trusted_roots, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point ref_time, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result	x509_path_validate (const X509_Certificate &end_cert, const Path_Validation_Restrictions &restrictions, const Certificate_Store &store, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
Path_Validation_Result	x509_path_validate (const X509_Certificate &end_cert, const Path_Validation_Restrictions &restrictions, const std::vector< Certificate_Store * > &trusted_roots, std::string_view hostname, Usage_Type usage, std::chrono::system_clock::time_point when, std::chrono::milliseconds ocsp_timeout, const std::vector< std::optional< OCSP::Response > > &ocsp_resp)
SphincsTreeNode	xmss_gen_root (const Sphincs_Parameters &params, const SphincsSecretSeed &secret_seed, Sphincs_Hash_Functions &hashes)
SphincsTreeNode	xmss_sign_and_pkgen (StrongSpan< SphincsXmssSignature > out_sig, const SphincsTreeNode &message, const SphincsSecretSeed &secret_seed, Sphincs_Address &wots_addr, Sphincs_Address &tree_addr, std::optional< TreeNodeIndex > idx_leaf, const Sphincs_Parameters &params, Sphincs_Hash_Functions &hashes)
	FIPS 205, Algorithm 10: xmss_sign.
constexpr void	xor_buf (ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
constexpr void	xor_buf (ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in1, ranges::contiguous_range< uint8_t > auto &&in2)
void	xor_buf (std::span< uint8_t > out, std::span< const uint8_t > in, size_t n)
template<typename Alloc, typename Alloc2>
void	xor_buf (std::vector< uint8_t, Alloc > &out, const uint8_t *in, const std::vector< uint8_t, Alloc2 > &in2, size_t n)
template<typename Alloc>
void	xor_buf (std::vector< uint8_t, Alloc > &out, const uint8_t *in, size_t n)
void	xor_buf (uint8_t out[], const uint8_t in[], const uint8_t in2[], size_t length)
void	xor_buf (uint8_t out[], const uint8_t in[], size_t length)
void	xts_update_tweak_block (uint8_t tweak[], size_t BS, size_t blocks_in_tweak)
template<typename T, typename Alloc>
void	zap (std::vector< T, Alloc > &vec)
template<typename T, typename Alloc>
void	zeroise (std::vector< T, Alloc > &vec)

Variables
constexpr size_t	BLAKE2B_BLOCKBYTES = 128
constexpr size_t	BYTES_448 = ceil_tobytes(448)
constexpr size_t	DefaultBufferSize = 4096
constexpr size_t	ED448_LEN = 57
const size_t	HEX_CODEC_BUFFER_SIZE = 256
template<typename T>
constexpr bool	is_strong_span_v = is_strong_span<T>::value
template<typename... Ts>
constexpr bool	is_strong_type_v = is_strong_type<std::remove_const_t<Ts>...>::value
constexpr size_t	LMS_IDENTIFIER_LEN = 16
	The length in bytes of the LMS identifier (I).
const size_t	MAX_EXT_DEG = 16
const size_t	PRIME_TABLE_SIZE = 6541
const uint16_t	PRIMES []
const uint64_t	STREEBOG_Ax [8][256]
const uint64_t	STREEBOG_C [12][8]
constexpr size_t	WORDS_448 = 7
constexpr size_t	X448_LEN = 56

Detailed Description

Wrapper for truncated hashes (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2019 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019,2021 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019,2022 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018,2019 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2023 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2022 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

(C) 2018 Jack Lloyd (C) 2018 Ribose Inc

Botan is released under the Simplified BSD License (see license.txt)

Symmetric primitives for dilithium

(C) 2022-2023 Jack Lloyd (C) 2022-2023 Michael Boric, René Meusel - Rohde & Schwarz Cybersecurity (C) 2022 Manuel Glaser - Rohde & Schwarz Cybersecurity (C) 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

HSS - Hierarchical Signatures System (RFC 8554) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

HSS-LMS (C) 2023 Jack Lloyd 2023 Fabian Albert, René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Utils for HSS/LMS (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LM-OTS - Leighton-Micali One-Time Signatures (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LM-OTS - Leighton-Micali One-Time Signatures (RFC 8554 Section 4) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

LMS - Leighton-Micali Hash-Based Signatures (RFC 8554) (C) 2023 Jack Lloyd 2023 Fabian Albert, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Botan is released under the Simplified BSD License (see license.txt)

Abstraction for a combined KEM public and private key.

(C) 2024 Jack Lloyd 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Abstraction for a combined KEM encryptors and decryptors.

(C) 2024 Jack Lloyd 2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Adapter that allows using a KEX key as a KEM, using an ephemeral key in the KEM encapsulation.

(C) 2023 Jack Lloyd 2023,2024 Fabian Albert, René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Ordinary applications should never need to include or use this header. It is exposed only for specialized applications which want to implement new versions of public key crypto without merging them as changes to the library. One actual example of such usage is an application which creates RSA signatures using a custom TPM library. Unless you're doing something like that, you don't need anything here. Instead use pubkey.h which wraps these types safely and provides a stable application-oriented API.

Note: This header was accidentally pulled from the public API between Botan 3.0.0 and 3.2.0, and then restored in 3.3.0. If you are maintaining an application which used this header in Botan 2.x, you should make sure to use Botan 3.3.0 or later when migrating.

Hybrid Session Manager emitting both Tickets and storing sessions in Memory (C) 2023 Jack Lloyd (C) 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

TLS Session Manager in Memory (C) 2011 Jack Lloyd (C) 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

TLS Stateless Session Manager for stateless servers (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

Useful concepts that are available throughout the library (C) 2023 Jack Lloyd 2023 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2025 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

A wrapper class to implement strong types (C) 2022 Jack Lloyd 2022 René Meusel - Rohde & Schwarz Cybersecurity

Botan is released under the Simplified BSD License (see license.txt)

(C) 2024 Jack Lloyd

Botan is released under the Simplified BSD License (see license.txt)

Treehash logic used for hash-based signatures (C) 2023 Jack Lloyd 2023 Fabian Albert, René Meusel, Amos Treiber, Philippe Lieser - Rohde & Schwarz Cybersecurity GmbH

Parts of this file have been adapted from https://github.com/sphincs/sphincsplus

Botan is released under the Simplified BSD License (see license.txt)

utilities for PKIX::build_all_certificate_paths

Typedef Documentation

Altivec32x4

typedef __vector unsigned int Botan::Altivec32x4

Definition at line 24 of file aes_power8.cpp.

Altivec64x2

typedef __vector unsigned long long Botan::Altivec64x2

Definition at line 23 of file aes_power8.cpp.

Altivec8x16

typedef __vector unsigned char Botan::Altivec8x16

Definition at line 25 of file aes_power8.cpp.

bitvector

using Botan::bitvector = bitvector_base<std::allocator>

Definition at line 1299 of file bitvector.h.

Bounded_XOF

template<size_t bound>

using Botan::Bounded_XOF = detail::Bounded_XOF<XOF&, bound>

Definition at line 221 of file pqcrystals_helpers.h.

byte

using Botan::byte = std::uint8_t

Definition at line 110 of file types.h.

CCCryptorStatus

typedef int32_t Botan::CCCryptorStatus

Definition at line 24 of file commoncrypto.h.

CertificatePathStatusCodes

typedef std::vector<std::set<Certificate_Status_Code> > Botan::CertificatePathStatusCodes

This type represents the validation status of an entire certificate path. There is one set of status codes for each certificate in the path.

Definition at line 29 of file x509path.h.

CmceCodeWord

using Botan::CmceCodeWord = Strong<secure_bitvector, struct CmceCodeWord_>

Represents C of decapsulation.

Definition at line 52 of file cmce_types.h.

CmceColumnSelection

using Botan::CmceColumnSelection = Strong<secure_bitvector, struct CmceColumnSelection_>

Represents c of private key.

Definition at line 46 of file cmce_types.h.

CmceErrorVector

using Botan::CmceErrorVector = Strong<secure_bitvector, struct CmceErrorVector_>

Represents e of encapsulation.

Definition at line 49 of file cmce_types.h.

CmceGfElem

using Botan::CmceGfElem = Strong<uint16_t, struct CmceGfElem_>

Represents a GF(q) element.

Definition at line 19 of file cmce_types.h.

CmceGfMod

using Botan::CmceGfMod = Strong<uint16_t, struct CmceGfMod_>

Represents a GF(q) modulus.

Definition at line 22 of file cmce_types.h.

CmceInitialSeed

using Botan::CmceInitialSeed = Strong<secure_vector<uint8_t>, struct CmceInitialSeed_>

Represents initial delta of keygen.

Definition at line 31 of file cmce_types.h.

CmceIrreducibleBits

using Botan::CmceIrreducibleBits = Strong<secure_vector<uint8_t>, struct CmceIrreducibleBits_>

Definition at line 40 of file cmce_types.h.

CmceKeyGenSeed

using Botan::CmceKeyGenSeed = Strong<secure_vector<uint8_t>, struct CmceKeyGenSeed_>

Represents a delta (can be altered; final value stored in private key)

Definition at line 34 of file cmce_types.h.

CmceOrderingBits

using Botan::CmceOrderingBits = Strong<secure_vector<uint8_t>, struct CmceOrderingBits_>

Definition at line 37 of file cmce_types.h.

CmcePermutation

using Botan::CmcePermutation = Strong<secure_vector<uint16_t>, struct CmcePermutation_>

Represents a permutation (pi in spec). Used in field ordering creation.

Definition at line 28 of file cmce_types.h.

CmcePermutationElement

using Botan::CmcePermutationElement = Strong<uint16_t, struct CmcePermutationElement_>

Represents an element of a permuation (pi in spec). Used in field ordering creation.

Definition at line 25 of file cmce_types.h.

CmceRejectionSeed

using Botan::CmceRejectionSeed = Strong<secure_vector<uint8_t>, struct CmceRejectionSeed_>

Represents s of private key.

Definition at line 43 of file cmce_types.h.

Curve25519_PrivateKey

typedef X25519_PrivateKey Botan::Curve25519_PrivateKey

Definition at line 18 of file curve25519.h.

Curve25519_PublicKey

typedef X25519_PublicKey Botan::Curve25519_PublicKey

Definition at line 17 of file curve25519.h.

DilithiumCommitmentHash

using Botan::DilithiumCommitmentHash = Strong<std::vector<uint8_t>, struct DilithiumCommitmentHash_>

Hash of the message representative and the signer's commitment.

Definition at line 64 of file dilithium_types.h.

DilithiumHashedPublicKey

using Botan::DilithiumHashedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumHashedPublicKey_>

Hash value of the serialized public key data (result of H(BytesToBits(pkEncode(pk)), also referred to as 'tr')

Definition at line 52 of file dilithium_types.h.

DilithiumInternalKeypair

using Botan::DilithiumInternalKeypair

Initial value:

 
   std::pair<std::shared_ptr<Dilithium_PublicKeyInternal>, std::shared_ptr<Dilithium_PrivateKeyInternal>>

Internal representation of a Dilithium key pair.

Definition at line 67 of file dilithium_types.h.

DilithiumMessageRepresentative

using Botan::DilithiumMessageRepresentative = Strong<std::vector<uint8_t>, struct DilithiumMessageRepresentative_>

Representation of the message to be signed.

Definition at line 55 of file dilithium_types.h.

DilithiumOptionalRandomness

using Botan::DilithiumOptionalRandomness = Strong<secure_vector<uint8_t>, struct DilithiumOptionalRandomness_>

Optional randomness 'rnd' used for rho prime computation in ML-DSA.

Definition at line 39 of file dilithium_types.h.

DilithiumPoly

using Botan::DilithiumPoly = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 26 of file dilithium_types.h.

DilithiumPolyMatNTT

using Botan::DilithiumPolyMatNTT = Botan::CRYSTALS::PolynomialMatrix<DilithiumPolyTraits>

Definition at line 24 of file dilithium_types.h.

DilithiumPolyNTT

using Botan::DilithiumPolyNTT = Botan::CRYSTALS::Polynomial<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 22 of file dilithium_types.h.

DilithiumPolyVec

using Botan::DilithiumPolyVec = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 27 of file dilithium_types.h.

DilithiumPolyVecNTT

using Botan::DilithiumPolyVecNTT = Botan::CRYSTALS::PolynomialVector<DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 23 of file dilithium_types.h.

DilithiumSeedRandomness

using Botan::DilithiumSeedRandomness = Strong<secure_vector<uint8_t>, struct DilithiumSeedRandomness_>

Principal seed used to generate Dilithium key pairs.

Definition at line 30 of file dilithium_types.h.

DilithiumSeedRho

using Botan::DilithiumSeedRho = Strong<std::vector<uint8_t>, struct DilithiumPublicSeed_>

Public seed to sample the polynomial matrix A from.

Definition at line 33 of file dilithium_types.h.

DilithiumSeedRhoPrime

using Botan::DilithiumSeedRhoPrime = Strong<secure_vector<uint8_t>, struct DilithiumSeedRhoPrime_>

Private seed to sample the polynomial vectors s1 and s2 from.

Definition at line 36 of file dilithium_types.h.

DilithiumSerializedCommitment

using Botan::DilithiumSerializedCommitment = Strong<std::vector<uint8_t>, struct DilithiumSerializedCommitment_>

Serialized representation of a commitment w1.

Definition at line 61 of file dilithium_types.h.

DilithiumSerializedPrivateKey

using Botan::DilithiumSerializedPrivateKey = Strong<secure_vector<uint8_t>, struct DilithiumSerializedPrivateKey_>

Serialized private key data.

Definition at line 45 of file dilithium_types.h.

DilithiumSerializedPublicKey

using Botan::DilithiumSerializedPublicKey = Strong<std::vector<uint8_t>, struct DilithiumSerializedPublicKey_>

Serialized public key data (result of pkEncode(pk))

Definition at line 48 of file dilithium_types.h.

DilithiumSerializedSignature

using Botan::DilithiumSerializedSignature = Strong<std::vector<uint8_t>, struct DilithiumSerializedSignature_>

Serialized signature data.

Definition at line 58 of file dilithium_types.h.

DilithiumSigningSeedK

using Botan::DilithiumSigningSeedK = Strong<secure_vector<uint8_t>, struct DilithiumSeedK_>

Private seed K used during signing.

Definition at line 42 of file dilithium_types.h.

ForsLeafSecret

using Botan::ForsLeafSecret = Strong<secure_vector<uint8_t>, struct ForsLeafSecret_>

Definition at line 71 of file sp_types.h.

ForsSignature

using Botan::ForsSignature = Strong<std::vector<uint8_t>, struct ForsSignature_>

Definition at line 72 of file sp_types.h.

FrodoDomainSeparator

using Botan::FrodoDomainSeparator = Strong<std::array<uint8_t, 1>, struct FrodoDoaminSeparator_>

Definition at line 47 of file frodo_types.h.

FrodoIntermediateSharedSecret

using Botan::FrodoIntermediateSharedSecret = Strong<secure_vector<uint8_t>, struct FrodoIntermediateSharedSecret_>

Definition at line 56 of file frodo_types.h.

FrodoPackedMatrix

using Botan::FrodoPackedMatrix = Strong<std::vector<uint8_t>, struct FrodoPackedMatrix_>

Definition at line 41 of file frodo_types.h.

FrodoPlaintext

using Botan::FrodoPlaintext = Strong<secure_vector<uint8_t>, struct FrodoPlaintext_>

Definition at line 50 of file frodo_types.h.

FrodoPublicKeyHash

using Botan::FrodoPublicKeyHash = Strong<std::vector<uint8_t>, struct FrodoPublicKeyHash_>

Definition at line 38 of file frodo_types.h.

FrodoSalt

using Botan::FrodoSalt = Strong<std::vector<uint8_t>, struct FrodoSalt_>

Definition at line 53 of file frodo_types.h.

FrodoSampleR

using Botan::FrodoSampleR = Strong<secure_vector<uint8_t>, struct FrodoSampleR_>

Definition at line 35 of file frodo_types.h.

FrodoSeedA

using Botan::FrodoSeedA = Strong<std::vector<uint8_t>, struct FrodoSeedA_>

Definition at line 23 of file frodo_types.h.

FrodoSeedS

using Botan::FrodoSeedS = Strong<secure_vector<uint8_t>, struct FrodoSeedS_>

Definition at line 26 of file frodo_types.h.

FrodoSeedSE

using Botan::FrodoSeedSE = Strong<secure_vector<uint8_t>, struct FrodoSeedSE_>

Definition at line 29 of file frodo_types.h.

FrodoSeedZ

using Botan::FrodoSeedZ = Strong<std::vector<uint8_t>, struct FrodoSeedZ_>

Definition at line 32 of file frodo_types.h.

FrodoSerializedMatrix

using Botan::FrodoSerializedMatrix = Strong<secure_vector<uint8_t>, struct FrodoSerializedMatrix_>

Definition at line 44 of file frodo_types.h.

GenerateLeafFunction

using Botan::GenerateLeafFunction = std::function<void(StrongSpan<SphincsTreeNode> , TreeNodeIndex)>

Definition at line 25 of file sp_treehash.h.

gf2m

typedef uint16_t Botan::gf2m

Definition at line 20 of file gf2m_small_m.h.

HSS_Level

using Botan::HSS_Level = Strong<uint32_t, struct HSS_Level_, EnableArithmeticWithPlainNumber>

The HSS layer in the HSS multi tree starting at 0 from the root.

Definition at line 34 of file hss.h.

HSS_Sig_Idx

using Botan::HSS_Sig_Idx = Strong<uint64_t, struct HSS_Sig_Idx_, EnableArithmeticWithPlainNumber>

The index of a node within a specific LMS tree layer.

Definition at line 29 of file hss.h.

HypertreeLayerIndex

using Botan::HypertreeLayerIndex = Strong<uint32_t, struct HypertreeLayerIndex_>

Index of a layer in the XMSS hyper-tree.

Definition at line 86 of file sp_types.h.

InitializationVector

using Botan::InitializationVector = OctetString

Alternate name for octet string showing intent to use as an IV

Definition at line 145 of file symkey.h.

Integrity_Failure

typedef Invalid_Authentication_Tag Botan::Integrity_Failure

For compatibility with older versions

Definition at line 283 of file exceptn.h.

KyberCompressedCiphertext

using Botan::KyberCompressedCiphertext = Strong<std::vector<uint8_t>, struct KyberCompressedCiphertext_>

Compressed and serialized ciphertext value.

Definition at line 63 of file kyber_types.h.

KyberEncryptionRandomness

using Botan::KyberEncryptionRandomness = Strong<secure_vector<uint8_t>, struct KyberEncryptionRandomness_>

Random value used to generate the Kyber ciphertext.

Definition at line 48 of file kyber_types.h.

KyberHashedCiphertext

using Botan::KyberHashedCiphertext = Strong<std::vector<uint8_t>, struct KyberHashedCiphertext_>

Hash of the compressed and serialized ciphertext value TODO: Remove this once Kyber-R3 is removed

Definition at line 67 of file kyber_types.h.

KyberHashedPublicKey

using Botan::KyberHashedPublicKey = Strong<std::vector<uint8_t>, struct KyberHashedPublicKey_>

Hash value of the serialized public key.

Definition at line 60 of file kyber_types.h.

KyberImplicitRejectionValue

using Botan::KyberImplicitRejectionValue = Strong<secure_vector<uint8_t>, struct KyberImplicitRejectionValue_>

Secret random value (called Z in the spec), used for implicit rejection in the decapsulation.

Definition at line 42 of file kyber_types.h.

KyberInternalKeypair

using Botan::KyberInternalKeypair

Initial value:

 
   std::pair<std::shared_ptr<Kyber_PublicKeyInternal>, std::shared_ptr<Kyber_PrivateKeyInternal>>

Definition at line 73 of file kyber_types.h.

KyberMessage

using Botan::KyberMessage = Strong<secure_vector<uint8_t>, struct KyberMessage_>

Random message value to be encrypted by the CPA-secure Kyber encryption scheme.

Definition at line 45 of file kyber_types.h.

KyberPoly

using Botan::KyberPoly = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 29 of file kyber_types.h.

KyberPolyMat

using Botan::KyberPolyMat = Botan::CRYSTALS::PolynomialMatrix<KyberPolyTraits>

Definition at line 27 of file kyber_types.h.

KyberPolyNTT

using Botan::KyberPolyNTT = Botan::CRYSTALS::Polynomial<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 25 of file kyber_types.h.

KyberPolyVec

using Botan::KyberPolyVec = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::Normal>

Definition at line 30 of file kyber_types.h.

KyberPolyVecNTT

using Botan::KyberPolyVecNTT = Botan::CRYSTALS::PolynomialVector<KyberPolyTraits, Botan::CRYSTALS::Domain::NTT>

Definition at line 26 of file kyber_types.h.

KyberSamplingRandomness

using Botan::KyberSamplingRandomness = Strong<secure_vector<uint8_t>, struct KyberSamplingRandomness_>

PRF value used for sampling of error polynomials.

Definition at line 51 of file kyber_types.h.

KyberSeedRandomness

using Botan::KyberSeedRandomness = Strong<secure_vector<uint8_t>, struct KyberSeedRandomness_>

Principal seed used to generate Kyber key pairs.

Definition at line 33 of file kyber_types.h.

KyberSeedRho

using Botan::KyberSeedRho = Strong<std::vector<uint8_t>, struct KyberSeedRho_>

Public seed value to generate the Kyber matrix A.

Definition at line 36 of file kyber_types.h.

KyberSeedSigma

using Botan::KyberSeedSigma = Strong<secure_vector<uint8_t>, struct KyberSeedSigma_>

Private seed used to generate polynomial vectors s and e during key generation.

Definition at line 39 of file kyber_types.h.

KyberSerializedPublicKey

using Botan::KyberSerializedPublicKey = Strong<std::vector<uint8_t>, struct KyberSerializedPublicKey_>

Public key in serialized form (t || rho)

Definition at line 57 of file kyber_types.h.

KyberSharedSecret

using Botan::KyberSharedSecret = Strong<secure_vector<uint8_t>, struct KyberSharedSecret_>

Shared secret value generated during encapsulation and recovered during decapsulation.

Definition at line 54 of file kyber_types.h.

KyberSigmaOrEncryptionRandomness

using Botan::KyberSigmaOrEncryptionRandomness

Initial value:

 
   std::variant<StrongSpan<const KyberSeedSigma>, StrongSpan<const KyberEncryptionRandomness>>

Variant value of either a KyberSeedSigma or a KyberEncryptionRandomness.

Definition at line 70 of file kyber_types.h.

LMOTS_K

using Botan::LMOTS_K = Strong<std::vector<uint8_t>, struct LMOTS_K_>

The K value from the LM-OTS public key.

Definition at line 35 of file lm_ots.h.

LMOTS_Node

using Botan::LMOTS_Node = Strong<secure_vector<uint8_t>, struct LMOTS_Node_>

One node within one LM-OTS hash chain.

Definition at line 30 of file lm_ots.h.

LMOTS_Signature_Bytes

using Botan::LMOTS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMOTS_Signature_Bytes_>

Byte vector of an LM-OTS signature.

Definition at line 40 of file lm_ots.h.

LMS_AuthenticationPath

using Botan::LMS_AuthenticationPath = Strong<std::vector<uint8_t>, struct LMS_AuthenticationPath_>

The authentication path of an LMS signature.

Definition at line 72 of file lms.h.

LMS_Identifier

using Botan::LMS_Identifier = Strong<std::vector<uint8_t>, struct LMS_Identifier_>

The identifier of an LMS tree (I in RFC 8554)

Definition at line 50 of file lm_ots.h.

LMS_Message

using Botan::LMS_Message = Strong<std::vector<uint8_t>, struct LMS_Message_>

A message that is signed with an LMS tree.

Definition at line 55 of file lm_ots.h.

LMS_Seed

using Botan::LMS_Seed = Strong<secure_vector<uint8_t>, struct LMS_SEED_>

Seed of the LMS tree, used to generate the LM-OTS private keys.

Definition at line 25 of file lm_ots.h.

LMS_Signature_Bytes

using Botan::LMS_Signature_Bytes = Strong<std::vector<uint8_t>, struct LMS_Signature_Bytes_>

Raw bytes of an LMS signature.

Definition at line 82 of file lms.h.

LMS_Tree_Node

using Botan::LMS_Tree_Node = Strong<std::vector<uint8_t>, struct LMS_Tree_Node_>

A node with the LMS tree.

Definition at line 77 of file lms.h.

LMS_Tree_Node_Idx

using Botan::LMS_Tree_Node_Idx = Strong<uint32_t, struct LMS_Tree_Node_Idx_, EnableArithmeticWithPlainNumber>

The index of a node within a specific LMS tree layer.

Definition at line 45 of file lm_ots.h.

lock_guard_type

template<typename T>

using Botan::lock_guard_type = lock_guard<T>

Definition at line 55 of file mutex.h.

MAC

typedef MessageAuthenticationCode Botan::MAC

Definition at line 133 of file mac.h.

ML_DSA_Mode

using Botan::ML_DSA_Mode = DilithiumMode

Definition at line 21 of file ml_dsa.h.

ML_DSA_PrivateKey

using Botan::ML_DSA_PrivateKey = Dilithium_PrivateKey

Definition at line 23 of file ml_dsa.h.

ML_DSA_PublicKey

using Botan::ML_DSA_PublicKey = Dilithium_PublicKey

Definition at line 22 of file ml_dsa.h.

ML_KEM_Mode

using Botan::ML_KEM_Mode = KyberMode

Definition at line 21 of file ml_kem.h.

ML_KEM_PrivateKey

using Botan::ML_KEM_PrivateKey = Kyber_PrivateKey

Definition at line 23 of file ml_kem.h.

ML_KEM_PublicKey

using Botan::ML_KEM_PublicKey = Kyber_PublicKey

Definition at line 22 of file ml_kem.h.

mutex_type

using Botan::mutex_type = noop_mutex

Definition at line 37 of file mutex.h.

next_longer_int_t

template<std::signed_integral T>

using Botan::next_longer_int_t

Initial value:

 
   std::conditional_t<sizeof(T) == 1, int16_t,
   std::conditional_t<sizeof(T) == 2, int32_t,
   std::conditional_t<sizeof(T) == 4, int64_t, void>>>

Definition at line 35 of file pqcrystals_helpers.h.

next_longer_uint_t

template<std::unsigned_integral T>

using Botan::next_longer_uint_t

Initial value:

 
   std::conditional_t<sizeof(T) == 1, uint16_t,
   std::conditional_t<sizeof(T) == 2, uint32_t,
   std::conditional_t<sizeof(T) == 4, uint64_t, void>>>

Definition at line 28 of file pqcrystals_helpers.h.

Point448

using Botan::Point448 = Strong<std::array<uint8_t, X448_LEN>, struct Point448_>

Definition at line 18 of file x448_internal.h.

PointGFp

typedef EC_Point Botan::PointGFp

Definition at line 429 of file ec_point.h.

recursive_mutex_type

using Botan::recursive_mutex_type = noop_mutex

Definition at line 38 of file mutex.h.

RNG

typedef RandomNumberGenerator Botan::RNG

Convenience typedef

Definition at line 285 of file rng.h.

S2K

typedef PBKDF Botan::S2K

Definition at line 235 of file pbkdf.h.

s32bit

using Botan::s32bit = std::int32_t

Definition at line 114 of file types.h.

ScalarX448

using Botan::ScalarX448 = Strong<std::array<uint8_t, X448_LEN>, struct ScalarX448_>

Definition at line 24 of file x448_internal.h.

secure_bitvector

using Botan::secure_bitvector = bitvector_base<secure_allocator>

Definition at line 1298 of file bitvector.h.

secure_deque

template<typename T>

using Botan::secure_deque = std::deque<T, secure_allocator<T>>

Definition at line 69 of file secmem.h.

secure_vector

template<typename T>

using Botan::secure_vector = std::vector<T, secure_allocator<T>>

Definition at line 65 of file secmem.h.

SecureVector

template<typename T>

using Botan::SecureVector = secure_vector<T>

Definition at line 74 of file secmem.h.

SM2_Encryption_PrivateKey

typedef SM2_PrivateKey Botan::SM2_Encryption_PrivateKey

Definition at line 166 of file sm2.h.

SM2_Encryption_PublicKey

typedef SM2_PublicKey Botan::SM2_Encryption_PublicKey

Definition at line 163 of file sm2.h.

SM2_Signature_PrivateKey

typedef SM2_PrivateKey Botan::SM2_Signature_PrivateKey

Definition at line 165 of file sm2.h.

SM2_Signature_PublicKey

typedef SM2_PublicKey Botan::SM2_Signature_PublicKey

Definition at line 162 of file sm2.h.

SphincsAuthenticationPath

using Botan::SphincsAuthenticationPath = Strong<std::vector<uint8_t>, struct SphincsAuthenticationPath_>

Definition at line 67 of file sp_types.h.

SphincsContext

using Botan::SphincsContext = Strong<std::vector<uint8_t>, struct SphincsContext_>

Definition at line 57 of file sp_types.h.

SphincsHashedMessage

using Botan::SphincsHashedMessage = Strong<std::vector<uint8_t>, struct SphincsHashedMessage_>

Definition at line 59 of file sp_types.h.

SphincsHypertreeSignature

using Botan::SphincsHypertreeSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>

Definition at line 66 of file sp_types.h.

SphincsInputMessage

using Botan::SphincsInputMessage = Strong<std::vector<uint8_t>, struct SphincsInputMessage_>

Definition at line 49 of file sp_types.h.

SphincsMessagePrefix

using Botan::SphincsMessagePrefix = Strong<std::vector<uint8_t>, struct SphincsMessagePrefix_>

The prefix appended to the message in [hash_]slh_sign and slh_verify. E.g. for SLH-DSA (pure): 0x00 || |ctx| || ctx. Empty for SPHINCS+.

Definition at line 47 of file sp_types.h.

SphincsMessageRandomness

using Botan::SphincsMessageRandomness = Strong<secure_vector<uint8_t>, struct SphincsMessageRandomness_>

Definition at line 64 of file sp_types.h.

SphincsOptionalRandomness

using Botan::SphincsOptionalRandomness = Strong<secure_vector<uint8_t>, struct SphincsOptionalRandomness_>

Definition at line 63 of file sp_types.h.

SphincsPublicSeed

using Botan::SphincsPublicSeed = Strong<std::vector<uint8_t>, struct SphincsPublicSeed_>

Definition at line 60 of file sp_types.h.

SphincsSecretPRF

using Botan::SphincsSecretPRF = Strong<secure_vector<uint8_t>, struct SphincsSecretPRF_>

Definition at line 62 of file sp_types.h.

SphincsSecretSeed

using Botan::SphincsSecretSeed = Strong<secure_vector<uint8_t>, struct SphincsSecretSeed_>

Definition at line 61 of file sp_types.h.

SphincsTreeNode

using Botan::SphincsTreeNode = Strong<std::vector<uint8_t>, struct SphincsTreeNode_>

Either an XMSS or FORS tree node or leaf.

Definition at line 70 of file sp_types.h.

SphincsXmssSignature

using Botan::SphincsXmssSignature = Strong<std::vector<uint8_t>, struct SphincsXmssSignature_>

Definition at line 65 of file sp_types.h.

strong_type_wrapped_type

template<typename T>

using Botan::strong_type_wrapped_type = typename detail::wrapped_type_helper<std::remove_cvref_t<T>>::type

Extracts the wrapped type from a strong type.

If the provided type is not a strong type, it is returned as is.

Note

This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary ::wrapped_type declaration if you know that you are dealing with a strong type.

Definition at line 287 of file strong_type.h.

SymmetricKey

using Botan::SymmetricKey = OctetString

Alternate name for octet string showing intent to use as a key

Definition at line 140 of file symkey.h.

TreeLayerIndex

using Botan::TreeLayerIndex = Strong<uint32_t, struct TreeLayerIndex_, EnableArithmeticWithPlainNumber>

Index of the layer within a FORS/XMSS tree.

Definition at line 83 of file sp_types.h.

TreeNodeIndex

using Botan::TreeNodeIndex = Strong<uint32_t, struct TreeNodeIndex_, EnableArithmeticWithPlainNumber>

Index of an individual node inside an XMSS or FORS tree.

Definition at line 92 of file sp_types.h.

u16bit

using Botan::u16bit = std::uint16_t

Definition at line 111 of file types.h.

u32bit

using Botan::u32bit = std::uint32_t

Definition at line 112 of file types.h.

u64bit

using Botan::u64bit = std::uint64_t

Definition at line 113 of file types.h.

word

using Botan::word = std::conditional_t<HasNative64BitRegisters, std::uint64_t, uint32_t>

Definition at line 119 of file types.h.

wots_keysig_t

typedef std::vector< secure_vector< uint8_t > > Botan::wots_keysig_t

Definition at line 20 of file xmss_common_ops.h.

WotsChainIndex

using Botan::WotsChainIndex = Strong<uint32_t, struct WotsChainIndex_>

Index of a WOTS chain within a single usage of WOTS.

Definition at line 95 of file sp_types.h.

WotsHashIndex

using Botan::WotsHashIndex = Strong<uint8_t, struct WotsHashIndex_, EnableArithmeticWithPlainNumber>

Index of a hash application inside a single WOTS chain (integers in "base_w")

Definition at line 98 of file sp_types.h.

WotsNode

using Botan::WotsNode = Strong<secure_vector<uint8_t>, struct WotsNode_>

Start (or intermediate) node of a WOTS+ chain.

Definition at line 79 of file sp_types.h.

WotsPublicKey

using Botan::WotsPublicKey = Strong<std::vector<uint8_t>, struct WotsPublicKey_>

Definition at line 73 of file sp_types.h.

WotsPublicKeyNode

using Botan::WotsPublicKeyNode = Strong<std::vector<uint8_t>, struct WotsPublicKeyNode_>

End node of a WOTS+ chain (part of the WOTS+ public key)

Definition at line 76 of file sp_types.h.

WotsSignature

using Botan::WotsSignature = Strong<secure_vector<uint8_t>, struct WotsSignature_>

Definition at line 80 of file sp_types.h.

X509_Time

typedef ASN1_Time Botan::X509_Time

Definition at line 417 of file asn1_obj.h.

XmssTreeIndexInLayer

using Botan::XmssTreeIndexInLayer = Strong<uint64_t, struct XmssTreeIndexInLayer_, EnableArithmeticWithPlainNumber>

Index of an XMSS tree (unique for just the local hyper-tree layer)

Definition at line 89 of file sp_types.h.

Enumeration Type Documentation

AlignmentBufferFinalBlock

enum class Botan::AlignmentBufferFinalBlock : size_t

strong

Defines the strategy for handling the final block of input data in the handle_unaligned_data() method of the AlignmentBuffer<>.

• is_not_special: the final block is treated like any other block
• must_be_deferred: the final block is not emitted while bulk processing (typically add_data()) but is deferred until manually consumed (typically final_result())

The AlignmentBuffer<> assumes data to be "the final block" if no further input data is available in the BufferSlicer<>. This might result in some performance overhead when using the must_be_deferred strategy.

Enumerator
is_not_special
must_be_deferred

Definition at line 34 of file alignment_buffer.h.

                                     : size_t {
   is_not_special = 0,
   must_be_deferred = 1,
};

ASN1_Class

enum class Botan::ASN1_Class : uint32_t

strong

ASN.1 Class Tags

Enumerator
Universal
Application
ContextSpecific
Private
Constructed
ExplicitContextSpecific
NoObject

Definition at line 29 of file asn1_obj.h.

                      : uint32_t {
   Universal = 0b0000'0000,
   Application = 0b0100'0000,
   ContextSpecific = 0b1000'0000,
   Private = 0b1100'0000,
 
   Constructed = 0b0010'0000,
   ExplicitContextSpecific = Constructed | ContextSpecific,
 
   NoObject = 0xFF00
};

ASN1_Type

enum class Botan::ASN1_Type : uint32_t

strong

ASN.1 Type Tags

Enumerator
Eoc
Boolean
Integer
BitString
OctetString
Null
ObjectId
Enumerated
Sequence
Set
Utf8String
NumericString
PrintableString
TeletexString
Ia5String
VisibleString
UniversalString
BmpString
UtcTime
GeneralizedTime
NoObject

Definition at line 44 of file asn1_obj.h.

                     : uint32_t {
   Eoc = 0x00,
   Boolean = 0x01,
   Integer = 0x02,
   BitString = 0x03,
   OctetString = 0x04,
   Null = 0x05,
   ObjectId = 0x06,
   Enumerated = 0x0A,
   Sequence = 0x10,
   Set = 0x11,
 
   Utf8String = 0x0C,
   NumericString = 0x12,
   PrintableString = 0x13,
   TeletexString = 0x14,
   Ia5String = 0x16,
   VisibleString = 0x1A,
   UniversalString = 0x1C,
   BmpString = 0x1E,
 
   UtcTime = 0x17,
   GeneralizedTime = 0x18,
 
   NoObject = 0xFF00,
};

Certificate_Status_Code

enum class Botan::Certificate_Status_Code

strong

Certificate validation status code

Enumerator
OK
VERIFIED
OCSP_RESPONSE_GOOD
OCSP_SIGNATURE_OK
VALID_CRL_CHECKED
OCSP_NO_HTTP
FIRST_WARNING_STATUS
CERT_SERIAL_NEGATIVE
DN_TOO_LONG
OCSP_NO_REVOCATION_URL
OCSP_SERVER_NOT_AVAILABLE
TRUSTED_CERT_HAS_EXPIRED
TRUSTED_CERT_NOT_YET_VALID
FIRST_ERROR_STATUS
SIGNATURE_METHOD_TOO_WEAK
UNTRUSTED_HASH
NO_REVOCATION_DATA
NO_MATCHING_CRLDP
OCSP_ISSUER_NOT_TRUSTED
CERT_NOT_YET_VALID
CERT_HAS_EXPIRED
OCSP_NOT_YET_VALID
OCSP_HAS_EXPIRED
CRL_NOT_YET_VALID
CRL_HAS_EXPIRED
OCSP_IS_TOO_OLD
CERT_ISSUER_NOT_FOUND
CANNOT_ESTABLISH_TRUST
CERT_CHAIN_LOOP
CHAIN_LACKS_TRUST_ROOT
CHAIN_NAME_MISMATCH
POLICY_ERROR
INVALID_USAGE
CERT_CHAIN_TOO_LONG
CA_CERT_NOT_FOR_CERT_ISSUER
NAME_CONSTRAINT_ERROR
CA_CERT_NOT_FOR_CRL_ISSUER
OCSP_CERT_NOT_LISTED
OCSP_BAD_STATUS
CERT_NAME_NOMATCH
UNKNOWN_CRITICAL_EXTENSION
DUPLICATE_CERT_EXTENSION
OCSP_SIGNATURE_ERROR
OCSP_ISSUER_NOT_FOUND
OCSP_RESPONSE_MISSING_KEYUSAGE
OCSP_RESPONSE_INVALID
EXT_IN_V1_V2_CERT
DUPLICATE_CERT_POLICY
V2_IDENTIFIERS_IN_V1_CERT
CERT_IS_REVOKED
CRL_BAD_SIGNATURE
SIGNATURE_ERROR
CERT_PUBKEY_INVALID
SIGNATURE_ALGO_UNKNOWN
SIGNATURE_ALGO_BAD_PARAMS

Definition at line 20 of file pkix_enums.h.

                                   {
   OK = 0,
   VERIFIED = 0,
 
   // Revocation status
   OCSP_RESPONSE_GOOD = 1,
   OCSP_SIGNATURE_OK = 2,
   VALID_CRL_CHECKED = 3,
   OCSP_NO_HTTP = 4,
 
   // Warnings
   FIRST_WARNING_STATUS = 500,
   CERT_SERIAL_NEGATIVE = 500,
   DN_TOO_LONG = 501,
   OCSP_NO_REVOCATION_URL = 502,
   OCSP_SERVER_NOT_AVAILABLE = 503,
   TRUSTED_CERT_HAS_EXPIRED = 504,
   TRUSTED_CERT_NOT_YET_VALID = 505,
 
   // Errors
   FIRST_ERROR_STATUS = 1000,
 
   SIGNATURE_METHOD_TOO_WEAK = 1000,
   UNTRUSTED_HASH = 1001,
   NO_REVOCATION_DATA = 1002,
   NO_MATCHING_CRLDP = 1003,
   OCSP_ISSUER_NOT_TRUSTED = 1004,
 
   // Time problems
   CERT_NOT_YET_VALID = 2000,
   CERT_HAS_EXPIRED = 2001,
   OCSP_NOT_YET_VALID = 2002,
   OCSP_HAS_EXPIRED = 2003,
   CRL_NOT_YET_VALID = 2004,
   CRL_HAS_EXPIRED = 2005,
   OCSP_IS_TOO_OLD = 2006,
 
   // Chain generation problems
   CERT_ISSUER_NOT_FOUND = 3000,
   CANNOT_ESTABLISH_TRUST = 3001,
   CERT_CHAIN_LOOP = 3002,
   CHAIN_LACKS_TRUST_ROOT = 3003,
   CHAIN_NAME_MISMATCH = 3004,
 
   // Validation errors
   POLICY_ERROR = 4000,
   INVALID_USAGE = 4001,
   CERT_CHAIN_TOO_LONG = 4002,
   CA_CERT_NOT_FOR_CERT_ISSUER = 4003,
   NAME_CONSTRAINT_ERROR = 4004,
 
   // Revocation errors
   CA_CERT_NOT_FOR_CRL_ISSUER = 4005,
   OCSP_CERT_NOT_LISTED = 4006,
   OCSP_BAD_STATUS = 4007,
 
   // Other problems
   CERT_NAME_NOMATCH = 4008,
   UNKNOWN_CRITICAL_EXTENSION = 4009,
   DUPLICATE_CERT_EXTENSION = 4010,
   OCSP_SIGNATURE_ERROR = 4501,
   OCSP_ISSUER_NOT_FOUND = 4502,
   OCSP_RESPONSE_MISSING_KEYUSAGE = 4503,
   OCSP_RESPONSE_INVALID = 4504,
   EXT_IN_V1_V2_CERT = 4505,
   DUPLICATE_CERT_POLICY = 4506,
   V2_IDENTIFIERS_IN_V1_CERT = 4507,
 
   // Hard failures
   CERT_IS_REVOKED = 5000,
   CRL_BAD_SIGNATURE = 5001,
   SIGNATURE_ERROR = 5002,
   CERT_PUBKEY_INVALID = 5003,
   SIGNATURE_ALGO_UNKNOWN = 5004,
   SIGNATURE_ALGO_BAD_PARAMS = 5005
};

Cipher_Dir

enum class Botan::Cipher_Dir : int

strong

The two possible directions a Cipher_Mode can operate in

Enumerator
Encryption
Decryption
ENCRYPTION
DECRYPTION

Definition at line 26 of file cipher_mode.h.

                      : int {
   Encryption,
   Decryption,
 
   ENCRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Encryption") = Encryption,
   DECRYPTION BOTAN_DEPRECATED("Use Cipher_Dir::Decryption") = Decryption,
};

CRL_Code

enum class Botan::CRL_Code : uint32_t

strong

X.509v2 CRL Reason Code.

Enumerator
Unspecified
KeyCompromise
CaCompromise
AffiliationChanged
Superseded
CessationOfOperation
CertificateHold
RemoveFromCrl
PrivilegeWithdrawn
AaCompromise

Definition at line 192 of file pkix_enums.h.

                    : uint32_t {
   Unspecified = 0,
   KeyCompromise = 1,
   CaCompromise = 2,
   AffiliationChanged = 3,
   Superseded = 4,
   CessationOfOperation = 5,
   CertificateHold = 6,
   RemoveFromCrl = 8,
   PrivilegeWithdrawn = 9,
   AaCompromise = 10,
};

Decoder_Checking

enum Botan::Decoder_Checking

The type of checking to be performed by decoders: NONE - no checks, IGNORE_WS - perform checks, but ignore whitespaces, FULL_CHECK - perform checks, also complain about white spaces.

Enumerator
NONE
IGNORE_WS
FULL_CHECK

Definition at line 164 of file filter.h.

{ NONE, IGNORE_WS, FULL_CHECK };

DL_Group_Format

enum class Botan::DL_Group_Format

strong

The DL group encoding format variants.

Enumerator
ANSI_X9_42
ANSI_X9_57
PKCS_3
DSA_PARAMETERS
DH_PARAMETERS
ANSI_X9_42_DH_PARAMETERS
PKCS3_DH_PARAMETERS

Definition at line 30 of file dl_group.h.

                           {
   ANSI_X9_42,
   ANSI_X9_57,
   PKCS_3,
 
   DSA_PARAMETERS = ANSI_X9_57,
   DH_PARAMETERS = ANSI_X9_42,
   ANSI_X9_42_DH_PARAMETERS = ANSI_X9_42,
   PKCS3_DH_PARAMETERS = PKCS_3
};

DL_Group_Source

enum class Botan::DL_Group_Source

strong

Enumerator
Builtin
RandomlyGenerated
ExternalSource

Definition at line 21 of file dl_group.h.

                           {
   Builtin,
   RandomlyGenerated,
   ExternalSource,
};

EC_Group_Encoding

enum class Botan::EC_Group_Encoding

strong

This enum indicates the method used to encode the EC parameters

Warning

All support for explicit or implicit domain encodings will be removed in Botan4. Only named curves will be supported.

TODO(Botan4) remove this enum

Enumerator
Explicit
ImplicitCA
NamedCurve
EC_DOMPAR_ENC_EXPLICIT
EC_DOMPAR_ENC_IMPLICITCA
EC_DOMPAR_ENC_OID

Definition at line 36 of file ec_group.h.

                             {
   Explicit,
   ImplicitCA,
   NamedCurve,
 
   EC_DOMPAR_ENC_EXPLICIT = Explicit,
   EC_DOMPAR_ENC_IMPLICITCA = ImplicitCA,
   EC_DOMPAR_ENC_OID = NamedCurve
};

EC_Group_Engine

enum class Botan::EC_Group_Engine

strong

Enum indicating the way the group in question is implemented

This is returned by EC_Group::engine

Enumerator
Optimized	Using per curve implementation; fastest available.
Generic	A generic implementation that handles many curves in one implementation.
Legacy	The old implementation, used as a fallback if none of the other implementations can be used TODO(Botan4) remove this

Definition at line 66 of file ec_group.h.

                           {
   /// Using per curve implementation; fastest available
   Optimized,
   /// A generic implementation that handles many curves in one implementation
   Generic,
   /// The old implementation, used as a fallback if none of the other
   /// implementations can be used
   /// TODO(Botan4) remove this
   Legacy,
};

EC_Group_Source

enum class Botan::EC_Group_Source

strong

This enum indicates the source of the elliptic curve parameters in use.

Builtin means the curve is a known standard one which was compiled in the library.

ExternalSource means the curve parameters came from either an explicit curve encoding or an application defined curve.

Enumerator
Builtin
ExternalSource

Definition at line 56 of file ec_group.h.

                           {
   Builtin,
   ExternalSource,
};

EC_Point_Format

enum class Botan::EC_Point_Format

strong

Enumerator
Uncompressed
Compressed
UNCOMPRESSED
COMPRESSED
Hybrid
HYBRID

Definition at line 21 of file ec_point_format.h.

                           {
   Uncompressed = 0,
   Compressed = 1,
 
   UNCOMPRESSED BOTAN_DEPRECATED("Use EC_Point_Format::Uncompressed") = Uncompressed,
   COMPRESSED BOTAN_DEPRECATED("Use EC_Point_Format::Compressed") = Compressed,
 
   Hybrid BOTAN_DEPRECATED("Hybrid point encoding is deprecated") = 2,
   HYBRID BOTAN_DEPRECATED("Hybrid point encoding is deprecated") = 2
};

ECIES_Flags

enum class Botan::ECIES_Flags : uint32_t

strong

Flags controlling ECIES operation

Two of the flags are related to how cofactors are handled. Support for cofactors is deprecated and will be removed in Botan4.

The CheckMode flag is completely ignored; we always check that the point is valid.

TODO(Botan4) remove this enum

Enumerator
None
SingleHashMode	if set: prefix the input of the (ecdh) key agreement with the encoded (ephemeral) public key
CofactorMode	(decryption only) if set: use cofactor multiplication during (ecdh) key agreement This only matters if the curve has a cofactor
OldCofactorMode	if set: use ecdhc instead of ecdh. This only matters if the curve has a cofactor
CheckMode	(decryption only) if set: test if the (ephemeral) public key is on the curve Note that we actually ignore this flag and always check the key
NONE
SINGLE_HASH_MODE
COFACTOR_MODE
OLD_COFACTOR_MODE
CHECK_MODE

Definition at line 44 of file ecies.h.

                       : uint32_t {
   None = 0,
   /// if set: prefix the input of the (ecdh) key agreement with the encoded (ephemeral) public key
   SingleHashMode = 1,
   /// (decryption only) if set: use cofactor multiplication during (ecdh) key agreement
   /// This only matters if the curve has a cofactor
   CofactorMode = 2,
   /// if set: use ecdhc instead of ecdh.
   /// This only matters if the curve has a cofactor
   OldCofactorMode = 4,
   /// (decryption only) if set: test if the (ephemeral) public key is on the curve
   /// Note that we actually ignore this flag and always check the key
   CheckMode = 8,
 
   NONE BOTAN_DEPRECATED("Use None") = None,
   SINGLE_HASH_MODE BOTAN_DEPRECATED("Use SingleHashMode") = SingleHashMode,
   COFACTOR_MODE BOTAN_DEPRECATED("Use CofactorMode") = CofactorMode,
   OLD_COFACTOR_MODE BOTAN_DEPRECATED("Use OldCofactorMode") = OldCofactorMode,
   CHECK_MODE BOTAN_DEPRECATED("Use CheckMode") = CheckMode,
};

ErrorType

enum class Botan::ErrorType

strong

Different types of errors that might occur

Enumerator
Unknown	Some unknown error
SystemError	An error while calling a system interface
NotImplemented	An operation seems valid, but not supported by the current version
OutOfMemory	Memory allocation failure
InternalError	An internal error occurred
IoError	An I/O error occurred
InvalidObjectState	Invalid object state
KeyNotSet	A key was not set on an object when this is required
InvalidArgument	The application provided an argument which is invalid
InvalidKeyLength	A key with invalid length was provided
InvalidNonceLength	A nonce with invalid length was provided
LookupError	An object type was requested but cannot be found
EncodingFailure	Encoding a message or datum failed
DecodingFailure	Decoding a message or datum failed
TLSError	A TLS error (error_code will be the alert type)
HttpError	An error during an HTTP operation
InvalidTag	A message with an invalid authentication tag was detected
RoughtimeError	An error during Roughtime validation
CommonCryptoError	An error when interacting with CommonCrypto API
Pkcs11Error	An error when interacting with a PKCS11 device
TPMError	An error when interacting with a TPM device
DatabaseError	An error when interacting with a database
ZlibError	An error when interacting with zlib
Bzip2Error	An error when interacting with bzip2
LzmaError	An error when interacting with lzma

Definition at line 20 of file exceptn.h.

                     {
   /** Some unknown error */
   Unknown = 1,
   /** An error while calling a system interface */
   SystemError,
   /** An operation seems valid, but not supported by the current version */
   NotImplemented,
   /** Memory allocation failure */
   OutOfMemory,
   /** An internal error occurred */
   InternalError,
   /** An I/O error occurred */
   IoError,
 
   /** Invalid object state */
   InvalidObjectState = 100,
   /** A key was not set on an object when this is required */
   KeyNotSet,
   /** The application provided an argument which is invalid */
   InvalidArgument,
   /** A key with invalid length was provided */
   InvalidKeyLength,
   /** A nonce with invalid length was provided */
   InvalidNonceLength,
   /** An object type was requested but cannot be found */
   LookupError,
   /** Encoding a message or datum failed */
   EncodingFailure,
   /** Decoding a message or datum failed */
   DecodingFailure,
   /** A TLS error (error_code will be the alert type) */
   TLSError,
   /** An error during an HTTP operation */
   HttpError,
   /** A message with an invalid authentication tag was detected */
   InvalidTag,
   /** An error during Roughtime validation */
   RoughtimeError,
 
   /** An error when interacting with CommonCrypto API */
   CommonCryptoError = 201,
   /** An error when interacting with a PKCS11 device */
   Pkcs11Error,
   /** An error when interacting with a TPM device */
   TPMError,
   /** An error when interacting with a database */
   DatabaseError,
 
   /** An error when interacting with zlib */
   ZlibError = 300,
   /** An error when interacting with bzip2 */
   Bzip2Error,
   /** An error when interacting with lzma */
   LzmaError,
 
};

LMOTS_Algorithm_Type

enum class Botan::LMOTS_Algorithm_Type : uint32_t

strong

Enum of available LM-OTS algorithm types.

The supported parameter sets are defined in RFC 8554 Section 4.1. and draft-fluhrer-lms-more-parm-sets-11 Section 4. HSS/LMS typecodes are introduced in RFC 8554 Section 3.2. and their format specified in Section 3.3.

Enumerator
RESERVED
SHA256_N32_W1
SHA256_N32_W2
SHA256_N32_W4
SHA256_N32_W8
SHA256_N24_W1
SHA256_N24_W2
SHA256_N24_W4
SHA256_N24_W8
SHAKE_N32_W1
SHAKE_N32_W2
SHAKE_N32_W4
SHAKE_N32_W8
SHAKE_N24_W1
SHAKE_N24_W2
SHAKE_N24_W4
SHAKE_N24_W8

Definition at line 65 of file lm_ots.h.

                                : uint32_t {
   // --- RFC 8554 ---
   RESERVED = 0x00,
 
   // SHA-256 based
   SHA256_N32_W1 = 0x01,
   SHA256_N32_W2 = 0x02,
   SHA256_N32_W4 = 0x03,
   SHA256_N32_W8 = 0x04,
 
   // --- draft-fluhrer-lms-more-parm-sets-11 ---
   // SHA-256/192 based
   SHA256_N24_W1 = 0x05,
   SHA256_N24_W2 = 0x06,
   SHA256_N24_W4 = 0x07,
   SHA256_N24_W8 = 0x08,
 
   // SHAKE-256/256 based
   SHAKE_N32_W1 = 0x09,
   SHAKE_N32_W2 = 0x0a,
   SHAKE_N32_W4 = 0x0b,
   SHAKE_N32_W8 = 0x0c,
 
   // SHAKE-256/192 based
   SHAKE_N24_W1 = 0x0d,
   SHAKE_N24_W2 = 0x0e,
   SHAKE_N24_W4 = 0x0f,
   SHAKE_N24_W8 = 0x10,
};

LMS_Algorithm_Type

enum class Botan::LMS_Algorithm_Type : uint32_t

strong

Enum of available LMS algorithm types.

The supported parameter sets are defined in RFC 8554 Section 5.1. and draft-fluhrer-lms-more-parm-sets-11 Section 5. HSS/LMS typecodes are introduced in RFC 8554 Section 3.2. and their format specified in Section 3.3.

Enumerator
RESERVED
SHA256_M32_H5
SHA256_M32_H10
SHA256_M32_H15
SHA256_M32_H20
SHA256_M32_H25
SHA256_M24_H5
SHA256_M24_H10
SHA256_M24_H15
SHA256_M24_H20
SHA256_M24_H25
SHAKE_M32_H5
SHAKE_M32_H10
SHAKE_M32_H15
SHAKE_M32_H20
SHAKE_M32_H25
SHAKE_M24_H5
SHAKE_M24_H10
SHAKE_M24_H15
SHAKE_M24_H20
SHAKE_M24_H25

Definition at line 30 of file lms.h.

                              : uint32_t {
   // --- RFC 8554 ---
   RESERVED = 0x00,
 
   // SHA-256 based
   SHA256_M32_H5 = 0x05,
   SHA256_M32_H10 = 0x06,
   SHA256_M32_H15 = 0x07,
   SHA256_M32_H20 = 0x08,
   SHA256_M32_H25 = 0x09,
 
   // --- draft-fluhrer-lms-more-parm-sets-11 ---
   // SHA-256/192 based
   SHA256_M24_H5 = 0x0a,
   SHA256_M24_H10 = 0x0b,
   SHA256_M24_H15 = 0x0c,
   SHA256_M24_H20 = 0x0d,
   SHA256_M24_H25 = 0x0e,
 
   // SHAKE-256/256 based
   SHAKE_M32_H5 = 0x0f,
   SHAKE_M32_H10 = 0x10,
   SHAKE_M32_H15 = 0x11,
   SHAKE_M32_H20 = 0x12,
   SHAKE_M32_H25 = 0x13,
 
   // SHAKE-256/192 based
   SHAKE_M24_H5 = 0x14,
   SHAKE_M24_H10 = 0x15,
   SHAKE_M24_H15 = 0x16,
   SHAKE_M24_H20 = 0x17,
   SHAKE_M24_H25 = 0x18
};

MD_Endian

enum class Botan::MD_Endian

strong

Enumerator
Little
Big

Definition at line 20 of file mdx_hash.h.

                     {
   Little,
   Big,
};

MlPrivateKeyFormat

enum class Botan::MlPrivateKeyFormat

strong

Byte encoding format of ML-KEM and ML-DSA the private key.

Enumerator
Seed	Only supported for ML-KEM/ML-DSA keys: ML-KEM: 64-byte seed: d || z ML-DSA: 32-byte seed: xi (private_key_bits_with_format not yet yet supported for ML-DSA)
Expanded	The expanded format, i.e., the format specified in FIPS-203/204.

Definition at line 81 of file kyber.h.

                              {
   /// Only supported for ML-KEM/ML-DSA keys:
   /// - ML-KEM: 64-byte seed: d || z
   /// - ML-DSA: 32-byte seed: xi (private_key_bits_with_format not yet
   ///   yet supported for ML-DSA)
   Seed,
   /// The expanded format, i.e., the format specified in FIPS-203/204.
   Expanded,
};

PublicKeyOperation

enum class Botan::PublicKeyOperation

strong

Enumeration of possible operations a public key could be used for.

It is possible to query if a key supports a particular operation type using Asymmetric_Key::supports_operation()

Enumerator
Encryption
Signature
KeyEncapsulation
KeyAgreement

Definition at line 46 of file pk_keys.h.

                              {
   Encryption,
   Signature,
   KeyEncapsulation,
   KeyAgreement,
};

Signature_Format

enum class Botan::Signature_Format

strong

Enumeration specifying the signature format.

This is mostly used for requesting DER encoding of ECDSA signatures; most other algorithms only support "standard".

Enumerator
Standard
DerSequence
IEEE_1363
DER_SEQUENCE

Definition at line 32 of file pk_keys.h.

                            {
   Standard,
   DerSequence,
 
   IEEE_1363 BOTAN_DEPRECATED("Use Standard") = Standard,
   DER_SEQUENCE BOTAN_DEPRECATED("Use DerSequence") = DerSequence,
};

Sphincs_Address_Type

enum class Botan::Sphincs_Address_Type : uint32_t

strong

Enumerator
WotsHash
WotsPublicKeyCompression
HashTree
ForsTree
ForsTreeRootsCompression
WotsKeyGeneration
ForsKeyGeneration

Definition at line 20 of file sp_address.h.

                                : uint32_t {
   WotsHash = 0,
   WotsPublicKeyCompression = 1,
   HashTree = 2,
   ForsTree = 3,
   ForsTreeRootsCompression = 4,
   WotsKeyGeneration = 5,
   ForsKeyGeneration = 6
};

Sphincs_Hash_Type

enum class Botan::Sphincs_Hash_Type

strong

Enumerator
Shake256
Sha256
Haraka	Haraka is currently not supported.

Definition at line 18 of file sp_parameters.h.

                             {
   Shake256,
   Sha256,
   Haraka BOTAN_DEPRECATED("Haraka is not and will not be supported"),  ///< Haraka is currently not supported
};

Sphincs_Parameter_Set

enum class Botan::Sphincs_Parameter_Set

strong

Enumerator
Sphincs128Small
Sphincs128Fast
Sphincs192Small
Sphincs192Fast
Sphincs256Small
Sphincs256Fast
SLHDSA128Small
SLHDSA128Fast
SLHDSA192Small
SLHDSA192Fast
SLHDSA256Small
SLHDSA256Fast

Definition at line 24 of file sp_parameters.h.

                                 {
   Sphincs128Small,
   Sphincs128Fast,
   Sphincs192Small,
   Sphincs192Fast,
   Sphincs256Small,
   Sphincs256Fast,
 
   SLHDSA128Small,
   SLHDSA128Fast,
   SLHDSA192Small,
   SLHDSA192Fast,
   SLHDSA256Small,
   SLHDSA256Fast,
};

TPM_Storage_Type

enum class Botan::TPM_Storage_Type

strong

Enumerator
User
System

Definition at line 102 of file tpm.h.

{ User, System };

Usage_Type

enum class Botan::Usage_Type

strong

Enumerator
UNSPECIFIED
TLS_SERVER_AUTH
TLS_CLIENT_AUTH
CERTIFICATE_AUTHORITY
OCSP_RESPONDER
ENCRYPTION

Definition at line 22 of file x509cert.h.

                      {
   UNSPECIFIED,  // no restrictions
   TLS_SERVER_AUTH,
   TLS_CLIENT_AUTH,
   CERTIFICATE_AUTHORITY,
   OCSP_RESPONDER,
   ENCRYPTION
};

WOTS_Derivation_Method

enum class Botan::WOTS_Derivation_Method

strong

Determines how WOTS+ private keys are derived from the XMSS private key

Enumerator
Botan2x	This roughly followed the suggestions in RFC 8391 but is vulnerable to a multi-target attack. For new private keys, we recommend using the derivation as suggested in NIST SP.800-208. Private keys generated with Botan 2.x will need to stay with this mode, otherwise they won't be able to generate valid signatures any longer.
NIST_SP800_208	Derivation as specified in NIST SP.800-208 to avoid a multi-target attack on the WOTS+ key derivation suggested in RFC 8391. New private keys should use this mode.

Definition at line 138 of file xmss.h.

                                  {
   /// This roughly followed the suggestions in RFC 8391 but is vulnerable
   /// to a multi-target attack. For new private keys, we recommend using
   /// the derivation as suggested in NIST SP.800-208.
   /// Private keys generated with Botan 2.x will need to stay with this mode,
   /// otherwise they won't be able to generate valid signatures any longer.
   Botan2x = 1,
 
   /// Derivation as specified in NIST SP.800-208 to avoid a multi-target attack
   /// on the WOTS+ key derivation suggested in RFC 8391. New private keys
   /// should use this mode.
   NIST_SP800_208 = 2,
};

Function Documentation

abs()

BigInt Botan::abs ( const BigInt & n )

inline

Return the absolute value

Parameters

n	an integer

Returns

absolute value of n

Definition at line 24 of file numthry.h.

                                   {
   return n.abs();
}

References abs(), and Botan::BigInt::abs().

Referenced by abs(), Botan::EC_Group::EC_Group(), gcd(), and Botan::EC_Group::verify_group().

allocate_memory()

void * Botan::allocate_memory	(	size_t	elems,
		size_t	elem_size )

Allocate a memory buffer by some method. This should only be used for primitive types (uint8_t, uint32_t, etc).

Parameters

elems	the number of elements
elem_size	the size of each element

Returns

pointer to allocated and zeroed memory, or throw std::bad_alloc on failure

Definition at line 21 of file allocator.cpp.

                                                                      {
   if(elems == 0 || elem_size == 0) {
      return nullptr;
   }
 
   // Some calloc implementations do not check for overflow (?!?)
   if(!checked_mul(elems, elem_size).has_value()) {
      throw std::bad_alloc();
   }
 
#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
      return p;
   }
#endif
 
#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   void* ptr = ::calloc_conceal(elems, elem_size);
#else
   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc)
#endif
   if(!ptr) {
      [[unlikely]] throw std::bad_alloc();
   }
   return ptr;
}

References BOTAN_MALLOC_FN, checked_mul(), and Botan::mlock_allocator::instance().

Referenced by Botan::secure_allocator< T >::allocate().

argon2()

void Botan::argon2 ( uint8_t output[], size_t output_len, const char * password, size_t password_len, const uint8_t salt[], size_t salt_len, const uint8_t key[], size_t key_len, const uint8_t ad[], size_t ad_len, uint8_t y, size_t p, size_t M, size_t t )

inline

Argon2 key derivation function

Parameters

output	the output will be placed here
output_len	length of output
password	the user password
password_len	the length of password
salt	the salt
salt_len	length of salt
key	an optional secret key
key_len	the length of key
ad	an optional additional input
ad_len	the length of ad
y	the Argon2 variant (0 = Argon2d, 1 = Argon2i, 2 = Argon2id)
p	the parallelization parameter
M	the amount of memory to use in Kb
t	the number of iterations to use

Definition at line 144 of file argon2.h.

                             {
   auto pwdhash_fam = PasswordHashFamily::create_or_throw([y] {
      switch(y) {
         case 0:
            return "Argon2d";
         case 1:
            return "Argon2i";
         case 2:
            return "Argon2id";
         default:
            throw Not_Implemented("Unknown Argon2 family type");
      }
   }());
   auto pwdhash = pwdhash_fam->from_params(M, t, p);
   pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len, ad, ad_len, key, key_len);
}

References argon2(), and Botan::PasswordHashFamily::create_or_throw().

Referenced by argon2().

argon2_check_pwhash()

bool Botan::argon2_check_pwhash	(	const char *	password,
		size_t	password_len,
		std::string_view	hash )

Check a previously created password hash

Verify an Argon2 password hash against the provided password. Returns false if the input hash seems malformed or if the computed hash does not match.

Parameters

password	the password to check against
password_len	the length of password
hash	the stored hash to check against

Definition at line 77 of file argon2fmt.cpp.

                                                                                               {
   const std::vector<std::string> parts = split_on(input_hash, '$');
 
   if(parts.size() != 5) {
      return false;
   }
 
   uint8_t family = 0;
 
   if(parts[0] == "argon2d") {
      family = 0;
   } else if(parts[0] == "argon2i") {
      family = 1;
   } else if(parts[0] == "argon2id") {
      family = 2;
   } else {
      return false;
   }
 
   if(parts[1] != "v=19") {
      return false;
   }
 
   const std::vector<std::string> params = split_on(parts[2], ',');
 
   if(params.size() != 3) {
      return false;
   }
 
   size_t M = 0, t = 0, p = 0;
 
   for(const auto& param_str : params) {
      const std::vector<std::string> param = split_on(param_str, '=');
 
      if(param.size() != 2) {
         return false;
      }
 
      std::string_view key = param[0];
      const size_t val = to_u32bit(param[1]);
      if(key == "m") {
         M = val;
      } else if(key == "t") {
         t = val;
      } else if(key == "p") {
         p = val;
      } else {
         return false;
      }
   }
 
   std::vector<uint8_t> salt(base64_decode_max_output(parts[3].size()));
   salt.resize(base64_decode(salt.data(), parts[3], false));
 
   std::vector<uint8_t> hash(base64_decode_max_output(parts[4].size()));
   hash.resize(base64_decode(hash.data(), parts[4], false));
 
   if(hash.size() < 4) {
      return false;
   }
 
   std::vector<uint8_t> generated(hash.size());
   auto pwdhash_fam = PasswordHashFamily::create_or_throw(argon2_family(family));
   auto pwdhash = pwdhash_fam->from_params(M, t, p);
 
   pwdhash->derive_key(generated.data(), generated.size(), password, password_len, salt.data(), salt.size());
 
   return CT::is_equal(generated.data(), hash.data(), generated.size()).as_bool();
}

References base64_decode(), base64_decode_max_output(), Botan::PasswordHashFamily::create_or_throw(), Botan::CT::is_equal(), split_on(), and to_u32bit().

argon2_generate_pwhash()

std::string Botan::argon2_generate_pwhash	(	const char *	password,
		size_t	password_len,
		RandomNumberGenerator &	rng,
		size_t	p,
		size_t	M,
		size_t	t,
		uint8_t	y = 2,
		size_t	salt_len = 16,
		size_t	output_len = 32 )

Generate an Argon2 hash of the specified password. The y parameter specifies the variant: 0 for Argon2d, 1 for Argon2i, and 2 for Argon2id.

Definition at line 42 of file argon2fmt.cpp.

                                                      {
   std::vector<uint8_t> salt(salt_len);
   rng.randomize(salt.data(), salt.size());
 
   std::vector<uint8_t> output(output_len);
 
   auto pwdhash_fam = PasswordHashFamily::create_or_throw(argon2_family(y));
   auto pwdhash = pwdhash_fam->from_params(M, t, p);
 
   pwdhash->derive_key(output.data(), output.size(), password, password_len, salt.data(), salt.size());
 
   const auto enc_salt = strip_padding(base64_encode(salt));
   const auto enc_output = strip_padding(base64_encode(output));
 
   const std::string argon2_mode = [&]() -> std::string {
      if(y == 0) {
         return "d";
      } else if(y == 1) {
         return "i";
      } else {
         return "id";
      }
   }();
 
   return fmt("$argon2{}$v=19$m={},t={},p={}${}${}", argon2_mode, M, t, p, enc_salt, enc_output);
}

References base64_encode(), Botan::PasswordHashFamily::create_or_throw(), fmt(), and Botan::RandomNumberGenerator::randomize().

asn1_class_to_string()

std::string BOTAN_UNSTABLE_API Botan::asn1_class_to_string

(

ASN1_Class

type

)

Definition at line 74 of file asn1_obj.cpp.

                                                {
   switch(type) {
      case ASN1_Class::Universal:
         return "UNIVERSAL";
      case ASN1_Class::Constructed:
         return "CONSTRUCTED";
      case ASN1_Class::ContextSpecific:
         return "CONTEXT_SPECIFIC";
      case ASN1_Class::Application:
         return "APPLICATION";
      case ASN1_Class::Private:
         return "PRIVATE";
      case ASN1_Class::NoObject:
         return "NO_OBJECT";
      default:
         return "CLASS(" + std::to_string(static_cast<size_t>(type)) + ")";
   }
}

References Application, Constructed, ContextSpecific, NoObject, Private, and Universal.

Referenced by Botan::BER_Object::assert_is_a().

asn1_tag_to_string()

std::string BOTAN_UNSTABLE_API Botan::asn1_tag_to_string

(

ASN1_Type

type

)

Definition at line 93 of file asn1_obj.cpp.

                                             {
   switch(type) {
      case ASN1_Type::Sequence:
         return "SEQUENCE";
 
      case ASN1_Type::Set:
         return "SET";
 
      case ASN1_Type::PrintableString:
         return "PRINTABLE STRING";
 
      case ASN1_Type::NumericString:
         return "NUMERIC STRING";
 
      case ASN1_Type::Ia5String:
         return "IA5 STRING";
 
      case ASN1_Type::TeletexString:
         return "T61 STRING";
 
      case ASN1_Type::Utf8String:
         return "UTF8 STRING";
 
      case ASN1_Type::VisibleString:
         return "VISIBLE STRING";
 
      case ASN1_Type::BmpString:
         return "BMP STRING";
 
      case ASN1_Type::UniversalString:
         return "UNIVERSAL STRING";
 
      case ASN1_Type::UtcTime:
         return "UTC TIME";
 
      case ASN1_Type::GeneralizedTime:
         return "GENERALIZED TIME";
 
      case ASN1_Type::OctetString:
         return "OCTET STRING";
 
      case ASN1_Type::BitString:
         return "BIT STRING";
 
      case ASN1_Type::Enumerated:
         return "ENUMERATED";
 
      case ASN1_Type::Integer:
         return "INTEGER";
 
      case ASN1_Type::Null:
         return "NULL";
 
      case ASN1_Type::ObjectId:
         return "OBJECT";
 
      case ASN1_Type::Boolean:
         return "BOOLEAN";
 
      case ASN1_Type::NoObject:
         return "NO_OBJECT";
 
      default:
         return "TAG(" + std::to_string(static_cast<uint32_t>(type)) + ")";
   }
}

References BitString, BmpString, Boolean, Enumerated, GeneralizedTime, Ia5String, Integer, NoObject, Null, NumericString, ObjectId, OctetString, PrintableString, Sequence, Set, TeletexString, UniversalString, UtcTime, Utf8String, and VisibleString.

Referenced by Botan::BER_Object::assert_is_a().

assert_is_some()

template<typename T>

T Botan::assert_is_some	(	std::optional< T >	v,
		const char *	expr,
		const char *	func,
		const char *	file,
		int	line )

Define BOTAN_ASSERT_IS_SOME

Definition at line 391 of file stl_util.h.

                                                                                                   {
   if(v) {
      return *v;
   } else {
      Botan::assertion_failure(expr, "optional had value", func, file, line);
   }
}

References assertion_failure().

assert_unreachable()

void BOTAN_UNSTABLE_API Botan::assert_unreachable	(	const char *	file,
		int	line )

Definition at line 55 of file assert.cpp.

                                                    {
   const std::string msg = fmt("Codepath that was marked unreachable was reached @{}:{}", file, line);
 
#if defined(BOTAN_TERMINATE_ON_ASSERTS)
   std::cerr << msg << '\n';
   std::abort();
#else
   throw Internal_Error(msg);
#endif
}

References fmt().

assertion_failure()

void Botan::assertion_failure	(	const char *	expr_str,
		const char *	assertion_made,
		const char *	func,
		const char *	file,
		int	line )

Called when an assertion fails Throws an Exception object

Definition at line 30 of file assert.cpp.

                                                                                                                       {
   std::ostringstream format;
 
   format << "False assertion ";
 
   if(assertion_made && assertion_made[0] != 0) {
      format << "'" << assertion_made << "' (expression " << expr_str << ") ";
   } else {
      format << expr_str << " ";
   }
 
   if(func) {
      format << "in " << func << " ";
   }
 
   format << "@" << file << ":" << line;
 
#if defined(BOTAN_TERMINATE_ON_ASSERTS)
   std::cerr << format.str() << '\n';
   std::abort();
#else
   throw Internal_Error(format.str());
#endif
}

Referenced by assert_is_some().

base32_decode() [1/5]

secure_vector< uint8_t > Botan::base32_decode	(	const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform base32 decoding

Parameters

input	some base32 input
input_length	the length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded base32 output

Definition at line 163 of file base32.cpp.

                                                                                              {
   return base_decode_to_vec<secure_vector<uint8_t>>(Base32(), input, input_length, ignore_ws);
}

References base_decode_to_vec().

base32_decode() [2/5]

secure_vector< uint8_t > Botan::base32_decode	(	std::string_view	input,
		bool	ignore_ws = true )

Perform base32 decoding

Parameters

input	some base32 input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded base32 output

Definition at line 167 of file base32.cpp.

                                                                           {
   return base32_decode(input.data(), input.size(), ignore_ws);
}

References base32_decode().

base32_decode() [3/5]

size_t Botan::base32_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs,
		bool	ignore_ws = true )

Perform base32 decoding

Parameters

output	an array of at least base32_decode_max_output bytes
input	some base32 input
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding is allowed
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 150 of file base32.cpp.

                                                                                                                   {
   return base_decode(Base32(), out, in, input_length, input_consumed, final_inputs, ignore_ws);
}

References base_decode().

Referenced by base32_decode(), and base32_decode().

base32_decode() [4/5]

size_t Botan::base32_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform base32 decoding

Parameters

output	an array of at least base32_decode_max_output bytes
input	some base32 input
input_length	length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 155 of file base32.cpp.

                                                                                                {
   return base_decode_full(Base32(), output, input, input_length, ignore_ws);
}

References base_decode_full().

base32_decode() [5/5]

size_t Botan::base32_decode	(	uint8_t	output[],
		std::string_view	input,
		bool	ignore_ws = true )

Perform base32 decoding

Parameters

output	an array of at least base32_decode_max_output bytes
input	some base32 input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 159 of file base32.cpp.

                                                                             {
   return base32_decode(output, input.data(), input.length(), ignore_ws);
}

References base32_decode().

base32_decode_max_output()

size_t Botan::base32_decode_max_output

(

size_t

input_length

)

Calculate the size of output buffer for base32_decode

Parameters

input_length

the length of input in bytes

Returns

the size of output buffer in bytes

Definition at line 175 of file base32.cpp.

                                                     {
   return Base32::decode_max_output(input_length);
}

base32_encode() [1/3]

size_t Botan::base32_encode	(	char	output[],
		const uint8_t	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs )

Perform base32 encoding

Parameters

output	an array of at least base32_encode_max_output bytes
input	is some binary data
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding chars will be applied if needed

Returns

number of bytes written to output

Definition at line 142 of file base32.cpp.

                                                                                                                     {
   return base_encode(Base32(), out, in, input_length, input_consumed, final_inputs);
}

References base_encode().

Referenced by base32_encode().

base32_encode() [2/3]

std::string Botan::base32_encode	(	const uint8_t	input[],
		size_t	input_length )

Perform base32 encoding

Parameters

input	some input
input_length	length of input in bytes

Returns

base32 representation of input

Definition at line 146 of file base32.cpp.

                                                                    {
   return base_encode_to_string(Base32(), input, input_length);
}

References base_encode_to_string().

base32_encode() [3/3]

std::string Botan::base32_encode ( std::span< const uint8_t > input )

inline

Perform base32 encoding

Parameters

input

some input

Returns

base32 representation of input

Definition at line 47 of file base32.h.

                                                             {
   return base32_encode(input.data(), input.size());
}

References base32_encode().

base32_encode_max_output()

size_t Botan::base32_encode_max_output

(

size_t

input_length

)

Calculate the size of output buffer for base32_encode

Parameters

input_length

the length of input in bytes

Returns

the size of output buffer in bytes

Definition at line 171 of file base32.cpp.

                                                     {
   return Base32::encode_max_output(input_length);
}

base58_check_decode() [1/2]

std::vector< uint8_t > Botan::base58_check_decode	(	const char	input[],
		size_t	input_length )

Perform base58 decoding with checksum

Definition at line 164 of file base58.cpp.

                                                                                {
   std::vector<uint8_t> dec = base58_decode(input, input_length);
 
   if(dec.size() < 4) {
      throw Decoding_Error("Invalid base58 too short for checksum");
   }
 
   const uint32_t computed_checksum = sha256_d_checksum(dec.data(), dec.size() - 4);
   const uint32_t checksum = load_be<uint32_t>(&dec[dec.size() - 4], 0);
 
   if(checksum != computed_checksum) {
      throw Decoding_Error("Invalid base58 checksum");
   }
 
   dec.resize(dec.size() - 4);
 
   return dec;
}

References base58_decode(), and load_be().

Referenced by base58_check_decode().

base58_check_decode() [2/2]

std::vector< uint8_t > Botan::base58_check_decode ( std::string_view s )

inline

Definition at line 58 of file base58.h.

                                                                {
   return base58_check_decode(s.data(), s.size());
}

References base58_check_decode().

base58_check_encode() [1/2]

std::string Botan::base58_check_encode	(	const uint8_t	input[],
		size_t	input_length )

Perform base58 encoding with checksum

Definition at line 132 of file base58.cpp.

                                                                          {
   BigInt v(input, input_length);
   v <<= 32;
   v += sha256_d_checksum(input, input_length);
   return base58_encode(v, count_leading_zeros(input, input_length, 0));
}

References base58_encode().

Referenced by base58_check_encode().

base58_check_encode() [2/2]

std::string Botan::base58_check_encode ( std::span< const uint8_t > vec )

inline

Definition at line 50 of file base58.h.

                                                                 {
   return base58_check_encode(vec.data(), vec.size());
}

References base58_check_encode().

base58_decode() [1/2]

std::vector< uint8_t > Botan::base58_decode	(	const char	input[],
		size_t	input_length )

Perform base58 decoding

This is raw base58 encoding, without the checksum

Definition at line 139 of file base58.cpp.

                                                                          {
   const size_t leading_zeros = count_leading_zeros(input, input_length, '1');
 
   BigInt v;
 
   for(size_t i = leading_zeros; i != input_length; ++i) {
      const char c = input[i];
 
      if(c == ' ' || c == '\n') {
         continue;
      }
 
      const uint8_t idx = base58_value_of(c);
 
      if(idx == 0xFF) {
         throw Decoding_Error("Invalid base58");
      }
 
      v *= 58;
      v += idx;
   }
 
   return v.serialize(v.bytes() + leading_zeros);
}

References Botan::BigInt::bytes(), and Botan::BigInt::serialize().

Referenced by base58_check_decode(), and base58_decode().

base58_decode() [2/2]

std::vector< uint8_t > Botan::base58_decode ( std::string_view s )

inline

Definition at line 54 of file base58.h.

                                                          {
   return base58_decode(s.data(), s.size());
}

References base58_decode().

base58_encode() [1/2]

std::string Botan::base58_encode	(	const uint8_t	input[],
		size_t	input_length )

Perform base58 encoding

This is raw base58 encoding, without the checksum

Definition at line 127 of file base58.cpp.

                                                                    {
   BigInt v(input, input_length);
   return base58_encode(v, count_leading_zeros(input, input_length, 0));
}

References base58_encode().

Referenced by base58_check_encode(), base58_encode(), and base58_encode().

base58_encode() [2/2]

std::string Botan::base58_encode ( std::span< const uint8_t > vec )

inline

Definition at line 46 of file base58.h.

                                                           {
   return base58_encode(vec.data(), vec.size());
}

References base58_encode().

base64_decode() [1/6]

secure_vector< uint8_t > Botan::base64_decode	(	const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

input	some base64 input
input_length	the length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded base64 output

Definition at line 188 of file base64.cpp.

                                                                                              {
   return base_decode_to_vec<secure_vector<uint8_t>>(Base64(), input, input_length, ignore_ws);
}

References base_decode_to_vec().

base64_decode() [2/6]

size_t Botan::base64_decode	(	std::span< uint8_t >	output,
		std::string_view	input,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

output	a contiguous byte buffer of at least base64_decode_max_output bytes
input	some base64 input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 181 of file base64.cpp.

                                                                                    {
   if(output.size() < base64_decode_max_output(input.size())) {
      throw Invalid_Argument("base64_decode: output buffer is too short");
   }
   return base64_decode(output.data(), input.data(), input.length(), ignore_ws);
}

References base64_decode(), and base64_decode_max_output().

base64_decode() [3/6]

secure_vector< uint8_t > Botan::base64_decode	(	std::string_view	input,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

input	some base64 input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded base64 output

Definition at line 192 of file base64.cpp.

                                                                           {
   return base64_decode(input.data(), input.size(), ignore_ws);
}

References base64_decode().

base64_decode() [4/6]

size_t Botan::base64_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

output	an array of at least base64_decode_max_output bytes
input	some base64 input
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding is allowed
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 168 of file base64.cpp.

                                                                                                                   {
   return base_decode(Base64(), out, in, input_length, input_consumed, final_inputs, ignore_ws);
}

References base_decode().

Referenced by argon2_check_pwhash(), base64_decode(), base64_decode(), base64_decode(), botan_base64_decode(), Botan::Roughtime::Chain::Chain(), check_passhash9(), Botan::PEM_Code::decode(), Botan::Base64_Decoder::end_msg(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::list_names(), Botan::Roughtime::servers_from_str(), and Botan::Base64_Decoder::write().

base64_decode() [5/6]

size_t Botan::base64_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

output	an array of at least base64_decode_max_output bytes
input	some base64 input
input_length	length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 173 of file base64.cpp.

                                                                                                {
   return base_decode_full(Base64(), output, input, input_length, ignore_ws);
}

References base_decode_full().

base64_decode() [6/6]

size_t Botan::base64_decode	(	uint8_t	output[],
		std::string_view	input,
		bool	ignore_ws = true )

Perform base64 decoding

Parameters

output	an array of at least base64_decode_max_output bytes
input	some base64 input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 177 of file base64.cpp.

                                                                             {
   return base64_decode(output, input.data(), input.length(), ignore_ws);
}

References base64_decode().

base64_decode_max_output()

size_t Botan::base64_decode_max_output

(

size_t

input_length

)

Calculate the size of output buffer for base64_decode

Parameters

input_length

the length of input in bytes

Returns

the size of output buffer in bytes

Definition at line 200 of file base64.cpp.

                                                     {
   return Base64::decode_max_output(input_length);
}

Referenced by argon2_check_pwhash(), base64_decode(), and botan_base64_decode().

base64_encode() [1/3]

size_t Botan::base64_encode	(	char	output[],
		const uint8_t	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs )

Perform base64 encoding

Parameters

output	an array of at least base64_encode_max_output bytes
input	is some binary data
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding chars will be applied if needed

Returns

number of bytes written to output

Definition at line 160 of file base64.cpp.

                                                                                                                     {
   return base_encode(Base64(), out, in, input_length, input_consumed, final_inputs);
}

References base_encode().

Referenced by argon2_generate_pwhash(), base64_encode(), Botan::OCSP::Request::base64_encode(), botan_base64_encode(), Botan::PEM_Code::encode(), generate_passhash9(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::remove(), Botan::Encrypted_PSK_Database::set(), and Botan::Roughtime::Chain::to_string().

base64_encode() [2/3]

std::string Botan::base64_encode	(	const uint8_t	input[],
		size_t	input_length )

Perform base64 encoding

Parameters

input	some input
input_length	length of input in bytes

Returns

base64adecimal representation of input

Definition at line 164 of file base64.cpp.

                                                                    {
   return base_encode_to_string(Base64(), input, input_length);
}

References base_encode_to_string().

base64_encode() [3/3]

std::string Botan::base64_encode ( std::span< const uint8_t > input )

inline

Perform base64 encoding

Parameters

input

some input

Returns

base64adecimal representation of input

Definition at line 47 of file base64.h.

                                                             {
   return base64_encode(input.data(), input.size());
}

References base64_encode().

base64_encode_max_output()

size_t Botan::base64_encode_max_output

(

size_t

input_length

)

Calculate the size of output buffer for base64_encode

Parameters

input_length

the length of input in bytes

Returns

the size of output buffer in bytes

Definition at line 196 of file base64.cpp.

                                                     {
   return Base64::encode_max_output(input_length);
}

base_decode()

template<typename Base>

size_t Botan::base_decode	(	Base &&	base,
		uint8_t	output[],
		const char	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs,
		bool	ignore_ws = true )

Perform decoding using the base provided

Parameters

base	object giving access to the encodings specifications
output	an array of at least Base::decode_max_output bytes
input	some base input
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding is allowed
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 114 of file codec_base.h.

                                          {
   // TODO(Botan4) Check if we can use just base. or Base:: here instead
   constexpr size_t decoding_bytes_in = std::remove_reference_t<Base>::decoding_bytes_in();
   constexpr size_t decoding_bytes_out = std::remove_reference_t<Base>::decoding_bytes_out();
 
   uint8_t* out_ptr = output;
   std::array<uint8_t, decoding_bytes_in> decode_buf{};
   size_t decode_buf_pos = 0;
   size_t final_truncate = 0;
 
   clear_mem(output, base.decode_max_output(input_length));
 
   for(size_t i = 0; i != input_length; ++i) {
      const uint8_t bin = base.lookup_binary_value(input[i]);
 
      // This call might throw Invalid_Argument
      if(base.check_bad_char(bin, input[i], ignore_ws)) {
         decode_buf[decode_buf_pos] = bin;
         ++decode_buf_pos;
      }
 
      /*
      * If we're at the end of the input, pad with 0s and truncate
      */
      if(final_inputs && (i == input_length - 1)) {
         if(decode_buf_pos) {
            for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) {
               decode_buf[j] = 0;
            }
 
            final_truncate = decoding_bytes_in - decode_buf_pos;
            decode_buf_pos = decoding_bytes_in;
         }
      }
 
      if(decode_buf_pos == decoding_bytes_in) {
         base.decode(out_ptr, decode_buf.data());
 
         out_ptr += decoding_bytes_out;
         decode_buf_pos = 0;
         input_consumed = i + 1;
      }
   }
 
   while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) {
      ++input_consumed;
   }
 
   size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate);
 
   return written;
}

References clear_mem(), and out_ptr().

Referenced by base32_decode(), base64_decode(), and base_decode_full().

base_decode_full()

template<typename Base>

size_t Botan::base_decode_full	(	Base &&	base,
		uint8_t	output[],
		const char	input[],
		size_t	input_length,
		bool	ignore_ws )

Definition at line 174 of file codec_base.h.

                                                                                                                {
   size_t consumed = 0;
   const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws);
 
   if(consumed != input_length) {
      throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes");
   }
 
   return written;
}

References base_decode().

Referenced by base32_decode(), base64_decode(), and base_decode_to_vec().

base_decode_to_vec()

template<typename Vector, typename Base>

Vector Botan::base_decode_to_vec	(	Base &&	base,
		const char	input[],
		size_t	input_length,
		bool	ignore_ws )

Definition at line 186 of file codec_base.h.

                                                                                                {
   const size_t output_length = base.decode_max_output(input_length);
   Vector bin(output_length);
 
   const size_t written = base_decode_full(base, bin.data(), input, input_length, ignore_ws);
 
   bin.resize(written);
   return bin;
}

References base_decode_full().

Referenced by base32_decode(), and base64_decode().

base_encode()

template<class Base>

size_t Botan::base_encode	(	Base &&	base,
		char	output[],
		const uint8_t	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	final_inputs )

Perform encoding using the base provided

Parameters

base	object giving access to the encodings specifications
output	an array of at least base.encode_max_output bytes
input	is some binary data
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
final_inputs	true iff this is the last input, in which case padding chars will be applied if needed

Returns

number of bytes written to output

Definition at line 35 of file codec_base.h.

                                                                                                                      {
   input_consumed = 0;
 
   // TODO(Botan4) Check if we can use just base. or Base:: here instead
   constexpr size_t encoding_bytes_in = std::remove_reference_t<Base>::encoding_bytes_in();
   constexpr size_t encoding_bytes_out = std::remove_reference_t<Base>::encoding_bytes_out();
 
   size_t input_remaining = input_length;
   size_t output_produced = 0;
 
   while(input_remaining >= encoding_bytes_in) {
      base.encode(output + output_produced, input + input_consumed);
 
      input_consumed += encoding_bytes_in;
      output_produced += encoding_bytes_out;
      input_remaining -= encoding_bytes_in;
   }
 
   if(final_inputs && input_remaining) {
      std::array<uint8_t, encoding_bytes_in> remainder{};
      for(size_t i = 0; i != input_remaining; ++i) {
         remainder[i] = input[input_consumed + i];
      }
 
      base.encode(output + output_produced, remainder.data());
 
      const size_t bits_consumed = base.bits_consumed();
      const size_t remaining_bits_before_padding = base.remaining_bits_before_padding();
 
      size_t empty_bits = 8 * (encoding_bytes_in - input_remaining);
      size_t index = output_produced + encoding_bytes_out - 1;
      while(empty_bits >= remaining_bits_before_padding) {
         output[index--] = '=';
         empty_bits -= bits_consumed;
      }
 
      input_consumed += input_remaining;
      output_produced += encoding_bytes_out;
   }
 
   return output_produced;
}

Referenced by base32_encode(), base64_encode(), and base_encode_to_string().

base_encode_to_string()

template<typename Base>

std::string Botan::base_encode_to_string	(	Base &&	base,
		const uint8_t	input[],
		size_t	input_length )

Definition at line 80 of file codec_base.h.

                                                                                         {
   const size_t output_length = base.encode_max_output(input_length);
   std::string output(output_length, 0);
 
   size_t consumed = 0;
   size_t produced = 0;
 
   if(output_length > 0) {
      produced = base_encode(base, &output.front(), input, input_length, consumed, true);
   }
 
   BOTAN_ASSERT_EQUAL(consumed, input_length, "Consumed the entire input");
   BOTAN_ASSERT_EQUAL(produced, output.size(), "Produced expected size");
 
   return output;
}

References base_encode(), and BOTAN_ASSERT_EQUAL.

Referenced by base32_encode(), and base64_encode().

basecase_mul()

void Botan::basecase_mul	(	word	z[],
		size_t	z_size,
		const word	x[],
		size_t	x_size,
		const word	y[],
		size_t	y_size )

Basecase O(N^2) multiplication

Definition at line 20 of file mp_karat.cpp.

                                                                                                         {
   if(z_size < x_size + y_size) {
      throw Invalid_Argument("basecase_mul z_size too small");
   }
 
   const size_t x_size_8 = x_size - (x_size % 8);
 
   clear_mem(z, z_size);
 
   for(size_t i = 0; i != y_size; ++i) {
      const word y_i = y[i];
 
      word carry = 0;
 
      for(size_t j = 0; j != x_size_8; j += 8) {
         carry = word8_madd3(z + i + j, x + j, y_i, carry);
      }
 
      for(size_t j = x_size_8; j != x_size; ++j) {
         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
      }
 
      z[x_size + i] = carry;
   }
}

References carry(), clear_mem(), word8_madd3(), and word_madd3().

Referenced by bigint_mul().

basecase_sqr()

void Botan::basecase_sqr	(	word	z[],
		size_t	z_size,
		const word	x[],
		size_t	x_size )

Basecase O(N^2) squaring

Definition at line 46 of file mp_karat.cpp.

                                                                          {
   if(z_size < 2 * x_size) {
      throw Invalid_Argument("basecase_sqr z_size too small");
   }
 
   const size_t x_size_8 = x_size - (x_size % 8);
 
   clear_mem(z, z_size);
 
   for(size_t i = 0; i != x_size; ++i) {
      const word x_i = x[i];
 
      word carry = 0;
 
      for(size_t j = 0; j != x_size_8; j += 8) {
         carry = word8_madd3(z + i + j, x + j, x_i, carry);
      }
 
      for(size_t j = x_size_8; j != x_size; ++j) {
         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
      }
 
      z[x_size + i] = carry;
   }
}

References carry(), clear_mem(), word8_madd3(), and word_madd3().

Referenced by bigint_sqr().

basemul_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>

C::ProjectivePoint Botan::basemul_exec	(	std::span< const typename C::AffinePoint >	table,
		const BlindedScalar &	scalar,
		RandomNumberGenerator &	rng )

Definition at line 174 of file pcurves_mul.h.

                                                                     {
   // 2^W elements, less the identity element
   static constexpr size_t WindowElements = (1 << WindowBits) - 1;
 
   // TODO: C++23 - use std::mdspan to access table?
 
   auto accum = [&]() {
      const size_t w_0 = scalar.get_window(0);
      const auto tbl_0 = table.first(WindowElements);
      auto pt = C::ProjectivePoint::from_affine(C::AffinePoint::ct_select(tbl_0, w_0));
      CT::poison(pt);
      pt.randomize_rep(rng);
      return pt;
   }();
 
   const size_t windows = (scalar.bits() + WindowBits - 1) / WindowBits;
 
   for(size_t i = 1; i != windows; ++i) {
      const size_t w_i = scalar.get_window(WindowBits * i);
      const auto tbl_i = table.subspan(WindowElements * i, WindowElements);
 
      /*
      None of these additions can be doublings, because in each iteration, the
      discrete logarithms of the points we're selecting out of the table are
      larger than the largest possible dlog of accum.
      */
      accum += C::AffinePoint::ct_select(tbl_i, w_i);
 
      if(i <= 3) {
         accum.randomize_rep(rng);
      }
   }
 
   CT::unpoison(accum);
   return accum;
}

References Botan::CT::poison(), and Botan::CT::unpoison().

basemul_setup()

template<typename C, size_t WindowBits>

std::vector< typename C::AffinePoint > Botan::basemul_setup	(	const typename C::AffinePoint &	p,
		size_t	max_scalar_bits )

Definition at line 141 of file pcurves_mul.h.

                                                                                                       {
   static_assert(WindowBits >= 1 && WindowBits <= 8);
 
   // 2^W elements, less the identity element
   constexpr size_t WindowElements = (1 << WindowBits) - 1;
 
   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
 
   const size_t TableSize = Windows * WindowElements;
 
   std::vector<typename C::ProjectivePoint> table;
   table.reserve(TableSize);
 
   auto accum = C::ProjectivePoint::from_affine(p);
 
   for(size_t i = 0; i != TableSize; i += WindowElements) {
      table.push_back(accum);
 
      for(size_t j = 1; j != WindowElements; ++j) {
         if(j % 2 == 1) {
            table.emplace_back(table[i + j / 2].dbl());
         } else {
            table.emplace_back(table[i + j - 1] + table[i]);
         }
      }
 
      accum = table[i + (WindowElements / 2)].dbl();
   }
 
   return to_affine_batch<C>(table);
}

References to_affine_batch().

bcrypt_pbkdf()

void Botan::bcrypt_pbkdf ( uint8_t output[], size_t output_len, const char * password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t rounds )

inline

Bcrypt PBKDF compatible with OpenBSD bcrypt_pbkdf

Definition at line 74 of file bcrypt_pbkdf.h.

                                        {
   auto pwdhash_fam = PasswordHashFamily::create_or_throw("Bcrypt-PBKDF");
   auto pwdhash = pwdhash_fam->from_params(rounds);
   pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len);
}

References bcrypt_pbkdf(), and Botan::PasswordHashFamily::create_or_throw().

Referenced by bcrypt_pbkdf().

bigint_add2()

template<WordType W>

void Botan::bigint_add2 ( W x[], size_t x_size, const W y[], size_t y_size )

inlineconstexpr

Two operand addition

Parameters

x	the first operand (and output)
x_size	size of x
y	the second operand
y_size	size of y (must be <= x_size)

Definition at line 245 of file mp_core.h.

                                                                                    {
   x[x_size] += bigint_add2_nc(x, x_size, y, y_size);
}

References bigint_add2_nc().

Referenced by Botan::BigInt::add().

bigint_add2_nc()

template<WordType W>

auto Botan::bigint_add2_nc ( W x[], size_t x_size, const W y[], size_t y_size ) -> W

inlineconstexpr

Two operand addition with carry out

Definition at line 187 of file mp_core.h.

                                                                                            {
   W carry = 0;
 
   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
 
   const size_t blocks = y_size - (y_size % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_add2(x + i, y + i, carry);
   }
 
   for(size_t i = blocks; i != y_size; ++i) {
      x[i] = word_add(x[i], y[i], &carry);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      x[i] = word_add(x[i], static_cast<W>(0), &carry);
   }
 
   return carry;
}

References BOTAN_ASSERT, carry(), word8_add2(), and word_add().

Referenced by bigint_add2(), and redc_crandall().

bigint_add3()

template<WordType W>

void Botan::bigint_add3 ( W z[], const W x[], size_t x_size, const W y[], size_t y_size )

inlineconstexpr

Three operand addition

Definition at line 253 of file mp_core.h.

                                                                                                 {
   z[x_size > y_size ? x_size : y_size] += bigint_add3_nc(z, x, x_size, y, y_size);
}

References bigint_add3_nc().

Referenced by Botan::BigInt::add2().

bigint_add3_nc()

template<WordType W>

auto Botan::bigint_add3_nc ( W z[], const W x[], size_t x_size, const W y[], size_t y_size ) -> W

inlineconstexpr

Three operand addition with carry out

Definition at line 213 of file mp_core.h.

                                                                                                         {
   if(x_size < y_size) {
      return bigint_add3_nc(z, y, y_size, x, x_size);
   }
 
   W carry = 0;
 
   const size_t blocks = y_size - (y_size % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_add3(z + i, x + i, y + i, carry);
   }
 
   for(size_t i = blocks; i != y_size; ++i) {
      z[i] = word_add(x[i], y[i], &carry);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      z[i] = word_add(x[i], static_cast<W>(0), &carry);
   }
 
   return carry;
}

References bigint_add3_nc(), carry(), word8_add3(), and word_add().

Referenced by bigint_add3(), bigint_add3_nc(), and Botan::BigInt::mod_add().

bigint_cmp()

template<WordType W>

int32_t Botan::bigint_cmp ( const W x[], size_t x_size, const W y[], size_t y_size )

inlineconstexpr

Compare x and y Return -1 if x < y Return 0 if x == y Return 1 if x > y

Definition at line 551 of file mp_core.h.

                                                                                            {
   static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption");
 
   const W LT = static_cast<W>(-1);
   const W EQ = 0;
   const W GT = 1;
 
   const size_t common_elems = std::min(x_size, y_size);
 
   W result = EQ;  // until found otherwise
 
   for(size_t i = 0; i != common_elems; i++) {
      const auto is_eq = CT::Mask<W>::is_equal(x[i], y[i]);
      const auto is_lt = CT::Mask<W>::is_lt(x[i], y[i]);
 
      result = is_eq.select(result, is_lt.select(LT, GT));
   }
 
   if(x_size < y_size) {
      W mask = 0;
      for(size_t i = x_size; i != y_size; i++) {
         mask |= y[i];
      }
 
      // If any bits were set in high part of y, then x < y
      result = CT::Mask<W>::is_zero(mask).select(result, LT);
   } else if(y_size < x_size) {
      W mask = 0;
      for(size_t i = y_size; i != x_size; i++) {
         mask |= x[i];
      }
 
      // If any bits were set in high part of x, then x > y
      result = CT::Mask<W>::is_zero(mask).select(result, GT);
   }
 
   CT::unpoison(result);
   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
   return static_cast<int32_t>(result);
}

References BOTAN_DEBUG_ASSERT, Botan::CT::Mask< T >::is_equal(), Botan::CT::Mask< T >::is_lt(), Botan::CT::Mask< T >::is_zero(), and Botan::CT::unpoison().

Referenced by Botan::BigInt::add(), bigint_sub_abs(), Botan::BigInt::cmp(), Botan::BigInt::cmp_word(), and gcd().

bigint_cnd_abs()

template<WordType W>

void Botan::bigint_cnd_abs ( W cnd, W x[], size_t size )

inlineconstexpr

Definition at line 173 of file mp_core.h.

                                                                {
   const auto mask = CT::Mask<W>::expand(cnd);
 
   W carry = mask.if_set_return(1);
   for(size_t i = 0; i != size; ++i) {
      const W z = word_add(~x[i], static_cast<W>(0), &carry);
      x[i] = mask.select(z, x[i]);
   }
}

References carry(), Botan::CT::Mask< T >::expand(), and word_add().

bigint_cnd_add() [1/2]

template<WordType W>

W Botan::bigint_cnd_add ( W cnd, W x[], const W y[], size_t size )

inlineconstexpr

Definition at line 66 of file mp_core.h.

                                                                          {
   return bigint_cnd_add(cnd, x, size, y, size);
}

References bigint_cnd_add().

bigint_cnd_add() [2/2]

template<WordType W>

W Botan::bigint_cnd_add ( W cnd, W x[], size_t x_size, const W y[], size_t y_size )

inlineconstexpr

Definition at line 43 of file mp_core.h.

                                                                                           {
   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
 
   const auto mask = CT::Mask<W>::expand(cnd).value();
 
   W carry = 0;
 
   for(size_t i = 0; i != y_size; ++i) {
      x[i] = word_add(x[i], y[i] & mask, &carry);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      x[i] = word_add(x[i], static_cast<W>(0), &carry);
   }
 
   return (mask & carry);
}

References BOTAN_ASSERT, carry(), Botan::CT::Mask< T >::expand(), and word_add().

Referenced by bigint_cnd_add(), bigint_correct_redc(), bigint_mod_sub(), and Botan::BigInt::ct_cond_add().

bigint_cnd_add_or_sub()

template<WordType W>

void Botan::bigint_cnd_add_or_sub ( CT::Mask< W > mask, W x[], const W y[], size_t size )

inlineconstexpr

Definition at line 110 of file mp_core.h.

                                                                                             {
   const size_t blocks = size - (size % 8);
 
   W carry = 0;
   W borrow = 0;
 
   W t0[8] = {0};
   W t1[8] = {0};
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_add3(t0, x + i, y + i, carry);
      borrow = word8_sub3(t1, x + i, y + i, borrow);
      mask.select_n(x + i, t0, t1, 8);
   }
 
   for(size_t i = blocks; i != size; ++i) {
      const W a = word_add(x[i], y[i], &carry);
      const W s = word_sub(x[i], y[i], &borrow);
 
      x[i] = mask.select(a, s);
   }
}

References carry(), Botan::CT::Mask< T >::select(), Botan::CT::Mask< T >::select_n(), word8_add3(), word8_sub3(), word_add(), and word_sub().

bigint_cnd_addsub()

template<WordType W>

auto Botan::bigint_cnd_addsub ( CT::Mask< W > mask, W x[], const W y[], const W z[], size_t size ) -> W

inlineconstexpr

Definition at line 143 of file mp_core.h.

                                                                                                           {
   const size_t blocks = size - (size % 8);
 
   W carry = 0;
   W borrow = 0;
 
   W t0[8] = {0};
   W t1[8] = {0};
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_add3(t0, x + i, y + i, carry);
      borrow = word8_sub3(t1, x + i, z + i, borrow);
      mask.select_n(x + i, t0, t1, 8);
   }
 
   for(size_t i = blocks; i != size; ++i) {
      t0[0] = word_add(x[i], y[i], &carry);
      t1[0] = word_sub(x[i], z[i], &borrow);
      x[i] = mask.select(t0[0], t1[0]);
   }
 
   return mask.select(carry, borrow);
}

References carry(), word8_add3(), word8_sub3(), word_add(), and word_sub().

bigint_cnd_sub() [1/2]

template<WordType W>

auto Botan::bigint_cnd_sub ( W cnd, W x[], const W y[], size_t size ) -> W

inlineconstexpr

Definition at line 98 of file mp_core.h.

                                                                                  {
   return bigint_cnd_sub(cnd, x, size, y, size);
}

References bigint_cnd_sub().

bigint_cnd_sub() [2/2]

template<WordType W>

auto Botan::bigint_cnd_sub ( W cnd, W x[], size_t x_size, const W y[], size_t y_size ) -> W

inlineconstexpr

Definition at line 75 of file mp_core.h.

                                                                                                   {
   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
 
   const auto mask = CT::Mask<W>::expand(cnd).value();
 
   W carry = 0;
 
   for(size_t i = 0; i != y_size; ++i) {
      x[i] = word_sub(x[i], y[i] & mask, &carry);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      x[i] = word_sub(x[i], static_cast<W>(0), &carry);
   }
 
   return (mask & carry);
}

References BOTAN_ASSERT, carry(), Botan::CT::Mask< T >::expand(), and word_sub().

Referenced by bigint_cnd_sub().

bigint_cnd_swap()

template<WordType W>

void Botan::bigint_cnd_swap ( W cnd, W x[], W y[], size_t size )

inlineconstexpr

Definition at line 31 of file mp_core.h.

                                                                        {
   const auto mask = CT::Mask<W>::expand(cnd);
 
   for(size_t i = 0; i != size; ++i) {
      const W a = x[i];
      const W b = y[i];
      x[i] = mask.select(b, a);
      y[i] = mask.select(a, b);
   }
}

References Botan::CT::Mask< T >::expand().

Referenced by Botan::BigInt::ct_cond_swap(), and ct_divide_pow2k().

bigint_comba_mul16()

BOTAN_FUZZER_API void Botan::bigint_comba_mul16	(	word	z[32],
		const word	x[16],
		const word	y[16] )

Definition at line 794 of file mp_comba.cpp.

                                                                        {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[0], y[6]);
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   accum.mul(x[6], y[0]);
   z[6] = accum.extract();
   accum.mul(x[0], y[7]);
   accum.mul(x[1], y[6]);
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   accum.mul(x[6], y[1]);
   accum.mul(x[7], y[0]);
   z[7] = accum.extract();
   accum.mul(x[0], y[8]);
   accum.mul(x[1], y[7]);
   accum.mul(x[2], y[6]);
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   accum.mul(x[6], y[2]);
   accum.mul(x[7], y[1]);
   accum.mul(x[8], y[0]);
   z[8] = accum.extract();
   accum.mul(x[0], y[9]);
   accum.mul(x[1], y[8]);
   accum.mul(x[2], y[7]);
   accum.mul(x[3], y[6]);
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   accum.mul(x[6], y[3]);
   accum.mul(x[7], y[2]);
   accum.mul(x[8], y[1]);
   accum.mul(x[9], y[0]);
   z[9] = accum.extract();
   accum.mul(x[0], y[10]);
   accum.mul(x[1], y[9]);
   accum.mul(x[2], y[8]);
   accum.mul(x[3], y[7]);
   accum.mul(x[4], y[6]);
   accum.mul(x[5], y[5]);
   accum.mul(x[6], y[4]);
   accum.mul(x[7], y[3]);
   accum.mul(x[8], y[2]);
   accum.mul(x[9], y[1]);
   accum.mul(x[10], y[0]);
   z[10] = accum.extract();
   accum.mul(x[0], y[11]);
   accum.mul(x[1], y[10]);
   accum.mul(x[2], y[9]);
   accum.mul(x[3], y[8]);
   accum.mul(x[4], y[7]);
   accum.mul(x[5], y[6]);
   accum.mul(x[6], y[5]);
   accum.mul(x[7], y[4]);
   accum.mul(x[8], y[3]);
   accum.mul(x[9], y[2]);
   accum.mul(x[10], y[1]);
   accum.mul(x[11], y[0]);
   z[11] = accum.extract();
   accum.mul(x[0], y[12]);
   accum.mul(x[1], y[11]);
   accum.mul(x[2], y[10]);
   accum.mul(x[3], y[9]);
   accum.mul(x[4], y[8]);
   accum.mul(x[5], y[7]);
   accum.mul(x[6], y[6]);
   accum.mul(x[7], y[5]);
   accum.mul(x[8], y[4]);
   accum.mul(x[9], y[3]);
   accum.mul(x[10], y[2]);
   accum.mul(x[11], y[1]);
   accum.mul(x[12], y[0]);
   z[12] = accum.extract();
   accum.mul(x[0], y[13]);
   accum.mul(x[1], y[12]);
   accum.mul(x[2], y[11]);
   accum.mul(x[3], y[10]);
   accum.mul(x[4], y[9]);
   accum.mul(x[5], y[8]);
   accum.mul(x[6], y[7]);
   accum.mul(x[7], y[6]);
   accum.mul(x[8], y[5]);
   accum.mul(x[9], y[4]);
   accum.mul(x[10], y[3]);
   accum.mul(x[11], y[2]);
   accum.mul(x[12], y[1]);
   accum.mul(x[13], y[0]);
   z[13] = accum.extract();
   accum.mul(x[0], y[14]);
   accum.mul(x[1], y[13]);
   accum.mul(x[2], y[12]);
   accum.mul(x[3], y[11]);
   accum.mul(x[4], y[10]);
   accum.mul(x[5], y[9]);
   accum.mul(x[6], y[8]);
   accum.mul(x[7], y[7]);
   accum.mul(x[8], y[6]);
   accum.mul(x[9], y[5]);
   accum.mul(x[10], y[4]);
   accum.mul(x[11], y[3]);
   accum.mul(x[12], y[2]);
   accum.mul(x[13], y[1]);
   accum.mul(x[14], y[0]);
   z[14] = accum.extract();
   accum.mul(x[0], y[15]);
   accum.mul(x[1], y[14]);
   accum.mul(x[2], y[13]);
   accum.mul(x[3], y[12]);
   accum.mul(x[4], y[11]);
   accum.mul(x[5], y[10]);
   accum.mul(x[6], y[9]);
   accum.mul(x[7], y[8]);
   accum.mul(x[8], y[7]);
   accum.mul(x[9], y[6]);
   accum.mul(x[10], y[5]);
   accum.mul(x[11], y[4]);
   accum.mul(x[12], y[3]);
   accum.mul(x[13], y[2]);
   accum.mul(x[14], y[1]);
   accum.mul(x[15], y[0]);
   z[15] = accum.extract();
   accum.mul(x[1], y[15]);
   accum.mul(x[2], y[14]);
   accum.mul(x[3], y[13]);
   accum.mul(x[4], y[12]);
   accum.mul(x[5], y[11]);
   accum.mul(x[6], y[10]);
   accum.mul(x[7], y[9]);
   accum.mul(x[8], y[8]);
   accum.mul(x[9], y[7]);
   accum.mul(x[10], y[6]);
   accum.mul(x[11], y[5]);
   accum.mul(x[12], y[4]);
   accum.mul(x[13], y[3]);
   accum.mul(x[14], y[2]);
   accum.mul(x[15], y[1]);
   z[16] = accum.extract();
   accum.mul(x[2], y[15]);
   accum.mul(x[3], y[14]);
   accum.mul(x[4], y[13]);
   accum.mul(x[5], y[12]);
   accum.mul(x[6], y[11]);
   accum.mul(x[7], y[10]);
   accum.mul(x[8], y[9]);
   accum.mul(x[9], y[8]);
   accum.mul(x[10], y[7]);
   accum.mul(x[11], y[6]);
   accum.mul(x[12], y[5]);
   accum.mul(x[13], y[4]);
   accum.mul(x[14], y[3]);
   accum.mul(x[15], y[2]);
   z[17] = accum.extract();
   accum.mul(x[3], y[15]);
   accum.mul(x[4], y[14]);
   accum.mul(x[5], y[13]);
   accum.mul(x[6], y[12]);
   accum.mul(x[7], y[11]);
   accum.mul(x[8], y[10]);
   accum.mul(x[9], y[9]);
   accum.mul(x[10], y[8]);
   accum.mul(x[11], y[7]);
   accum.mul(x[12], y[6]);
   accum.mul(x[13], y[5]);
   accum.mul(x[14], y[4]);
   accum.mul(x[15], y[3]);
   z[18] = accum.extract();
   accum.mul(x[4], y[15]);
   accum.mul(x[5], y[14]);
   accum.mul(x[6], y[13]);
   accum.mul(x[7], y[12]);
   accum.mul(x[8], y[11]);
   accum.mul(x[9], y[10]);
   accum.mul(x[10], y[9]);
   accum.mul(x[11], y[8]);
   accum.mul(x[12], y[7]);
   accum.mul(x[13], y[6]);
   accum.mul(x[14], y[5]);
   accum.mul(x[15], y[4]);
   z[19] = accum.extract();
   accum.mul(x[5], y[15]);
   accum.mul(x[6], y[14]);
   accum.mul(x[7], y[13]);
   accum.mul(x[8], y[12]);
   accum.mul(x[9], y[11]);
   accum.mul(x[10], y[10]);
   accum.mul(x[11], y[9]);
   accum.mul(x[12], y[8]);
   accum.mul(x[13], y[7]);
   accum.mul(x[14], y[6]);
   accum.mul(x[15], y[5]);
   z[20] = accum.extract();
   accum.mul(x[6], y[15]);
   accum.mul(x[7], y[14]);
   accum.mul(x[8], y[13]);
   accum.mul(x[9], y[12]);
   accum.mul(x[10], y[11]);
   accum.mul(x[11], y[10]);
   accum.mul(x[12], y[9]);
   accum.mul(x[13], y[8]);
   accum.mul(x[14], y[7]);
   accum.mul(x[15], y[6]);
   z[21] = accum.extract();
   accum.mul(x[7], y[15]);
   accum.mul(x[8], y[14]);
   accum.mul(x[9], y[13]);
   accum.mul(x[10], y[12]);
   accum.mul(x[11], y[11]);
   accum.mul(x[12], y[10]);
   accum.mul(x[13], y[9]);
   accum.mul(x[14], y[8]);
   accum.mul(x[15], y[7]);
   z[22] = accum.extract();
   accum.mul(x[8], y[15]);
   accum.mul(x[9], y[14]);
   accum.mul(x[10], y[13]);
   accum.mul(x[11], y[12]);
   accum.mul(x[12], y[11]);
   accum.mul(x[13], y[10]);
   accum.mul(x[14], y[9]);
   accum.mul(x[15], y[8]);
   z[23] = accum.extract();
   accum.mul(x[9], y[15]);
   accum.mul(x[10], y[14]);
   accum.mul(x[11], y[13]);
   accum.mul(x[12], y[12]);
   accum.mul(x[13], y[11]);
   accum.mul(x[14], y[10]);
   accum.mul(x[15], y[9]);
   z[24] = accum.extract();
   accum.mul(x[10], y[15]);
   accum.mul(x[11], y[14]);
   accum.mul(x[12], y[13]);
   accum.mul(x[13], y[12]);
   accum.mul(x[14], y[11]);
   accum.mul(x[15], y[10]);
   z[25] = accum.extract();
   accum.mul(x[11], y[15]);
   accum.mul(x[12], y[14]);
   accum.mul(x[13], y[13]);
   accum.mul(x[14], y[12]);
   accum.mul(x[15], y[11]);
   z[26] = accum.extract();
   accum.mul(x[12], y[15]);
   accum.mul(x[13], y[14]);
   accum.mul(x[14], y[13]);
   accum.mul(x[15], y[12]);
   z[27] = accum.extract();
   accum.mul(x[13], y[15]);
   accum.mul(x[14], y[14]);
   accum.mul(x[15], y[13]);
   z[28] = accum.extract();
   accum.mul(x[14], y[15]);
   accum.mul(x[15], y[14]);
   z[29] = accum.extract();
   accum.mul(x[15], y[15]);
   z[30] = accum.extract();
   z[31] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

bigint_comba_mul24()

BOTAN_FUZZER_API void Botan::bigint_comba_mul24	(	word	z[48],
		const word	x[24],
		const word	y[24] )

Definition at line 1446 of file mp_comba.cpp.

                                                                        {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[0], y[6]);
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   accum.mul(x[6], y[0]);
   z[6] = accum.extract();
   accum.mul(x[0], y[7]);
   accum.mul(x[1], y[6]);
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   accum.mul(x[6], y[1]);
   accum.mul(x[7], y[0]);
   z[7] = accum.extract();
   accum.mul(x[0], y[8]);
   accum.mul(x[1], y[7]);
   accum.mul(x[2], y[6]);
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   accum.mul(x[6], y[2]);
   accum.mul(x[7], y[1]);
   accum.mul(x[8], y[0]);
   z[8] = accum.extract();
   accum.mul(x[0], y[9]);
   accum.mul(x[1], y[8]);
   accum.mul(x[2], y[7]);
   accum.mul(x[3], y[6]);
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   accum.mul(x[6], y[3]);
   accum.mul(x[7], y[2]);
   accum.mul(x[8], y[1]);
   accum.mul(x[9], y[0]);
   z[9] = accum.extract();
   accum.mul(x[0], y[10]);
   accum.mul(x[1], y[9]);
   accum.mul(x[2], y[8]);
   accum.mul(x[3], y[7]);
   accum.mul(x[4], y[6]);
   accum.mul(x[5], y[5]);
   accum.mul(x[6], y[4]);
   accum.mul(x[7], y[3]);
   accum.mul(x[8], y[2]);
   accum.mul(x[9], y[1]);
   accum.mul(x[10], y[0]);
   z[10] = accum.extract();
   accum.mul(x[0], y[11]);
   accum.mul(x[1], y[10]);
   accum.mul(x[2], y[9]);
   accum.mul(x[3], y[8]);
   accum.mul(x[4], y[7]);
   accum.mul(x[5], y[6]);
   accum.mul(x[6], y[5]);
   accum.mul(x[7], y[4]);
   accum.mul(x[8], y[3]);
   accum.mul(x[9], y[2]);
   accum.mul(x[10], y[1]);
   accum.mul(x[11], y[0]);
   z[11] = accum.extract();
   accum.mul(x[0], y[12]);
   accum.mul(x[1], y[11]);
   accum.mul(x[2], y[10]);
   accum.mul(x[3], y[9]);
   accum.mul(x[4], y[8]);
   accum.mul(x[5], y[7]);
   accum.mul(x[6], y[6]);
   accum.mul(x[7], y[5]);
   accum.mul(x[8], y[4]);
   accum.mul(x[9], y[3]);
   accum.mul(x[10], y[2]);
   accum.mul(x[11], y[1]);
   accum.mul(x[12], y[0]);
   z[12] = accum.extract();
   accum.mul(x[0], y[13]);
   accum.mul(x[1], y[12]);
   accum.mul(x[2], y[11]);
   accum.mul(x[3], y[10]);
   accum.mul(x[4], y[9]);
   accum.mul(x[5], y[8]);
   accum.mul(x[6], y[7]);
   accum.mul(x[7], y[6]);
   accum.mul(x[8], y[5]);
   accum.mul(x[9], y[4]);
   accum.mul(x[10], y[3]);
   accum.mul(x[11], y[2]);
   accum.mul(x[12], y[1]);
   accum.mul(x[13], y[0]);
   z[13] = accum.extract();
   accum.mul(x[0], y[14]);
   accum.mul(x[1], y[13]);
   accum.mul(x[2], y[12]);
   accum.mul(x[3], y[11]);
   accum.mul(x[4], y[10]);
   accum.mul(x[5], y[9]);
   accum.mul(x[6], y[8]);
   accum.mul(x[7], y[7]);
   accum.mul(x[8], y[6]);
   accum.mul(x[9], y[5]);
   accum.mul(x[10], y[4]);
   accum.mul(x[11], y[3]);
   accum.mul(x[12], y[2]);
   accum.mul(x[13], y[1]);
   accum.mul(x[14], y[0]);
   z[14] = accum.extract();
   accum.mul(x[0], y[15]);
   accum.mul(x[1], y[14]);
   accum.mul(x[2], y[13]);
   accum.mul(x[3], y[12]);
   accum.mul(x[4], y[11]);
   accum.mul(x[5], y[10]);
   accum.mul(x[6], y[9]);
   accum.mul(x[7], y[8]);
   accum.mul(x[8], y[7]);
   accum.mul(x[9], y[6]);
   accum.mul(x[10], y[5]);
   accum.mul(x[11], y[4]);
   accum.mul(x[12], y[3]);
   accum.mul(x[13], y[2]);
   accum.mul(x[14], y[1]);
   accum.mul(x[15], y[0]);
   z[15] = accum.extract();
   accum.mul(x[0], y[16]);
   accum.mul(x[1], y[15]);
   accum.mul(x[2], y[14]);
   accum.mul(x[3], y[13]);
   accum.mul(x[4], y[12]);
   accum.mul(x[5], y[11]);
   accum.mul(x[6], y[10]);
   accum.mul(x[7], y[9]);
   accum.mul(x[8], y[8]);
   accum.mul(x[9], y[7]);
   accum.mul(x[10], y[6]);
   accum.mul(x[11], y[5]);
   accum.mul(x[12], y[4]);
   accum.mul(x[13], y[3]);
   accum.mul(x[14], y[2]);
   accum.mul(x[15], y[1]);
   accum.mul(x[16], y[0]);
   z[16] = accum.extract();
   accum.mul(x[0], y[17]);
   accum.mul(x[1], y[16]);
   accum.mul(x[2], y[15]);
   accum.mul(x[3], y[14]);
   accum.mul(x[4], y[13]);
   accum.mul(x[5], y[12]);
   accum.mul(x[6], y[11]);
   accum.mul(x[7], y[10]);
   accum.mul(x[8], y[9]);
   accum.mul(x[9], y[8]);
   accum.mul(x[10], y[7]);
   accum.mul(x[11], y[6]);
   accum.mul(x[12], y[5]);
   accum.mul(x[13], y[4]);
   accum.mul(x[14], y[3]);
   accum.mul(x[15], y[2]);
   accum.mul(x[16], y[1]);
   accum.mul(x[17], y[0]);
   z[17] = accum.extract();
   accum.mul(x[0], y[18]);
   accum.mul(x[1], y[17]);
   accum.mul(x[2], y[16]);
   accum.mul(x[3], y[15]);
   accum.mul(x[4], y[14]);
   accum.mul(x[5], y[13]);
   accum.mul(x[6], y[12]);
   accum.mul(x[7], y[11]);
   accum.mul(x[8], y[10]);
   accum.mul(x[9], y[9]);
   accum.mul(x[10], y[8]);
   accum.mul(x[11], y[7]);
   accum.mul(x[12], y[6]);
   accum.mul(x[13], y[5]);
   accum.mul(x[14], y[4]);
   accum.mul(x[15], y[3]);
   accum.mul(x[16], y[2]);
   accum.mul(x[17], y[1]);
   accum.mul(x[18], y[0]);
   z[18] = accum.extract();
   accum.mul(x[0], y[19]);
   accum.mul(x[1], y[18]);
   accum.mul(x[2], y[17]);
   accum.mul(x[3], y[16]);
   accum.mul(x[4], y[15]);
   accum.mul(x[5], y[14]);
   accum.mul(x[6], y[13]);
   accum.mul(x[7], y[12]);
   accum.mul(x[8], y[11]);
   accum.mul(x[9], y[10]);
   accum.mul(x[10], y[9]);
   accum.mul(x[11], y[8]);
   accum.mul(x[12], y[7]);
   accum.mul(x[13], y[6]);
   accum.mul(x[14], y[5]);
   accum.mul(x[15], y[4]);
   accum.mul(x[16], y[3]);
   accum.mul(x[17], y[2]);
   accum.mul(x[18], y[1]);
   accum.mul(x[19], y[0]);
   z[19] = accum.extract();
   accum.mul(x[0], y[20]);
   accum.mul(x[1], y[19]);
   accum.mul(x[2], y[18]);
   accum.mul(x[3], y[17]);
   accum.mul(x[4], y[16]);
   accum.mul(x[5], y[15]);
   accum.mul(x[6], y[14]);
   accum.mul(x[7], y[13]);
   accum.mul(x[8], y[12]);
   accum.mul(x[9], y[11]);
   accum.mul(x[10], y[10]);
   accum.mul(x[11], y[9]);
   accum.mul(x[12], y[8]);
   accum.mul(x[13], y[7]);
   accum.mul(x[14], y[6]);
   accum.mul(x[15], y[5]);
   accum.mul(x[16], y[4]);
   accum.mul(x[17], y[3]);
   accum.mul(x[18], y[2]);
   accum.mul(x[19], y[1]);
   accum.mul(x[20], y[0]);
   z[20] = accum.extract();
   accum.mul(x[0], y[21]);
   accum.mul(x[1], y[20]);
   accum.mul(x[2], y[19]);
   accum.mul(x[3], y[18]);
   accum.mul(x[4], y[17]);
   accum.mul(x[5], y[16]);
   accum.mul(x[6], y[15]);
   accum.mul(x[7], y[14]);
   accum.mul(x[8], y[13]);
   accum.mul(x[9], y[12]);
   accum.mul(x[10], y[11]);
   accum.mul(x[11], y[10]);
   accum.mul(x[12], y[9]);
   accum.mul(x[13], y[8]);
   accum.mul(x[14], y[7]);
   accum.mul(x[15], y[6]);
   accum.mul(x[16], y[5]);
   accum.mul(x[17], y[4]);
   accum.mul(x[18], y[3]);
   accum.mul(x[19], y[2]);
   accum.mul(x[20], y[1]);
   accum.mul(x[21], y[0]);
   z[21] = accum.extract();
   accum.mul(x[0], y[22]);
   accum.mul(x[1], y[21]);
   accum.mul(x[2], y[20]);
   accum.mul(x[3], y[19]);
   accum.mul(x[4], y[18]);
   accum.mul(x[5], y[17]);
   accum.mul(x[6], y[16]);
   accum.mul(x[7], y[15]);
   accum.mul(x[8], y[14]);
   accum.mul(x[9], y[13]);
   accum.mul(x[10], y[12]);
   accum.mul(x[11], y[11]);
   accum.mul(x[12], y[10]);
   accum.mul(x[13], y[9]);
   accum.mul(x[14], y[8]);
   accum.mul(x[15], y[7]);
   accum.mul(x[16], y[6]);
   accum.mul(x[17], y[5]);
   accum.mul(x[18], y[4]);
   accum.mul(x[19], y[3]);
   accum.mul(x[20], y[2]);
   accum.mul(x[21], y[1]);
   accum.mul(x[22], y[0]);
   z[22] = accum.extract();
   accum.mul(x[0], y[23]);
   accum.mul(x[1], y[22]);
   accum.mul(x[2], y[21]);
   accum.mul(x[3], y[20]);
   accum.mul(x[4], y[19]);
   accum.mul(x[5], y[18]);
   accum.mul(x[6], y[17]);
   accum.mul(x[7], y[16]);
   accum.mul(x[8], y[15]);
   accum.mul(x[9], y[14]);
   accum.mul(x[10], y[13]);
   accum.mul(x[11], y[12]);
   accum.mul(x[12], y[11]);
   accum.mul(x[13], y[10]);
   accum.mul(x[14], y[9]);
   accum.mul(x[15], y[8]);
   accum.mul(x[16], y[7]);
   accum.mul(x[17], y[6]);
   accum.mul(x[18], y[5]);
   accum.mul(x[19], y[4]);
   accum.mul(x[20], y[3]);
   accum.mul(x[21], y[2]);
   accum.mul(x[22], y[1]);
   accum.mul(x[23], y[0]);
   z[23] = accum.extract();
   accum.mul(x[1], y[23]);
   accum.mul(x[2], y[22]);
   accum.mul(x[3], y[21]);
   accum.mul(x[4], y[20]);
   accum.mul(x[5], y[19]);
   accum.mul(x[6], y[18]);
   accum.mul(x[7], y[17]);
   accum.mul(x[8], y[16]);
   accum.mul(x[9], y[15]);
   accum.mul(x[10], y[14]);
   accum.mul(x[11], y[13]);
   accum.mul(x[12], y[12]);
   accum.mul(x[13], y[11]);
   accum.mul(x[14], y[10]);
   accum.mul(x[15], y[9]);
   accum.mul(x[16], y[8]);
   accum.mul(x[17], y[7]);
   accum.mul(x[18], y[6]);
   accum.mul(x[19], y[5]);
   accum.mul(x[20], y[4]);
   accum.mul(x[21], y[3]);
   accum.mul(x[22], y[2]);
   accum.mul(x[23], y[1]);
   z[24] = accum.extract();
   accum.mul(x[2], y[23]);
   accum.mul(x[3], y[22]);
   accum.mul(x[4], y[21]);
   accum.mul(x[5], y[20]);
   accum.mul(x[6], y[19]);
   accum.mul(x[7], y[18]);
   accum.mul(x[8], y[17]);
   accum.mul(x[9], y[16]);
   accum.mul(x[10], y[15]);
   accum.mul(x[11], y[14]);
   accum.mul(x[12], y[13]);
   accum.mul(x[13], y[12]);
   accum.mul(x[14], y[11]);
   accum.mul(x[15], y[10]);
   accum.mul(x[16], y[9]);
   accum.mul(x[17], y[8]);
   accum.mul(x[18], y[7]);
   accum.mul(x[19], y[6]);
   accum.mul(x[20], y[5]);
   accum.mul(x[21], y[4]);
   accum.mul(x[22], y[3]);
   accum.mul(x[23], y[2]);
   z[25] = accum.extract();
   accum.mul(x[3], y[23]);
   accum.mul(x[4], y[22]);
   accum.mul(x[5], y[21]);
   accum.mul(x[6], y[20]);
   accum.mul(x[7], y[19]);
   accum.mul(x[8], y[18]);
   accum.mul(x[9], y[17]);
   accum.mul(x[10], y[16]);
   accum.mul(x[11], y[15]);
   accum.mul(x[12], y[14]);
   accum.mul(x[13], y[13]);
   accum.mul(x[14], y[12]);
   accum.mul(x[15], y[11]);
   accum.mul(x[16], y[10]);
   accum.mul(x[17], y[9]);
   accum.mul(x[18], y[8]);
   accum.mul(x[19], y[7]);
   accum.mul(x[20], y[6]);
   accum.mul(x[21], y[5]);
   accum.mul(x[22], y[4]);
   accum.mul(x[23], y[3]);
   z[26] = accum.extract();
   accum.mul(x[4], y[23]);
   accum.mul(x[5], y[22]);
   accum.mul(x[6], y[21]);
   accum.mul(x[7], y[20]);
   accum.mul(x[8], y[19]);
   accum.mul(x[9], y[18]);
   accum.mul(x[10], y[17]);
   accum.mul(x[11], y[16]);
   accum.mul(x[12], y[15]);
   accum.mul(x[13], y[14]);
   accum.mul(x[14], y[13]);
   accum.mul(x[15], y[12]);
   accum.mul(x[16], y[11]);
   accum.mul(x[17], y[10]);
   accum.mul(x[18], y[9]);
   accum.mul(x[19], y[8]);
   accum.mul(x[20], y[7]);
   accum.mul(x[21], y[6]);
   accum.mul(x[22], y[5]);
   accum.mul(x[23], y[4]);
   z[27] = accum.extract();
   accum.mul(x[5], y[23]);
   accum.mul(x[6], y[22]);
   accum.mul(x[7], y[21]);
   accum.mul(x[8], y[20]);
   accum.mul(x[9], y[19]);
   accum.mul(x[10], y[18]);
   accum.mul(x[11], y[17]);
   accum.mul(x[12], y[16]);
   accum.mul(x[13], y[15]);
   accum.mul(x[14], y[14]);
   accum.mul(x[15], y[13]);
   accum.mul(x[16], y[12]);
   accum.mul(x[17], y[11]);
   accum.mul(x[18], y[10]);
   accum.mul(x[19], y[9]);
   accum.mul(x[20], y[8]);
   accum.mul(x[21], y[7]);
   accum.mul(x[22], y[6]);
   accum.mul(x[23], y[5]);
   z[28] = accum.extract();
   accum.mul(x[6], y[23]);
   accum.mul(x[7], y[22]);
   accum.mul(x[8], y[21]);
   accum.mul(x[9], y[20]);
   accum.mul(x[10], y[19]);
   accum.mul(x[11], y[18]);
   accum.mul(x[12], y[17]);
   accum.mul(x[13], y[16]);
   accum.mul(x[14], y[15]);
   accum.mul(x[15], y[14]);
   accum.mul(x[16], y[13]);
   accum.mul(x[17], y[12]);
   accum.mul(x[18], y[11]);
   accum.mul(x[19], y[10]);
   accum.mul(x[20], y[9]);
   accum.mul(x[21], y[8]);
   accum.mul(x[22], y[7]);
   accum.mul(x[23], y[6]);
   z[29] = accum.extract();
   accum.mul(x[7], y[23]);
   accum.mul(x[8], y[22]);
   accum.mul(x[9], y[21]);
   accum.mul(x[10], y[20]);
   accum.mul(x[11], y[19]);
   accum.mul(x[12], y[18]);
   accum.mul(x[13], y[17]);
   accum.mul(x[14], y[16]);
   accum.mul(x[15], y[15]);
   accum.mul(x[16], y[14]);
   accum.mul(x[17], y[13]);
   accum.mul(x[18], y[12]);
   accum.mul(x[19], y[11]);
   accum.mul(x[20], y[10]);
   accum.mul(x[21], y[9]);
   accum.mul(x[22], y[8]);
   accum.mul(x[23], y[7]);
   z[30] = accum.extract();
   accum.mul(x[8], y[23]);
   accum.mul(x[9], y[22]);
   accum.mul(x[10], y[21]);
   accum.mul(x[11], y[20]);
   accum.mul(x[12], y[19]);
   accum.mul(x[13], y[18]);
   accum.mul(x[14], y[17]);
   accum.mul(x[15], y[16]);
   accum.mul(x[16], y[15]);
   accum.mul(x[17], y[14]);
   accum.mul(x[18], y[13]);
   accum.mul(x[19], y[12]);
   accum.mul(x[20], y[11]);
   accum.mul(x[21], y[10]);
   accum.mul(x[22], y[9]);
   accum.mul(x[23], y[8]);
   z[31] = accum.extract();
   accum.mul(x[9], y[23]);
   accum.mul(x[10], y[22]);
   accum.mul(x[11], y[21]);
   accum.mul(x[12], y[20]);
   accum.mul(x[13], y[19]);
   accum.mul(x[14], y[18]);
   accum.mul(x[15], y[17]);
   accum.mul(x[16], y[16]);
   accum.mul(x[17], y[15]);
   accum.mul(x[18], y[14]);
   accum.mul(x[19], y[13]);
   accum.mul(x[20], y[12]);
   accum.mul(x[21], y[11]);
   accum.mul(x[22], y[10]);
   accum.mul(x[23], y[9]);
   z[32] = accum.extract();
   accum.mul(x[10], y[23]);
   accum.mul(x[11], y[22]);
   accum.mul(x[12], y[21]);
   accum.mul(x[13], y[20]);
   accum.mul(x[14], y[19]);
   accum.mul(x[15], y[18]);
   accum.mul(x[16], y[17]);
   accum.mul(x[17], y[16]);
   accum.mul(x[18], y[15]);
   accum.mul(x[19], y[14]);
   accum.mul(x[20], y[13]);
   accum.mul(x[21], y[12]);
   accum.mul(x[22], y[11]);
   accum.mul(x[23], y[10]);
   z[33] = accum.extract();
   accum.mul(x[11], y[23]);
   accum.mul(x[12], y[22]);
   accum.mul(x[13], y[21]);
   accum.mul(x[14], y[20]);
   accum.mul(x[15], y[19]);
   accum.mul(x[16], y[18]);
   accum.mul(x[17], y[17]);
   accum.mul(x[18], y[16]);
   accum.mul(x[19], y[15]);
   accum.mul(x[20], y[14]);
   accum.mul(x[21], y[13]);
   accum.mul(x[22], y[12]);
   accum.mul(x[23], y[11]);
   z[34] = accum.extract();
   accum.mul(x[12], y[23]);
   accum.mul(x[13], y[22]);
   accum.mul(x[14], y[21]);
   accum.mul(x[15], y[20]);
   accum.mul(x[16], y[19]);
   accum.mul(x[17], y[18]);
   accum.mul(x[18], y[17]);
   accum.mul(x[19], y[16]);
   accum.mul(x[20], y[15]);
   accum.mul(x[21], y[14]);
   accum.mul(x[22], y[13]);
   accum.mul(x[23], y[12]);
   z[35] = accum.extract();
   accum.mul(x[13], y[23]);
   accum.mul(x[14], y[22]);
   accum.mul(x[15], y[21]);
   accum.mul(x[16], y[20]);
   accum.mul(x[17], y[19]);
   accum.mul(x[18], y[18]);
   accum.mul(x[19], y[17]);
   accum.mul(x[20], y[16]);
   accum.mul(x[21], y[15]);
   accum.mul(x[22], y[14]);
   accum.mul(x[23], y[13]);
   z[36] = accum.extract();
   accum.mul(x[14], y[23]);
   accum.mul(x[15], y[22]);
   accum.mul(x[16], y[21]);
   accum.mul(x[17], y[20]);
   accum.mul(x[18], y[19]);
   accum.mul(x[19], y[18]);
   accum.mul(x[20], y[17]);
   accum.mul(x[21], y[16]);
   accum.mul(x[22], y[15]);
   accum.mul(x[23], y[14]);
   z[37] = accum.extract();
   accum.mul(x[15], y[23]);
   accum.mul(x[16], y[22]);
   accum.mul(x[17], y[21]);
   accum.mul(x[18], y[20]);
   accum.mul(x[19], y[19]);
   accum.mul(x[20], y[18]);
   accum.mul(x[21], y[17]);
   accum.mul(x[22], y[16]);
   accum.mul(x[23], y[15]);
   z[38] = accum.extract();
   accum.mul(x[16], y[23]);
   accum.mul(x[17], y[22]);
   accum.mul(x[18], y[21]);
   accum.mul(x[19], y[20]);
   accum.mul(x[20], y[19]);
   accum.mul(x[21], y[18]);
   accum.mul(x[22], y[17]);
   accum.mul(x[23], y[16]);
   z[39] = accum.extract();
   accum.mul(x[17], y[23]);
   accum.mul(x[18], y[22]);
   accum.mul(x[19], y[21]);
   accum.mul(x[20], y[20]);
   accum.mul(x[21], y[19]);
   accum.mul(x[22], y[18]);
   accum.mul(x[23], y[17]);
   z[40] = accum.extract();
   accum.mul(x[18], y[23]);
   accum.mul(x[19], y[22]);
   accum.mul(x[20], y[21]);
   accum.mul(x[21], y[20]);
   accum.mul(x[22], y[19]);
   accum.mul(x[23], y[18]);
   z[41] = accum.extract();
   accum.mul(x[19], y[23]);
   accum.mul(x[20], y[22]);
   accum.mul(x[21], y[21]);
   accum.mul(x[22], y[20]);
   accum.mul(x[23], y[19]);
   z[42] = accum.extract();
   accum.mul(x[20], y[23]);
   accum.mul(x[21], y[22]);
   accum.mul(x[22], y[21]);
   accum.mul(x[23], y[20]);
   z[43] = accum.extract();
   accum.mul(x[21], y[23]);
   accum.mul(x[22], y[22]);
   accum.mul(x[23], y[21]);
   z[44] = accum.extract();
   accum.mul(x[22], y[23]);
   accum.mul(x[23], y[22]);
   z[45] = accum.extract();
   accum.mul(x[23], y[23]);
   z[46] = accum.extract();
   z[47] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul().

bigint_comba_mul4()

BOTAN_FUZZER_API void Botan::bigint_comba_mul4	(	word	z[8],
		const word	x[4],
		const word	y[4] )

Definition at line 42 of file mp_comba.cpp.

                                                                    {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   z[4] = accum.extract();
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   z[5] = accum.extract();
   accum.mul(x[3], y[3]);
   z[6] = accum.extract();
   z[7] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

bigint_comba_mul6()

BOTAN_FUZZER_API void Botan::bigint_comba_mul6	(	word	z[12],
		const word	x[6],
		const word	y[6] )

Definition at line 115 of file mp_comba.cpp.

                                                                     {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   z[6] = accum.extract();
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   z[7] = accum.extract();
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   z[8] = accum.extract();
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   z[9] = accum.extract();
   accum.mul(x[5], y[5]);
   z[10] = accum.extract();
   z[11] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

bigint_comba_mul7()

BOTAN_FUZZER_API void Botan::bigint_comba_mul7	(	word	z[14],
		const word	x[7],
		const word	y[7] )

Definition at line 221 of file mp_comba.cpp.

                                                                     {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[0], y[6]);
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   accum.mul(x[6], y[0]);
   z[6] = accum.extract();
   accum.mul(x[1], y[6]);
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   accum.mul(x[6], y[1]);
   z[7] = accum.extract();
   accum.mul(x[2], y[6]);
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   accum.mul(x[6], y[2]);
   z[8] = accum.extract();
   accum.mul(x[3], y[6]);
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   accum.mul(x[6], y[3]);
   z[9] = accum.extract();
   accum.mul(x[4], y[6]);
   accum.mul(x[5], y[5]);
   accum.mul(x[6], y[4]);
   z[10] = accum.extract();
   accum.mul(x[5], y[6]);
   accum.mul(x[6], y[5]);
   z[11] = accum.extract();
   accum.mul(x[6], y[6]);
   z[12] = accum.extract();
   z[13] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by comba_mul().

bigint_comba_mul8()

BOTAN_FUZZER_API void Botan::bigint_comba_mul8	(	word	z[16],
		const word	x[8],
		const word	y[8] )

Definition at line 352 of file mp_comba.cpp.

                                                                     {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[0], y[6]);
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   accum.mul(x[6], y[0]);
   z[6] = accum.extract();
   accum.mul(x[0], y[7]);
   accum.mul(x[1], y[6]);
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   accum.mul(x[6], y[1]);
   accum.mul(x[7], y[0]);
   z[7] = accum.extract();
   accum.mul(x[1], y[7]);
   accum.mul(x[2], y[6]);
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   accum.mul(x[6], y[2]);
   accum.mul(x[7], y[1]);
   z[8] = accum.extract();
   accum.mul(x[2], y[7]);
   accum.mul(x[3], y[6]);
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   accum.mul(x[6], y[3]);
   accum.mul(x[7], y[2]);
   z[9] = accum.extract();
   accum.mul(x[3], y[7]);
   accum.mul(x[4], y[6]);
   accum.mul(x[5], y[5]);
   accum.mul(x[6], y[4]);
   accum.mul(x[7], y[3]);
   z[10] = accum.extract();
   accum.mul(x[4], y[7]);
   accum.mul(x[5], y[6]);
   accum.mul(x[6], y[5]);
   accum.mul(x[7], y[4]);
   z[11] = accum.extract();
   accum.mul(x[5], y[7]);
   accum.mul(x[6], y[6]);
   accum.mul(x[7], y[5]);
   z[12] = accum.extract();
   accum.mul(x[6], y[7]);
   accum.mul(x[7], y[6]);
   z[13] = accum.extract();
   accum.mul(x[7], y[7]);
   z[14] = accum.extract();
   z[15] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

bigint_comba_mul9()

BOTAN_FUZZER_API void Botan::bigint_comba_mul9	(	word	z[18],
		const word	x[9],
		const word	y[9] )

Definition at line 511 of file mp_comba.cpp.

                                                                     {
   word3<word> accum;
 
   accum.mul(x[0], y[0]);
   z[0] = accum.extract();
   accum.mul(x[0], y[1]);
   accum.mul(x[1], y[0]);
   z[1] = accum.extract();
   accum.mul(x[0], y[2]);
   accum.mul(x[1], y[1]);
   accum.mul(x[2], y[0]);
   z[2] = accum.extract();
   accum.mul(x[0], y[3]);
   accum.mul(x[1], y[2]);
   accum.mul(x[2], y[1]);
   accum.mul(x[3], y[0]);
   z[3] = accum.extract();
   accum.mul(x[0], y[4]);
   accum.mul(x[1], y[3]);
   accum.mul(x[2], y[2]);
   accum.mul(x[3], y[1]);
   accum.mul(x[4], y[0]);
   z[4] = accum.extract();
   accum.mul(x[0], y[5]);
   accum.mul(x[1], y[4]);
   accum.mul(x[2], y[3]);
   accum.mul(x[3], y[2]);
   accum.mul(x[4], y[1]);
   accum.mul(x[5], y[0]);
   z[5] = accum.extract();
   accum.mul(x[0], y[6]);
   accum.mul(x[1], y[5]);
   accum.mul(x[2], y[4]);
   accum.mul(x[3], y[3]);
   accum.mul(x[4], y[2]);
   accum.mul(x[5], y[1]);
   accum.mul(x[6], y[0]);
   z[6] = accum.extract();
   accum.mul(x[0], y[7]);
   accum.mul(x[1], y[6]);
   accum.mul(x[2], y[5]);
   accum.mul(x[3], y[4]);
   accum.mul(x[4], y[3]);
   accum.mul(x[5], y[2]);
   accum.mul(x[6], y[1]);
   accum.mul(x[7], y[0]);
   z[7] = accum.extract();
   accum.mul(x[0], y[8]);
   accum.mul(x[1], y[7]);
   accum.mul(x[2], y[6]);
   accum.mul(x[3], y[5]);
   accum.mul(x[4], y[4]);
   accum.mul(x[5], y[3]);
   accum.mul(x[6], y[2]);
   accum.mul(x[7], y[1]);
   accum.mul(x[8], y[0]);
   z[8] = accum.extract();
   accum.mul(x[1], y[8]);
   accum.mul(x[2], y[7]);
   accum.mul(x[3], y[6]);
   accum.mul(x[4], y[5]);
   accum.mul(x[5], y[4]);
   accum.mul(x[6], y[3]);
   accum.mul(x[7], y[2]);
   accum.mul(x[8], y[1]);
   z[9] = accum.extract();
   accum.mul(x[2], y[8]);
   accum.mul(x[3], y[7]);
   accum.mul(x[4], y[6]);
   accum.mul(x[5], y[5]);
   accum.mul(x[6], y[4]);
   accum.mul(x[7], y[3]);
   accum.mul(x[8], y[2]);
   z[10] = accum.extract();
   accum.mul(x[3], y[8]);
   accum.mul(x[4], y[7]);
   accum.mul(x[5], y[6]);
   accum.mul(x[6], y[5]);
   accum.mul(x[7], y[4]);
   accum.mul(x[8], y[3]);
   z[11] = accum.extract();
   accum.mul(x[4], y[8]);
   accum.mul(x[5], y[7]);
   accum.mul(x[6], y[6]);
   accum.mul(x[7], y[5]);
   accum.mul(x[8], y[4]);
   z[12] = accum.extract();
   accum.mul(x[5], y[8]);
   accum.mul(x[6], y[7]);
   accum.mul(x[7], y[6]);
   accum.mul(x[8], y[5]);
   z[13] = accum.extract();
   accum.mul(x[6], y[8]);
   accum.mul(x[7], y[7]);
   accum.mul(x[8], y[6]);
   z[14] = accum.extract();
   accum.mul(x[7], y[8]);
   accum.mul(x[8], y[7]);
   z[15] = accum.extract();
   accum.mul(x[8], y[8]);
   z[16] = accum.extract();
   z[17] = accum.extract();
}

References Botan::word3< W >::extract(), and Botan::word3< W >::mul().

Referenced by bigint_mul(), and comba_mul().

bigint_comba_sqr16()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr16	(	word	z[32],
		const word	x[16] )

Definition at line 618 of file mp_comba.cpp.

                                                      {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[0], x[6]);
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[0], x[7]);
   accum.mul_x2(x[1], x[6]);
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[0], x[8]);
   accum.mul_x2(x[1], x[7]);
   accum.mul_x2(x[2], x[6]);
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[0], x[9]);
   accum.mul_x2(x[1], x[8]);
   accum.mul_x2(x[2], x[7]);
   accum.mul_x2(x[3], x[6]);
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul_x2(x[0], x[10]);
   accum.mul_x2(x[1], x[9]);
   accum.mul_x2(x[2], x[8]);
   accum.mul_x2(x[3], x[7]);
   accum.mul_x2(x[4], x[6]);
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   accum.mul_x2(x[0], x[11]);
   accum.mul_x2(x[1], x[10]);
   accum.mul_x2(x[2], x[9]);
   accum.mul_x2(x[3], x[8]);
   accum.mul_x2(x[4], x[7]);
   accum.mul_x2(x[5], x[6]);
   z[11] = accum.extract();
   accum.mul_x2(x[0], x[12]);
   accum.mul_x2(x[1], x[11]);
   accum.mul_x2(x[2], x[10]);
   accum.mul_x2(x[3], x[9]);
   accum.mul_x2(x[4], x[8]);
   accum.mul_x2(x[5], x[7]);
   accum.mul(x[6], x[6]);
   z[12] = accum.extract();
   accum.mul_x2(x[0], x[13]);
   accum.mul_x2(x[1], x[12]);
   accum.mul_x2(x[2], x[11]);
   accum.mul_x2(x[3], x[10]);
   accum.mul_x2(x[4], x[9]);
   accum.mul_x2(x[5], x[8]);
   accum.mul_x2(x[6], x[7]);
   z[13] = accum.extract();
   accum.mul_x2(x[0], x[14]);
   accum.mul_x2(x[1], x[13]);
   accum.mul_x2(x[2], x[12]);
   accum.mul_x2(x[3], x[11]);
   accum.mul_x2(x[4], x[10]);
   accum.mul_x2(x[5], x[9]);
   accum.mul_x2(x[6], x[8]);
   accum.mul(x[7], x[7]);
   z[14] = accum.extract();
   accum.mul_x2(x[0], x[15]);
   accum.mul_x2(x[1], x[14]);
   accum.mul_x2(x[2], x[13]);
   accum.mul_x2(x[3], x[12]);
   accum.mul_x2(x[4], x[11]);
   accum.mul_x2(x[5], x[10]);
   accum.mul_x2(x[6], x[9]);
   accum.mul_x2(x[7], x[8]);
   z[15] = accum.extract();
   accum.mul_x2(x[1], x[15]);
   accum.mul_x2(x[2], x[14]);
   accum.mul_x2(x[3], x[13]);
   accum.mul_x2(x[4], x[12]);
   accum.mul_x2(x[5], x[11]);
   accum.mul_x2(x[6], x[10]);
   accum.mul_x2(x[7], x[9]);
   accum.mul(x[8], x[8]);
   z[16] = accum.extract();
   accum.mul_x2(x[2], x[15]);
   accum.mul_x2(x[3], x[14]);
   accum.mul_x2(x[4], x[13]);
   accum.mul_x2(x[5], x[12]);
   accum.mul_x2(x[6], x[11]);
   accum.mul_x2(x[7], x[10]);
   accum.mul_x2(x[8], x[9]);
   z[17] = accum.extract();
   accum.mul_x2(x[3], x[15]);
   accum.mul_x2(x[4], x[14]);
   accum.mul_x2(x[5], x[13]);
   accum.mul_x2(x[6], x[12]);
   accum.mul_x2(x[7], x[11]);
   accum.mul_x2(x[8], x[10]);
   accum.mul(x[9], x[9]);
   z[18] = accum.extract();
   accum.mul_x2(x[4], x[15]);
   accum.mul_x2(x[5], x[14]);
   accum.mul_x2(x[6], x[13]);
   accum.mul_x2(x[7], x[12]);
   accum.mul_x2(x[8], x[11]);
   accum.mul_x2(x[9], x[10]);
   z[19] = accum.extract();
   accum.mul_x2(x[5], x[15]);
   accum.mul_x2(x[6], x[14]);
   accum.mul_x2(x[7], x[13]);
   accum.mul_x2(x[8], x[12]);
   accum.mul_x2(x[9], x[11]);
   accum.mul(x[10], x[10]);
   z[20] = accum.extract();
   accum.mul_x2(x[6], x[15]);
   accum.mul_x2(x[7], x[14]);
   accum.mul_x2(x[8], x[13]);
   accum.mul_x2(x[9], x[12]);
   accum.mul_x2(x[10], x[11]);
   z[21] = accum.extract();
   accum.mul_x2(x[7], x[15]);
   accum.mul_x2(x[8], x[14]);
   accum.mul_x2(x[9], x[13]);
   accum.mul_x2(x[10], x[12]);
   accum.mul(x[11], x[11]);
   z[22] = accum.extract();
   accum.mul_x2(x[8], x[15]);
   accum.mul_x2(x[9], x[14]);
   accum.mul_x2(x[10], x[13]);
   accum.mul_x2(x[11], x[12]);
   z[23] = accum.extract();
   accum.mul_x2(x[9], x[15]);
   accum.mul_x2(x[10], x[14]);
   accum.mul_x2(x[11], x[13]);
   accum.mul(x[12], x[12]);
   z[24] = accum.extract();
   accum.mul_x2(x[10], x[15]);
   accum.mul_x2(x[11], x[14]);
   accum.mul_x2(x[12], x[13]);
   z[25] = accum.extract();
   accum.mul_x2(x[11], x[15]);
   accum.mul_x2(x[12], x[14]);
   accum.mul(x[13], x[13]);
   z[26] = accum.extract();
   accum.mul_x2(x[12], x[15]);
   accum.mul_x2(x[13], x[14]);
   z[27] = accum.extract();
   accum.mul_x2(x[13], x[15]);
   accum.mul(x[14], x[14]);
   z[28] = accum.extract();
   accum.mul_x2(x[14], x[15]);
   z[29] = accum.extract();
   accum.mul(x[15], x[15]);
   z[30] = accum.extract();
   z[31] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

bigint_comba_sqr24()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr24	(	word	z[48],
		const word	x[24] )

Definition at line 1090 of file mp_comba.cpp.

                                                      {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[0], x[6]);
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[0], x[7]);
   accum.mul_x2(x[1], x[6]);
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[0], x[8]);
   accum.mul_x2(x[1], x[7]);
   accum.mul_x2(x[2], x[6]);
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[0], x[9]);
   accum.mul_x2(x[1], x[8]);
   accum.mul_x2(x[2], x[7]);
   accum.mul_x2(x[3], x[6]);
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul_x2(x[0], x[10]);
   accum.mul_x2(x[1], x[9]);
   accum.mul_x2(x[2], x[8]);
   accum.mul_x2(x[3], x[7]);
   accum.mul_x2(x[4], x[6]);
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   accum.mul_x2(x[0], x[11]);
   accum.mul_x2(x[1], x[10]);
   accum.mul_x2(x[2], x[9]);
   accum.mul_x2(x[3], x[8]);
   accum.mul_x2(x[4], x[7]);
   accum.mul_x2(x[5], x[6]);
   z[11] = accum.extract();
   accum.mul_x2(x[0], x[12]);
   accum.mul_x2(x[1], x[11]);
   accum.mul_x2(x[2], x[10]);
   accum.mul_x2(x[3], x[9]);
   accum.mul_x2(x[4], x[8]);
   accum.mul_x2(x[5], x[7]);
   accum.mul(x[6], x[6]);
   z[12] = accum.extract();
   accum.mul_x2(x[0], x[13]);
   accum.mul_x2(x[1], x[12]);
   accum.mul_x2(x[2], x[11]);
   accum.mul_x2(x[3], x[10]);
   accum.mul_x2(x[4], x[9]);
   accum.mul_x2(x[5], x[8]);
   accum.mul_x2(x[6], x[7]);
   z[13] = accum.extract();
   accum.mul_x2(x[0], x[14]);
   accum.mul_x2(x[1], x[13]);
   accum.mul_x2(x[2], x[12]);
   accum.mul_x2(x[3], x[11]);
   accum.mul_x2(x[4], x[10]);
   accum.mul_x2(x[5], x[9]);
   accum.mul_x2(x[6], x[8]);
   accum.mul(x[7], x[7]);
   z[14] = accum.extract();
   accum.mul_x2(x[0], x[15]);
   accum.mul_x2(x[1], x[14]);
   accum.mul_x2(x[2], x[13]);
   accum.mul_x2(x[3], x[12]);
   accum.mul_x2(x[4], x[11]);
   accum.mul_x2(x[5], x[10]);
   accum.mul_x2(x[6], x[9]);
   accum.mul_x2(x[7], x[8]);
   z[15] = accum.extract();
   accum.mul_x2(x[0], x[16]);
   accum.mul_x2(x[1], x[15]);
   accum.mul_x2(x[2], x[14]);
   accum.mul_x2(x[3], x[13]);
   accum.mul_x2(x[4], x[12]);
   accum.mul_x2(x[5], x[11]);
   accum.mul_x2(x[6], x[10]);
   accum.mul_x2(x[7], x[9]);
   accum.mul(x[8], x[8]);
   z[16] = accum.extract();
   accum.mul_x2(x[0], x[17]);
   accum.mul_x2(x[1], x[16]);
   accum.mul_x2(x[2], x[15]);
   accum.mul_x2(x[3], x[14]);
   accum.mul_x2(x[4], x[13]);
   accum.mul_x2(x[5], x[12]);
   accum.mul_x2(x[6], x[11]);
   accum.mul_x2(x[7], x[10]);
   accum.mul_x2(x[8], x[9]);
   z[17] = accum.extract();
   accum.mul_x2(x[0], x[18]);
   accum.mul_x2(x[1], x[17]);
   accum.mul_x2(x[2], x[16]);
   accum.mul_x2(x[3], x[15]);
   accum.mul_x2(x[4], x[14]);
   accum.mul_x2(x[5], x[13]);
   accum.mul_x2(x[6], x[12]);
   accum.mul_x2(x[7], x[11]);
   accum.mul_x2(x[8], x[10]);
   accum.mul(x[9], x[9]);
   z[18] = accum.extract();
   accum.mul_x2(x[0], x[19]);
   accum.mul_x2(x[1], x[18]);
   accum.mul_x2(x[2], x[17]);
   accum.mul_x2(x[3], x[16]);
   accum.mul_x2(x[4], x[15]);
   accum.mul_x2(x[5], x[14]);
   accum.mul_x2(x[6], x[13]);
   accum.mul_x2(x[7], x[12]);
   accum.mul_x2(x[8], x[11]);
   accum.mul_x2(x[9], x[10]);
   z[19] = accum.extract();
   accum.mul_x2(x[0], x[20]);
   accum.mul_x2(x[1], x[19]);
   accum.mul_x2(x[2], x[18]);
   accum.mul_x2(x[3], x[17]);
   accum.mul_x2(x[4], x[16]);
   accum.mul_x2(x[5], x[15]);
   accum.mul_x2(x[6], x[14]);
   accum.mul_x2(x[7], x[13]);
   accum.mul_x2(x[8], x[12]);
   accum.mul_x2(x[9], x[11]);
   accum.mul(x[10], x[10]);
   z[20] = accum.extract();
   accum.mul_x2(x[0], x[21]);
   accum.mul_x2(x[1], x[20]);
   accum.mul_x2(x[2], x[19]);
   accum.mul_x2(x[3], x[18]);
   accum.mul_x2(x[4], x[17]);
   accum.mul_x2(x[5], x[16]);
   accum.mul_x2(x[6], x[15]);
   accum.mul_x2(x[7], x[14]);
   accum.mul_x2(x[8], x[13]);
   accum.mul_x2(x[9], x[12]);
   accum.mul_x2(x[10], x[11]);
   z[21] = accum.extract();
   accum.mul_x2(x[0], x[22]);
   accum.mul_x2(x[1], x[21]);
   accum.mul_x2(x[2], x[20]);
   accum.mul_x2(x[3], x[19]);
   accum.mul_x2(x[4], x[18]);
   accum.mul_x2(x[5], x[17]);
   accum.mul_x2(x[6], x[16]);
   accum.mul_x2(x[7], x[15]);
   accum.mul_x2(x[8], x[14]);
   accum.mul_x2(x[9], x[13]);
   accum.mul_x2(x[10], x[12]);
   accum.mul(x[11], x[11]);
   z[22] = accum.extract();
   accum.mul_x2(x[0], x[23]);
   accum.mul_x2(x[1], x[22]);
   accum.mul_x2(x[2], x[21]);
   accum.mul_x2(x[3], x[20]);
   accum.mul_x2(x[4], x[19]);
   accum.mul_x2(x[5], x[18]);
   accum.mul_x2(x[6], x[17]);
   accum.mul_x2(x[7], x[16]);
   accum.mul_x2(x[8], x[15]);
   accum.mul_x2(x[9], x[14]);
   accum.mul_x2(x[10], x[13]);
   accum.mul_x2(x[11], x[12]);
   z[23] = accum.extract();
   accum.mul_x2(x[1], x[23]);
   accum.mul_x2(x[2], x[22]);
   accum.mul_x2(x[3], x[21]);
   accum.mul_x2(x[4], x[20]);
   accum.mul_x2(x[5], x[19]);
   accum.mul_x2(x[6], x[18]);
   accum.mul_x2(x[7], x[17]);
   accum.mul_x2(x[8], x[16]);
   accum.mul_x2(x[9], x[15]);
   accum.mul_x2(x[10], x[14]);
   accum.mul_x2(x[11], x[13]);
   accum.mul(x[12], x[12]);
   z[24] = accum.extract();
   accum.mul_x2(x[2], x[23]);
   accum.mul_x2(x[3], x[22]);
   accum.mul_x2(x[4], x[21]);
   accum.mul_x2(x[5], x[20]);
   accum.mul_x2(x[6], x[19]);
   accum.mul_x2(x[7], x[18]);
   accum.mul_x2(x[8], x[17]);
   accum.mul_x2(x[9], x[16]);
   accum.mul_x2(x[10], x[15]);
   accum.mul_x2(x[11], x[14]);
   accum.mul_x2(x[12], x[13]);
   z[25] = accum.extract();
   accum.mul_x2(x[3], x[23]);
   accum.mul_x2(x[4], x[22]);
   accum.mul_x2(x[5], x[21]);
   accum.mul_x2(x[6], x[20]);
   accum.mul_x2(x[7], x[19]);
   accum.mul_x2(x[8], x[18]);
   accum.mul_x2(x[9], x[17]);
   accum.mul_x2(x[10], x[16]);
   accum.mul_x2(x[11], x[15]);
   accum.mul_x2(x[12], x[14]);
   accum.mul(x[13], x[13]);
   z[26] = accum.extract();
   accum.mul_x2(x[4], x[23]);
   accum.mul_x2(x[5], x[22]);
   accum.mul_x2(x[6], x[21]);
   accum.mul_x2(x[7], x[20]);
   accum.mul_x2(x[8], x[19]);
   accum.mul_x2(x[9], x[18]);
   accum.mul_x2(x[10], x[17]);
   accum.mul_x2(x[11], x[16]);
   accum.mul_x2(x[12], x[15]);
   accum.mul_x2(x[13], x[14]);
   z[27] = accum.extract();
   accum.mul_x2(x[5], x[23]);
   accum.mul_x2(x[6], x[22]);
   accum.mul_x2(x[7], x[21]);
   accum.mul_x2(x[8], x[20]);
   accum.mul_x2(x[9], x[19]);
   accum.mul_x2(x[10], x[18]);
   accum.mul_x2(x[11], x[17]);
   accum.mul_x2(x[12], x[16]);
   accum.mul_x2(x[13], x[15]);
   accum.mul(x[14], x[14]);
   z[28] = accum.extract();
   accum.mul_x2(x[6], x[23]);
   accum.mul_x2(x[7], x[22]);
   accum.mul_x2(x[8], x[21]);
   accum.mul_x2(x[9], x[20]);
   accum.mul_x2(x[10], x[19]);
   accum.mul_x2(x[11], x[18]);
   accum.mul_x2(x[12], x[17]);
   accum.mul_x2(x[13], x[16]);
   accum.mul_x2(x[14], x[15]);
   z[29] = accum.extract();
   accum.mul_x2(x[7], x[23]);
   accum.mul_x2(x[8], x[22]);
   accum.mul_x2(x[9], x[21]);
   accum.mul_x2(x[10], x[20]);
   accum.mul_x2(x[11], x[19]);
   accum.mul_x2(x[12], x[18]);
   accum.mul_x2(x[13], x[17]);
   accum.mul_x2(x[14], x[16]);
   accum.mul(x[15], x[15]);
   z[30] = accum.extract();
   accum.mul_x2(x[8], x[23]);
   accum.mul_x2(x[9], x[22]);
   accum.mul_x2(x[10], x[21]);
   accum.mul_x2(x[11], x[20]);
   accum.mul_x2(x[12], x[19]);
   accum.mul_x2(x[13], x[18]);
   accum.mul_x2(x[14], x[17]);
   accum.mul_x2(x[15], x[16]);
   z[31] = accum.extract();
   accum.mul_x2(x[9], x[23]);
   accum.mul_x2(x[10], x[22]);
   accum.mul_x2(x[11], x[21]);
   accum.mul_x2(x[12], x[20]);
   accum.mul_x2(x[13], x[19]);
   accum.mul_x2(x[14], x[18]);
   accum.mul_x2(x[15], x[17]);
   accum.mul(x[16], x[16]);
   z[32] = accum.extract();
   accum.mul_x2(x[10], x[23]);
   accum.mul_x2(x[11], x[22]);
   accum.mul_x2(x[12], x[21]);
   accum.mul_x2(x[13], x[20]);
   accum.mul_x2(x[14], x[19]);
   accum.mul_x2(x[15], x[18]);
   accum.mul_x2(x[16], x[17]);
   z[33] = accum.extract();
   accum.mul_x2(x[11], x[23]);
   accum.mul_x2(x[12], x[22]);
   accum.mul_x2(x[13], x[21]);
   accum.mul_x2(x[14], x[20]);
   accum.mul_x2(x[15], x[19]);
   accum.mul_x2(x[16], x[18]);
   accum.mul(x[17], x[17]);
   z[34] = accum.extract();
   accum.mul_x2(x[12], x[23]);
   accum.mul_x2(x[13], x[22]);
   accum.mul_x2(x[14], x[21]);
   accum.mul_x2(x[15], x[20]);
   accum.mul_x2(x[16], x[19]);
   accum.mul_x2(x[17], x[18]);
   z[35] = accum.extract();
   accum.mul_x2(x[13], x[23]);
   accum.mul_x2(x[14], x[22]);
   accum.mul_x2(x[15], x[21]);
   accum.mul_x2(x[16], x[20]);
   accum.mul_x2(x[17], x[19]);
   accum.mul(x[18], x[18]);
   z[36] = accum.extract();
   accum.mul_x2(x[14], x[23]);
   accum.mul_x2(x[15], x[22]);
   accum.mul_x2(x[16], x[21]);
   accum.mul_x2(x[17], x[20]);
   accum.mul_x2(x[18], x[19]);
   z[37] = accum.extract();
   accum.mul_x2(x[15], x[23]);
   accum.mul_x2(x[16], x[22]);
   accum.mul_x2(x[17], x[21]);
   accum.mul_x2(x[18], x[20]);
   accum.mul(x[19], x[19]);
   z[38] = accum.extract();
   accum.mul_x2(x[16], x[23]);
   accum.mul_x2(x[17], x[22]);
   accum.mul_x2(x[18], x[21]);
   accum.mul_x2(x[19], x[20]);
   z[39] = accum.extract();
   accum.mul_x2(x[17], x[23]);
   accum.mul_x2(x[18], x[22]);
   accum.mul_x2(x[19], x[21]);
   accum.mul(x[20], x[20]);
   z[40] = accum.extract();
   accum.mul_x2(x[18], x[23]);
   accum.mul_x2(x[19], x[22]);
   accum.mul_x2(x[20], x[21]);
   z[41] = accum.extract();
   accum.mul_x2(x[19], x[23]);
   accum.mul_x2(x[20], x[22]);
   accum.mul(x[21], x[21]);
   z[42] = accum.extract();
   accum.mul_x2(x[20], x[23]);
   accum.mul_x2(x[21], x[22]);
   z[43] = accum.extract();
   accum.mul_x2(x[21], x[23]);
   accum.mul(x[22], x[22]);
   z[44] = accum.extract();
   accum.mul_x2(x[22], x[23]);
   z[45] = accum.extract();
   accum.mul(x[23], x[23]);
   z[46] = accum.extract();
   z[47] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr().

bigint_comba_sqr4()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr4	(	word	z[8],
		const word	x[4] )

Definition at line 16 of file mp_comba.cpp.

                                                   {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   z[7] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

bigint_comba_sqr6()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr6	(	word	z[12],
		const word	x[6] )

Definition at line 74 of file mp_comba.cpp.

                                                    {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   z[11] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

bigint_comba_sqr7()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr7	(	word	z[14],
		const word	x[7] )

Definition at line 171 of file mp_comba.cpp.

                                                    {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[0], x[6]);
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[1], x[6]);
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[2], x[6]);
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[3], x[6]);
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul_x2(x[4], x[6]);
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   accum.mul_x2(x[5], x[6]);
   z[11] = accum.extract();
   accum.mul(x[6], x[6]);
   z[12] = accum.extract();
   z[13] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by comba_sqr().

bigint_comba_sqr8()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr8	(	word	z[16],
		const word	x[8] )

Definition at line 292 of file mp_comba.cpp.

                                                    {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[0], x[6]);
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[0], x[7]);
   accum.mul_x2(x[1], x[6]);
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[1], x[7]);
   accum.mul_x2(x[2], x[6]);
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[2], x[7]);
   accum.mul_x2(x[3], x[6]);
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul_x2(x[3], x[7]);
   accum.mul_x2(x[4], x[6]);
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   accum.mul_x2(x[4], x[7]);
   accum.mul_x2(x[5], x[6]);
   z[11] = accum.extract();
   accum.mul_x2(x[5], x[7]);
   accum.mul(x[6], x[6]);
   z[12] = accum.extract();
   accum.mul_x2(x[6], x[7]);
   z[13] = accum.extract();
   accum.mul(x[7], x[7]);
   z[14] = accum.extract();
   z[15] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

bigint_comba_sqr9()

BOTAN_FUZZER_API void Botan::bigint_comba_sqr9	(	word	z[18],
		const word	x[9] )

Definition at line 440 of file mp_comba.cpp.

                                                    {
   word3<word> accum;
 
   accum.mul(x[0], x[0]);
   z[0] = accum.extract();
   accum.mul_x2(x[0], x[1]);
   z[1] = accum.extract();
   accum.mul_x2(x[0], x[2]);
   accum.mul(x[1], x[1]);
   z[2] = accum.extract();
   accum.mul_x2(x[0], x[3]);
   accum.mul_x2(x[1], x[2]);
   z[3] = accum.extract();
   accum.mul_x2(x[0], x[4]);
   accum.mul_x2(x[1], x[3]);
   accum.mul(x[2], x[2]);
   z[4] = accum.extract();
   accum.mul_x2(x[0], x[5]);
   accum.mul_x2(x[1], x[4]);
   accum.mul_x2(x[2], x[3]);
   z[5] = accum.extract();
   accum.mul_x2(x[0], x[6]);
   accum.mul_x2(x[1], x[5]);
   accum.mul_x2(x[2], x[4]);
   accum.mul(x[3], x[3]);
   z[6] = accum.extract();
   accum.mul_x2(x[0], x[7]);
   accum.mul_x2(x[1], x[6]);
   accum.mul_x2(x[2], x[5]);
   accum.mul_x2(x[3], x[4]);
   z[7] = accum.extract();
   accum.mul_x2(x[0], x[8]);
   accum.mul_x2(x[1], x[7]);
   accum.mul_x2(x[2], x[6]);
   accum.mul_x2(x[3], x[5]);
   accum.mul(x[4], x[4]);
   z[8] = accum.extract();
   accum.mul_x2(x[1], x[8]);
   accum.mul_x2(x[2], x[7]);
   accum.mul_x2(x[3], x[6]);
   accum.mul_x2(x[4], x[5]);
   z[9] = accum.extract();
   accum.mul_x2(x[2], x[8]);
   accum.mul_x2(x[3], x[7]);
   accum.mul_x2(x[4], x[6]);
   accum.mul(x[5], x[5]);
   z[10] = accum.extract();
   accum.mul_x2(x[3], x[8]);
   accum.mul_x2(x[4], x[7]);
   accum.mul_x2(x[5], x[6]);
   z[11] = accum.extract();
   accum.mul_x2(x[4], x[8]);
   accum.mul_x2(x[5], x[7]);
   accum.mul(x[6], x[6]);
   z[12] = accum.extract();
   accum.mul_x2(x[5], x[8]);
   accum.mul_x2(x[6], x[7]);
   z[13] = accum.extract();
   accum.mul_x2(x[6], x[8]);
   accum.mul(x[7], x[7]);
   z[14] = accum.extract();
   accum.mul_x2(x[7], x[8]);
   z[15] = accum.extract();
   accum.mul(x[8], x[8]);
   z[16] = accum.extract();
   z[17] = accum.extract();
}

References Botan::word3< W >::extract(), Botan::word3< W >::mul(), and Botan::word3< W >::mul_x2().

Referenced by bigint_sqr(), and comba_sqr().

bigint_correct_redc()

template<size_t N, WordType W>

void Botan::bigint_correct_redc ( std::array< W, N > & r, const std::array< W, N > & P, const std::array< W, N > & C )

inlineconstexpr

Set r to r - C. Then if r < 0, add P to r

Definition at line 1137 of file mp_core.h.

                                                                                                               {
   // TODO look into combining the two operations for important values of N
   W borrow = bigint_sub2(r.data(), N, C.data(), N);
   bigint_cnd_add(borrow, r.data(), N, P.data(), N);
}

References bigint_cnd_add(), and bigint_sub2().

bigint_ct_is_eq()

template<WordType W>

auto Botan::bigint_ct_is_eq ( const W x[], size_t x_size, const W y[], size_t y_size ) -> CT::Mask<W>

inlineconstexpr

Definition at line 631 of file mp_core.h.

                                                                                                           {
   const size_t common_elems = std::min(x_size, y_size);
 
   W diff = 0;
 
   for(size_t i = 0; i != common_elems; i++) {
      diff |= (x[i] ^ y[i]);
   }
 
   // If any bits were set in high part of x/y, then they are not equal
   if(x_size < y_size) {
      for(size_t i = x_size; i != y_size; i++) {
         diff |= y[i];
      }
   } else if(y_size < x_size) {
      for(size_t i = y_size; i != x_size; i++) {
         diff |= x[i];
      }
   }
 
   return CT::Mask<W>::is_zero(diff);
}

References Botan::CT::Mask< T >::is_zero().

Referenced by Botan::BigInt::is_equal().

bigint_ct_is_lt()

template<WordType W>

auto Botan::bigint_ct_is_lt ( const W x[], size_t x_size, const W y[], size_t y_size, bool lt_or_equal = false ) -> CT::Mask<W>

inlineconstexpr

Compare x and y Return ~0 if x[0:x_size] < y[0:y_size] or 0 otherwise If lt_or_equal is true, returns ~0 also for x == y

Definition at line 598 of file mp_core.h.

                {
   const size_t common_elems = std::min(x_size, y_size);
 
   auto is_lt = CT::Mask<W>::expand(lt_or_equal);
 
   for(size_t i = 0; i != common_elems; i++) {
      const auto eq = CT::Mask<W>::is_equal(x[i], y[i]);
      const auto lt = CT::Mask<W>::is_lt(x[i], y[i]);
      is_lt = eq.select_mask(is_lt, lt);
   }
 
   if(x_size < y_size) {
      W mask = 0;
      for(size_t i = x_size; i != y_size; i++) {
         mask |= y[i];
      }
      // If any bits were set in high part of y, then is_lt should be forced true
      is_lt |= CT::Mask<W>::expand(mask);
   } else if(y_size < x_size) {
      W mask = 0;
      for(size_t i = y_size; i != x_size; i++) {
         mask |= x[i];
      }
 
      // If any bits were set in high part of x, then is_lt should be false
      is_lt &= CT::Mask<W>::is_zero(mask);
   }
 
   return is_lt;
}

References Botan::CT::Mask< T >::expand(), Botan::CT::Mask< T >::is_equal(), Botan::CT::Mask< T >::is_lt(), and Botan::CT::Mask< T >::is_zero().

Referenced by Botan::BigInt::is_less_than(), Botan::PCurve::GenericPrimeOrderCurve::mul2_vartime_x_mod_order_eq(), and Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime_x_mod_order_eq().

bigint_divop_vartime()

template<WordType W>

auto Botan::bigint_divop_vartime ( W n1, W n0, W d ) -> W

inlineconstexpr

Compute ((n1<<bits) + n0) / d

Definition at line 712 of file mp_core.h.

                                                                 {
   if(d == 0) {
      throw Invalid_Argument("bigint_divop_vartime divide by zero");
   }
 
   if constexpr(WordInfo<W>::dword_is_native) {
      typename WordInfo<W>::dword n = n1;
      n <<= WordInfo<W>::bits;
      n |= n0;
      return static_cast<W>(n / d);
   } else {
      W high = n1 % d;
      W quotient = 0;
 
      for(size_t i = 0; i != WordInfo<W>::bits; ++i) {
         const W high_top_bit = high >> (WordInfo<W>::bits - 1);
 
         high <<= 1;
         high |= (n0 >> (WordInfo<W>::bits - 1 - i)) & 1;
         quotient <<= 1;
 
         if(high_top_bit || high >= d) {
            high -= d;
            quotient |= 1;
         }
      }
 
      return quotient;
   }
}

Referenced by bigint_modop_vartime(), and vartime_divide().

bigint_linmul2()

template<WordType W>

auto Botan::bigint_linmul2 ( W x[], size_t x_size, W y ) -> W

inlinenodiscardconstexpr

Definition at line 511 of file mp_core.h.

                                                                                   {
   const size_t blocks = x_size - (x_size % 8);
 
   W carry = 0;
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_linmul2(x + i, y, carry);
   }
 
   for(size_t i = blocks; i != x_size; ++i) {
      x[i] = word_madd2(x[i], y, &carry);
   }
 
   return carry;
}

References carry(), word8_linmul2(), and word_madd2().

Referenced by Botan::BigInt::mul(), and Botan::BigInt::operator*=().

bigint_linmul3()

template<WordType W>

void Botan::bigint_linmul3 ( W z[], const W x[], size_t x_size, W y )

inlineconstexpr

Definition at line 528 of file mp_core.h.

                                                                             {
   const size_t blocks = x_size - (x_size % 8);
 
   W carry = 0;
 
   for(size_t i = 0; i != blocks; i += 8) {
      carry = word8_linmul3(z + i, x + i, y, carry);
   }
 
   for(size_t i = blocks; i != x_size; ++i) {
      z[i] = word_madd2(x[i], y, &carry);
   }
 
   z[x_size] = carry;
}

References carry(), word8_linmul3(), and word_madd2().

Referenced by bigint_mul(), bigint_sqr(), Botan::BigInt::mul(), operator*(), and operator*().

bigint_mod_sub()

template<WordType W>

void Botan::bigint_mod_sub ( W t[], const W s[], const W mod[], size_t mod_sw, W ws[] )

inlineconstexpr

Set t to t-s modulo mod

Parameters

t	first integer
s	second integer
mod	the modulus
mod_sw	size of t, s, and mod
ws	workspace of size mod_sw

Definition at line 698 of file mp_core.h.

                                                                                               {
   // ws = t - s
   const W borrow = bigint_sub3(ws, t, mod_sw, s, mod_sw);
 
   // Conditionally add back the modulus
   bigint_cnd_add(borrow, ws, mod, mod_sw);
 
   copy_mem(t, ws, mod_sw);
}

References bigint_cnd_add(), bigint_sub3(), and copy_mem().

Referenced by Botan::BigInt::mod_sub().

bigint_modop_vartime()

template<WordType W>

auto Botan::bigint_modop_vartime ( W n1, W n0, W d ) -> W

inlineconstexpr

Compute ((n1<<bits) + n0) % d

Definition at line 747 of file mp_core.h.

                                                                 {
   if(d == 0) {
      throw Invalid_Argument("bigint_modop_vartime divide by zero");
   }
 
   W z = bigint_divop_vartime(n1, n0, d);
   W carry = 0;
   z = word_madd2(z, d, &carry);
   return (n0 - z);
}

References bigint_divop_vartime(), carry(), and word_madd2().

Referenced by operator%(), and Botan::BigInt::operator%=().

bigint_monty_maybe_sub() [1/2]

template<WordType W>

void Botan::bigint_monty_maybe_sub ( size_t N, W z[], W x0, const W x[], const W p[] )

inlineconstexpr

Conditional subtraction for Montgomery reduction

This function assumes that (x0 || x) is less than 2*p

Computes z[0:N] = (x0 || x[0:N]) - p[0:N]

If z would be positive, returns z[0:N] Otherwise returns original input x

Definition at line 344 of file mp_core.h.

                                                                                              {
   W borrow = 0;
 
   const size_t blocks = N - (N % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      borrow = word8_sub3(z + i, x + i, p + i, borrow);
   }
 
   for(size_t i = blocks; i != N; ++i) {
      z[i] = word_sub(x[i], p[i], &borrow);
   }
 
   borrow = (x0 - borrow) > x0;
 
   CT::conditional_assign_mem(borrow, z, x, N);
}

References Botan::CT::conditional_assign_mem(), word8_sub3(), and word_sub().

Referenced by bigint_monty_redc_12(), bigint_monty_redc_16(), bigint_monty_redc_24(), bigint_monty_redc_32(), bigint_monty_redc_4(), bigint_monty_redc_6(), bigint_monty_redc_8(), and bigint_monty_redc_generic().

bigint_monty_maybe_sub() [2/2]

template<size_t N, WordType W>

void Botan::bigint_monty_maybe_sub ( W z[N], W x0, const W x[N], const W y[N] )

inlineconstexpr

Conditional subtraction for Montgomery reduction

This function assumes that (x0 || x) is less than 2*p

Computes z[0:N] = (x0 || x[0:N]) - p[0:N]

If z would be positive, returns z[0:N] Otherwise returns original input x

Definition at line 373 of file mp_core.h.

                                                                                       {
   W borrow = 0;
 
   for(size_t i = 0; i != N; ++i) {
      z[i] = word_sub(x[i], y[i], &borrow);
   }
 
   borrow = (x0 - borrow) > x0;
 
   CT::conditional_assign_mem(borrow, z, x, N);
}

References Botan::CT::conditional_assign_mem(), and word_sub().

bigint_monty_redc()

void Botan::bigint_monty_redc ( word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size )

inline

Montgomery Reduction

Parameters

r	result of exactly p_size words
z	integer to reduce, of size exactly 2*p_size.
p	modulus
p_size	size of p
p_dash	Montgomery value
ws	array of at least p_size words
ws_size	size of ws in words

It is allowed to set &r[0] == &z[0] however in this case note that only the first p_size words of r will be written to and the high p_size words of r/z will still hold the original inputs, these must be cleared after use. See bigint_monty_redc_inplace

Definition at line 987 of file mp_core.h.

                                                                                                    {
   const size_t z_size = 2 * p_size;
 
   BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small");
 
   if(p_size == 4) {
      bigint_monty_redc_4(r, z, p, p_dash, ws);
   } else if(p_size == 6) {
      bigint_monty_redc_6(r, z, p, p_dash, ws);
   } else if(p_size == 8) {
      bigint_monty_redc_8(r, z, p, p_dash, ws);
   } else if(p_size == 12) {
      bigint_monty_redc_12(r, z, p, p_dash, ws);
   } else if(p_size == 16) {
      bigint_monty_redc_16(r, z, p, p_dash, ws);
   } else if(p_size == 24) {
      bigint_monty_redc_24(r, z, p, p_dash, ws);
   } else if(p_size == 32) {
      bigint_monty_redc_32(r, z, p, p_dash, ws);
   } else {
      bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws);
   }
}

References bigint_monty_redc_12(), bigint_monty_redc_16(), bigint_monty_redc_24(), bigint_monty_redc_32(), bigint_monty_redc_4(), bigint_monty_redc_6(), bigint_monty_redc_8(), bigint_monty_redc_generic(), and BOTAN_ARG_CHECK.

Referenced by bigint_monty_redc_inplace().

bigint_monty_redc_12()

void Botan::bigint_monty_redc_12	(	word	r[12],
		const word	z[24],
		const word	p[12],
		word	p_dash,
		word	ws[12] )

Definition at line 202 of file mp_monty_n.cpp.

                                                                                                    {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[6]);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[6] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[7]);
   accum.mul(ws[1], p[6]);
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.mul(ws[6], p[1]);
   accum.add(z[7]);
   ws[7] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[8]);
   accum.mul(ws[1], p[7]);
   accum.mul(ws[2], p[6]);
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.mul(ws[6], p[2]);
   accum.mul(ws[7], p[1]);
   accum.add(z[8]);
   ws[8] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[9]);
   accum.mul(ws[1], p[8]);
   accum.mul(ws[2], p[7]);
   accum.mul(ws[3], p[6]);
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.mul(ws[6], p[3]);
   accum.mul(ws[7], p[2]);
   accum.mul(ws[8], p[1]);
   accum.add(z[9]);
   ws[9] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[10]);
   accum.mul(ws[1], p[9]);
   accum.mul(ws[2], p[8]);
   accum.mul(ws[3], p[7]);
   accum.mul(ws[4], p[6]);
   accum.mul(ws[5], p[5]);
   accum.mul(ws[6], p[4]);
   accum.mul(ws[7], p[3]);
   accum.mul(ws[8], p[2]);
   accum.mul(ws[9], p[1]);
   accum.add(z[10]);
   ws[10] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[11]);
   accum.mul(ws[1], p[10]);
   accum.mul(ws[2], p[9]);
   accum.mul(ws[3], p[8]);
   accum.mul(ws[4], p[7]);
   accum.mul(ws[5], p[6]);
   accum.mul(ws[6], p[5]);
   accum.mul(ws[7], p[4]);
   accum.mul(ws[8], p[3]);
   accum.mul(ws[9], p[2]);
   accum.mul(ws[10], p[1]);
   accum.add(z[11]);
   ws[11] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[11]);
   accum.mul(ws[2], p[10]);
   accum.mul(ws[3], p[9]);
   accum.mul(ws[4], p[8]);
   accum.mul(ws[5], p[7]);
   accum.mul(ws[6], p[6]);
   accum.mul(ws[7], p[5]);
   accum.mul(ws[8], p[4]);
   accum.mul(ws[9], p[3]);
   accum.mul(ws[10], p[2]);
   accum.mul(ws[11], p[1]);
   accum.add(z[12]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[11]);
   accum.mul(ws[3], p[10]);
   accum.mul(ws[4], p[9]);
   accum.mul(ws[5], p[8]);
   accum.mul(ws[6], p[7]);
   accum.mul(ws[7], p[6]);
   accum.mul(ws[8], p[5]);
   accum.mul(ws[9], p[4]);
   accum.mul(ws[10], p[3]);
   accum.mul(ws[11], p[2]);
   accum.add(z[13]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[11]);
   accum.mul(ws[4], p[10]);
   accum.mul(ws[5], p[9]);
   accum.mul(ws[6], p[8]);
   accum.mul(ws[7], p[7]);
   accum.mul(ws[8], p[6]);
   accum.mul(ws[9], p[5]);
   accum.mul(ws[10], p[4]);
   accum.mul(ws[11], p[3]);
   accum.add(z[14]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[11]);
   accum.mul(ws[5], p[10]);
   accum.mul(ws[6], p[9]);
   accum.mul(ws[7], p[8]);
   accum.mul(ws[8], p[7]);
   accum.mul(ws[9], p[6]);
   accum.mul(ws[10], p[5]);
   accum.mul(ws[11], p[4]);
   accum.add(z[15]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[11]);
   accum.mul(ws[6], p[10]);
   accum.mul(ws[7], p[9]);
   accum.mul(ws[8], p[8]);
   accum.mul(ws[9], p[7]);
   accum.mul(ws[10], p[6]);
   accum.mul(ws[11], p[5]);
   accum.add(z[16]);
   ws[4] = accum.extract();
   accum.mul(ws[6], p[11]);
   accum.mul(ws[7], p[10]);
   accum.mul(ws[8], p[9]);
   accum.mul(ws[9], p[8]);
   accum.mul(ws[10], p[7]);
   accum.mul(ws[11], p[6]);
   accum.add(z[17]);
   ws[5] = accum.extract();
   accum.mul(ws[7], p[11]);
   accum.mul(ws[8], p[10]);
   accum.mul(ws[9], p[9]);
   accum.mul(ws[10], p[8]);
   accum.mul(ws[11], p[7]);
   accum.add(z[18]);
   ws[6] = accum.extract();
   accum.mul(ws[8], p[11]);
   accum.mul(ws[9], p[10]);
   accum.mul(ws[10], p[9]);
   accum.mul(ws[11], p[8]);
   accum.add(z[19]);
   ws[7] = accum.extract();
   accum.mul(ws[9], p[11]);
   accum.mul(ws[10], p[10]);
   accum.mul(ws[11], p[9]);
   accum.add(z[20]);
   ws[8] = accum.extract();
   accum.mul(ws[10], p[11]);
   accum.mul(ws[11], p[10]);
   accum.add(z[21]);
   ws[9] = accum.extract();
   accum.mul(ws[11], p[11]);
   accum.add(z[22]);
   ws[10] = accum.extract();
   accum.add(z[23]);
   ws[11] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<12>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_16()

void Botan::bigint_monty_redc_16	(	word	r[16],
		const word	z[32],
		const word	p[16],
		word	p_dash,
		word	ws[16] )

Definition at line 388 of file mp_monty_n.cpp.

                                                                                                    {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[6]);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[6] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[7]);
   accum.mul(ws[1], p[6]);
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.mul(ws[6], p[1]);
   accum.add(z[7]);
   ws[7] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[8]);
   accum.mul(ws[1], p[7]);
   accum.mul(ws[2], p[6]);
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.mul(ws[6], p[2]);
   accum.mul(ws[7], p[1]);
   accum.add(z[8]);
   ws[8] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[9]);
   accum.mul(ws[1], p[8]);
   accum.mul(ws[2], p[7]);
   accum.mul(ws[3], p[6]);
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.mul(ws[6], p[3]);
   accum.mul(ws[7], p[2]);
   accum.mul(ws[8], p[1]);
   accum.add(z[9]);
   ws[9] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[10]);
   accum.mul(ws[1], p[9]);
   accum.mul(ws[2], p[8]);
   accum.mul(ws[3], p[7]);
   accum.mul(ws[4], p[6]);
   accum.mul(ws[5], p[5]);
   accum.mul(ws[6], p[4]);
   accum.mul(ws[7], p[3]);
   accum.mul(ws[8], p[2]);
   accum.mul(ws[9], p[1]);
   accum.add(z[10]);
   ws[10] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[11]);
   accum.mul(ws[1], p[10]);
   accum.mul(ws[2], p[9]);
   accum.mul(ws[3], p[8]);
   accum.mul(ws[4], p[7]);
   accum.mul(ws[5], p[6]);
   accum.mul(ws[6], p[5]);
   accum.mul(ws[7], p[4]);
   accum.mul(ws[8], p[3]);
   accum.mul(ws[9], p[2]);
   accum.mul(ws[10], p[1]);
   accum.add(z[11]);
   ws[11] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[12]);
   accum.mul(ws[1], p[11]);
   accum.mul(ws[2], p[10]);
   accum.mul(ws[3], p[9]);
   accum.mul(ws[4], p[8]);
   accum.mul(ws[5], p[7]);
   accum.mul(ws[6], p[6]);
   accum.mul(ws[7], p[5]);
   accum.mul(ws[8], p[4]);
   accum.mul(ws[9], p[3]);
   accum.mul(ws[10], p[2]);
   accum.mul(ws[11], p[1]);
   accum.add(z[12]);
   ws[12] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[13]);
   accum.mul(ws[1], p[12]);
   accum.mul(ws[2], p[11]);
   accum.mul(ws[3], p[10]);
   accum.mul(ws[4], p[9]);
   accum.mul(ws[5], p[8]);
   accum.mul(ws[6], p[7]);
   accum.mul(ws[7], p[6]);
   accum.mul(ws[8], p[5]);
   accum.mul(ws[9], p[4]);
   accum.mul(ws[10], p[3]);
   accum.mul(ws[11], p[2]);
   accum.mul(ws[12], p[1]);
   accum.add(z[13]);
   ws[13] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[14]);
   accum.mul(ws[1], p[13]);
   accum.mul(ws[2], p[12]);
   accum.mul(ws[3], p[11]);
   accum.mul(ws[4], p[10]);
   accum.mul(ws[5], p[9]);
   accum.mul(ws[6], p[8]);
   accum.mul(ws[7], p[7]);
   accum.mul(ws[8], p[6]);
   accum.mul(ws[9], p[5]);
   accum.mul(ws[10], p[4]);
   accum.mul(ws[11], p[3]);
   accum.mul(ws[12], p[2]);
   accum.mul(ws[13], p[1]);
   accum.add(z[14]);
   ws[14] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[15]);
   accum.mul(ws[1], p[14]);
   accum.mul(ws[2], p[13]);
   accum.mul(ws[3], p[12]);
   accum.mul(ws[4], p[11]);
   accum.mul(ws[5], p[10]);
   accum.mul(ws[6], p[9]);
   accum.mul(ws[7], p[8]);
   accum.mul(ws[8], p[7]);
   accum.mul(ws[9], p[6]);
   accum.mul(ws[10], p[5]);
   accum.mul(ws[11], p[4]);
   accum.mul(ws[12], p[3]);
   accum.mul(ws[13], p[2]);
   accum.mul(ws[14], p[1]);
   accum.add(z[15]);
   ws[15] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[15]);
   accum.mul(ws[2], p[14]);
   accum.mul(ws[3], p[13]);
   accum.mul(ws[4], p[12]);
   accum.mul(ws[5], p[11]);
   accum.mul(ws[6], p[10]);
   accum.mul(ws[7], p[9]);
   accum.mul(ws[8], p[8]);
   accum.mul(ws[9], p[7]);
   accum.mul(ws[10], p[6]);
   accum.mul(ws[11], p[5]);
   accum.mul(ws[12], p[4]);
   accum.mul(ws[13], p[3]);
   accum.mul(ws[14], p[2]);
   accum.mul(ws[15], p[1]);
   accum.add(z[16]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[15]);
   accum.mul(ws[3], p[14]);
   accum.mul(ws[4], p[13]);
   accum.mul(ws[5], p[12]);
   accum.mul(ws[6], p[11]);
   accum.mul(ws[7], p[10]);
   accum.mul(ws[8], p[9]);
   accum.mul(ws[9], p[8]);
   accum.mul(ws[10], p[7]);
   accum.mul(ws[11], p[6]);
   accum.mul(ws[12], p[5]);
   accum.mul(ws[13], p[4]);
   accum.mul(ws[14], p[3]);
   accum.mul(ws[15], p[2]);
   accum.add(z[17]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[15]);
   accum.mul(ws[4], p[14]);
   accum.mul(ws[5], p[13]);
   accum.mul(ws[6], p[12]);
   accum.mul(ws[7], p[11]);
   accum.mul(ws[8], p[10]);
   accum.mul(ws[9], p[9]);
   accum.mul(ws[10], p[8]);
   accum.mul(ws[11], p[7]);
   accum.mul(ws[12], p[6]);
   accum.mul(ws[13], p[5]);
   accum.mul(ws[14], p[4]);
   accum.mul(ws[15], p[3]);
   accum.add(z[18]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[15]);
   accum.mul(ws[5], p[14]);
   accum.mul(ws[6], p[13]);
   accum.mul(ws[7], p[12]);
   accum.mul(ws[8], p[11]);
   accum.mul(ws[9], p[10]);
   accum.mul(ws[10], p[9]);
   accum.mul(ws[11], p[8]);
   accum.mul(ws[12], p[7]);
   accum.mul(ws[13], p[6]);
   accum.mul(ws[14], p[5]);
   accum.mul(ws[15], p[4]);
   accum.add(z[19]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[15]);
   accum.mul(ws[6], p[14]);
   accum.mul(ws[7], p[13]);
   accum.mul(ws[8], p[12]);
   accum.mul(ws[9], p[11]);
   accum.mul(ws[10], p[10]);
   accum.mul(ws[11], p[9]);
   accum.mul(ws[12], p[8]);
   accum.mul(ws[13], p[7]);
   accum.mul(ws[14], p[6]);
   accum.mul(ws[15], p[5]);
   accum.add(z[20]);
   ws[4] = accum.extract();
   accum.mul(ws[6], p[15]);
   accum.mul(ws[7], p[14]);
   accum.mul(ws[8], p[13]);
   accum.mul(ws[9], p[12]);
   accum.mul(ws[10], p[11]);
   accum.mul(ws[11], p[10]);
   accum.mul(ws[12], p[9]);
   accum.mul(ws[13], p[8]);
   accum.mul(ws[14], p[7]);
   accum.mul(ws[15], p[6]);
   accum.add(z[21]);
   ws[5] = accum.extract();
   accum.mul(ws[7], p[15]);
   accum.mul(ws[8], p[14]);
   accum.mul(ws[9], p[13]);
   accum.mul(ws[10], p[12]);
   accum.mul(ws[11], p[11]);
   accum.mul(ws[12], p[10]);
   accum.mul(ws[13], p[9]);
   accum.mul(ws[14], p[8]);
   accum.mul(ws[15], p[7]);
   accum.add(z[22]);
   ws[6] = accum.extract();
   accum.mul(ws[8], p[15]);
   accum.mul(ws[9], p[14]);
   accum.mul(ws[10], p[13]);
   accum.mul(ws[11], p[12]);
   accum.mul(ws[12], p[11]);
   accum.mul(ws[13], p[10]);
   accum.mul(ws[14], p[9]);
   accum.mul(ws[15], p[8]);
   accum.add(z[23]);
   ws[7] = accum.extract();
   accum.mul(ws[9], p[15]);
   accum.mul(ws[10], p[14]);
   accum.mul(ws[11], p[13]);
   accum.mul(ws[12], p[12]);
   accum.mul(ws[13], p[11]);
   accum.mul(ws[14], p[10]);
   accum.mul(ws[15], p[9]);
   accum.add(z[24]);
   ws[8] = accum.extract();
   accum.mul(ws[10], p[15]);
   accum.mul(ws[11], p[14]);
   accum.mul(ws[12], p[13]);
   accum.mul(ws[13], p[12]);
   accum.mul(ws[14], p[11]);
   accum.mul(ws[15], p[10]);
   accum.add(z[25]);
   ws[9] = accum.extract();
   accum.mul(ws[11], p[15]);
   accum.mul(ws[12], p[14]);
   accum.mul(ws[13], p[13]);
   accum.mul(ws[14], p[12]);
   accum.mul(ws[15], p[11]);
   accum.add(z[26]);
   ws[10] = accum.extract();
   accum.mul(ws[12], p[15]);
   accum.mul(ws[13], p[14]);
   accum.mul(ws[14], p[13]);
   accum.mul(ws[15], p[12]);
   accum.add(z[27]);
   ws[11] = accum.extract();
   accum.mul(ws[13], p[15]);
   accum.mul(ws[14], p[14]);
   accum.mul(ws[15], p[13]);
   accum.add(z[28]);
   ws[12] = accum.extract();
   accum.mul(ws[14], p[15]);
   accum.mul(ws[15], p[14]);
   accum.add(z[29]);
   ws[13] = accum.extract();
   accum.mul(ws[15], p[15]);
   accum.add(z[30]);
   ws[14] = accum.extract();
   accum.add(z[31]);
   ws[15] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<16>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_24()

void Botan::bigint_monty_redc_24	(	word	r[24],
		const word	z[48],
		const word	p[24],
		word	p_dash,
		word	ws[24] )

Definition at line 698 of file mp_monty_n.cpp.

                                                                                                    {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[6]);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[6] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[7]);
   accum.mul(ws[1], p[6]);
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.mul(ws[6], p[1]);
   accum.add(z[7]);
   ws[7] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[8]);
   accum.mul(ws[1], p[7]);
   accum.mul(ws[2], p[6]);
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.mul(ws[6], p[2]);
   accum.mul(ws[7], p[1]);
   accum.add(z[8]);
   ws[8] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[9]);
   accum.mul(ws[1], p[8]);
   accum.mul(ws[2], p[7]);
   accum.mul(ws[3], p[6]);
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.mul(ws[6], p[3]);
   accum.mul(ws[7], p[2]);
   accum.mul(ws[8], p[1]);
   accum.add(z[9]);
   ws[9] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[10]);
   accum.mul(ws[1], p[9]);
   accum.mul(ws[2], p[8]);
   accum.mul(ws[3], p[7]);
   accum.mul(ws[4], p[6]);
   accum.mul(ws[5], p[5]);
   accum.mul(ws[6], p[4]);
   accum.mul(ws[7], p[3]);
   accum.mul(ws[8], p[2]);
   accum.mul(ws[9], p[1]);
   accum.add(z[10]);
   ws[10] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[11]);
   accum.mul(ws[1], p[10]);
   accum.mul(ws[2], p[9]);
   accum.mul(ws[3], p[8]);
   accum.mul(ws[4], p[7]);
   accum.mul(ws[5], p[6]);
   accum.mul(ws[6], p[5]);
   accum.mul(ws[7], p[4]);
   accum.mul(ws[8], p[3]);
   accum.mul(ws[9], p[2]);
   accum.mul(ws[10], p[1]);
   accum.add(z[11]);
   ws[11] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[12]);
   accum.mul(ws[1], p[11]);
   accum.mul(ws[2], p[10]);
   accum.mul(ws[3], p[9]);
   accum.mul(ws[4], p[8]);
   accum.mul(ws[5], p[7]);
   accum.mul(ws[6], p[6]);
   accum.mul(ws[7], p[5]);
   accum.mul(ws[8], p[4]);
   accum.mul(ws[9], p[3]);
   accum.mul(ws[10], p[2]);
   accum.mul(ws[11], p[1]);
   accum.add(z[12]);
   ws[12] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[13]);
   accum.mul(ws[1], p[12]);
   accum.mul(ws[2], p[11]);
   accum.mul(ws[3], p[10]);
   accum.mul(ws[4], p[9]);
   accum.mul(ws[5], p[8]);
   accum.mul(ws[6], p[7]);
   accum.mul(ws[7], p[6]);
   accum.mul(ws[8], p[5]);
   accum.mul(ws[9], p[4]);
   accum.mul(ws[10], p[3]);
   accum.mul(ws[11], p[2]);
   accum.mul(ws[12], p[1]);
   accum.add(z[13]);
   ws[13] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[14]);
   accum.mul(ws[1], p[13]);
   accum.mul(ws[2], p[12]);
   accum.mul(ws[3], p[11]);
   accum.mul(ws[4], p[10]);
   accum.mul(ws[5], p[9]);
   accum.mul(ws[6], p[8]);
   accum.mul(ws[7], p[7]);
   accum.mul(ws[8], p[6]);
   accum.mul(ws[9], p[5]);
   accum.mul(ws[10], p[4]);
   accum.mul(ws[11], p[3]);
   accum.mul(ws[12], p[2]);
   accum.mul(ws[13], p[1]);
   accum.add(z[14]);
   ws[14] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[15]);
   accum.mul(ws[1], p[14]);
   accum.mul(ws[2], p[13]);
   accum.mul(ws[3], p[12]);
   accum.mul(ws[4], p[11]);
   accum.mul(ws[5], p[10]);
   accum.mul(ws[6], p[9]);
   accum.mul(ws[7], p[8]);
   accum.mul(ws[8], p[7]);
   accum.mul(ws[9], p[6]);
   accum.mul(ws[10], p[5]);
   accum.mul(ws[11], p[4]);
   accum.mul(ws[12], p[3]);
   accum.mul(ws[13], p[2]);
   accum.mul(ws[14], p[1]);
   accum.add(z[15]);
   ws[15] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[16]);
   accum.mul(ws[1], p[15]);
   accum.mul(ws[2], p[14]);
   accum.mul(ws[3], p[13]);
   accum.mul(ws[4], p[12]);
   accum.mul(ws[5], p[11]);
   accum.mul(ws[6], p[10]);
   accum.mul(ws[7], p[9]);
   accum.mul(ws[8], p[8]);
   accum.mul(ws[9], p[7]);
   accum.mul(ws[10], p[6]);
   accum.mul(ws[11], p[5]);
   accum.mul(ws[12], p[4]);
   accum.mul(ws[13], p[3]);
   accum.mul(ws[14], p[2]);
   accum.mul(ws[15], p[1]);
   accum.add(z[16]);
   ws[16] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[17]);
   accum.mul(ws[1], p[16]);
   accum.mul(ws[2], p[15]);
   accum.mul(ws[3], p[14]);
   accum.mul(ws[4], p[13]);
   accum.mul(ws[5], p[12]);
   accum.mul(ws[6], p[11]);
   accum.mul(ws[7], p[10]);
   accum.mul(ws[8], p[9]);
   accum.mul(ws[9], p[8]);
   accum.mul(ws[10], p[7]);
   accum.mul(ws[11], p[6]);
   accum.mul(ws[12], p[5]);
   accum.mul(ws[13], p[4]);
   accum.mul(ws[14], p[3]);
   accum.mul(ws[15], p[2]);
   accum.mul(ws[16], p[1]);
   accum.add(z[17]);
   ws[17] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[18]);
   accum.mul(ws[1], p[17]);
   accum.mul(ws[2], p[16]);
   accum.mul(ws[3], p[15]);
   accum.mul(ws[4], p[14]);
   accum.mul(ws[5], p[13]);
   accum.mul(ws[6], p[12]);
   accum.mul(ws[7], p[11]);
   accum.mul(ws[8], p[10]);
   accum.mul(ws[9], p[9]);
   accum.mul(ws[10], p[8]);
   accum.mul(ws[11], p[7]);
   accum.mul(ws[12], p[6]);
   accum.mul(ws[13], p[5]);
   accum.mul(ws[14], p[4]);
   accum.mul(ws[15], p[3]);
   accum.mul(ws[16], p[2]);
   accum.mul(ws[17], p[1]);
   accum.add(z[18]);
   ws[18] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[19]);
   accum.mul(ws[1], p[18]);
   accum.mul(ws[2], p[17]);
   accum.mul(ws[3], p[16]);
   accum.mul(ws[4], p[15]);
   accum.mul(ws[5], p[14]);
   accum.mul(ws[6], p[13]);
   accum.mul(ws[7], p[12]);
   accum.mul(ws[8], p[11]);
   accum.mul(ws[9], p[10]);
   accum.mul(ws[10], p[9]);
   accum.mul(ws[11], p[8]);
   accum.mul(ws[12], p[7]);
   accum.mul(ws[13], p[6]);
   accum.mul(ws[14], p[5]);
   accum.mul(ws[15], p[4]);
   accum.mul(ws[16], p[3]);
   accum.mul(ws[17], p[2]);
   accum.mul(ws[18], p[1]);
   accum.add(z[19]);
   ws[19] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[20]);
   accum.mul(ws[1], p[19]);
   accum.mul(ws[2], p[18]);
   accum.mul(ws[3], p[17]);
   accum.mul(ws[4], p[16]);
   accum.mul(ws[5], p[15]);
   accum.mul(ws[6], p[14]);
   accum.mul(ws[7], p[13]);
   accum.mul(ws[8], p[12]);
   accum.mul(ws[9], p[11]);
   accum.mul(ws[10], p[10]);
   accum.mul(ws[11], p[9]);
   accum.mul(ws[12], p[8]);
   accum.mul(ws[13], p[7]);
   accum.mul(ws[14], p[6]);
   accum.mul(ws[15], p[5]);
   accum.mul(ws[16], p[4]);
   accum.mul(ws[17], p[3]);
   accum.mul(ws[18], p[2]);
   accum.mul(ws[19], p[1]);
   accum.add(z[20]);
   ws[20] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[21]);
   accum.mul(ws[1], p[20]);
   accum.mul(ws[2], p[19]);
   accum.mul(ws[3], p[18]);
   accum.mul(ws[4], p[17]);
   accum.mul(ws[5], p[16]);
   accum.mul(ws[6], p[15]);
   accum.mul(ws[7], p[14]);
   accum.mul(ws[8], p[13]);
   accum.mul(ws[9], p[12]);
   accum.mul(ws[10], p[11]);
   accum.mul(ws[11], p[10]);
   accum.mul(ws[12], p[9]);
   accum.mul(ws[13], p[8]);
   accum.mul(ws[14], p[7]);
   accum.mul(ws[15], p[6]);
   accum.mul(ws[16], p[5]);
   accum.mul(ws[17], p[4]);
   accum.mul(ws[18], p[3]);
   accum.mul(ws[19], p[2]);
   accum.mul(ws[20], p[1]);
   accum.add(z[21]);
   ws[21] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[22]);
   accum.mul(ws[1], p[21]);
   accum.mul(ws[2], p[20]);
   accum.mul(ws[3], p[19]);
   accum.mul(ws[4], p[18]);
   accum.mul(ws[5], p[17]);
   accum.mul(ws[6], p[16]);
   accum.mul(ws[7], p[15]);
   accum.mul(ws[8], p[14]);
   accum.mul(ws[9], p[13]);
   accum.mul(ws[10], p[12]);
   accum.mul(ws[11], p[11]);
   accum.mul(ws[12], p[10]);
   accum.mul(ws[13], p[9]);
   accum.mul(ws[14], p[8]);
   accum.mul(ws[15], p[7]);
   accum.mul(ws[16], p[6]);
   accum.mul(ws[17], p[5]);
   accum.mul(ws[18], p[4]);
   accum.mul(ws[19], p[3]);
   accum.mul(ws[20], p[2]);
   accum.mul(ws[21], p[1]);
   accum.add(z[22]);
   ws[22] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[23]);
   accum.mul(ws[1], p[22]);
   accum.mul(ws[2], p[21]);
   accum.mul(ws[3], p[20]);
   accum.mul(ws[4], p[19]);
   accum.mul(ws[5], p[18]);
   accum.mul(ws[6], p[17]);
   accum.mul(ws[7], p[16]);
   accum.mul(ws[8], p[15]);
   accum.mul(ws[9], p[14]);
   accum.mul(ws[10], p[13]);
   accum.mul(ws[11], p[12]);
   accum.mul(ws[12], p[11]);
   accum.mul(ws[13], p[10]);
   accum.mul(ws[14], p[9]);
   accum.mul(ws[15], p[8]);
   accum.mul(ws[16], p[7]);
   accum.mul(ws[17], p[6]);
   accum.mul(ws[18], p[5]);
   accum.mul(ws[19], p[4]);
   accum.mul(ws[20], p[3]);
   accum.mul(ws[21], p[2]);
   accum.mul(ws[22], p[1]);
   accum.add(z[23]);
   ws[23] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[23]);
   accum.mul(ws[2], p[22]);
   accum.mul(ws[3], p[21]);
   accum.mul(ws[4], p[20]);
   accum.mul(ws[5], p[19]);
   accum.mul(ws[6], p[18]);
   accum.mul(ws[7], p[17]);
   accum.mul(ws[8], p[16]);
   accum.mul(ws[9], p[15]);
   accum.mul(ws[10], p[14]);
   accum.mul(ws[11], p[13]);
   accum.mul(ws[12], p[12]);
   accum.mul(ws[13], p[11]);
   accum.mul(ws[14], p[10]);
   accum.mul(ws[15], p[9]);
   accum.mul(ws[16], p[8]);
   accum.mul(ws[17], p[7]);
   accum.mul(ws[18], p[6]);
   accum.mul(ws[19], p[5]);
   accum.mul(ws[20], p[4]);
   accum.mul(ws[21], p[3]);
   accum.mul(ws[22], p[2]);
   accum.mul(ws[23], p[1]);
   accum.add(z[24]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[23]);
   accum.mul(ws[3], p[22]);
   accum.mul(ws[4], p[21]);
   accum.mul(ws[5], p[20]);
   accum.mul(ws[6], p[19]);
   accum.mul(ws[7], p[18]);
   accum.mul(ws[8], p[17]);
   accum.mul(ws[9], p[16]);
   accum.mul(ws[10], p[15]);
   accum.mul(ws[11], p[14]);
   accum.mul(ws[12], p[13]);
   accum.mul(ws[13], p[12]);
   accum.mul(ws[14], p[11]);
   accum.mul(ws[15], p[10]);
   accum.mul(ws[16], p[9]);
   accum.mul(ws[17], p[8]);
   accum.mul(ws[18], p[7]);
   accum.mul(ws[19], p[6]);
   accum.mul(ws[20], p[5]);
   accum.mul(ws[21], p[4]);
   accum.mul(ws[22], p[3]);
   accum.mul(ws[23], p[2]);
   accum.add(z[25]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[23]);
   accum.mul(ws[4], p[22]);
   accum.mul(ws[5], p[21]);
   accum.mul(ws[6], p[20]);
   accum.mul(ws[7], p[19]);
   accum.mul(ws[8], p[18]);
   accum.mul(ws[9], p[17]);
   accum.mul(ws[10], p[16]);
   accum.mul(ws[11], p[15]);
   accum.mul(ws[12], p[14]);
   accum.mul(ws[13], p[13]);
   accum.mul(ws[14], p[12]);
   accum.mul(ws[15], p[11]);
   accum.mul(ws[16], p[10]);
   accum.mul(ws[17], p[9]);
   accum.mul(ws[18], p[8]);
   accum.mul(ws[19], p[7]);
   accum.mul(ws[20], p[6]);
   accum.mul(ws[21], p[5]);
   accum.mul(ws[22], p[4]);
   accum.mul(ws[23], p[3]);
   accum.add(z[26]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[23]);
   accum.mul(ws[5], p[22]);
   accum.mul(ws[6], p[21]);
   accum.mul(ws[7], p[20]);
   accum.mul(ws[8], p[19]);
   accum.mul(ws[9], p[18]);
   accum.mul(ws[10], p[17]);
   accum.mul(ws[11], p[16]);
   accum.mul(ws[12], p[15]);
   accum.mul(ws[13], p[14]);
   accum.mul(ws[14], p[13]);
   accum.mul(ws[15], p[12]);
   accum.mul(ws[16], p[11]);
   accum.mul(ws[17], p[10]);
   accum.mul(ws[18], p[9]);
   accum.mul(ws[19], p[8]);
   accum.mul(ws[20], p[7]);
   accum.mul(ws[21], p[6]);
   accum.mul(ws[22], p[5]);
   accum.mul(ws[23], p[4]);
   accum.add(z[27]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[23]);
   accum.mul(ws[6], p[22]);
   accum.mul(ws[7], p[21]);
   accum.mul(ws[8], p[20]);
   accum.mul(ws[9], p[19]);
   accum.mul(ws[10], p[18]);
   accum.mul(ws[11], p[17]);
   accum.mul(ws[12], p[16]);
   accum.mul(ws[13], p[15]);
   accum.mul(ws[14], p[14]);
   accum.mul(ws[15], p[13]);
   accum.mul(ws[16], p[12]);
   accum.mul(ws[17], p[11]);
   accum.mul(ws[18], p[10]);
   accum.mul(ws[19], p[9]);
   accum.mul(ws[20], p[8]);
   accum.mul(ws[21], p[7]);
   accum.mul(ws[22], p[6]);
   accum.mul(ws[23], p[5]);
   accum.add(z[28]);
   ws[4] = accum.extract();
   accum.mul(ws[6], p[23]);
   accum.mul(ws[7], p[22]);
   accum.mul(ws[8], p[21]);
   accum.mul(ws[9], p[20]);
   accum.mul(ws[10], p[19]);
   accum.mul(ws[11], p[18]);
   accum.mul(ws[12], p[17]);
   accum.mul(ws[13], p[16]);
   accum.mul(ws[14], p[15]);
   accum.mul(ws[15], p[14]);
   accum.mul(ws[16], p[13]);
   accum.mul(ws[17], p[12]);
   accum.mul(ws[18], p[11]);
   accum.mul(ws[19], p[10]);
   accum.mul(ws[20], p[9]);
   accum.mul(ws[21], p[8]);
   accum.mul(ws[22], p[7]);
   accum.mul(ws[23], p[6]);
   accum.add(z[29]);
   ws[5] = accum.extract();
   accum.mul(ws[7], p[23]);
   accum.mul(ws[8], p[22]);
   accum.mul(ws[9], p[21]);
   accum.mul(ws[10], p[20]);
   accum.mul(ws[11], p[19]);
   accum.mul(ws[12], p[18]);
   accum.mul(ws[13], p[17]);
   accum.mul(ws[14], p[16]);
   accum.mul(ws[15], p[15]);
   accum.mul(ws[16], p[14]);
   accum.mul(ws[17], p[13]);
   accum.mul(ws[18], p[12]);
   accum.mul(ws[19], p[11]);
   accum.mul(ws[20], p[10]);
   accum.mul(ws[21], p[9]);
   accum.mul(ws[22], p[8]);
   accum.mul(ws[23], p[7]);
   accum.add(z[30]);
   ws[6] = accum.extract();
   accum.mul(ws[8], p[23]);
   accum.mul(ws[9], p[22]);
   accum.mul(ws[10], p[21]);
   accum.mul(ws[11], p[20]);
   accum.mul(ws[12], p[19]);
   accum.mul(ws[13], p[18]);
   accum.mul(ws[14], p[17]);
   accum.mul(ws[15], p[16]);
   accum.mul(ws[16], p[15]);
   accum.mul(ws[17], p[14]);
   accum.mul(ws[18], p[13]);
   accum.mul(ws[19], p[12]);
   accum.mul(ws[20], p[11]);
   accum.mul(ws[21], p[10]);
   accum.mul(ws[22], p[9]);
   accum.mul(ws[23], p[8]);
   accum.add(z[31]);
   ws[7] = accum.extract();
   accum.mul(ws[9], p[23]);
   accum.mul(ws[10], p[22]);
   accum.mul(ws[11], p[21]);
   accum.mul(ws[12], p[20]);
   accum.mul(ws[13], p[19]);
   accum.mul(ws[14], p[18]);
   accum.mul(ws[15], p[17]);
   accum.mul(ws[16], p[16]);
   accum.mul(ws[17], p[15]);
   accum.mul(ws[18], p[14]);
   accum.mul(ws[19], p[13]);
   accum.mul(ws[20], p[12]);
   accum.mul(ws[21], p[11]);
   accum.mul(ws[22], p[10]);
   accum.mul(ws[23], p[9]);
   accum.add(z[32]);
   ws[8] = accum.extract();
   accum.mul(ws[10], p[23]);
   accum.mul(ws[11], p[22]);
   accum.mul(ws[12], p[21]);
   accum.mul(ws[13], p[20]);
   accum.mul(ws[14], p[19]);
   accum.mul(ws[15], p[18]);
   accum.mul(ws[16], p[17]);
   accum.mul(ws[17], p[16]);
   accum.mul(ws[18], p[15]);
   accum.mul(ws[19], p[14]);
   accum.mul(ws[20], p[13]);
   accum.mul(ws[21], p[12]);
   accum.mul(ws[22], p[11]);
   accum.mul(ws[23], p[10]);
   accum.add(z[33]);
   ws[9] = accum.extract();
   accum.mul(ws[11], p[23]);
   accum.mul(ws[12], p[22]);
   accum.mul(ws[13], p[21]);
   accum.mul(ws[14], p[20]);
   accum.mul(ws[15], p[19]);
   accum.mul(ws[16], p[18]);
   accum.mul(ws[17], p[17]);
   accum.mul(ws[18], p[16]);
   accum.mul(ws[19], p[15]);
   accum.mul(ws[20], p[14]);
   accum.mul(ws[21], p[13]);
   accum.mul(ws[22], p[12]);
   accum.mul(ws[23], p[11]);
   accum.add(z[34]);
   ws[10] = accum.extract();
   accum.mul(ws[12], p[23]);
   accum.mul(ws[13], p[22]);
   accum.mul(ws[14], p[21]);
   accum.mul(ws[15], p[20]);
   accum.mul(ws[16], p[19]);
   accum.mul(ws[17], p[18]);
   accum.mul(ws[18], p[17]);
   accum.mul(ws[19], p[16]);
   accum.mul(ws[20], p[15]);
   accum.mul(ws[21], p[14]);
   accum.mul(ws[22], p[13]);
   accum.mul(ws[23], p[12]);
   accum.add(z[35]);
   ws[11] = accum.extract();
   accum.mul(ws[13], p[23]);
   accum.mul(ws[14], p[22]);
   accum.mul(ws[15], p[21]);
   accum.mul(ws[16], p[20]);
   accum.mul(ws[17], p[19]);
   accum.mul(ws[18], p[18]);
   accum.mul(ws[19], p[17]);
   accum.mul(ws[20], p[16]);
   accum.mul(ws[21], p[15]);
   accum.mul(ws[22], p[14]);
   accum.mul(ws[23], p[13]);
   accum.add(z[36]);
   ws[12] = accum.extract();
   accum.mul(ws[14], p[23]);
   accum.mul(ws[15], p[22]);
   accum.mul(ws[16], p[21]);
   accum.mul(ws[17], p[20]);
   accum.mul(ws[18], p[19]);
   accum.mul(ws[19], p[18]);
   accum.mul(ws[20], p[17]);
   accum.mul(ws[21], p[16]);
   accum.mul(ws[22], p[15]);
   accum.mul(ws[23], p[14]);
   accum.add(z[37]);
   ws[13] = accum.extract();
   accum.mul(ws[15], p[23]);
   accum.mul(ws[16], p[22]);
   accum.mul(ws[17], p[21]);
   accum.mul(ws[18], p[20]);
   accum.mul(ws[19], p[19]);
   accum.mul(ws[20], p[18]);
   accum.mul(ws[21], p[17]);
   accum.mul(ws[22], p[16]);
   accum.mul(ws[23], p[15]);
   accum.add(z[38]);
   ws[14] = accum.extract();
   accum.mul(ws[16], p[23]);
   accum.mul(ws[17], p[22]);
   accum.mul(ws[18], p[21]);
   accum.mul(ws[19], p[20]);
   accum.mul(ws[20], p[19]);
   accum.mul(ws[21], p[18]);
   accum.mul(ws[22], p[17]);
   accum.mul(ws[23], p[16]);
   accum.add(z[39]);
   ws[15] = accum.extract();
   accum.mul(ws[17], p[23]);
   accum.mul(ws[18], p[22]);
   accum.mul(ws[19], p[21]);
   accum.mul(ws[20], p[20]);
   accum.mul(ws[21], p[19]);
   accum.mul(ws[22], p[18]);
   accum.mul(ws[23], p[17]);
   accum.add(z[40]);
   ws[16] = accum.extract();
   accum.mul(ws[18], p[23]);
   accum.mul(ws[19], p[22]);
   accum.mul(ws[20], p[21]);
   accum.mul(ws[21], p[20]);
   accum.mul(ws[22], p[19]);
   accum.mul(ws[23], p[18]);
   accum.add(z[41]);
   ws[17] = accum.extract();
   accum.mul(ws[19], p[23]);
   accum.mul(ws[20], p[22]);
   accum.mul(ws[21], p[21]);
   accum.mul(ws[22], p[20]);
   accum.mul(ws[23], p[19]);
   accum.add(z[42]);
   ws[18] = accum.extract();
   accum.mul(ws[20], p[23]);
   accum.mul(ws[21], p[22]);
   accum.mul(ws[22], p[21]);
   accum.mul(ws[23], p[20]);
   accum.add(z[43]);
   ws[19] = accum.extract();
   accum.mul(ws[21], p[23]);
   accum.mul(ws[22], p[22]);
   accum.mul(ws[23], p[21]);
   accum.add(z[44]);
   ws[20] = accum.extract();
   accum.mul(ws[22], p[23]);
   accum.mul(ws[23], p[22]);
   accum.add(z[45]);
   ws[21] = accum.extract();
   accum.mul(ws[23], p[23]);
   accum.add(z[46]);
   ws[22] = accum.extract();
   accum.add(z[47]);
   ws[23] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<24>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_32()

void Botan::bigint_monty_redc_32	(	word	r[32],
		const word	z[64],
		const word	p[32],
		word	p_dash,
		word	ws[32] )

Definition at line 1352 of file mp_monty_n.cpp.

                                                                                                    {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[6]);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[6] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[7]);
   accum.mul(ws[1], p[6]);
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.mul(ws[6], p[1]);
   accum.add(z[7]);
   ws[7] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[8]);
   accum.mul(ws[1], p[7]);
   accum.mul(ws[2], p[6]);
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.mul(ws[6], p[2]);
   accum.mul(ws[7], p[1]);
   accum.add(z[8]);
   ws[8] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[9]);
   accum.mul(ws[1], p[8]);
   accum.mul(ws[2], p[7]);
   accum.mul(ws[3], p[6]);
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.mul(ws[6], p[3]);
   accum.mul(ws[7], p[2]);
   accum.mul(ws[8], p[1]);
   accum.add(z[9]);
   ws[9] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[10]);
   accum.mul(ws[1], p[9]);
   accum.mul(ws[2], p[8]);
   accum.mul(ws[3], p[7]);
   accum.mul(ws[4], p[6]);
   accum.mul(ws[5], p[5]);
   accum.mul(ws[6], p[4]);
   accum.mul(ws[7], p[3]);
   accum.mul(ws[8], p[2]);
   accum.mul(ws[9], p[1]);
   accum.add(z[10]);
   ws[10] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[11]);
   accum.mul(ws[1], p[10]);
   accum.mul(ws[2], p[9]);
   accum.mul(ws[3], p[8]);
   accum.mul(ws[4], p[7]);
   accum.mul(ws[5], p[6]);
   accum.mul(ws[6], p[5]);
   accum.mul(ws[7], p[4]);
   accum.mul(ws[8], p[3]);
   accum.mul(ws[9], p[2]);
   accum.mul(ws[10], p[1]);
   accum.add(z[11]);
   ws[11] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[12]);
   accum.mul(ws[1], p[11]);
   accum.mul(ws[2], p[10]);
   accum.mul(ws[3], p[9]);
   accum.mul(ws[4], p[8]);
   accum.mul(ws[5], p[7]);
   accum.mul(ws[6], p[6]);
   accum.mul(ws[7], p[5]);
   accum.mul(ws[8], p[4]);
   accum.mul(ws[9], p[3]);
   accum.mul(ws[10], p[2]);
   accum.mul(ws[11], p[1]);
   accum.add(z[12]);
   ws[12] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[13]);
   accum.mul(ws[1], p[12]);
   accum.mul(ws[2], p[11]);
   accum.mul(ws[3], p[10]);
   accum.mul(ws[4], p[9]);
   accum.mul(ws[5], p[8]);
   accum.mul(ws[6], p[7]);
   accum.mul(ws[7], p[6]);
   accum.mul(ws[8], p[5]);
   accum.mul(ws[9], p[4]);
   accum.mul(ws[10], p[3]);
   accum.mul(ws[11], p[2]);
   accum.mul(ws[12], p[1]);
   accum.add(z[13]);
   ws[13] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[14]);
   accum.mul(ws[1], p[13]);
   accum.mul(ws[2], p[12]);
   accum.mul(ws[3], p[11]);
   accum.mul(ws[4], p[10]);
   accum.mul(ws[5], p[9]);
   accum.mul(ws[6], p[8]);
   accum.mul(ws[7], p[7]);
   accum.mul(ws[8], p[6]);
   accum.mul(ws[9], p[5]);
   accum.mul(ws[10], p[4]);
   accum.mul(ws[11], p[3]);
   accum.mul(ws[12], p[2]);
   accum.mul(ws[13], p[1]);
   accum.add(z[14]);
   ws[14] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[15]);
   accum.mul(ws[1], p[14]);
   accum.mul(ws[2], p[13]);
   accum.mul(ws[3], p[12]);
   accum.mul(ws[4], p[11]);
   accum.mul(ws[5], p[10]);
   accum.mul(ws[6], p[9]);
   accum.mul(ws[7], p[8]);
   accum.mul(ws[8], p[7]);
   accum.mul(ws[9], p[6]);
   accum.mul(ws[10], p[5]);
   accum.mul(ws[11], p[4]);
   accum.mul(ws[12], p[3]);
   accum.mul(ws[13], p[2]);
   accum.mul(ws[14], p[1]);
   accum.add(z[15]);
   ws[15] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[16]);
   accum.mul(ws[1], p[15]);
   accum.mul(ws[2], p[14]);
   accum.mul(ws[3], p[13]);
   accum.mul(ws[4], p[12]);
   accum.mul(ws[5], p[11]);
   accum.mul(ws[6], p[10]);
   accum.mul(ws[7], p[9]);
   accum.mul(ws[8], p[8]);
   accum.mul(ws[9], p[7]);
   accum.mul(ws[10], p[6]);
   accum.mul(ws[11], p[5]);
   accum.mul(ws[12], p[4]);
   accum.mul(ws[13], p[3]);
   accum.mul(ws[14], p[2]);
   accum.mul(ws[15], p[1]);
   accum.add(z[16]);
   ws[16] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[17]);
   accum.mul(ws[1], p[16]);
   accum.mul(ws[2], p[15]);
   accum.mul(ws[3], p[14]);
   accum.mul(ws[4], p[13]);
   accum.mul(ws[5], p[12]);
   accum.mul(ws[6], p[11]);
   accum.mul(ws[7], p[10]);
   accum.mul(ws[8], p[9]);
   accum.mul(ws[9], p[8]);
   accum.mul(ws[10], p[7]);
   accum.mul(ws[11], p[6]);
   accum.mul(ws[12], p[5]);
   accum.mul(ws[13], p[4]);
   accum.mul(ws[14], p[3]);
   accum.mul(ws[15], p[2]);
   accum.mul(ws[16], p[1]);
   accum.add(z[17]);
   ws[17] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[18]);
   accum.mul(ws[1], p[17]);
   accum.mul(ws[2], p[16]);
   accum.mul(ws[3], p[15]);
   accum.mul(ws[4], p[14]);
   accum.mul(ws[5], p[13]);
   accum.mul(ws[6], p[12]);
   accum.mul(ws[7], p[11]);
   accum.mul(ws[8], p[10]);
   accum.mul(ws[9], p[9]);
   accum.mul(ws[10], p[8]);
   accum.mul(ws[11], p[7]);
   accum.mul(ws[12], p[6]);
   accum.mul(ws[13], p[5]);
   accum.mul(ws[14], p[4]);
   accum.mul(ws[15], p[3]);
   accum.mul(ws[16], p[2]);
   accum.mul(ws[17], p[1]);
   accum.add(z[18]);
   ws[18] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[19]);
   accum.mul(ws[1], p[18]);
   accum.mul(ws[2], p[17]);
   accum.mul(ws[3], p[16]);
   accum.mul(ws[4], p[15]);
   accum.mul(ws[5], p[14]);
   accum.mul(ws[6], p[13]);
   accum.mul(ws[7], p[12]);
   accum.mul(ws[8], p[11]);
   accum.mul(ws[9], p[10]);
   accum.mul(ws[10], p[9]);
   accum.mul(ws[11], p[8]);
   accum.mul(ws[12], p[7]);
   accum.mul(ws[13], p[6]);
   accum.mul(ws[14], p[5]);
   accum.mul(ws[15], p[4]);
   accum.mul(ws[16], p[3]);
   accum.mul(ws[17], p[2]);
   accum.mul(ws[18], p[1]);
   accum.add(z[19]);
   ws[19] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[20]);
   accum.mul(ws[1], p[19]);
   accum.mul(ws[2], p[18]);
   accum.mul(ws[3], p[17]);
   accum.mul(ws[4], p[16]);
   accum.mul(ws[5], p[15]);
   accum.mul(ws[6], p[14]);
   accum.mul(ws[7], p[13]);
   accum.mul(ws[8], p[12]);
   accum.mul(ws[9], p[11]);
   accum.mul(ws[10], p[10]);
   accum.mul(ws[11], p[9]);
   accum.mul(ws[12], p[8]);
   accum.mul(ws[13], p[7]);
   accum.mul(ws[14], p[6]);
   accum.mul(ws[15], p[5]);
   accum.mul(ws[16], p[4]);
   accum.mul(ws[17], p[3]);
   accum.mul(ws[18], p[2]);
   accum.mul(ws[19], p[1]);
   accum.add(z[20]);
   ws[20] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[21]);
   accum.mul(ws[1], p[20]);
   accum.mul(ws[2], p[19]);
   accum.mul(ws[3], p[18]);
   accum.mul(ws[4], p[17]);
   accum.mul(ws[5], p[16]);
   accum.mul(ws[6], p[15]);
   accum.mul(ws[7], p[14]);
   accum.mul(ws[8], p[13]);
   accum.mul(ws[9], p[12]);
   accum.mul(ws[10], p[11]);
   accum.mul(ws[11], p[10]);
   accum.mul(ws[12], p[9]);
   accum.mul(ws[13], p[8]);
   accum.mul(ws[14], p[7]);
   accum.mul(ws[15], p[6]);
   accum.mul(ws[16], p[5]);
   accum.mul(ws[17], p[4]);
   accum.mul(ws[18], p[3]);
   accum.mul(ws[19], p[2]);
   accum.mul(ws[20], p[1]);
   accum.add(z[21]);
   ws[21] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[22]);
   accum.mul(ws[1], p[21]);
   accum.mul(ws[2], p[20]);
   accum.mul(ws[3], p[19]);
   accum.mul(ws[4], p[18]);
   accum.mul(ws[5], p[17]);
   accum.mul(ws[6], p[16]);
   accum.mul(ws[7], p[15]);
   accum.mul(ws[8], p[14]);
   accum.mul(ws[9], p[13]);
   accum.mul(ws[10], p[12]);
   accum.mul(ws[11], p[11]);
   accum.mul(ws[12], p[10]);
   accum.mul(ws[13], p[9]);
   accum.mul(ws[14], p[8]);
   accum.mul(ws[15], p[7]);
   accum.mul(ws[16], p[6]);
   accum.mul(ws[17], p[5]);
   accum.mul(ws[18], p[4]);
   accum.mul(ws[19], p[3]);
   accum.mul(ws[20], p[2]);
   accum.mul(ws[21], p[1]);
   accum.add(z[22]);
   ws[22] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[23]);
   accum.mul(ws[1], p[22]);
   accum.mul(ws[2], p[21]);
   accum.mul(ws[3], p[20]);
   accum.mul(ws[4], p[19]);
   accum.mul(ws[5], p[18]);
   accum.mul(ws[6], p[17]);
   accum.mul(ws[7], p[16]);
   accum.mul(ws[8], p[15]);
   accum.mul(ws[9], p[14]);
   accum.mul(ws[10], p[13]);
   accum.mul(ws[11], p[12]);
   accum.mul(ws[12], p[11]);
   accum.mul(ws[13], p[10]);
   accum.mul(ws[14], p[9]);
   accum.mul(ws[15], p[8]);
   accum.mul(ws[16], p[7]);
   accum.mul(ws[17], p[6]);
   accum.mul(ws[18], p[5]);
   accum.mul(ws[19], p[4]);
   accum.mul(ws[20], p[3]);
   accum.mul(ws[21], p[2]);
   accum.mul(ws[22], p[1]);
   accum.add(z[23]);
   ws[23] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[24]);
   accum.mul(ws[1], p[23]);
   accum.mul(ws[2], p[22]);
   accum.mul(ws[3], p[21]);
   accum.mul(ws[4], p[20]);
   accum.mul(ws[5], p[19]);
   accum.mul(ws[6], p[18]);
   accum.mul(ws[7], p[17]);
   accum.mul(ws[8], p[16]);
   accum.mul(ws[9], p[15]);
   accum.mul(ws[10], p[14]);
   accum.mul(ws[11], p[13]);
   accum.mul(ws[12], p[12]);
   accum.mul(ws[13], p[11]);
   accum.mul(ws[14], p[10]);
   accum.mul(ws[15], p[9]);
   accum.mul(ws[16], p[8]);
   accum.mul(ws[17], p[7]);
   accum.mul(ws[18], p[6]);
   accum.mul(ws[19], p[5]);
   accum.mul(ws[20], p[4]);
   accum.mul(ws[21], p[3]);
   accum.mul(ws[22], p[2]);
   accum.mul(ws[23], p[1]);
   accum.add(z[24]);
   ws[24] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[25]);
   accum.mul(ws[1], p[24]);
   accum.mul(ws[2], p[23]);
   accum.mul(ws[3], p[22]);
   accum.mul(ws[4], p[21]);
   accum.mul(ws[5], p[20]);
   accum.mul(ws[6], p[19]);
   accum.mul(ws[7], p[18]);
   accum.mul(ws[8], p[17]);
   accum.mul(ws[9], p[16]);
   accum.mul(ws[10], p[15]);
   accum.mul(ws[11], p[14]);
   accum.mul(ws[12], p[13]);
   accum.mul(ws[13], p[12]);
   accum.mul(ws[14], p[11]);
   accum.mul(ws[15], p[10]);
   accum.mul(ws[16], p[9]);
   accum.mul(ws[17], p[8]);
   accum.mul(ws[18], p[7]);
   accum.mul(ws[19], p[6]);
   accum.mul(ws[20], p[5]);
   accum.mul(ws[21], p[4]);
   accum.mul(ws[22], p[3]);
   accum.mul(ws[23], p[2]);
   accum.mul(ws[24], p[1]);
   accum.add(z[25]);
   ws[25] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[26]);
   accum.mul(ws[1], p[25]);
   accum.mul(ws[2], p[24]);
   accum.mul(ws[3], p[23]);
   accum.mul(ws[4], p[22]);
   accum.mul(ws[5], p[21]);
   accum.mul(ws[6], p[20]);
   accum.mul(ws[7], p[19]);
   accum.mul(ws[8], p[18]);
   accum.mul(ws[9], p[17]);
   accum.mul(ws[10], p[16]);
   accum.mul(ws[11], p[15]);
   accum.mul(ws[12], p[14]);
   accum.mul(ws[13], p[13]);
   accum.mul(ws[14], p[12]);
   accum.mul(ws[15], p[11]);
   accum.mul(ws[16], p[10]);
   accum.mul(ws[17], p[9]);
   accum.mul(ws[18], p[8]);
   accum.mul(ws[19], p[7]);
   accum.mul(ws[20], p[6]);
   accum.mul(ws[21], p[5]);
   accum.mul(ws[22], p[4]);
   accum.mul(ws[23], p[3]);
   accum.mul(ws[24], p[2]);
   accum.mul(ws[25], p[1]);
   accum.add(z[26]);
   ws[26] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[27]);
   accum.mul(ws[1], p[26]);
   accum.mul(ws[2], p[25]);
   accum.mul(ws[3], p[24]);
   accum.mul(ws[4], p[23]);
   accum.mul(ws[5], p[22]);
   accum.mul(ws[6], p[21]);
   accum.mul(ws[7], p[20]);
   accum.mul(ws[8], p[19]);
   accum.mul(ws[9], p[18]);
   accum.mul(ws[10], p[17]);
   accum.mul(ws[11], p[16]);
   accum.mul(ws[12], p[15]);
   accum.mul(ws[13], p[14]);
   accum.mul(ws[14], p[13]);
   accum.mul(ws[15], p[12]);
   accum.mul(ws[16], p[11]);
   accum.mul(ws[17], p[10]);
   accum.mul(ws[18], p[9]);
   accum.mul(ws[19], p[8]);
   accum.mul(ws[20], p[7]);
   accum.mul(ws[21], p[6]);
   accum.mul(ws[22], p[5]);
   accum.mul(ws[23], p[4]);
   accum.mul(ws[24], p[3]);
   accum.mul(ws[25], p[2]);
   accum.mul(ws[26], p[1]);
   accum.add(z[27]);
   ws[27] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[28]);
   accum.mul(ws[1], p[27]);
   accum.mul(ws[2], p[26]);
   accum.mul(ws[3], p[25]);
   accum.mul(ws[4], p[24]);
   accum.mul(ws[5], p[23]);
   accum.mul(ws[6], p[22]);
   accum.mul(ws[7], p[21]);
   accum.mul(ws[8], p[20]);
   accum.mul(ws[9], p[19]);
   accum.mul(ws[10], p[18]);
   accum.mul(ws[11], p[17]);
   accum.mul(ws[12], p[16]);
   accum.mul(ws[13], p[15]);
   accum.mul(ws[14], p[14]);
   accum.mul(ws[15], p[13]);
   accum.mul(ws[16], p[12]);
   accum.mul(ws[17], p[11]);
   accum.mul(ws[18], p[10]);
   accum.mul(ws[19], p[9]);
   accum.mul(ws[20], p[8]);
   accum.mul(ws[21], p[7]);
   accum.mul(ws[22], p[6]);
   accum.mul(ws[23], p[5]);
   accum.mul(ws[24], p[4]);
   accum.mul(ws[25], p[3]);
   accum.mul(ws[26], p[2]);
   accum.mul(ws[27], p[1]);
   accum.add(z[28]);
   ws[28] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[29]);
   accum.mul(ws[1], p[28]);
   accum.mul(ws[2], p[27]);
   accum.mul(ws[3], p[26]);
   accum.mul(ws[4], p[25]);
   accum.mul(ws[5], p[24]);
   accum.mul(ws[6], p[23]);
   accum.mul(ws[7], p[22]);
   accum.mul(ws[8], p[21]);
   accum.mul(ws[9], p[20]);
   accum.mul(ws[10], p[19]);
   accum.mul(ws[11], p[18]);
   accum.mul(ws[12], p[17]);
   accum.mul(ws[13], p[16]);
   accum.mul(ws[14], p[15]);
   accum.mul(ws[15], p[14]);
   accum.mul(ws[16], p[13]);
   accum.mul(ws[17], p[12]);
   accum.mul(ws[18], p[11]);
   accum.mul(ws[19], p[10]);
   accum.mul(ws[20], p[9]);
   accum.mul(ws[21], p[8]);
   accum.mul(ws[22], p[7]);
   accum.mul(ws[23], p[6]);
   accum.mul(ws[24], p[5]);
   accum.mul(ws[25], p[4]);
   accum.mul(ws[26], p[3]);
   accum.mul(ws[27], p[2]);
   accum.mul(ws[28], p[1]);
   accum.add(z[29]);
   ws[29] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[30]);
   accum.mul(ws[1], p[29]);
   accum.mul(ws[2], p[28]);
   accum.mul(ws[3], p[27]);
   accum.mul(ws[4], p[26]);
   accum.mul(ws[5], p[25]);
   accum.mul(ws[6], p[24]);
   accum.mul(ws[7], p[23]);
   accum.mul(ws[8], p[22]);
   accum.mul(ws[9], p[21]);
   accum.mul(ws[10], p[20]);
   accum.mul(ws[11], p[19]);
   accum.mul(ws[12], p[18]);
   accum.mul(ws[13], p[17]);
   accum.mul(ws[14], p[16]);
   accum.mul(ws[15], p[15]);
   accum.mul(ws[16], p[14]);
   accum.mul(ws[17], p[13]);
   accum.mul(ws[18], p[12]);
   accum.mul(ws[19], p[11]);
   accum.mul(ws[20], p[10]);
   accum.mul(ws[21], p[9]);
   accum.mul(ws[22], p[8]);
   accum.mul(ws[23], p[7]);
   accum.mul(ws[24], p[6]);
   accum.mul(ws[25], p[5]);
   accum.mul(ws[26], p[4]);
   accum.mul(ws[27], p[3]);
   accum.mul(ws[28], p[2]);
   accum.mul(ws[29], p[1]);
   accum.add(z[30]);
   ws[30] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[31]);
   accum.mul(ws[1], p[30]);
   accum.mul(ws[2], p[29]);
   accum.mul(ws[3], p[28]);
   accum.mul(ws[4], p[27]);
   accum.mul(ws[5], p[26]);
   accum.mul(ws[6], p[25]);
   accum.mul(ws[7], p[24]);
   accum.mul(ws[8], p[23]);
   accum.mul(ws[9], p[22]);
   accum.mul(ws[10], p[21]);
   accum.mul(ws[11], p[20]);
   accum.mul(ws[12], p[19]);
   accum.mul(ws[13], p[18]);
   accum.mul(ws[14], p[17]);
   accum.mul(ws[15], p[16]);
   accum.mul(ws[16], p[15]);
   accum.mul(ws[17], p[14]);
   accum.mul(ws[18], p[13]);
   accum.mul(ws[19], p[12]);
   accum.mul(ws[20], p[11]);
   accum.mul(ws[21], p[10]);
   accum.mul(ws[22], p[9]);
   accum.mul(ws[23], p[8]);
   accum.mul(ws[24], p[7]);
   accum.mul(ws[25], p[6]);
   accum.mul(ws[26], p[5]);
   accum.mul(ws[27], p[4]);
   accum.mul(ws[28], p[3]);
   accum.mul(ws[29], p[2]);
   accum.mul(ws[30], p[1]);
   accum.add(z[31]);
   ws[31] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[31]);
   accum.mul(ws[2], p[30]);
   accum.mul(ws[3], p[29]);
   accum.mul(ws[4], p[28]);
   accum.mul(ws[5], p[27]);
   accum.mul(ws[6], p[26]);
   accum.mul(ws[7], p[25]);
   accum.mul(ws[8], p[24]);
   accum.mul(ws[9], p[23]);
   accum.mul(ws[10], p[22]);
   accum.mul(ws[11], p[21]);
   accum.mul(ws[12], p[20]);
   accum.mul(ws[13], p[19]);
   accum.mul(ws[14], p[18]);
   accum.mul(ws[15], p[17]);
   accum.mul(ws[16], p[16]);
   accum.mul(ws[17], p[15]);
   accum.mul(ws[18], p[14]);
   accum.mul(ws[19], p[13]);
   accum.mul(ws[20], p[12]);
   accum.mul(ws[21], p[11]);
   accum.mul(ws[22], p[10]);
   accum.mul(ws[23], p[9]);
   accum.mul(ws[24], p[8]);
   accum.mul(ws[25], p[7]);
   accum.mul(ws[26], p[6]);
   accum.mul(ws[27], p[5]);
   accum.mul(ws[28], p[4]);
   accum.mul(ws[29], p[3]);
   accum.mul(ws[30], p[2]);
   accum.mul(ws[31], p[1]);
   accum.add(z[32]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[31]);
   accum.mul(ws[3], p[30]);
   accum.mul(ws[4], p[29]);
   accum.mul(ws[5], p[28]);
   accum.mul(ws[6], p[27]);
   accum.mul(ws[7], p[26]);
   accum.mul(ws[8], p[25]);
   accum.mul(ws[9], p[24]);
   accum.mul(ws[10], p[23]);
   accum.mul(ws[11], p[22]);
   accum.mul(ws[12], p[21]);
   accum.mul(ws[13], p[20]);
   accum.mul(ws[14], p[19]);
   accum.mul(ws[15], p[18]);
   accum.mul(ws[16], p[17]);
   accum.mul(ws[17], p[16]);
   accum.mul(ws[18], p[15]);
   accum.mul(ws[19], p[14]);
   accum.mul(ws[20], p[13]);
   accum.mul(ws[21], p[12]);
   accum.mul(ws[22], p[11]);
   accum.mul(ws[23], p[10]);
   accum.mul(ws[24], p[9]);
   accum.mul(ws[25], p[8]);
   accum.mul(ws[26], p[7]);
   accum.mul(ws[27], p[6]);
   accum.mul(ws[28], p[5]);
   accum.mul(ws[29], p[4]);
   accum.mul(ws[30], p[3]);
   accum.mul(ws[31], p[2]);
   accum.add(z[33]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[31]);
   accum.mul(ws[4], p[30]);
   accum.mul(ws[5], p[29]);
   accum.mul(ws[6], p[28]);
   accum.mul(ws[7], p[27]);
   accum.mul(ws[8], p[26]);
   accum.mul(ws[9], p[25]);
   accum.mul(ws[10], p[24]);
   accum.mul(ws[11], p[23]);
   accum.mul(ws[12], p[22]);
   accum.mul(ws[13], p[21]);
   accum.mul(ws[14], p[20]);
   accum.mul(ws[15], p[19]);
   accum.mul(ws[16], p[18]);
   accum.mul(ws[17], p[17]);
   accum.mul(ws[18], p[16]);
   accum.mul(ws[19], p[15]);
   accum.mul(ws[20], p[14]);
   accum.mul(ws[21], p[13]);
   accum.mul(ws[22], p[12]);
   accum.mul(ws[23], p[11]);
   accum.mul(ws[24], p[10]);
   accum.mul(ws[25], p[9]);
   accum.mul(ws[26], p[8]);
   accum.mul(ws[27], p[7]);
   accum.mul(ws[28], p[6]);
   accum.mul(ws[29], p[5]);
   accum.mul(ws[30], p[4]);
   accum.mul(ws[31], p[3]);
   accum.add(z[34]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[31]);
   accum.mul(ws[5], p[30]);
   accum.mul(ws[6], p[29]);
   accum.mul(ws[7], p[28]);
   accum.mul(ws[8], p[27]);
   accum.mul(ws[9], p[26]);
   accum.mul(ws[10], p[25]);
   accum.mul(ws[11], p[24]);
   accum.mul(ws[12], p[23]);
   accum.mul(ws[13], p[22]);
   accum.mul(ws[14], p[21]);
   accum.mul(ws[15], p[20]);
   accum.mul(ws[16], p[19]);
   accum.mul(ws[17], p[18]);
   accum.mul(ws[18], p[17]);
   accum.mul(ws[19], p[16]);
   accum.mul(ws[20], p[15]);
   accum.mul(ws[21], p[14]);
   accum.mul(ws[22], p[13]);
   accum.mul(ws[23], p[12]);
   accum.mul(ws[24], p[11]);
   accum.mul(ws[25], p[10]);
   accum.mul(ws[26], p[9]);
   accum.mul(ws[27], p[8]);
   accum.mul(ws[28], p[7]);
   accum.mul(ws[29], p[6]);
   accum.mul(ws[30], p[5]);
   accum.mul(ws[31], p[4]);
   accum.add(z[35]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[31]);
   accum.mul(ws[6], p[30]);
   accum.mul(ws[7], p[29]);
   accum.mul(ws[8], p[28]);
   accum.mul(ws[9], p[27]);
   accum.mul(ws[10], p[26]);
   accum.mul(ws[11], p[25]);
   accum.mul(ws[12], p[24]);
   accum.mul(ws[13], p[23]);
   accum.mul(ws[14], p[22]);
   accum.mul(ws[15], p[21]);
   accum.mul(ws[16], p[20]);
   accum.mul(ws[17], p[19]);
   accum.mul(ws[18], p[18]);
   accum.mul(ws[19], p[17]);
   accum.mul(ws[20], p[16]);
   accum.mul(ws[21], p[15]);
   accum.mul(ws[22], p[14]);
   accum.mul(ws[23], p[13]);
   accum.mul(ws[24], p[12]);
   accum.mul(ws[25], p[11]);
   accum.mul(ws[26], p[10]);
   accum.mul(ws[27], p[9]);
   accum.mul(ws[28], p[8]);
   accum.mul(ws[29], p[7]);
   accum.mul(ws[30], p[6]);
   accum.mul(ws[31], p[5]);
   accum.add(z[36]);
   ws[4] = accum.extract();
   accum.mul(ws[6], p[31]);
   accum.mul(ws[7], p[30]);
   accum.mul(ws[8], p[29]);
   accum.mul(ws[9], p[28]);
   accum.mul(ws[10], p[27]);
   accum.mul(ws[11], p[26]);
   accum.mul(ws[12], p[25]);
   accum.mul(ws[13], p[24]);
   accum.mul(ws[14], p[23]);
   accum.mul(ws[15], p[22]);
   accum.mul(ws[16], p[21]);
   accum.mul(ws[17], p[20]);
   accum.mul(ws[18], p[19]);
   accum.mul(ws[19], p[18]);
   accum.mul(ws[20], p[17]);
   accum.mul(ws[21], p[16]);
   accum.mul(ws[22], p[15]);
   accum.mul(ws[23], p[14]);
   accum.mul(ws[24], p[13]);
   accum.mul(ws[25], p[12]);
   accum.mul(ws[26], p[11]);
   accum.mul(ws[27], p[10]);
   accum.mul(ws[28], p[9]);
   accum.mul(ws[29], p[8]);
   accum.mul(ws[30], p[7]);
   accum.mul(ws[31], p[6]);
   accum.add(z[37]);
   ws[5] = accum.extract();
   accum.mul(ws[7], p[31]);
   accum.mul(ws[8], p[30]);
   accum.mul(ws[9], p[29]);
   accum.mul(ws[10], p[28]);
   accum.mul(ws[11], p[27]);
   accum.mul(ws[12], p[26]);
   accum.mul(ws[13], p[25]);
   accum.mul(ws[14], p[24]);
   accum.mul(ws[15], p[23]);
   accum.mul(ws[16], p[22]);
   accum.mul(ws[17], p[21]);
   accum.mul(ws[18], p[20]);
   accum.mul(ws[19], p[19]);
   accum.mul(ws[20], p[18]);
   accum.mul(ws[21], p[17]);
   accum.mul(ws[22], p[16]);
   accum.mul(ws[23], p[15]);
   accum.mul(ws[24], p[14]);
   accum.mul(ws[25], p[13]);
   accum.mul(ws[26], p[12]);
   accum.mul(ws[27], p[11]);
   accum.mul(ws[28], p[10]);
   accum.mul(ws[29], p[9]);
   accum.mul(ws[30], p[8]);
   accum.mul(ws[31], p[7]);
   accum.add(z[38]);
   ws[6] = accum.extract();
   accum.mul(ws[8], p[31]);
   accum.mul(ws[9], p[30]);
   accum.mul(ws[10], p[29]);
   accum.mul(ws[11], p[28]);
   accum.mul(ws[12], p[27]);
   accum.mul(ws[13], p[26]);
   accum.mul(ws[14], p[25]);
   accum.mul(ws[15], p[24]);
   accum.mul(ws[16], p[23]);
   accum.mul(ws[17], p[22]);
   accum.mul(ws[18], p[21]);
   accum.mul(ws[19], p[20]);
   accum.mul(ws[20], p[19]);
   accum.mul(ws[21], p[18]);
   accum.mul(ws[22], p[17]);
   accum.mul(ws[23], p[16]);
   accum.mul(ws[24], p[15]);
   accum.mul(ws[25], p[14]);
   accum.mul(ws[26], p[13]);
   accum.mul(ws[27], p[12]);
   accum.mul(ws[28], p[11]);
   accum.mul(ws[29], p[10]);
   accum.mul(ws[30], p[9]);
   accum.mul(ws[31], p[8]);
   accum.add(z[39]);
   ws[7] = accum.extract();
   accum.mul(ws[9], p[31]);
   accum.mul(ws[10], p[30]);
   accum.mul(ws[11], p[29]);
   accum.mul(ws[12], p[28]);
   accum.mul(ws[13], p[27]);
   accum.mul(ws[14], p[26]);
   accum.mul(ws[15], p[25]);
   accum.mul(ws[16], p[24]);
   accum.mul(ws[17], p[23]);
   accum.mul(ws[18], p[22]);
   accum.mul(ws[19], p[21]);
   accum.mul(ws[20], p[20]);
   accum.mul(ws[21], p[19]);
   accum.mul(ws[22], p[18]);
   accum.mul(ws[23], p[17]);
   accum.mul(ws[24], p[16]);
   accum.mul(ws[25], p[15]);
   accum.mul(ws[26], p[14]);
   accum.mul(ws[27], p[13]);
   accum.mul(ws[28], p[12]);
   accum.mul(ws[29], p[11]);
   accum.mul(ws[30], p[10]);
   accum.mul(ws[31], p[9]);
   accum.add(z[40]);
   ws[8] = accum.extract();
   accum.mul(ws[10], p[31]);
   accum.mul(ws[11], p[30]);
   accum.mul(ws[12], p[29]);
   accum.mul(ws[13], p[28]);
   accum.mul(ws[14], p[27]);
   accum.mul(ws[15], p[26]);
   accum.mul(ws[16], p[25]);
   accum.mul(ws[17], p[24]);
   accum.mul(ws[18], p[23]);
   accum.mul(ws[19], p[22]);
   accum.mul(ws[20], p[21]);
   accum.mul(ws[21], p[20]);
   accum.mul(ws[22], p[19]);
   accum.mul(ws[23], p[18]);
   accum.mul(ws[24], p[17]);
   accum.mul(ws[25], p[16]);
   accum.mul(ws[26], p[15]);
   accum.mul(ws[27], p[14]);
   accum.mul(ws[28], p[13]);
   accum.mul(ws[29], p[12]);
   accum.mul(ws[30], p[11]);
   accum.mul(ws[31], p[10]);
   accum.add(z[41]);
   ws[9] = accum.extract();
   accum.mul(ws[11], p[31]);
   accum.mul(ws[12], p[30]);
   accum.mul(ws[13], p[29]);
   accum.mul(ws[14], p[28]);
   accum.mul(ws[15], p[27]);
   accum.mul(ws[16], p[26]);
   accum.mul(ws[17], p[25]);
   accum.mul(ws[18], p[24]);
   accum.mul(ws[19], p[23]);
   accum.mul(ws[20], p[22]);
   accum.mul(ws[21], p[21]);
   accum.mul(ws[22], p[20]);
   accum.mul(ws[23], p[19]);
   accum.mul(ws[24], p[18]);
   accum.mul(ws[25], p[17]);
   accum.mul(ws[26], p[16]);
   accum.mul(ws[27], p[15]);
   accum.mul(ws[28], p[14]);
   accum.mul(ws[29], p[13]);
   accum.mul(ws[30], p[12]);
   accum.mul(ws[31], p[11]);
   accum.add(z[42]);
   ws[10] = accum.extract();
   accum.mul(ws[12], p[31]);
   accum.mul(ws[13], p[30]);
   accum.mul(ws[14], p[29]);
   accum.mul(ws[15], p[28]);
   accum.mul(ws[16], p[27]);
   accum.mul(ws[17], p[26]);
   accum.mul(ws[18], p[25]);
   accum.mul(ws[19], p[24]);
   accum.mul(ws[20], p[23]);
   accum.mul(ws[21], p[22]);
   accum.mul(ws[22], p[21]);
   accum.mul(ws[23], p[20]);
   accum.mul(ws[24], p[19]);
   accum.mul(ws[25], p[18]);
   accum.mul(ws[26], p[17]);
   accum.mul(ws[27], p[16]);
   accum.mul(ws[28], p[15]);
   accum.mul(ws[29], p[14]);
   accum.mul(ws[30], p[13]);
   accum.mul(ws[31], p[12]);
   accum.add(z[43]);
   ws[11] = accum.extract();
   accum.mul(ws[13], p[31]);
   accum.mul(ws[14], p[30]);
   accum.mul(ws[15], p[29]);
   accum.mul(ws[16], p[28]);
   accum.mul(ws[17], p[27]);
   accum.mul(ws[18], p[26]);
   accum.mul(ws[19], p[25]);
   accum.mul(ws[20], p[24]);
   accum.mul(ws[21], p[23]);
   accum.mul(ws[22], p[22]);
   accum.mul(ws[23], p[21]);
   accum.mul(ws[24], p[20]);
   accum.mul(ws[25], p[19]);
   accum.mul(ws[26], p[18]);
   accum.mul(ws[27], p[17]);
   accum.mul(ws[28], p[16]);
   accum.mul(ws[29], p[15]);
   accum.mul(ws[30], p[14]);
   accum.mul(ws[31], p[13]);
   accum.add(z[44]);
   ws[12] = accum.extract();
   accum.mul(ws[14], p[31]);
   accum.mul(ws[15], p[30]);
   accum.mul(ws[16], p[29]);
   accum.mul(ws[17], p[28]);
   accum.mul(ws[18], p[27]);
   accum.mul(ws[19], p[26]);
   accum.mul(ws[20], p[25]);
   accum.mul(ws[21], p[24]);
   accum.mul(ws[22], p[23]);
   accum.mul(ws[23], p[22]);
   accum.mul(ws[24], p[21]);
   accum.mul(ws[25], p[20]);
   accum.mul(ws[26], p[19]);
   accum.mul(ws[27], p[18]);
   accum.mul(ws[28], p[17]);
   accum.mul(ws[29], p[16]);
   accum.mul(ws[30], p[15]);
   accum.mul(ws[31], p[14]);
   accum.add(z[45]);
   ws[13] = accum.extract();
   accum.mul(ws[15], p[31]);
   accum.mul(ws[16], p[30]);
   accum.mul(ws[17], p[29]);
   accum.mul(ws[18], p[28]);
   accum.mul(ws[19], p[27]);
   accum.mul(ws[20], p[26]);
   accum.mul(ws[21], p[25]);
   accum.mul(ws[22], p[24]);
   accum.mul(ws[23], p[23]);
   accum.mul(ws[24], p[22]);
   accum.mul(ws[25], p[21]);
   accum.mul(ws[26], p[20]);
   accum.mul(ws[27], p[19]);
   accum.mul(ws[28], p[18]);
   accum.mul(ws[29], p[17]);
   accum.mul(ws[30], p[16]);
   accum.mul(ws[31], p[15]);
   accum.add(z[46]);
   ws[14] = accum.extract();
   accum.mul(ws[16], p[31]);
   accum.mul(ws[17], p[30]);
   accum.mul(ws[18], p[29]);
   accum.mul(ws[19], p[28]);
   accum.mul(ws[20], p[27]);
   accum.mul(ws[21], p[26]);
   accum.mul(ws[22], p[25]);
   accum.mul(ws[23], p[24]);
   accum.mul(ws[24], p[23]);
   accum.mul(ws[25], p[22]);
   accum.mul(ws[26], p[21]);
   accum.mul(ws[27], p[20]);
   accum.mul(ws[28], p[19]);
   accum.mul(ws[29], p[18]);
   accum.mul(ws[30], p[17]);
   accum.mul(ws[31], p[16]);
   accum.add(z[47]);
   ws[15] = accum.extract();
   accum.mul(ws[17], p[31]);
   accum.mul(ws[18], p[30]);
   accum.mul(ws[19], p[29]);
   accum.mul(ws[20], p[28]);
   accum.mul(ws[21], p[27]);
   accum.mul(ws[22], p[26]);
   accum.mul(ws[23], p[25]);
   accum.mul(ws[24], p[24]);
   accum.mul(ws[25], p[23]);
   accum.mul(ws[26], p[22]);
   accum.mul(ws[27], p[21]);
   accum.mul(ws[28], p[20]);
   accum.mul(ws[29], p[19]);
   accum.mul(ws[30], p[18]);
   accum.mul(ws[31], p[17]);
   accum.add(z[48]);
   ws[16] = accum.extract();
   accum.mul(ws[18], p[31]);
   accum.mul(ws[19], p[30]);
   accum.mul(ws[20], p[29]);
   accum.mul(ws[21], p[28]);
   accum.mul(ws[22], p[27]);
   accum.mul(ws[23], p[26]);
   accum.mul(ws[24], p[25]);
   accum.mul(ws[25], p[24]);
   accum.mul(ws[26], p[23]);
   accum.mul(ws[27], p[22]);
   accum.mul(ws[28], p[21]);
   accum.mul(ws[29], p[20]);
   accum.mul(ws[30], p[19]);
   accum.mul(ws[31], p[18]);
   accum.add(z[49]);
   ws[17] = accum.extract();
   accum.mul(ws[19], p[31]);
   accum.mul(ws[20], p[30]);
   accum.mul(ws[21], p[29]);
   accum.mul(ws[22], p[28]);
   accum.mul(ws[23], p[27]);
   accum.mul(ws[24], p[26]);
   accum.mul(ws[25], p[25]);
   accum.mul(ws[26], p[24]);
   accum.mul(ws[27], p[23]);
   accum.mul(ws[28], p[22]);
   accum.mul(ws[29], p[21]);
   accum.mul(ws[30], p[20]);
   accum.mul(ws[31], p[19]);
   accum.add(z[50]);
   ws[18] = accum.extract();
   accum.mul(ws[20], p[31]);
   accum.mul(ws[21], p[30]);
   accum.mul(ws[22], p[29]);
   accum.mul(ws[23], p[28]);
   accum.mul(ws[24], p[27]);
   accum.mul(ws[25], p[26]);
   accum.mul(ws[26], p[25]);
   accum.mul(ws[27], p[24]);
   accum.mul(ws[28], p[23]);
   accum.mul(ws[29], p[22]);
   accum.mul(ws[30], p[21]);
   accum.mul(ws[31], p[20]);
   accum.add(z[51]);
   ws[19] = accum.extract();
   accum.mul(ws[21], p[31]);
   accum.mul(ws[22], p[30]);
   accum.mul(ws[23], p[29]);
   accum.mul(ws[24], p[28]);
   accum.mul(ws[25], p[27]);
   accum.mul(ws[26], p[26]);
   accum.mul(ws[27], p[25]);
   accum.mul(ws[28], p[24]);
   accum.mul(ws[29], p[23]);
   accum.mul(ws[30], p[22]);
   accum.mul(ws[31], p[21]);
   accum.add(z[52]);
   ws[20] = accum.extract();
   accum.mul(ws[22], p[31]);
   accum.mul(ws[23], p[30]);
   accum.mul(ws[24], p[29]);
   accum.mul(ws[25], p[28]);
   accum.mul(ws[26], p[27]);
   accum.mul(ws[27], p[26]);
   accum.mul(ws[28], p[25]);
   accum.mul(ws[29], p[24]);
   accum.mul(ws[30], p[23]);
   accum.mul(ws[31], p[22]);
   accum.add(z[53]);
   ws[21] = accum.extract();
   accum.mul(ws[23], p[31]);
   accum.mul(ws[24], p[30]);
   accum.mul(ws[25], p[29]);
   accum.mul(ws[26], p[28]);
   accum.mul(ws[27], p[27]);
   accum.mul(ws[28], p[26]);
   accum.mul(ws[29], p[25]);
   accum.mul(ws[30], p[24]);
   accum.mul(ws[31], p[23]);
   accum.add(z[54]);
   ws[22] = accum.extract();
   accum.mul(ws[24], p[31]);
   accum.mul(ws[25], p[30]);
   accum.mul(ws[26], p[29]);
   accum.mul(ws[27], p[28]);
   accum.mul(ws[28], p[27]);
   accum.mul(ws[29], p[26]);
   accum.mul(ws[30], p[25]);
   accum.mul(ws[31], p[24]);
   accum.add(z[55]);
   ws[23] = accum.extract();
   accum.mul(ws[25], p[31]);
   accum.mul(ws[26], p[30]);
   accum.mul(ws[27], p[29]);
   accum.mul(ws[28], p[28]);
   accum.mul(ws[29], p[27]);
   accum.mul(ws[30], p[26]);
   accum.mul(ws[31], p[25]);
   accum.add(z[56]);
   ws[24] = accum.extract();
   accum.mul(ws[26], p[31]);
   accum.mul(ws[27], p[30]);
   accum.mul(ws[28], p[29]);
   accum.mul(ws[29], p[28]);
   accum.mul(ws[30], p[27]);
   accum.mul(ws[31], p[26]);
   accum.add(z[57]);
   ws[25] = accum.extract();
   accum.mul(ws[27], p[31]);
   accum.mul(ws[28], p[30]);
   accum.mul(ws[29], p[29]);
   accum.mul(ws[30], p[28]);
   accum.mul(ws[31], p[27]);
   accum.add(z[58]);
   ws[26] = accum.extract();
   accum.mul(ws[28], p[31]);
   accum.mul(ws[29], p[30]);
   accum.mul(ws[30], p[29]);
   accum.mul(ws[31], p[28]);
   accum.add(z[59]);
   ws[27] = accum.extract();
   accum.mul(ws[29], p[31]);
   accum.mul(ws[30], p[30]);
   accum.mul(ws[31], p[29]);
   accum.add(z[60]);
   ws[28] = accum.extract();
   accum.mul(ws[30], p[31]);
   accum.mul(ws[31], p[30]);
   accum.add(z[61]);
   ws[29] = accum.extract();
   accum.mul(ws[31], p[31]);
   accum.add(z[62]);
   ws[30] = accum.extract();
   accum.add(z[63]);
   ws[31] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<32>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_4()

void Botan::bigint_monty_redc_4	(	word	r[4],
		const word	z[8],
		const word	p[4],
		word	p_dash,
		word	ws[4] )

Definition at line 14 of file mp_monty_n.cpp.

                                                                                               {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.add(z[5]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[3]);
   accum.add(z[6]);
   ws[2] = accum.extract();
   accum.add(z[7]);
   ws[3] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<4>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_6()

void Botan::bigint_monty_redc_6	(	word	r[6],
		const word	z[12],
		const word	p[6],
		word	p_dash,
		word	ws[6] )

Definition at line 48 of file mp_monty_n.cpp.

                                                                                                {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.add(z[7]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.add(z[8]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.add(z[9]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[5]);
   accum.add(z[10]);
   ws[4] = accum.extract();
   accum.add(z[11]);
   ws[5] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<6>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_8()

void Botan::bigint_monty_redc_8	(	word	r[8],
		const word	z[16],
		const word	p[8],
		word	p_dash,
		word	ws[8] )

Definition at line 108 of file mp_monty_n.cpp.

                                                                                                {
   word3<word> accum;
   accum.add(z[0]);
   ws[0] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[1]);
   accum.add(z[1]);
   ws[1] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[2]);
   accum.mul(ws[1], p[1]);
   accum.add(z[2]);
   ws[2] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[3]);
   accum.mul(ws[1], p[2]);
   accum.mul(ws[2], p[1]);
   accum.add(z[3]);
   ws[3] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[4]);
   accum.mul(ws[1], p[3]);
   accum.mul(ws[2], p[2]);
   accum.mul(ws[3], p[1]);
   accum.add(z[4]);
   ws[4] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[5]);
   accum.mul(ws[1], p[4]);
   accum.mul(ws[2], p[3]);
   accum.mul(ws[3], p[2]);
   accum.mul(ws[4], p[1]);
   accum.add(z[5]);
   ws[5] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[6]);
   accum.mul(ws[1], p[5]);
   accum.mul(ws[2], p[4]);
   accum.mul(ws[3], p[3]);
   accum.mul(ws[4], p[2]);
   accum.mul(ws[5], p[1]);
   accum.add(z[6]);
   ws[6] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[0], p[7]);
   accum.mul(ws[1], p[6]);
   accum.mul(ws[2], p[5]);
   accum.mul(ws[3], p[4]);
   accum.mul(ws[4], p[3]);
   accum.mul(ws[5], p[2]);
   accum.mul(ws[6], p[1]);
   accum.add(z[7]);
   ws[7] = accum.monty_step(p[0], p_dash);
   accum.mul(ws[1], p[7]);
   accum.mul(ws[2], p[6]);
   accum.mul(ws[3], p[5]);
   accum.mul(ws[4], p[4]);
   accum.mul(ws[5], p[3]);
   accum.mul(ws[6], p[2]);
   accum.mul(ws[7], p[1]);
   accum.add(z[8]);
   ws[0] = accum.extract();
   accum.mul(ws[2], p[7]);
   accum.mul(ws[3], p[6]);
   accum.mul(ws[4], p[5]);
   accum.mul(ws[5], p[4]);
   accum.mul(ws[6], p[3]);
   accum.mul(ws[7], p[2]);
   accum.add(z[9]);
   ws[1] = accum.extract();
   accum.mul(ws[3], p[7]);
   accum.mul(ws[4], p[6]);
   accum.mul(ws[5], p[5]);
   accum.mul(ws[6], p[4]);
   accum.mul(ws[7], p[3]);
   accum.add(z[10]);
   ws[2] = accum.extract();
   accum.mul(ws[4], p[7]);
   accum.mul(ws[5], p[6]);
   accum.mul(ws[6], p[5]);
   accum.mul(ws[7], p[4]);
   accum.add(z[11]);
   ws[3] = accum.extract();
   accum.mul(ws[5], p[7]);
   accum.mul(ws[6], p[6]);
   accum.mul(ws[7], p[5]);
   accum.add(z[12]);
   ws[4] = accum.extract();
   accum.mul(ws[6], p[7]);
   accum.mul(ws[7], p[6]);
   accum.add(z[13]);
   ws[5] = accum.extract();
   accum.mul(ws[7], p[7]);
   accum.add(z[14]);
   ws[6] = accum.extract();
   accum.add(z[15]);
   ws[7] = accum.extract();
   word w1 = accum.extract();
   bigint_monty_maybe_sub<8>(r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_generic()

void Botan::bigint_monty_redc_generic	(	word	r[],
		const word	z[],
		size_t	z_size,
		const word	p[],
		size_t	p_size,
		word	p_dash,
		word	ws[] )

Definition at line 31 of file mp_monty.cpp.

                                                                                                   {
   BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
 
   word3<word> accum;
 
   accum.add(z[0]);
 
   ws[0] = accum.monty_step(p[0], p_dash);
 
   for(size_t i = 1; i != p_size; ++i) {
      for(size_t j = 0; j < i; ++j) {
         accum.mul(ws[j], p[i - j]);
      }
 
      accum.add(z[i]);
      ws[i] = accum.monty_step(p[0], p_dash);
   }
 
   for(size_t i = 0; i != p_size - 1; ++i) {
      for(size_t j = i + 1; j != p_size; ++j) {
         accum.mul(ws[j], p[p_size + i - j]);
      }
 
      accum.add(z[p_size + i]);
      ws[i] = accum.extract();
   }
 
   accum.add(z[2 * p_size - 1]);
 
   ws[p_size - 1] = accum.extract();
   // w1 is the final part, which is not stored in the workspace
   const word w1 = accum.extract();
 
   /*
   * The result might need to be reduced mod p. To avoid a timing
   * channel, always perform the subtraction. If in the compution
   * of x - p a borrow is required then x was already < p.
   *
   * x starts at ws[0] and is p_size bytes long plus a possible high
   * digit left over in w1.
   *
   * x - p starts at z[0] and is also p_size bytes long
   *
   * If borrow was set after the subtraction, then x was already less
   * than p and the subtraction was not needed. In that case overwrite
   * z[0:p_size] with the original x in ws[0:p_size].
   *
   * We only copy out p_size in the final step because we know
   * the Montgomery result is < P
   */
 
   bigint_monty_maybe_sub(p_size, r, w1, ws, p);
}

References Botan::word3< W >::add(), bigint_monty_maybe_sub(), BOTAN_ARG_CHECK, Botan::word3< W >::extract(), Botan::word3< W >::monty_step(), and Botan::word3< W >::mul().

Referenced by bigint_monty_redc().

bigint_monty_redc_inplace()

void Botan::bigint_monty_redc_inplace ( word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size )

inline

Definition at line 1012 of file mp_core.h.

                                                                                                                       {
   bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size);
   clear_mem(z + p_size, p_size);
}

References bigint_monty_redc(), and clear_mem().

Referenced by Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul_by(), Botan::Montgomery_Params::mul_by(), Botan::Montgomery_Params::redc(), Botan::Montgomery_Params::sqr(), and Botan::Montgomery_Params::square_this().

bigint_mul()

void Botan::bigint_mul	(	word	z[],
		size_t	z_size,
		const word	x[],
		size_t	x_size,
		size_t	x_sw,
		const word	y[],
		size_t	y_size,
		size_t	y_sw,
		word	workspace[],
		size_t	ws_size )

Definition at line 282 of file mp_karat.cpp.

                                {
   clear_mem(z, z_size);
 
   if(x_sw == 1) {
      bigint_linmul3(z, y, y_sw, x[0]);
   } else if(y_sw == 1) {
      bigint_linmul3(z, x, x_sw, y[0]);
   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul4(z, x, y);
   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul6(z, x, y);
   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul8(z, x, y);
   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul9(z, x, y);
   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul16(z, x, y);
   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
      bigint_comba_mul24(z, x, y);
   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || !workspace) {
      basecase_mul(z, z_size, x, x_sw, y, y_sw);
   } else {
      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
 
      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
         karatsuba_mul(z, x, y, N, workspace);
      } else {
         basecase_mul(z, z_size, x, x_sw, y, y_sw);
      }
   }
}

References basecase_mul(), bigint_comba_mul16(), bigint_comba_mul24(), bigint_comba_mul4(), bigint_comba_mul6(), bigint_comba_mul8(), bigint_comba_mul9(), bigint_linmul3(), and clear_mem().

Referenced by Botan::BigInt::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul(), Botan::Montgomery_Params::mul_by(), Botan::Montgomery_Params::mul_by(), Botan::Barrett_Reduction::multiply(), operator*(), and Botan::Scalar448::operator*().

bigint_shl1()

template<WordType W>

void Botan::bigint_shl1 ( W x[], size_t x_size, size_t x_words, size_t shift )

inlineconstexpr

Definition at line 426 of file mp_core.h.

                                                                                      {
   const size_t word_shift = shift / WordInfo<W>::bits;
   const size_t bit_shift = shift % WordInfo<W>::bits;
 
   copy_mem(x + word_shift, x, x_words);
   clear_mem(x, word_shift);
 
   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
 
   W carry = 0;
   for(size_t i = word_shift; i != x_size; ++i) {
      const W w = x[i];
      x[i] = (w << bit_shift) | carry;
      carry = carry_mask.if_set_return(w >> carry_shift);
   }
}

References carry(), carry_shift(), clear_mem(), copy_mem(), and Botan::CT::Mask< T >::expand().

Referenced by ct_divide_pow2k(), and Botan::BigInt::operator<<=().

bigint_shl2()

template<WordType W>

void Botan::bigint_shl2 ( W y[], const W x[], size_t x_size, size_t shift )

inlineconstexpr

Definition at line 469 of file mp_core.h.

                                                                                   {
   const size_t word_shift = shift / WordInfo<W>::bits;
   const size_t bit_shift = shift % WordInfo<W>::bits;
 
   copy_mem(y + word_shift, x, x_size);
 
   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
 
   W carry = 0;
   for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) {
      const W w = y[i];
      y[i] = (w << bit_shift) | carry;
      carry = carry_mask.if_set_return(w >> carry_shift);
   }
}

References carry(), carry_shift(), copy_mem(), and Botan::CT::Mask< T >::expand().

Referenced by Botan::BigInt::ct_shift_left(), and operator<<().

bigint_shr1()

template<WordType W>

void Botan::bigint_shr1 ( W x[], size_t x_size, size_t shift )

inlineconstexpr

Definition at line 445 of file mp_core.h.

                                                                      {
   const size_t word_shift = shift / WordInfo<W>::bits;
   const size_t bit_shift = shift % WordInfo<W>::bits;
 
   const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
 
   if(top > 0) {
      copy_mem(x, x + word_shift, top);
   }
   clear_mem(x + top, std::min(word_shift, x_size));
 
   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
 
   W carry = 0;
 
   for(size_t i = 0; i != top; ++i) {
      const W w = x[top - i - 1];
      x[top - i - 1] = (w >> bit_shift) | carry;
      carry = carry_mask.if_set_return(w << carry_shift);
   }
}

References carry(), carry_shift(), clear_mem(), copy_mem(), and Botan::CT::Mask< T >::expand().

Referenced by Botan::BigInt::operator>>=().

bigint_shr2()

template<WordType W>

void Botan::bigint_shr2 ( W y[], const W x[], size_t x_size, size_t shift )

inlineconstexpr

Definition at line 487 of file mp_core.h.

                                                                                   {
   const size_t word_shift = shift / WordInfo<W>::bits;
   const size_t bit_shift = shift % WordInfo<W>::bits;
   const size_t new_size = x_size < word_shift ? 0 : (x_size - word_shift);
 
   if(new_size > 0) {
      copy_mem(y, x + word_shift, new_size);
   }
 
   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
 
   W carry = 0;
   for(size_t i = new_size; i > 0; --i) {
      W w = y[i - 1];
      y[i - 1] = (w >> bit_shift) | carry;
      carry = carry_mask.if_set_return(w << carry_shift);
   }
}

References carry(), carry_shift(), copy_mem(), and Botan::CT::Mask< T >::expand().

Referenced by gcd(), and operator>>().

bigint_sqr()

void Botan::bigint_sqr	(	word	z[],
		size_t	z_size,
		const word	x[],
		size_t	x_size,
		size_t	x_sw,
		word	workspace[],
		size_t	ws_size )

Definition at line 326 of file mp_karat.cpp.

                                                                                                                       {
   clear_mem(z, z_size);
 
   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
 
   if(x_sw == 1) {
      bigint_linmul3(z, x, x_sw, x[0]);
   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
      bigint_comba_sqr4(z, x);
   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
      bigint_comba_sqr6(z, x);
   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
      bigint_comba_sqr8(z, x);
   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
      bigint_comba_sqr9(z, x);
   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
      bigint_comba_sqr16(z, x);
   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
      bigint_comba_sqr24(z, x);
   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || !workspace) {
      basecase_sqr(z, z_size, x, x_sw);
   } else {
      const size_t N = karatsuba_size(z_size, x_size, x_sw);
 
      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
         karatsuba_sqr(z, x, N, workspace);
      } else {
         basecase_sqr(z, z_size, x, x_sw);
      }
   }
}

References basecase_sqr(), bigint_comba_sqr16(), bigint_comba_sqr24(), bigint_comba_sqr4(), bigint_comba_sqr6(), bigint_comba_sqr8(), bigint_comba_sqr9(), bigint_linmul3(), BOTAN_ASSERT, and clear_mem().

Referenced by Botan::Montgomery_Params::sqr(), Botan::Barrett_Reduction::square(), Botan::BigInt::square(), and Botan::Montgomery_Params::square_this().

bigint_sub2()

template<WordType W>

auto Botan::bigint_sub2 ( W x[], size_t x_size, const W y[], size_t y_size ) -> W

inlineconstexpr

Two operand subtraction

Definition at line 261 of file mp_core.h.

                                                                                         {
   W borrow = 0;
 
   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
 
   const size_t blocks = y_size - (y_size % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      borrow = word8_sub2(x + i, y + i, borrow);
   }
 
   for(size_t i = blocks; i != y_size; ++i) {
      x[i] = word_sub(x[i], y[i], &borrow);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      x[i] = word_sub(x[i], static_cast<W>(0), &borrow);
   }
 
   return borrow;
}

References BOTAN_ASSERT, word8_sub2(), and word_sub().

Referenced by Botan::BigInt::add(), and bigint_correct_redc().

bigint_sub2_rev()

template<WordType W>

void Botan::bigint_sub2_rev ( W x[], const W y[], size_t y_size )

inlineconstexpr

Two operand subtraction, x = y - x; assumes y >= x

Definition at line 287 of file mp_core.h.

                                                                         {
   W borrow = 0;
 
   const size_t blocks = y_size - (y_size % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      borrow = word8_sub2_rev(x + i, y + i, borrow);
   }
 
   for(size_t i = blocks; i != y_size; ++i) {
      x[i] = word_sub(y[i], x[i], &borrow);
   }
 
   BOTAN_ASSERT(borrow == 0, "y must be greater than x");
}

References BOTAN_ASSERT, word8_sub2_rev(), and word_sub().

Referenced by Botan::BigInt::add().

bigint_sub3()

template<WordType W>

auto Botan::bigint_sub3 ( W z[], const W x[], size_t x_size, const W y[], size_t y_size ) -> W

inlineconstexpr

Three operand subtraction

Expects that x_size >= y_size

Writes to z[0:x_size] and returns borrow

Definition at line 311 of file mp_core.h.

                                                                                                      {
   W borrow = 0;
 
   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
 
   const size_t blocks = y_size - (y_size % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      borrow = word8_sub3(z + i, x + i, y + i, borrow);
   }
 
   for(size_t i = blocks; i != y_size; ++i) {
      z[i] = word_sub(x[i], y[i], &borrow);
   }
 
   for(size_t i = y_size; i != x_size; ++i) {
      z[i] = word_sub(x[i], static_cast<W>(0), &borrow);
   }
 
   return borrow;
}

References BOTAN_ASSERT, word8_sub3(), and word_sub().

Referenced by bigint_mod_sub(), bigint_sub_abs(), ct_divide(), ct_divide_pow2k(), ct_modulo(), Botan::BigInt::ct_reduce_below(), Botan::BigInt::mod_add(), and Botan::BigInt::reduce_below().

bigint_sub_abs() [1/2]

template<WordType W>

auto Botan::bigint_sub_abs ( W z[], const W x[], const W y[], size_t N, W ws[] ) -> CT::Mask<W>

inlineconstexpr

Return abs(x-y), ie if x >= y, then compute z = x - y Otherwise compute z = y - x No borrow is possible since the result is always >= 0

Returns ~0 if x >= y or 0 if x < y

Parameters

z	output array of at least N words
x	input array of N words
y	input array of N words
N	length of x and y
ws	array of at least 2*N words

Definition at line 398 of file mp_core.h.

                                                                                                     {
   // Subtract in both direction then conditional copy out the result
 
   W* ws0 = ws;
   W* ws1 = ws + N;
 
   W borrow0 = 0;
   W borrow1 = 0;
 
   const size_t blocks = N - (N % 8);
 
   for(size_t i = 0; i != blocks; i += 8) {
      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
   }
 
   for(size_t i = blocks; i != N; ++i) {
      ws0[i] = word_sub(x[i], y[i], &borrow0);
      ws1[i] = word_sub(y[i], x[i], &borrow1);
   }
 
   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
}

References Botan::CT::conditional_copy_mem(), word8_sub3(), and word_sub().

Referenced by Botan::BigInt::add2(), gcd(), and Botan::BigInt::rev_sub().

bigint_sub_abs() [2/2]

template<WordType W>

int32_t Botan::bigint_sub_abs ( W z[], const W x[], size_t x_size, const W y[], size_t y_size )

inlineconstexpr

Set z to abs(x-y), ie if x >= y, then compute z = x - y Otherwise compute z = y - x No borrow is possible since the result is always >= 0

Return the relative size of x vs y (-1, 0, 1)

Parameters

z	output array of max(x_size,y_size) words
x	input param
x_size	length of x
y	input param
y_size	length of y

Definition at line 668 of file mp_core.h.

                                                                                                       {
   const int32_t relative_size = bigint_cmp(x, x_size, y, y_size);
 
   // Swap if relative_size == -1
   const bool need_swap = relative_size < 0;
   CT::conditional_swap_ptr(need_swap, x, y);
   CT::conditional_swap(need_swap, x_size, y_size);
 
   /*
   * We know at this point that x >= y so if y_size is larger than
   * x_size, we are guaranteed they are just leading zeros which can
   * be ignored
   */
   y_size = std::min(x_size, y_size);
 
   bigint_sub3(z, x, x_size, y, y_size);
 
   return relative_size;
}

References bigint_cmp(), bigint_sub3(), Botan::CT::conditional_swap(), and Botan::CT::conditional_swap_ptr().

bit_permute_step()

template<typename T>

T Botan::bit_permute_step ( T x, T mask, size_t shift )

inlineconstexpr

Definition at line 187 of file bit_ops.h.

                                                               {
   /*
   See https://reflectionsonsecurity.wordpress.com/2014/05/11/efficient-bit-permutation-using-delta-swaps/
   and http://programming.sirrida.de/bit_perm.html
   */
   const T swap = ((x >> shift) ^ x) & mask;
   return (x ^ swap) ^ (swap << shift);
}

bit_size_to_32bit_size()

size_t Botan::bit_size_to_32bit_size ( size_t bit_size )

inline

Definition at line 46 of file code_based_util.h.

                                                      {
   return (bit_size - 1) / 32 + 1;
}

Referenced by generate_mceliece_key(), mceliece_decrypt(), and Botan::McEliece_PrivateKey::McEliece_PrivateKey().

bit_size_to_byte_size()

size_t Botan::bit_size_to_byte_size ( size_t bit_size )

inline

Definition at line 42 of file code_based_util.h.

                                                     {
   return (bit_size - 1) / 8 + 1;
}

Referenced by mceliece_decrypt().

bitlen()

auto Botan::bitlen ( size_t x )

constexpr

Definition at line 98 of file pqcrystals_helpers.h.

                                {
   return ceil_log2(x + 1);
}

References ceil_log2().

Referenced by Botan::DilithiumConstants::DilithiumConstants(), Botan::KyberConstants::KyberConstants(), and Botan::bitvector_base< secure_allocator >::subvector().

buffer_insert() [1/2]

template<typename T, typename Alloc, typename Alloc2>

size_t Botan::buffer_insert	(	std::vector< T, Alloc > &	buf,
		size_t	buf_offset,
		const std::vector< T, Alloc2 > &	input )

Definition at line 328 of file mem_ops.h.

                                                                                                     {
   BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
   const size_t to_copy = std::min(input.size(), buf.size() - buf_offset);
   if(to_copy > 0) {
      copy_mem(&buf[buf_offset], input.data(), to_copy);
   }
   return to_copy;
}

References BOTAN_ASSERT_NOMSG, buffer_insert(), and copy_mem().

buffer_insert() [2/2]

template<typename T, typename Alloc>

size_t Botan::buffer_insert	(	std::vector< T, Alloc > &	buf,
		size_t	buf_offset,
		const T	input[],
		size_t	input_length )

Definition at line 317 of file mem_ops.h.

                                                                                                        {
   BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
   const size_t to_copy = std::min(input_length, buf.size() - buf_offset);
   if(to_copy > 0) {
      copy_mem(&buf[buf_offset], input, to_copy);
   }
   return to_copy;
}

References BOTAN_ASSERT_NOMSG, buffer_insert(), and copy_mem().

Referenced by buffer_insert(), and buffer_insert().

carry()

template<size_t S, int64_t MUL = 1>
requires (S > 0 && S < 64)

void Botan::carry ( int64_t & h0, int64_t & h1 )

inline

Definition at line 28 of file ed25519_internal.h.

{
   const int64_t X1 = (static_cast<int64_t>(1) << S);
   const int64_t X2 = (static_cast<int64_t>(1) << (S - 1));
   int64_t c = (h0 + X2) >> S;
   h1 += c * MUL;
   h0 -= c * X1;
}

Referenced by Botan::word3< W >::add(), basecase_mul(), basecase_sqr(), bigint_add2_nc(), bigint_add3_nc(), bigint_cnd_abs(), bigint_cnd_add(), bigint_cnd_add_or_sub(), bigint_cnd_addsub(), bigint_cnd_sub(), bigint_linmul2(), bigint_linmul3(), bigint_modop_vartime(), bigint_shl1(), bigint_shl2(), bigint_shr1(), bigint_shr2(), Botan::Streebog::compress_64(), Botan::FE_25519::from_bytes(), ge_scalarmult_base(), Botan::BigInt::mul(), Botan::FE_25519::mul(), Botan::word3< W >::mul(), Botan::word3< W >::mul_x2(), Botan::BigInt::operator*=(), Botan::donna128::operator+=(), Botan::donna128::operator+=(), Botan::donna128::operator<<, Botan::donna128::operator>>, redc_crandall(), sc_muladd(), sc_reduce(), Botan::EC_Group_Data::scalar_from_bytes_with_trunc(), shift_left(), shift_right(), Botan::Sodium::sodium_add(), Botan::Sodium::sodium_increment(), Botan::FE_25519::sqr2(), Botan::FE_25519::sqr_iter(), word8_add2(), word8_add3(), word8_linmul2(), word8_linmul3(), word8_madd3(), word8_sub2(), word8_sub2_rev(), word8_sub3(), word_add(), word_madd2(), word_madd3(), word_sub(), and xts_update_tweak_block().

carry0() [1/2]

template<size_t S>
requires (S > 0 && S < 32)

void Botan::carry0 ( int32_t & h0, int32_t & h1 )

inline

Definition at line 49 of file ed25519_internal.h.

{
   const int32_t X1 = (static_cast<int64_t>(1) << S);
   int32_t c = h0 >> S;
   h1 += c;
   h0 -= c * X1;
}

carry0() [2/2]

template<size_t S>
requires (S > 0 && S < 64)

void Botan::carry0 ( int64_t & h0, int64_t & h1 )

inline

Definition at line 39 of file ed25519_internal.h.

{
   const int64_t X1 = (static_cast<int64_t>(1) << S);
   int64_t c = h0 >> S;
   h1 += c;
   h0 -= c * X1;
}

Referenced by sc_muladd(), sc_reduce(), and Botan::FE_25519::to_bytes().

carry_shift()

uint64_t Botan::carry_shift ( const donna128 & a, size_t shift )

inlineconstexpr

Definition at line 133 of file donna128.h.

                                                                       {
   return (a >> shift).lo();
}

Referenced by bigint_shl1(), bigint_shl2(), bigint_shr1(), and bigint_shr2().

cast_char_ptr_to_uint8() [1/2]

uint8_t * Botan::cast_char_ptr_to_uint8 ( char * s )

inline

Definition at line 284 of file mem_ops.h.

                                                {
   return reinterpret_cast<uint8_t*>(s);
}

cast_char_ptr_to_uint8() [2/2]

const uint8_t * Botan::cast_char_ptr_to_uint8 ( const char * s )

inline

Definition at line 276 of file mem_ops.h.

                                                            {
   return reinterpret_cast<const uint8_t*>(s);
}

Referenced by Botan::DER_Encoder::add_object(), Botan::TLS::append_tls_length_value(), Botan::BigInt::BigInt(), botan_mp_set_from_radix_str(), check_bcrypt(), Botan::cSHAKE_XOF::cSHAKE_XOF(), Botan::DataSource_Memory::DataSource_Memory(), Botan::CryptoBox::decrypt(), Botan::CryptoBox::decrypt_bin(), Botan::PK_Key_Agreement::derive_key(), Botan::PK_Key_Agreement::derive_key(), Botan::Scrypt::derive_key(), Botan::Encrypted_PSK_Database::get(), hkdf_expand_label(), Botan::Pipe::process_msg(), Botan::Encrypted_PSK_Database::remove(), Botan::TLS::Application_Layer_Protocol_Notification::serialize(), Botan::TLS::Server_Name_Indicator::serialize(), Botan::Encrypted_PSK_Database::set(), Botan::PSK_Database::set_str(), Botan::Buffered_Computation::update(), Botan::PK_Signer::update(), Botan::PK_Verifier::update(), Botan::HTTP::url_encode(), Botan::Roughtime::Response::validate(), Botan::Pipe::write(), Botan_FFI::write_str_output(), Botan_FFI::write_str_output(), and Botan_FFI::write_str_output().

cast_uint8_ptr_to_char() [1/2]

const char * Botan::cast_uint8_ptr_to_char ( const uint8_t * b )

inline

Definition at line 280 of file mem_ops.h.

                                                            {
   return reinterpret_cast<const char*>(b);
}

Referenced by Botan::BigInt::decode(), Botan::CryptoBox::decrypt(), Botan::Base64_Decoder::end_msg(), Botan::Hex_Decoder::end_msg(), Botan::PSK_Database::get_str(), Botan::TLS::TLS_Data_Reader::get_string(), Botan::HTTP::http_sync(), Botan::Encrypted_PSK_Database::list_names(), Botan::TPM2::Context::manufacturer(), Botan::HTTP::operator<<(), operator<<(), operator>>(), Botan::DataSource_Stream::peek(), Botan::DataSource_Stream::read(), Botan::Pipe::read_all_as_string(), Botan::ASN1::to_string(), Botan::TPM2::Context::vendor(), Botan::Base64_Decoder::write(), Botan::DataSink_Stream::write(), and Botan::Hex_Decoder::write().

cast_uint8_ptr_to_char() [2/2]

char * Botan::cast_uint8_ptr_to_char ( uint8_t * b )

inline

Definition at line 288 of file mem_ops.h.

                                                {
   return reinterpret_cast<char*>(b);
}

ceil_division()

template<std::unsigned_integral T>

T Botan::ceil_division ( T a, T b )

inlineconstexpr

Ceil of an unsigned integer division. b must not be zero.

Parameters

a	divident
b	divisor

Returns

ceil(a/b)

Definition at line 160 of file bit_ops.h.

                                           {
   return (a + b - 1) / b;
}

Referenced by Botan::Classic_McEliece_Parameters::encode_out_size().

ceil_log2()

template<typename T>
requires (std::is_integral<T>::value && sizeof(T) < 32)

uint8_t Botan::ceil_log2 ( T x )

constexpr

Definition at line 133 of file bit_ops.h.

{
   if(x >> (sizeof(T) * 8 - 1)) {
      return sizeof(T) * 8;
   }
 
   uint8_t result = 0;
   T compare = 1;
 
   while(compare < x) {
      compare <<= 1;
      result++;
   }
 
   return result;
}

Referenced by bitlen(), Botan::BigInt::ct_shift_left(), Botan::McEliece_PublicKey::get_message_word_bit_length(), Botan::McEliece_PrivateKey::McEliece_PrivateKey(), Botan::McEliece_PrivateKey::McEliece_PrivateKey(), and mceliece_work_factor().

ceil_tobytes()

template<typename T>
requires (std::is_integral<T>::value)

T Botan::ceil_tobytes ( T bits )

inlineconstexpr

Return the number of bytes necessary to contain bits bits.

Definition at line 168 of file bit_ops.h.

{
   return (bits + 7) / 8;
}

Referenced by Botan::Classic_McEliece_Encryptor::raw_kem_encrypt(), Botan::bitvector_base< secure_allocator >::to_bytes(), Botan::bitvector_base< secure_allocator >::to_bytes(), and Botan::FrodoMatrix::unpack().

chain_lengths()

BOTAN_TEST_API std::vector< WotsHashIndex > Botan::chain_lengths	(	const SphincsTreeNode &	msg,
		const Sphincs_Parameters &	params )

Given a msg construct the lengths (amount of hashes for signature) for each WOTS+ chain, including the checksum.

Corresponds to FIPS 205, Algorithm 7 or 8, Step 1-7

Definition at line 91 of file sp_wots.cpp.

                                                                                                     {
   std::vector<WotsHashIndex> result(params.wots_len_1() + params.wots_len_2());
 
   auto msg_base_w = std::span(result).first(params.wots_len_1());
   auto checksum_base_w = std::span(result).last(params.wots_len_2());
 
   base_2_b(msg_base_w, msg.get(), params);
   wots_checksum(checksum_base_w, msg_base_w, params);
 
   return result;
}

References Botan::detail::Strong_Base< T >::get(), Botan::Sphincs_Parameters::wots_len_1(), and Botan::Sphincs_Parameters::wots_len_2().

Referenced by wots_public_key_from_signature(), and xmss_sign_and_pkgen().

check_and_canonicalize_dns_name()

std::string Botan::check_and_canonicalize_dns_name

(

std::string_view

name

)

If name is a valid DNS name, return it canonicalized

Otherwise throws Decoding_Error

Definition at line 367 of file parsing.cpp.

                                                               {
   if(name.size() > 255) {
      throw Decoding_Error("DNS name exceeds maximum allowed length");
   }
 
   if(name.empty()) {
      throw Decoding_Error("DNS name cannot be empty");
   }
 
   if(name.starts_with(".")) {
      throw Decoding_Error("DNS name cannot start with a dot");
   }
 
   /*
   * Table mapping uppercase to lowercase and only including values for valid DNS names
   * namely A-Z, a-z, 0-9, hypen, and dot, plus '*' for wildcarding.
   */
   // clang-format off
   constexpr uint8_t DNS_CHAR_MAPPING[128] = {
      '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0',
      '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0', '\0',
      '\0', '\0', '\0', '\0',  '*', '\0', '\0',  '-',  '.', '\0',  '0',  '1',  '2',  '3',  '4',  '5',  '6',  '7',  '8',
       '9', '\0', '\0', '\0', '\0', '\0', '\0', '\0',  'a',  'b',  'c',  'd',  'e',  'f',  'g',  'h',  'i',  'j',  'k',
       'l',  'm',  'n',  'o',  'p',  'q',  'r',  's',  't',  'u',  'v',  'w',  'x',  'y',  'z', '\0', '\0', '\0', '\0',
      '\0', '\0',  'a',  'b',  'c',  'd',  'e',  'f',  'g',  'h',  'i',  'j',  'k',  'l',  'm',  'n',  'o',  'p',  'q',
       'r',  's',  't',  'u',  'v',  'w',  'x',  'y',  'z', '\0', '\0', '\0', '\0', '\0',
   };
   // clang-format on
 
   std::string canon;
   canon.reserve(name.size());
 
   for(size_t i = 0; i != name.size(); ++i) {
      char c = name[i];
 
      if(c == '.') {
         if(name[i - 1] == '.') {
            throw Decoding_Error("DNS name contains sequential period chars");
         }
         if(i == name.size() - 1) {
            throw Decoding_Error("DNS name cannot end in a period");
         }
      }
 
      const uint8_t cu = static_cast<uint8_t>(c);
      if(cu >= 128) {
         throw Decoding_Error("DNS name must not contain any extended ASCII code points");
      }
      const uint8_t mapped = DNS_CHAR_MAPPING[cu];
      if(mapped == 0) {
         throw Decoding_Error("DNS name includes invalid character");
      }
      // TODO check label lengths
      canon.push_back(static_cast<char>(mapped));
   }
 
   return canon;
}

Referenced by Botan::AlternativeName::decode_from().

check_bcrypt()

bool Botan::check_bcrypt	(	std::string_view	password,
		std::string_view	hash )

Check a previously created password hash

Takes a password and a bcrypt hash and returns true if the password is the same as the one that was used to generate the bcrypt hash.

Parameters

password	the password to check against
hash	the stored hash to check against

Definition at line 160 of file bcrypt.cpp.

                                                            {
   if(hash.size() != 60 || hash[0] != '$' || hash[1] != '2' || hash[3] != '$' || hash[6] != '$') {
      return false;
   }
 
   const char bcrypt_version = hash[2];
 
   if(bcrypt_version != 'a' && bcrypt_version != 'b' && bcrypt_version != 'y') {
      return false;
   }
 
   const uint16_t workfactor = to_uint16(hash.substr(4, 2));
 
   const std::vector<uint8_t> salt = bcrypt_base64_decode(hash.substr(7, 22));
   if(salt.size() != 16) {
      return false;
   }
 
   const std::string compare = make_bcrypt(pass, salt, workfactor, bcrypt_version);
 
   return CT::is_equal(cast_char_ptr_to_uint8(hash.data()), cast_char_ptr_to_uint8(compare.data()), compare.size())
      .as_bool();
}

References cast_char_ptr_to_uint8(), Botan::CT::is_equal(), and to_uint16().

Referenced by botan_bcrypt_is_valid().

check_passhash9()

bool Botan::check_passhash9	(	std::string_view	password,
		std::string_view	hash )

Check a previously created password hash

Parameters

password	the password to check against
hash	the stored hash to check against

Definition at line 75 of file passhash9.cpp.

                                                               {
   const size_t BINARY_LENGTH = ALGID_BYTES + WORKFACTOR_BYTES + PASSHASH9_PBKDF_OUTPUT_LEN + SALT_BYTES;
 
   const size_t BASE64_LENGTH = MAGIC_PREFIX.size() + (BINARY_LENGTH * 8) / 6;
 
   if(hash.size() != BASE64_LENGTH) {
      return false;
   }
 
   for(size_t i = 0; i != MAGIC_PREFIX.size(); ++i) {
      if(hash[i] != MAGIC_PREFIX[i]) {
         return false;
      }
   }
 
   secure_vector<uint8_t> bin = base64_decode(hash.data() + MAGIC_PREFIX.size());
 
   if(bin.size() != BINARY_LENGTH) {
      return false;
   }
 
   uint8_t alg_id = bin[0];
 
   const size_t work_factor = load_be<uint16_t>(&bin[ALGID_BYTES], 0);
 
   // Bug in the format, bad states shouldn't be representable, but are...
   if(work_factor == 0) {
      return false;
   }
 
   if(work_factor > 512) {
      throw Invalid_Argument("Requested passhash9 work factor " + std::to_string(work_factor) + " is too large");
   }
 
   const size_t kdf_iterations = WORK_FACTOR_SCALE * work_factor;
 
   auto pbkdf_prf = get_pbkdf_prf(alg_id);
 
   if(!pbkdf_prf) {
      return false;  // unknown algorithm, reject
   }
 
   PKCS5_PBKDF2 kdf(std::move(pbkdf_prf));
 
   secure_vector<uint8_t> cmp =
      kdf.derive_key(PASSHASH9_PBKDF_OUTPUT_LEN, pass, &bin[ALGID_BYTES + WORKFACTOR_BYTES], SALT_BYTES, kdf_iterations)
         .bits_of();
 
   const uint8_t* hashbytes = &bin[ALGID_BYTES + WORKFACTOR_BYTES + SALT_BYTES];
 
   return CT::is_equal(cmp.data(), hashbytes, PASSHASH9_PBKDF_OUTPUT_LEN).as_bool();
}

References base64_decode(), Botan::OctetString::bits_of(), Botan::PBKDF::derive_key(), Botan::CT::is_equal(), and load_be().

checked_add() [1/2]

template<std::unsigned_integral T>

std::optional< T > Botan::checked_add ( T a, T b )

inlineconstexpr

Definition at line 19 of file int_utils.h.

                                                      {
   const T r = a + b;
   if(r < a || r < b) {
      return {};
   }
   return r;
}

Referenced by checked_add(), Botan::AlternativeName::count(), and Botan::OID::encode_into().

checked_add() [2/2]

template<std::unsigned_integral T, std::unsigned_integral... Ts>
requires all_same_v<T, Ts...>

std::optional< T > Botan::checked_add ( T a, T b, Ts... rest )

inlineconstexpr

Definition at line 37 of file int_utils.h.

                                                                  {
   if(auto r = checked_add(a, b)) {
      return checked_add(r.value(), rest...);
   } else {
      return {};
   }
}

References checked_add().

checked_cast_to()

template<typename RT, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>

RT Botan::checked_cast_to ( AT i )

constexpr

Definition at line 74 of file int_utils.h.

                                   {
   return checked_cast_to_or_throw<RT, Internal_Error>(i, "Error during integer conversion");
}

References checked_cast_to_or_throw().

Referenced by Botan::HSS_LMS_Params::L(), Botan::ML_DSA_MessageHash::start(), and Botan::HSS_LMS_PublicKeyInternal::verify_signature().

checked_cast_to_or_throw()

template<typename RT, typename ExceptionType, typename AT>
requires std::integral<strong_type_wrapped_type<RT>> && std::integral<strong_type_wrapped_type<AT>>

RT Botan::checked_cast_to_or_throw ( AT i, std::string_view error_msg_on_fail )

constexpr

Definition at line 61 of file int_utils.h.

                                                                              {
   const auto unwrapped_input = unwrap_strong_type(i);
 
   const auto unwrapped_result = static_cast<strong_type_wrapped_type<RT>>(unwrapped_input);
   if(unwrapped_input != static_cast<strong_type_wrapped_type<AT>>(unwrapped_result)) [[unlikely]] {
      throw ExceptionType(error_msg_on_fail);
   }
 
   return wrap_strong_type<RT>(unwrapped_result);
}

References unwrap_strong_type(), and wrap_strong_type().

Referenced by checked_cast_to(), and Botan::HSS_LMS_Params::HSS_LMS_Params().

checked_mul()

template<std::unsigned_integral T>

std::optional< T > Botan::checked_mul ( T a, T b )

inlineconstexpr

Definition at line 46 of file int_utils.h.

                                                      {
   // Multiplication by 1U is a hack to work around C's insane
   // integer promotion rules.
   // https://stackoverflow.com/questions/24795651
   const T r = (1U * a) * b;
   // If a == 0 then the multiply certainly did not overflow
   // Otherwise r / a == b unless overflow occured
   if(a != 0 && r / a != b) {
      return {};
   }
   return r;
}

Referenced by Botan::mlock_allocator::allocate(), allocate_memory(), and Botan::mlock_allocator::deallocate().

checked_sub()

template<std::unsigned_integral T>

std::optional< T > Botan::checked_sub ( T a, T b )

constexpr

Definition at line 28 of file int_utils.h.

                                               {
   if(b > a) {
      return {};
   }
   return a - b;
}

choose()

template<typename T>

T Botan::choose ( T mask, T a, T b )

inlineconstexpr

Definition at line 204 of file bit_ops.h.

                                            {
   //return (mask & a) | (~mask & b);
   return (b ^ (mask & (a ^ b)));
}

Referenced by majority(), Botan::CT::Mask< T >::select(), Botan::CT::Mask< T >::select_n(), SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

clear_bytes()

void Botan::clear_bytes ( void * ptr, size_t bytes )

inlineconstexpr

Zero out some bytes. Warning: use secure_scrub_memory instead if the memory is about to be freed or otherwise the compiler thinks it can elide the writes.

Parameters

ptr	a pointer to memory to zero
bytes	the number of bytes to zero in ptr

Definition at line 106 of file mem_ops.h.

                                                           {
   if(bytes > 0) {
      std::memset(ptr, 0, bytes);
   }
}

Referenced by clear_mem(), clear_mem(), Botan::TPM2::init_with_size(), and Botan::Memory_Pool::Memory_Pool().

clear_mem() [1/2]

template<ranges::contiguous_output_range R>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<R>>

void Botan::clear_mem ( R && mem )

inlineconstexpr

Zero memory before use. This simply calls memset and should not be used in cases where the compiler cannot see the call as a side-effecting operation.

Parameters

mem	a contiguous range of Ts to zero

Definition at line 135 of file mem_ops.h.

{
   clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem));
}

References clear_bytes(), and Botan::ranges::size_bytes().

clear_mem() [2/2]

template<typename T>

void Botan::clear_mem ( T * ptr, size_t n )

inlineconstexpr

Zero memory before use. This simply calls memset and should not be used in cases where the compiler cannot see the call as a side-effecting operation (for example, if calling clear_mem before deallocating memory, the compiler would be allowed to omit the call to memset entirely under the as-if rule.)

Parameters

ptr	a pointer to an array of Ts to zero
n	the number of Ts pointed to by ptr

Definition at line 123 of file mem_ops.h.

                                                  {
   clear_bytes(ptr, sizeof(T) * n);
}

References clear_bytes().

Referenced by base_decode(), basecase_mul(), basecase_sqr(), bigint_monty_redc_inplace(), bigint_mul(), bigint_shl1(), bigint_shr1(), bigint_sqr(), Botan_FFI::botan_view_bin_bounce_fn(), Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::clear(), Botan::CT::copy_output(), create_aes_row_generator(), Botan::Sodium::crypto_secretbox_xsalsa20poly1305(), Botan::Sodium::crypto_secretbox_xsalsa20poly1305_open(), Botan::BigInt::ct_reduce_below(), Botan::BigInt::ct_shift_left(), Botan::Bcrypt_PBKDF::derive_key(), Botan::ZFEC::encode_shares(), Botan::BigInt::encode_words(), Botan::FE_25519::FE_25519(), Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::fill_up_with_zeros(), Botan::StreamCipher::generate_keystream(), Botan::Gf448Elem::Gf448Elem(), hex_decode(), Botan::BLAKE2b::key_schedule(), Botan::EC_Point_Var_Point_Precompute::mul(), pbkdf2(), Botan::CRYSTALS::Trait_Base< ConstantsT, DerivedT >::polyvec_pointwise_acc_montgomery(), Botan::BigInt::reduce_below(), Botan::BigInt::rev_sub(), Botan::polyn_gf2m::set_to_zero(), Botan::polyn_gf2m::sqmod_init(), Botan::bitvector_base< secure_allocator >::to_bytes(), Botan_FFI::write_output(), Botan::Zlib_Style_Stream< Stream, ByteType, StreamLenType >::Zlib_Style_Stream(), and Botan::Zlib_Style_Stream< Stream, ByteType, StreamLenType >::~Zlib_Style_Stream().

comba_mul()

template<size_t N, WordType W>

void Botan::comba_mul ( W z[2 *N], const W x[N], const W y[N] )

inlineconstexpr

Definition at line 882 of file mp_core.h.

                                                                        {
   if(!std::is_constant_evaluated()) {
      if constexpr(std::same_as<W, word> && N == 4) {
         return bigint_comba_mul4(z, x, y);
      }
      if constexpr(std::same_as<W, word> && N == 6) {
         return bigint_comba_mul6(z, x, y);
      }
      if constexpr(std::same_as<W, word> && N == 7) {
         return bigint_comba_mul7(z, x, y);
      }
      if constexpr(std::same_as<W, word> && N == 8) {
         return bigint_comba_mul8(z, x, y);
      }
      if constexpr(std::same_as<W, word> && N == 9) {
         return bigint_comba_mul9(z, x, y);
      }
      if constexpr(std::same_as<W, word> && N == 16) {
         return bigint_comba_mul16(z, x, y);
      }
   }
 
   word3<W> accum;
 
   for(size_t i = 0; i != 2 * N; ++i) {
      const size_t start = i + 1 < N ? 0 : i + 1 - N;
      const size_t end = std::min(N, i + 1);
 
      for(size_t j = start; j != end; ++j) {
         accum.mul(x[j], y[i - j]);
      }
      z[i] = accum.extract();
   }
}

References bigint_comba_mul16(), bigint_comba_mul4(), bigint_comba_mul6(), bigint_comba_mul7(), bigint_comba_mul8(), bigint_comba_mul9(), Botan::word3< W >::extract(), and Botan::word3< W >::mul().

comba_sqr()

template<size_t N, WordType W>

void Botan::comba_sqr ( W z[2 *N], const W x[N] )

inlineconstexpr

Definition at line 918 of file mp_core.h.

                                                          {
   if(!std::is_constant_evaluated()) {
      if constexpr(std::same_as<W, word> && N == 4) {
         return bigint_comba_sqr4(z, x);
      }
      if constexpr(std::same_as<W, word> && N == 6) {
         return bigint_comba_sqr6(z, x);
      }
      if constexpr(std::same_as<W, word> && N == 7) {
         return bigint_comba_sqr7(z, x);
      }
      if constexpr(std::same_as<W, word> && N == 8) {
         return bigint_comba_sqr8(z, x);
      }
      if constexpr(std::same_as<W, word> && N == 9) {
         return bigint_comba_sqr9(z, x);
      }
      if constexpr(std::same_as<W, word> && N == 16) {
         return bigint_comba_sqr16(z, x);
      }
   }
 
   word3<W> accum;
 
   for(size_t i = 0; i != 2 * N; ++i) {
      const size_t start = i + 1 < N ? 0 : i + 1 - N;
      const size_t end = std::min(N, i + 1);
 
      for(size_t j = start; j != end; ++j) {
         accum.mul(x[j], x[i - j]);
      }
      z[i] = accum.extract();
   }
}

References bigint_comba_sqr16(), bigint_comba_sqr4(), bigint_comba_sqr6(), bigint_comba_sqr7(), bigint_comba_sqr8(), bigint_comba_sqr9(), Botan::word3< W >::extract(), and Botan::word3< W >::mul().

combine_lower()

uint64_t Botan::combine_lower ( const donna128 & a, size_t s1, const donna128 & b, size_t s2 )

inlineconstexpr

Definition at line 137 of file donna128.h.

                                                                                                    {
   donna128 z = (a >> s1) | (b << s2);
   return z.lo();
}

References Botan::donna128::lo().

commoncrypto_adjust_key_size()

void Botan::commoncrypto_adjust_key_size	(	const uint8_t	key[],
		size_t	length,
		const CommonCryptor_Opts &	opts,
		secure_vector< uint8_t > &	full_key )

Definition at line 134 of file commoncrypto_utils.cpp.

                                                                    {
   if(opts.algo == kCCAlgorithmBlowfish && length < 8) {
      size_t repeat;
      switch(length) {
         case 1:
            repeat = 8;
            break;
         case 2:
            repeat = 4;
            break;
         case 3:
            repeat = 3;
            break;
         default:
            repeat = 2;
            break;
      }
 
      full_key.resize(length * repeat);
      for(size_t i = 0; i < repeat; i++) {
         copy_mem(full_key.data() + i * length, key, length);
      }
   } else if(opts.algo == kCCAlgorithm3DES && length == 16) {
      full_key += std::make_pair(key, 8);
   }
}

References Botan::CommonCryptor_Opts::algo, and copy_mem().

commoncrypto_opts_from_algo()

CommonCryptor_Opts Botan::commoncrypto_opts_from_algo

(

std::string_view

algo

)

Definition at line 96 of file commoncrypto_utils.cpp.

                                                                    {
   SCAN_Name spec(algo);
 
   std::string algo_name = spec.algo_name();
   std::string cipher_mode = spec.cipher_mode();
   std::string cipher_mode_padding = spec.cipher_mode_pad();
 
   CommonCryptor_Opts opts = commoncrypto_opts_from_algo_name(algo_name);
 
   //TODO add CFB and XTS support
   if(cipher_mode.empty() || cipher_mode == "ECB") {
      opts.mode = kCCModeECB;
   } else if(cipher_mode == "CBC") {
      opts.mode = kCCModeCBC;
   } else if(cipher_mode == "CTR") {
      opts.mode = kCCModeCTR;
   } else if(cipher_mode == "OFB") {
      opts.mode = kCCModeOFB;
   } else {
      throw CommonCrypto_Error("Unsupported cipher mode!");
   }
 
   if(cipher_mode_padding == "NoPadding") {
      opts.padding = ccNoPadding;
   }
   /*
   else if(cipher_mode_padding.empty() || cipher_mode_padding == "PKCS7")
      {
      opts.padding = ccPKCS7Padding;
      }
   */
   else {
      throw CommonCrypto_Error("Unsupported cipher mode padding!");
   }
 
   return opts;
}

References Botan::SCAN_Name::algo_name(), Botan::SCAN_Name::cipher_mode(), Botan::SCAN_Name::cipher_mode_pad(), commoncrypto_opts_from_algo_name(), Botan::CommonCryptor_Opts::mode, and Botan::CommonCryptor_Opts::padding.

Referenced by make_commoncrypto_cipher_mode().

commoncrypto_opts_from_algo_name()

CommonCryptor_Opts Botan::commoncrypto_opts_from_algo_name

(

std::string_view

algo_name

)

Definition at line 56 of file commoncrypto_utils.cpp.

                                                                              {
   CommonCryptor_Opts opts;
 
   if(algo_name.compare(0, 3, "AES") == 0) {
      opts.algo = kCCAlgorithmAES;
      opts.block_size = kCCBlockSizeAES128;
      if(algo_name == "AES-128") {
         opts.key_spec = Key_Length_Specification(kCCKeySizeAES128);
      } else if(algo_name == "AES-192") {
         opts.key_spec = Key_Length_Specification(kCCKeySizeAES192);
      } else if(algo_name == "AES-256") {
         opts.key_spec = Key_Length_Specification(kCCKeySizeAES256);
      } else {
         throw CommonCrypto_Error("Unknown AES algorithm");
      }
   } else if(algo_name == "DES") {
      opts.algo = kCCAlgorithmDES;
      opts.block_size = kCCBlockSizeDES;
      opts.key_spec = Key_Length_Specification(kCCKeySizeDES);
   } else if(algo_name == "TripleDES") {
      opts.algo = kCCAlgorithm3DES;
      opts.block_size = kCCBlockSize3DES;
      opts.key_spec = Key_Length_Specification(16, kCCKeySize3DES, 8);
   } else if(algo_name == "Blowfish") {
      opts.algo = kCCAlgorithmBlowfish;
      opts.block_size = kCCBlockSizeBlowfish;
      opts.key_spec = Key_Length_Specification(1, kCCKeySizeMaxBlowfish, 1);
   } else if(algo_name == "CAST-128") {
      opts.algo = kCCAlgorithmCAST;
      opts.block_size = kCCBlockSizeCAST;
      // Botan's base implementation of CAST does not support shorter keys
      // so we limit its minimum key size to 11 here.
      opts.key_spec = Key_Length_Specification(11, kCCKeySizeMaxCAST, 1);
   } else {
      throw CommonCrypto_Error("Unsupported cipher");
   }
 
   return opts;
}

References Botan::CommonCryptor_Opts::algo, Botan::CommonCryptor_Opts::block_size, and Botan::CommonCryptor_Opts::key_spec.

Referenced by commoncrypto_opts_from_algo(), and make_commoncrypto_block_cipher().

compute_root() [1/2]

BOTAN_TEST_API void Botan::compute_root	(	StrongSpan< SphincsTreeNode >	out,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes,
		const SphincsTreeNode &	leaf,
		TreeNodeIndex	leaf_idx,
		uint32_t	idx_offset,
		StrongSpan< const SphincsAuthenticationPath >	authentication_path,
		uint32_t	tree_height,
		Sphincs_Address &	tree_address )

Using a leaf node and the authentication path (neighbor nodes on the way from leaf to root), computes the the root node of the respective tree. This function is generic and used by FORS and XMSS in the SLH-DSA verification logic.

Definition at line 102 of file sp_treehash.cpp.

                                                 {
   BOTAN_ASSERT_NOMSG(out.size() == params.n());
   BOTAN_ASSERT_NOMSG(authentication_path.size() == params.n() * total_tree_height);
   BOTAN_ASSERT_NOMSG(leaf.size() == params.n());
 
   // Use the `out` parameter as intermediate buffer for left/right nodes
   // while traversing the tree.
   copy_mem(out, leaf);
 
   // Views into either `auth_path` or `out` depending on the tree location.
   StrongSpan<const SphincsTreeNode> left;
   StrongSpan<const SphincsTreeNode> right;
 
   BufferSlicer auth_path(authentication_path);
 
   // The leaf is put in the left or right buffer, depending on its indexes parity.
   // Same for the first node of the authentication path
 
   for(TreeLayerIndex i(0); i < total_tree_height; i++) {
      // The input of the hash function takes the current node and the node
      // given in the authentication path. If the current node is a right node
      // in the tree (i.e. its leaf index is uneven) the hash function inputs
      // must be swapped.
      left = out;
      right = auth_path.take<SphincsTreeNode>(params.n());
 
      if((leaf_idx & 1) == 1U) {
         std::swap(left, right);
      }
 
      leaf_idx /= 2;
      idx_offset /= 2;
      tree_address.set_tree_height(i + 1).set_tree_index(leaf_idx + idx_offset);
 
      hashes.T(out, tree_address, left, right);
   }
 
   BOTAN_ASSERT_NOMSG(auth_path.empty());
}

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::BufferSlicer::empty(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_tree_height(), Botan::Sphincs_Address::set_tree_index(), Botan::detail::Container_Strong_Adapter_Base< T >::size(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), and Botan::BufferSlicer::take().

Referenced by fors_public_key_from_signature(), and ht_verify().

compute_root() [2/2]

template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>

void Botan::compute_root ( StrongSpan< TreeNode > out_root, AuthPathSS authentication_path, TreeNodeIndex leaf_idx, StrongSpan< const TreeNode > leaf, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, Address & tree_address )

inline

Uses an authentication path and a leaf node to reconstruct the root node of a merkle tree.

Parameters

out_root	A output buffer for the root node of the merkle tree.
authentication_path	The authentication path in one buffer (concatenated nodes).
leaf_idx	The index of the leaf used to sig in the bottom layer beginning with 0.
leaf	The leaf node used to sig.
node_size	The size of each node in the tree.
total_tree_height	The hight of the merkle tree to construct.
idx_offset	If we compute a subtree this marks the index of the leftmost leaf node in the bottom layer.
node_pair_hash	The function to process two child nodes to compute their parent node.
tree_address	The address that is passed to node_pair hash. This function will update the address accordings to the currently processed node. This object may contain further algorithm specific information, like the position of this merkle tree in a hypertree.

Definition at line 214 of file tree_hash.h.

                          {
   BOTAN_ASSERT_NOMSG(out_root.size() == node_size);
   BOTAN_ASSERT_NOMSG(authentication_path.size() == node_size * static_cast<size_t>(total_tree_height.get()));
   BOTAN_ASSERT_NOMSG(leaf.size() == node_size);
 
   // Use the `out` parameter as intermediate buffer for left/right nodes
   // while traversing the tree.
   copy_mem(out_root, leaf);
 
   // Views into either `auth_path` or `out` depending on the tree location.
   StrongSpan<const TreeNode> left;
   StrongSpan<const TreeNode> right;
 
   BufferSlicer auth_path(authentication_path);
 
   // The leaf is put in the left or right buffer, depending on its indexes parity.
   // Same for the first node of the authentication path
 
   for(TreeLayerIndex i(0); i < total_tree_height; i++) {
      // The input of the hash function takes the current node and the node
      // given in the authentication path. If the current node is a right node
      // in the tree (i.e. its leaf index is uneven) the hash function inputs
      // must be swapped.
      left = out_root;
      right = auth_path.take<TreeNode>(node_size);
 
      if((leaf_idx & 1) == 1U) {
         std::swap(left, right);
      }
 
      leaf_idx /= 2;
      idx_offset /= 2;
      tree_address.set_address(i + 1, leaf_idx + idx_offset);
 
      node_pair_hash(out_root, tree_address, left, right);
   }
 
   BOTAN_ASSERT_NOMSG(auth_path.empty());
}

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::BufferSlicer::empty(), Botan::detail::Strong_Base< T >::get(), Botan::StrongSpan< T >::size(), and Botan::BufferSlicer::take().

compute_rsa_secret_exponent()

BigInt BOTAN_TEST_API Botan::compute_rsa_secret_exponent	(	const BigInt &	e,
		const BigInt &	phi_n,
		const BigInt &	p,
		const BigInt &	q )

Compute the RSA private exponent d

This algorithm is constant time with respect to phi_n, p, and q, aside from leaking their lengths. It may leak the public exponent e.

Parameters

e	the public exponent
phi_n	is lcm(p-1, q-1)
p	is the first secret prime
q	is the second secret prime

Returns

d inverse of e modulo phi_n

Definition at line 330 of file mod_inv.cpp.

                                                                                                           {
   /*
   * Both p - 1 and q - 1 are chosen to be relatively prime to e. Thus
   * phi(n), the least common multiple of p - 1 and q - 1, is also
   * relatively prime to e.
   */
   BOTAN_DEBUG_ASSERT(gcd(e, phi_n) == 1);
 
   if(e == 65537) {
      /*
      Arazi's algorithm for inversion of prime x modulo a non-prime
 
      "GCD-Free Algorithms for Computing Modular Inverses"
      Marc Joye and Pascal Paillier, CHES 2003 (LNCS 2779)
      https://marcjoye.github.io/papers/JP03gcdfree.pdf
 
      This could be extended to cover other cases such as e=3 or e=17 but
      these days 65537 is the standard RSA public exponent
      */
 
      constexpr word e_w = 65537;
 
      const word phi_mod_e = ct_mod_word(phi_n, e_w);
      const word inv_phi_mod_e = inverse_mod_65537(phi_mod_e);
      BOTAN_DEBUG_ASSERT((inv_phi_mod_e * phi_mod_e) % e_w == 1);
      const word neg_inv_phi_mod_e = (e_w - inv_phi_mod_e);
      return ct_divide_word((phi_n * neg_inv_phi_mod_e) + 1, e_w);
   } else {
      // TODO possibly do something else taking advantage of the special structure here
 
      BOTAN_UNUSED(p, q);
      if(auto d = inverse_mod_general(e, phi_n)) {
         return *d;
      } else {
         throw Internal_Error("Failed to compute RSA secret exponent");
      }
   }
}

References BOTAN_DEBUG_ASSERT, BOTAN_UNUSED, ct_divide_word(), ct_mod_word(), gcd(), and inverse_mod_general().

Referenced by Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

concat()

template<typename OutR = detail::AutoDetect, ranges::spanable_range... Rs>
requires (all_same_v<std::ranges::range_value_t<Rs>...>)

auto Botan::concat ( Rs &&... ranges )

constexpr

Concatenate an arbitrary number of buffers. Performs range-checks as needed.

The output type can be auto-detected based on the input ranges, or explicitly specified by the caller. If all input ranges have a static extent, the total size is calculated at compile time and a statically sized std::array<> is used. Otherwise this tries to use the type of the first input range as output type.

Alternatively, the output container type can be specified explicitly.

Definition at line 264 of file stl_util.h.

{
   if constexpr(std::same_as<detail::AutoDetect, OutR>) {
      // Try to auto-detect a reasonable output type given the input ranges
      static_assert(sizeof...(Rs) > 0, "Cannot auto-detect the output type if not a single input range is provided.");
      using candidate_result_t = std::remove_cvref_t<std::tuple_element_t<0, std::tuple<Rs...>>>;
      using result_range_value_t = std::remove_cvref_t<std::ranges::range_value_t<candidate_result_t>>;
 
      if constexpr((ranges::statically_spanable_range<Rs> && ...)) {
         // If all input ranges have a static extent, we can calculate the total size at compile time
         // and therefore can use a statically sized output container. This is constexpr.
         constexpr size_t total_size = (decltype(std::span{ranges})::extent + ... + 0);
         using out_array_t = std::array<result_range_value_t, total_size>;
         return detail::concatenate<out_array_t>(std::forward<Rs>(ranges)...);
      } else {
         // If at least one input range has a dynamic extent, we must use a dynamically allocated output container.
         // We assume that the user wants to use the first input range's container type as output type.
         static_assert(
            concepts::reservable_container<candidate_result_t>,
            "First input range has static extent, but a dynamically allocated output range is required. Please explicitly specify a dynamically allocatable output type.");
         return detail::concatenate<candidate_result_t>(std::forward<Rs>(ranges)...);
      }
   } else {
      // The caller has explicitly specified the output type
      return detail::concatenate<OutR>(std::forward<Rs>(ranges)...);
   }
}

References Botan::detail::concatenate().

Referenced by Botan::PKIX::check_ocsp(), Botan::Classic_McEliece_Polynomial_Ring::compute_minimal_polynomial(), Botan::Expanded_Keypair_Codec::encode_keypair(), Botan::Seed_Expanding_Keypair_Codec::encode_keypair(), hkdf_expand_label(), Botan::Kyber_PublicKeyInternal::Kyber_PublicKeyInternal(), Botan::SphincsPlus_PrivateKey::private_key_bits(), Botan::FrodoKEM_PrivateKey::raw_private_key_bits(), Botan::FrodoKEM_PublicKey::raw_public_key_bits(), Botan::Hybrid_PublicKey::raw_public_key_bits(), Botan::TLS::Hybrid_KEM_PublicKey::raw_public_key_bits(), Botan::XMSS_PublicKey::raw_public_key_bits(), Botan::Classic_McEliece_PrivateKeyInternal::serialize(), Botan::HSS_LMS_PublicKeyInternal::to_bytes(), and Botan::LMS_PublicKey::to_bytes().

constant_time_compare() [1/2]

bool Botan::constant_time_compare ( const uint8_t x[], const uint8_t y[], size_t len )

inline

Memory comparison, input insensitive

Parameters

x	a pointer to an array
y	a pointer to another array
len	the number of Ts in x and y

Returns

true iff x[i] == y[i] forall i in [0...n)

Definition at line 93 of file mem_ops.h.

                                                                                    {
   // simply assumes that *x and *y point to len allocated bytes at least
   return constant_time_compare({x, len}, {y, len});
}

References constant_time_compare().

constant_time_compare() [2/2]

bool Botan::constant_time_compare	(	std::span< const uint8_t >	x,
		std::span< const uint8_t >	y )

Memory comparison, input insensitive

Parameters

x	a range of bytes
y	another range of bytes

Returns

true iff x and y have equal lengths and x[i] == y[i] forall i in [0...n)

Definition at line 17 of file mem_ops.cpp.

                                                                               {
   const auto min_size = CT::Mask<size_t>::is_lte(x.size(), y.size()).select(x.size(), y.size());
   const auto equal_size = CT::Mask<size_t>::is_equal(x.size(), y.size());
   const auto equal_content = CT::Mask<size_t>::expand(CT::is_equal(x.data(), y.data(), min_size));
   return (equal_content & equal_size).as_bool();
}

References Botan::CT::Mask< T >::expand(), Botan::CT::is_equal(), Botan::CT::Mask< T >::is_equal(), and Botan::CT::Mask< T >::is_lte().

Referenced by constant_time_compare(), Botan::EMSA_PKCS1v15::verify(), and Botan::EMSA_PKCS1v15_Raw::verify().

copy_mem() [1/2]

template<ranges::contiguous_output_range OutR, ranges::contiguous_range InR>
requires std::is_same_v<std::ranges::range_value_t<OutR>, std::ranges::range_value_t<InR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<InR>>

void Botan::copy_mem ( OutR && out, InR && in )

inlineconstexpr

Copy memory

Parameters

out	the destination array
in	the source array

Definition at line 165 of file mem_ops.h.

                                                     {
   ranges::assert_equal_byte_lengths(out, in);
   if(std::is_constant_evaluated()) {
      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
   } else if(ranges::size_bytes(out) > 0) {
      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
   }
}

References Botan::ranges::assert_equal_byte_lengths(), and Botan::ranges::size_bytes().

copy_mem() [2/2]

template<typename T>
requires std::is_trivial<typename std::decay<T>::type>::value

void Botan::copy_mem ( T * out, const T * in, size_t n )

inlineconstexpr

Copy memory

Parameters

out	the destination array
in	the source array
n	the number of elements of in/out

Definition at line 149 of file mem_ops.h.

                                                              {
   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
 
   if(in != nullptr && out != nullptr && n > 0) {
      std::memmove(out, in, sizeof(T) * n);
   }
}

References BOTAN_ASSERT_IMPLICATION.

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), bigint_mod_sub(), bigint_shl1(), bigint_shl2(), bigint_shr1(), bigint_shr2(), Botan::Argon2::blamka(), botan_cipher_update(), botan_privkey_ed25519_get_privkey(), botan_privkey_ed448_get_privkey(), botan_privkey_x25519_get_privkey(), botan_privkey_x448_get_privkey(), botan_pubkey_ed25519_get_pubkey(), botan_pubkey_ed448_get_pubkey(), botan_pubkey_x25519_get_pubkey(), botan_pubkey_x448_get_pubkey(), Botan_FFI::botan_view_bin_bounce_fn(), buffer_insert(), buffer_insert(), Botan::Ed25519_PublicKey::check_key(), Botan::CRYSTALS::Polynomial< DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT >::clone(), Botan::CRYSTALS::PolynomialVector< DilithiumPolyTraits, Botan::CRYSTALS::Domain::NTT >::clone(), commoncrypto_adjust_key_size(), Botan::Streebog::compress_64(), compute_root(), compute_root(), Botan::TPM2::copy_into(), Botan::TPM2::copy_into(), Botan::Sodium::crypto_auth_hmacsha512256(), Botan::Sodium::crypto_box_curve25519xsalsa20poly1305_seed_keypair(), curve25519_donna(), ed25519_gen_keypair(), Botan::Ed448_PublicKey::Ed448_PublicKey(), Botan::ML_KEM_Encryptor::encapsulate(), Botan::BigInt::encode_words(), Botan::CryptoBox::encrypt(), expand_message_xmd(), Botan::FE_25519::FE_25519(), Botan::RawHashFunction::final_result(), Botan::TLS::Stream_Handshake_IO::format(), Botan::CCM_Mode::format_b0(), Botan::CCM_Mode::format_c0(), Botan::TPM_Context::gen_random(), Botan::Gf448Elem::Gf448Elem(), Botan::BLAKE2b::key_schedule(), mceliece_decrypt(), Botan::Montgomery_Params::mul_by(), Botan::Montgomery_Params::mul_by(), nist_key_unwrap(), nist_key_unwrap_padded(), nist_key_wrap(), nist_key_wrap_padded(), operator^(), Botan::DataSource_Memory::peek(), Botan::PseudorandomKeyGeneration::PseudorandomKeyGeneration(), Botan::DataSource_Memory::read(), Botan::Blowfish::salted_set_key(), Botan::Scalar448::Scalar448(), Botan::CTR_BE::seek(), Botan::EC_AffinePoint_Data_PC::serialize_uncompressed_to(), Botan::EC_AffinePoint_Data_BN::serialize_x_to(), Botan::EC_AffinePoint_Data_PC::serialize_x_to(), Botan::EC_AffinePoint_Data_BN::serialize_xy_to(), Botan::EC_AffinePoint_Data_PC::serialize_xy_to(), Botan::EC_AffinePoint_Data_BN::serialize_y_to(), Botan::EC_AffinePoint_Data_PC::serialize_y_to(), Botan::TLS::Session_Keys::Session_Keys(), Botan::CFB_Mode::shift_register(), Botan::HSS_LMS_PrivateKeyInternal::sign(), Botan::RTSS_Share::split(), Botan::polyn_gf2m::sqmod_init(), Botan::Montgomery_Params::square_this(), Botan::GHASH::start(), Botan::bitvector_base< secure_allocator >::subvector(), treehash(), treehash(), Botan::Base64_Decoder::write(), Botan::Base64_Encoder::write(), Botan::Buffered_Filter::write(), Botan::Hex_Decoder::write(), Botan::Hex_Encoder::write(), Botan_FFI::write_output(), and Botan::X448_PublicKey::X448_PublicKey().

copy_out_be()

template<ranges::spanable_range InR>

void Botan::copy_out_be ( std::span< uint8_t > out, InR && in )

inline

Partially copy a subset of in into out using big-endian byte order.

Definition at line 773 of file loadstor.h.

                                                        {
   using T = std::ranges::range_value_t<InR>;
   std::span<const T> in_s{in};
   const auto remaining_bytes = detail::copy_out_any_word_aligned_portion<std::endian::big>(out, in_s);
 
   // copy remaining bytes as a partial word
   for(size_t i = 0; i < remaining_bytes; ++i) {
      out[i] = get_byte_var(i, in_s.front());
   }
}

References Botan::detail::copy_out_any_word_aligned_portion(), and get_byte_var().

copy_out_le()

template<ranges::spanable_range InR>

void Botan::copy_out_le ( std::span< uint8_t > out, InR && in )

inline

Partially copy a subset of in into out using little-endian byte order.

Definition at line 789 of file loadstor.h.

                                                        {
   using T = std::ranges::range_value_t<InR>;
   std::span<const T> in_s{in};
   const auto remaining_bytes = detail::copy_out_any_word_aligned_portion<std::endian::little>(out, in_s);
 
   // copy remaining bytes as a partial word
   for(size_t i = 0; i < remaining_bytes; ++i) {
      out[i] = get_byte_var(sizeof(T) - 1 - i, in_s.front());
   }
}

References Botan::detail::copy_out_any_word_aligned_portion(), and get_byte_var().

Referenced by Botan::BLAKE2b::final_result(), and xts_update_tweak_block().

create_aes_row_generator()

auto Botan::create_aes_row_generator ( const FrodoKEMConstants & constants, StrongSpan< const FrodoSeedA > seed_a )

inline

Definition at line 25 of file frodo_aes_generator.h.

                                                                                                              {
   BOTAN_ASSERT_NOMSG(constants.mode().is_aes());
 
   auto setup_aes = [](StrongSpan<const FrodoSeedA> seed) {
      AES_128 aes;
      aes.set_key(seed);
      return aes;
   };
 
   return [n = static_cast<uint16_t>(constants.n()), aes = setup_aes(seed_a)](std::span<uint8_t> out, uint16_t i) {
      BufferStuffer out_bs(out);
 
      BOTAN_DEBUG_ASSERT(out_bs.remaining_capacity() % AES_128::BLOCK_SIZE == 0);
 
      for(uint16_t j = 0; j < n; j += AES_128::BLOCK_SIZE / 2) {
         // set up the to-be-encrypted 'b' value in the out variable
         // for in-place encryption of the block cipher
         // b = i || j || 0000...
         out_bs.append(store_le(i, j));
         clear_mem(out_bs.next<AES_128::BLOCK_SIZE - sizeof(i) - sizeof(j)>());
      }
 
      BOTAN_DEBUG_ASSERT(out_bs.full());
 
      aes.encrypt(out);
   };
}

References Botan::BufferStuffer::append(), Botan::Block_Cipher_Fixed_Params< 16, 16 >::BLOCK_SIZE, BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, clear_mem(), Botan::BufferStuffer::full(), Botan::FrodoKEMMode::is_aes(), Botan::FrodoKEMConstants::mode(), Botan::FrodoKEMConstants::n(), Botan::BufferStuffer::next(), Botan::BufferStuffer::remaining_capacity(), Botan::SymmetricAlgorithm::set_key(), and store_le().

create_ec_private_key()

std::unique_ptr< Private_Key > Botan::create_ec_private_key	(	std::string_view	algo_name,
		const EC_Group &	group,
		RandomNumberGenerator &	rng )

Create a new ECC key

Definition at line 442 of file pk_algs.cpp.

                                                                               {
   // Potentially unused if all EC algorithms are disabled
   BOTAN_UNUSED(alg_name, ec_group, rng);
 
#if defined(BOTAN_HAS_ECDSA)
   if(alg_name == "ECDSA") {
      return std::make_unique<ECDSA_PrivateKey>(rng, ec_group);
   }
#endif
 
#if defined(BOTAN_HAS_ECDH)
   if(alg_name == "ECDH") {
      return std::make_unique<ECDH_PrivateKey>(rng, ec_group);
   }
#endif
 
#if defined(BOTAN_HAS_ECKCDSA)
   if(alg_name == "ECKCDSA") {
      return std::make_unique<ECKCDSA_PrivateKey>(rng, ec_group);
   }
#endif
 
#if defined(BOTAN_HAS_GOST_34_10_2001)
   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
      return std::make_unique<GOST_3410_PrivateKey>(rng, ec_group);
   }
#endif
 
#if defined(BOTAN_HAS_SM2)
   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
      return std::make_unique<SM2_PrivateKey>(rng, ec_group);
   }
#endif
 
#if defined(BOTAN_HAS_ECGDSA)
   if(alg_name == "ECGDSA") {
      return std::make_unique<ECGDSA_PrivateKey>(rng, ec_group);
   }
#endif
 
   return nullptr;
}

References BOTAN_UNUSED.

Referenced by botan_ec_privkey_create(), and create_private_key().

create_hex_fingerprint() [1/2]

std::string Botan::create_hex_fingerprint	(	const uint8_t	bits[],
		size_t	bits_len,
		std::string_view	hash_name )

Definition at line 38 of file pk_keys.cpp.

                                                                                                  {
   auto hash_fn = HashFunction::create_or_throw(hash_name);
   const std::string hex_hash = hex_encode(hash_fn->process(bits, bits_len));
 
   std::string fprint;
 
   for(size_t i = 0; i != hex_hash.size(); i += 2) {
      if(i != 0) {
         fprint.push_back(':');
      }
 
      fprint.push_back(hex_hash[i]);
      fprint.push_back(hex_hash[i + 1]);
   }
 
   return fprint;
}

References Botan::HashFunction::create_or_throw(), and hex_encode().

Referenced by create_hex_fingerprint(), Botan::X509_Certificate::fingerprint(), Botan::Private_Key::fingerprint_private(), and Botan::Public_Key::fingerprint_public().

create_hex_fingerprint() [2/2]

std::string Botan::create_hex_fingerprint ( std::span< const uint8_t > vec, std::string_view hash_name )

inline

Definition at line 424 of file pk_keys.h.

                                                                                              {
   return create_hex_fingerprint(vec.data(), vec.size(), hash_name);
}

References create_hex_fingerprint().

create_pk_from_sk()

BOTAN_TEST_API std::array< uint8_t, ED448_LEN > Botan::create_pk_from_sk

(

std::span< const uint8_t, ED448_LEN >

sk

)

Create a public key point from a secret key (RFC 8032 5.2.5)

Definition at line 224 of file ed448_internal.cpp.

                                                                                     {
   // 5.2.5. Key Generation
   // The 57-byte public key is generated by the following steps:
   auto shake_xof = SHAKE_256_XOF();
   shake_xof.update(sk);
 
   const Scalar448 s = scalar_from_xof(shake_xof);
   // 3. Interpret the buffer as the little-endian integer, forming a
   //    secret scalar s. Perform a known-base-point scalar
   //    multiplication [s]B.
   return (s * Ed448Point::base_point()).encode();
}

References Botan::Ed448Point::base_point().

Referenced by Botan::Ed448_PrivateKey::Ed448_PrivateKey(), and Botan::Ed448_PrivateKey::Ed448_PrivateKey().

create_private_key()

std::unique_ptr< Private_Key > Botan::create_private_key	(	std::string_view	algo_name,
		RandomNumberGenerator &	rng,
		std::string_view	algo_params = "",
		std::string_view	provider = "" )

Create a new key For ECC keys, algo_params specifies EC group (eg, "secp256r1") For DH/DSA/ElGamal keys, algo_params is DL group (eg, "modp/ietf/2048") For RSA, algo_params is integer keylength For McEliece, algo_params is n,t If algo_params is left empty, suitable default parameters are chosen.

Definition at line 487 of file pk_algs.cpp.

                                                                         {
   /*
   * Default paramaters are chosen for work factor > 2**128 where possible
   */
 
#if defined(BOTAN_HAS_X25519)
   if(alg_name == "X25519" || alg_name == "Curve25519") {
      return std::make_unique<X25519_PrivateKey>(rng);
   }
#endif
 
#if defined(BOTAN_HAS_X448)
   if(alg_name == "X448") {
      return std::make_unique<X448_PrivateKey>(rng);
   }
#endif
 
#if defined(BOTAN_HAS_RSA)
   if(alg_name == "RSA") {
      const size_t modulus_bits = params.empty() ? 3072 : to_u32bit(params);
      return std::make_unique<RSA_PrivateKey>(rng, modulus_bits);
   }
#endif
 
#if defined(BOTAN_HAS_MCELIECE)
   if(alg_name == "McEliece") {
      const auto [n, t] = [&]() -> std::pair<size_t, size_t> {
         if(params.empty()) {
            return {2960, 57};
         }
 
         const auto mce_params = split_on(params, ',');
 
         if(mce_params.size() != 2) {
            throw Invalid_Argument(fmt("create_private_key: invalid McEliece parameters '{}'", params));
         }
 
         const size_t mce_n = to_u32bit(mce_params[0]);
         const size_t mce_t = to_u32bit(mce_params[1]);
         return {mce_n, mce_t};
      }();
 
      return std::make_unique<McEliece_PrivateKey>(rng, n, t);
   }
#endif
#if defined(BOTAN_HAS_CLASSICMCELIECE)
   if(alg_name == "ClassicMcEliece") {
      auto cmce_params_set = params.empty() ? Classic_McEliece_Parameter_Set::ClassicMcEliece_6960119f
                                            : Classic_McEliece_Parameter_Set::from_string(params);
      return std::make_unique<Classic_McEliece_PrivateKey>(rng, cmce_params_set);
   }
#endif
 
#if defined(BOTAN_HAS_FRODOKEM)
   if(alg_name == "FrodoKEM") {
      const auto mode = params.empty() ? FrodoKEMMode::FrodoKEM976_SHAKE : FrodoKEMMode(params);
      return std::make_unique<FrodoKEM_PrivateKey>(rng, mode);
   }
#endif
 
#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
   if(alg_name == "Kyber") {
      const auto mode = [&]() -> KyberMode {
         if(params.empty()) {
            return KyberMode::Kyber1024_R3;
         }
         return KyberMode(params);
      }();
 
      return std::make_unique<Kyber_PrivateKey>(rng, mode);
   }
#endif
 
#if defined(BOTAN_HAS_ML_KEM)
   if(alg_name == "ML-KEM") {
      const auto mode = [&]() -> ML_KEM_Mode {
         if(params.empty()) {
            return ML_KEM_Mode::ML_KEM_768;
         }
         return ML_KEM_Mode(params);
      }();
 
      return std::make_unique<ML_KEM_PrivateKey>(rng, mode);
   }
#endif
 
#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
      const auto mode = [&]() -> DilithiumMode {
         if(params.empty()) {
            return DilithiumMode::Dilithium6x5;
         }
         return DilithiumMode(params);
      }();
 
      return std::make_unique<Dilithium_PrivateKey>(rng, mode);
   }
#endif
 
#if defined(BOTAN_HAS_ML_DSA)
   if(alg_name == "ML-DSA") {
      const auto mode = [&]() -> ML_DSA_Mode {
         if(params.empty()) {
            return ML_DSA_Mode::ML_DSA_6x5;
         }
         return ML_DSA_Mode(params);
      }();
 
      return std::make_unique<ML_DSA_PrivateKey>(rng, mode);
   }
#endif
 
#if defined(BOTAN_HAS_HSS_LMS)
   if(alg_name == "HSS-LMS") {
      const auto hss_params = [&]() -> std::string {
         if(params.empty()) {
            return "SHA-256,HW(10,1)";
         } else {
            return std::string(params);
         }
      }();
      return std::make_unique<HSS_LMS_PrivateKey>(rng, hss_params);
   }
#endif
 
#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
   if(alg_name == "SPHINCS+" || alg_name == "SphincsPlus") {
      auto sphincs_params = Sphincs_Parameters::create(params);
 
      return std::make_unique<SphincsPlus_PrivateKey>(rng, sphincs_params);
   }
#endif
 
#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
   if(alg_name == "SLH-DSA") {
      auto slh_dsa_params = SLH_DSA_Parameters::create(params);
 
      return std::make_unique<SLH_DSA_PrivateKey>(rng, slh_dsa_params);
   }
#endif
 
#if defined(BOTAN_HAS_XMSS_RFC8391)
   if(alg_name == "XMSS") {
      const auto xmss_oid = [&]() -> XMSS_Parameters::xmss_algorithm_t {
         if(params.empty()) {
            return XMSS_Parameters::XMSS_SHA2_10_512;
         }
         return XMSS_Parameters(params).oid();
      }();
 
      return std::make_unique<XMSS_PrivateKey>(xmss_oid, rng);
   }
#endif
 
#if defined(BOTAN_HAS_ED25519)
   if(alg_name == "Ed25519") {
      return std::make_unique<Ed25519_PrivateKey>(rng);
   }
#endif
 
#if defined(BOTAN_HAS_ED448)
   if(alg_name == "Ed448") {
      return std::make_unique<Ed448_PrivateKey>(rng);
   }
#endif
 
   // ECC crypto
#if defined(BOTAN_HAS_ECC_PUBLIC_KEY_CRYPTO)
 
   if(alg_name == "ECDSA" || alg_name == "ECDH" || alg_name == "ECKCDSA" || alg_name == "ECGDSA" || alg_name == "SM2" ||
      alg_name == "SM2_Sig" || alg_name == "SM2_Enc" || alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" ||
      alg_name == "GOST-34.10-2012-512") {
      const std::string group_id = [&]() -> std::string {
         if(!params.empty()) {
            return std::string(params);
         }
         if(alg_name == "SM2" || alg_name == "SM2_Enc" || alg_name == "SM2_Sig") {
            return "sm2p256v1";
         }
         if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256") {
            return "gost_256A";
         }
         if(alg_name == "GOST-34.10-2012-512") {
            return "gost_512A";
         }
         if(alg_name == "ECGDSA") {
            return "brainpool256r1";
         }
         return "secp256r1";
      }();
 
      if(EC_Group::supports_named_group(group_id)) {
         auto ec_group = EC_Group::from_name(group_id);
         return create_ec_private_key(alg_name, ec_group, rng);
      } else {
         return {};
      }
   }
#endif
 
   // DL crypto
#if defined(BOTAN_HAS_DL_GROUP)
   if(alg_name == "DH" || alg_name == "DSA" || alg_name == "ElGamal") {
      const std::string group_id = [&]() -> std::string {
         if(!params.empty()) {
            return std::string(params);
         }
         if(alg_name == "DSA") {
            return "dsa/botan/2048";
         }
         return "modp/ietf/2048";
      }();
 
      auto modp_group = DL_Group::from_name(group_id);
 
   #if defined(BOTAN_HAS_DIFFIE_HELLMAN)
      if(alg_name == "DH") {
         return std::make_unique<DH_PrivateKey>(rng, modp_group);
      }
   #endif
 
   #if defined(BOTAN_HAS_DSA)
      if(alg_name == "DSA") {
         return std::make_unique<DSA_PrivateKey>(rng, modp_group);
      }
   #endif
 
   #if defined(BOTAN_HAS_ELGAMAL)
      if(alg_name == "ElGamal") {
         return std::make_unique<ElGamal_PrivateKey>(rng, modp_group);
      }
   #endif
   }
#endif
 
   BOTAN_UNUSED(alg_name, rng, params, provider);
 
   return std::unique_ptr<Private_Key>();
}

References BOTAN_UNUSED, Botan::Classic_McEliece_Parameter_Set::ClassicMcEliece_6960119f, Botan::Sphincs_Parameters::create(), create_ec_private_key(), Botan::DilithiumMode::Dilithium6x5, fmt(), Botan::FrodoKEMMode::FrodoKEM976_SHAKE, Botan::DL_Group::from_name(), Botan::EC_Group::from_name(), Botan::Classic_McEliece_Parameter_Set::from_string(), Botan::KyberMode::Kyber1024_R3, Botan::DilithiumMode::ML_DSA_6x5, Botan::KyberMode::ML_KEM_768, Botan::XMSS_Parameters::oid(), split_on(), Botan::EC_Group::supports_named_group(), to_u32bit(), and Botan::XMSS_Parameters::XMSS_SHA2_10_512.

Referenced by botan_privkey_create(), and Botan::TLS::Hybrid_KEM_PrivateKey::generate_from_group().

create_shake_row_generator()

auto Botan::create_shake_row_generator ( const FrodoKEMConstants & constants, StrongSpan< const FrodoSeedA > seed_a )

inline

Definition at line 23 of file frodo_shake_generator.h.

                                                                                                                {
   BOTAN_ASSERT_NOMSG(constants.mode().is_shake());
 
   return [xof = SHAKE_128_XOF(), a = FrodoSeedA(seed_a)](std::span<uint8_t> out, uint16_t i) mutable {
      xof.clear();
      xof.update(store_le(i));
      xof.update(a);
      xof.output(out);
   };
}

References BOTAN_ASSERT_NOMSG, Botan::FrodoKEMMode::is_shake(), Botan::FrodoKEMConstants::mode(), and store_le().

ct_compare_u8()

uint8_t Botan::ct_compare_u8	(	const uint8_t	x[],
		const uint8_t	y[],
		size_t	len )

Memory comparison, input insensitive

Parameters

x	a pointer to an array
y	a pointer to another array
len	the number of Ts in x and y

Returns

0xFF iff x[i] == y[i] forall i in [0...n) or 0x00 otherwise

Definition at line 13 of file mem_ops.cpp.

                                                                        {
   return CT::is_equal(x, y, len).value();
}

References Botan::CT::is_equal().

ct_divide() [1/2]

BigInt Botan::ct_divide ( const BigInt & x, const BigInt & y )

inline

BigInt division, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leak the sizes of x and y.

Parameters

x	an integer
y	a non-zero integer

Returns

x/y with remainder discarded

Definition at line 63 of file divide.h.

                                                          {
   BigInt q, r;
   ct_divide(x, y, q, r);
   return q;
}

References ct_divide().

ct_divide() [2/2]

BOTAN_TEST_API void Botan::ct_divide	(	const BigInt &	x,
		const BigInt &	y,
		BigInt &	q,
		BigInt &	r )

BigInt division, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leak the sizes of x and y.

Parameters

x	an integer
y	a non-zero integer
q	will be set to x / y
r	will be set to x % y

Definition at line 51 of file divide.cpp.

                                                                               {
   if(y.is_zero()) {
      throw Invalid_Argument("ct_divide: cannot divide by zero");
   }
 
   const size_t x_words = x.sig_words();
   const size_t y_words = y.sig_words();
 
   const size_t x_bits = x.bits();
 
   BigInt q = BigInt::with_capacity(x_words);
   BigInt r = BigInt::with_capacity(y_words);
   BigInt t = BigInt::with_capacity(y_words);  // a temporary
 
   for(size_t i = 0; i != x_bits; ++i) {
      const size_t b = x_bits - 1 - i;
      const bool x_b = x.get_bit(b);
 
      r <<= 1;
      r.conditionally_set_bit(0, x_b);
 
      const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
 
      q.conditionally_set_bit(b, r_gte_y);
      r.ct_cond_swap(r_gte_y, t);
   }
 
   sign_fixup(x, y, q, r);
   r_out = r;
   q_out = q;
}

References Botan::BigInt::_data(), bigint_sub3(), Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::BigInt::ct_cond_swap(), Botan::BigInt::get_bit(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::size(), and Botan::BigInt::with_capacity().

Referenced by ct_divide(), Botan::FPE_FE1::decrypt(), Botan::FPE_FE1::encrypt(), and lcm().

ct_divide_pow2k()

BOTAN_TEST_API BigInt Botan::ct_divide_pow2k	(	size_t	k,
		const BigInt &	y )

BigInt division, const time variant, 2^k variant

This runs with control flow independent of the value of y. This function leaks the value of k and the length of y. If k < bits(y) this returns zero

Parameters

k	an integer
y	a positive integer

Returns

q equal to 2**k / y

Definition at line 83 of file divide.cpp.

                                                  {
   BOTAN_ARG_CHECK(!y.is_zero(), "Cannot divide by zero");
   BOTAN_ARG_CHECK(!y.is_negative(), "Negative divisor not supported");
   BOTAN_ARG_CHECK(k > 1, "Invalid k");
 
   const size_t x_bits = k + 1;
   const size_t y_bits = y.bits();
 
   if(x_bits < y_bits) {
      return BigInt::zero();
   }
 
   BOTAN_ASSERT_NOMSG(y_bits >= 1);
   const size_t x_words = (x_bits + WordInfo<word>::bits - 1) / WordInfo<word>::bits;
   const size_t y_words = y.sig_words();
 
   BigInt q = BigInt::with_capacity(x_words);
   BigInt r = BigInt::with_capacity(y_words + 1);
   BigInt t = BigInt::with_capacity(y_words + 1);  // a temporary
 
   r.set_bit(y_bits - 1);
   for(size_t i = y_bits - 1; i != x_bits; ++i) {
      const size_t b = x_bits - 1 - i;
 
      if(i >= y_bits) {
         bigint_shl1(r.mutable_data(), r.size(), r.size(), 1);
      }
 
      const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
 
      q.conditionally_set_bit(b, r_gte_y);
 
      bigint_cnd_swap(static_cast<word>(r_gte_y), r.mutable_data(), t.mutable_data(), y_words + 1);
   }
 
   // No need for sign fixup
 
   return q;
}

References Botan::BigInt::_data(), bigint_cnd_swap(), bigint_shl1(), bigint_sub3(), Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::BigInt::conditionally_set_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::set_bit(), Botan::BigInt::sig_words(), Botan::BigInt::size(), Botan::BigInt::with_capacity(), and Botan::BigInt::zero().

Referenced by Botan::Barrett_Reduction::for_secret_modulus().

ct_divide_word() [1/2]

BigInt Botan::ct_divide_word	(	const BigInt &	x,
		word	y )

Constant time division

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters

x	an integer
y	a non-zero word

Returns

quotient floor(x / y)

Definition at line 160 of file divide.cpp.

                                               {
   BigInt q;
   word r;
   ct_divide_word(x, y, q, r);
   BOTAN_UNUSED(r);
   return q;
}

References BOTAN_UNUSED, and ct_divide_word().

ct_divide_word() [2/2]

BOTAN_TEST_API void Botan::ct_divide_word	(	const BigInt &	x,
		word	y,
		BigInt &	q,
		word &	r )

Constant time division

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters

x	an integer
y	a non-zero integer
q	will be set to x / y
r	will be set to x % y

Definition at line 123 of file divide.cpp.

                                                                         {
   if(y == 0) {
      throw Invalid_Argument("ct_divide_word: cannot divide by zero");
   }
 
   const size_t x_words = x.sig_words();
   const size_t x_bits = x.bits();
 
   BigInt q = BigInt::with_capacity(x_words);
   word r = 0;
 
   for(size_t i = 0; i != x_bits; ++i) {
      const size_t b = x_bits - 1 - i;
      const bool x_b = x.get_bit(b);
 
      const auto r_carry = CT::Mask<word>::expand_top_bit(r);
 
      r <<= 1;
      r += x_b;
 
      const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
      q.conditionally_set_bit(b, r_gte_y.as_bool());
      r = r_gte_y.select(r - y, r);
   }
 
   if(x.is_negative()) {
      q.flip_sign();
      if(r != 0) {
         --q;
         r = y - r;
      }
   }
 
   r_out = r;
   q_out = q;
}

References Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::CT::Mask< T >::expand_top_bit(), Botan::BigInt::flip_sign(), Botan::BigInt::get_bit(), Botan::CT::Mask< T >::is_gte(), Botan::BigInt::is_negative(), Botan::BigInt::sig_words(), and Botan::BigInt::with_capacity().

Referenced by compute_rsa_secret_exponent(), ct_divide_word(), operator/(), and Botan::BigInt::to_dec_string().

ct_is_zero()

template<typename T>
requires (std::is_integral<T>::value)

T Botan::ct_is_zero ( T x )

inlineconstexpr

If arg is zero, return ~0. Otherwise return 0

Definition at line 36 of file bit_ops.h.

{
   return expand_top_bit<T>(~x & (x - 1));
}

References expand_top_bit().

Referenced by ctz(), Botan::CT::Choice::from_int(), high_bit(), Botan::CT::Mask< T >::is_zero(), prefetch_array_raw(), and significant_bytes().

ct_mod_word()

BOTAN_TEST_API word Botan::ct_mod_word	(	const BigInt &	x,
		word	y )

BigInt word modulo, const time variant

This runs with control flow independent of the values of x/y. Warning: the loop bounds still leaks the size of x.

Parameters

x	a positive integer
y	a non-zero word

Returns

r the remainder of x divided by y

Definition at line 168 of file divide.cpp.

                                          {
   BOTAN_ARG_CHECK(x.is_positive(), "The argument x must be positive");
   BOTAN_ARG_CHECK(y != 0, "Cannot divide by zero");
 
   const size_t x_bits = x.bits();
 
   word r = 0;
 
   for(size_t i = 0; i != x_bits; ++i) {
      const size_t b = x_bits - 1 - i;
      const bool x_b = x.get_bit(b);
 
      const auto r_carry = CT::Mask<word>::expand_top_bit(r);
 
      r <<= 1;
      r += x_b;
 
      const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
      r = r_gte_y.select(r - y, r);
   }
 
   return r;
}

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, Botan::CT::Mask< T >::expand_top_bit(), Botan::BigInt::get_bit(), Botan::CT::Mask< T >::is_gte(), and Botan::BigInt::is_positive().

Referenced by compute_rsa_secret_exponent().

ct_modulo()

BOTAN_TEST_API BigInt Botan::ct_modulo	(	const BigInt &	x,
		const BigInt &	modulo )

BigInt modulo, const time variant

Using this function is (slightly) cheaper than calling ct_divide and using only the remainder.

Parameters

x	a non-negative integer
modulo	a positive integer

Returns

result x % modulo

Definition at line 192 of file divide.cpp.

                                                   {
   if(y.is_negative() || y.is_zero()) {
      throw Invalid_Argument("ct_modulo requires y > 0");
   }
 
   const size_t y_words = y.sig_words();
 
   const size_t x_bits = x.bits();
 
   BigInt r = BigInt::with_capacity(y_words);
   BigInt t = BigInt::with_capacity(y_words);
 
   for(size_t i = 0; i != x_bits; ++i) {
      const size_t b = x_bits - 1 - i;
      const bool x_b = x.get_bit(b);
 
      r <<= 1;
      r.conditionally_set_bit(0, x_b);
 
      const bool r_gte_y = bigint_sub3(t.mutable_data(), r._data(), r.size(), y._data(), y_words) == 0;
 
      r.ct_cond_swap(r_gte_y, t);
   }
 
   if(x.is_negative()) {
      if(r.is_nonzero()) {
         r = y - r;
      }
   }
 
   return r;
}

References Botan::BigInt::_data(), bigint_sub3(), Botan::BigInt::bits(), Botan::BigInt::conditionally_set_bit(), Botan::BigInt::ct_cond_swap(), Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_nonzero(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::size(), and Botan::BigInt::with_capacity().

Referenced by Botan::RSA_PrivateKey::check_key(), Botan::FPE_FE1::decrypt(), Botan::FPE_FE1::encrypt(), inverse_mod(), inverse_mod_general(), power_mod(), Botan::Modular_Reducer::reduce(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

ct_popcount()

template<std::unsigned_integral T>

uint8_t Botan::ct_popcount ( T x )

inlineconstexpr

Calculates the number of 1-bits in an unsigned integer in constant-time. This operation is also known as "population count" or hamming weight.

Modern compilers will recognize this pattern and replace it by a hardware instruction, if available. This is the SWAR (SIMD within a register) algorithm. See: https://nimrod.blog/posts/algorithms-behind-popcount/#swar-algorithm

Note: C++20 provides std::popcount(), but there's no guarantee that this is implemented in constant-time.

Parameters

x	an unsigned integer

Returns

the number of 1-bits in the provided value

Definition at line 261 of file bit_ops.h.

                                          {
   constexpr size_t s = sizeof(T);
   static_assert(s <= 8, "T is not a suitable unsigned integer value");
   if constexpr(s == 8) {
      x = x - ((x >> 1) & 0x5555555555555555);
      x = (x & 0x3333333333333333) + ((x >> 2) & 0x3333333333333333);
      x = (x + (x >> 4)) & 0xF0F0F0F0F0F0F0F;
      return (x * 0x101010101010101) >> 56;
   } else if constexpr(s == 4) {
      x = x - ((x >> 1) & 0x55555555);
      x = (x & 0x33333333) + ((x >> 2) & 0x33333333);
      x = (x + (x >> 4)) & 0x0F0F0F0F;
      return (x * 0x01010101) >> 24;
   } else {
      // s < 4
      return ct_popcount(static_cast<uint32_t>(x));
   }
}

References ct_popcount().

Referenced by ct_popcount(), and Botan::bitvector_base< secure_allocator >::hamming_weight().

ct_reverse_bits()

template<std::unsigned_integral T>

T Botan::ct_reverse_bits ( T b )

constexpr

Returns

the reversed bits in b.

Definition at line 227 of file bit_ops.h.

                                 {
   auto extend = [](uint8_t m) -> T {
      T mask = 0;
      for(size_t i = 0; i < sizeof(T); ++i) {
         mask |= T(m) << i * 8;
      }
      return mask;
   };
 
   // First reverse bits in each byte...
   // From: https://stackoverflow.com/a/2602885
   b = (b & extend(0xF0)) >> 4 | (b & extend(0x0F)) << 4;
   b = (b & extend(0xCC)) >> 2 | (b & extend(0x33)) << 2;
   b = (b & extend(0xAA)) >> 1 | (b & extend(0x55)) << 1;
 
   // ... then swap the bytes
   return reverse_bytes(b);
}

References reverse_bytes().

ctz()

template<typename T>
requires (std::is_integral<T>::value)

size_t Botan::ctz ( T n )

inlineconstexpr

Count the trailing zero bits in n

Parameters

n	an integer value

Returns

maximum x st 2^x divides n

Definition at line 105 of file bit_ops.h.

{
   /*
   * If n == 0 then this function will compute 8*sizeof(T)-1, so
   * initialize lb to 1 if n == 0 to produce the expected result.
   */
   size_t lb = ct_is_zero(n) & 1;
 
   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
      const T mask = (static_cast<T>(1) << s) - 1;
      const size_t z = s * (ct_is_zero(n & mask) & 1);
      lb += z;
      n >>= z;
   }
 
   return lb;
}

References ct_is_zero().

Referenced by low_zero_bits(), and var_ctz32().

curve25519_basepoint()

void Botan::curve25519_basepoint	(	uint8_t	mypublic[32],
		const uint8_t	secret[32] )

Exponentiate by the x25519 base point

Parameters

mypublic	output value
secret	random scalar

Definition at line 19 of file x25519.cpp.

                                                                          {
   const uint8_t basepoint[32] = {9};
   curve25519_donna(mypublic, secret, basepoint);
}

References curve25519_donna().

Referenced by Botan::X25519_PrivateKey::check_key(), Botan::Sodium::crypto_scalarmult_curve25519_base(), Botan::X25519_PrivateKey::X25519_PrivateKey(), Botan::X25519_PrivateKey::X25519_PrivateKey(), and Botan::X25519_PrivateKey::X25519_PrivateKey().

curve25519_donna()

void Botan::curve25519_donna	(	uint8_t	mypublic[32],
		const uint8_t	secret[32],
		const uint8_t	basepoint[32] )

Definition at line 454 of file donna.cpp.

                                                                                                   {
   CT::poison(secret, 32);
   CT::poison(basepoint, 32);
 
   uint64_t bp[5], x[5], z[5], zmone[5];
   uint8_t e[32];
 
   copy_mem(e, secret, 32);
   e[0] &= 248;
   e[31] &= 127;
   e[31] |= 64;
 
   fexpand(bp, basepoint);
   cmult(x, z, e, bp);
   crecip(zmone, z);
   fmul(z, x, zmone);
   fcontract(mypublic, z);
 
   CT::unpoison(secret, 32);
   CT::unpoison(basepoint, 32);
   CT::unpoison(mypublic, 32);
}

References copy_mem(), Botan::CT::poison(), and Botan::CT::unpoison().

Referenced by Botan::Sodium::crypto_scalarmult_curve25519(), and curve25519_basepoint().

dbl_a_minus_3()

template<typename ProjectivePoint>

ProjectivePoint Botan::dbl_a_minus_3 ( const ProjectivePoint & pt )

inlineconstexpr

Definition at line 309 of file pcurves_algos.h.

                                                                          {
   /*
   if a == -3 then
   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
   */
   const auto z2 = pt.z().square();
   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
 
   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
   const auto y2 = pt.y().square();
   const auto s = pt.x().mul4() * y2;
   const auto nx = m.square() - s.mul2();
   const auto ny = m * (s - nx) - y2.square().mul8();
   const auto nz = pt.y().mul2() * pt.z();
 
   return ProjectivePoint(nx, ny, nz);
}

dbl_a_zero()

template<typename ProjectivePoint>

ProjectivePoint Botan::dbl_a_zero ( const ProjectivePoint & pt )

inlineconstexpr

Definition at line 328 of file pcurves_algos.h.

                                                                       {
   // If a == 0 then 3*x^2 + a*z^4 == 3*x^2
   // Cost: 1S + 1*3
   const auto m = pt.x().square().mul3();
 
   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
   const auto y2 = pt.y().square();
   const auto s = pt.x().mul4() * y2;
   const auto nx = m.square() - s.mul2();
   const auto ny = m * (s - nx) - y2.square().mul8();
   const auto nz = pt.y().mul2() * pt.z();
 
   return ProjectivePoint(nx, ny, nz);
}

dbl_generic()

template<typename ProjectivePoint, typename FieldElement>

ProjectivePoint Botan::dbl_generic ( const ProjectivePoint & pt, const FieldElement & A )

inlineconstexpr

Definition at line 344 of file pcurves_algos.h.

                                                                                               {
   // Cost: 1M + 3S + 1A + 1*3
   const auto z2 = pt.z().square();
   const auto m = pt.x().square().mul3() + A * z2.square();
 
   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
   const auto y2 = pt.y().square();
   const auto s = pt.x().mul4() * y2;
   const auto nx = m.square() - s.mul2();
   const auto ny = m * (s - nx) - y2.square().mul8();
   const auto nz = pt.y().mul2() * pt.z();
 
   return ProjectivePoint(nx, ny, nz);
}

dbl_n_a_minus_3()

template<typename ProjectivePoint>

ProjectivePoint Botan::dbl_n_a_minus_3 ( const ProjectivePoint & pt, size_t n )

inlineconstexpr

Definition at line 377 of file pcurves_algos.h.

                                                                                      {
   auto nx = pt.x();
   auto ny = pt.y().mul2();
   auto nz = pt.z();
   auto w = nz.square().square();
 
   while(n > 0) {
      const auto ny2 = ny.square();
      const auto ny4 = ny2.square();
      const auto t1 = (nx.square() - w).mul3();
      const auto t2 = nx * ny2;
      nx = t1.square() - t2.mul2();
      nz *= ny;
      ny = t1 * (t2 - nx).mul2() - ny4;
      n--;
      if(n > 0) {
         w *= ny4;
      }
   }
   return ProjectivePoint(nx, ny.div2(), nz);
}

dbl_n_a_zero()

template<typename ProjectivePoint>

ProjectivePoint Botan::dbl_n_a_zero ( const ProjectivePoint & pt, size_t n )

inlineconstexpr

Definition at line 400 of file pcurves_algos.h.

                                                                                   {
   auto nx = pt.x();
   auto ny = pt.y().mul2();
   auto nz = pt.z();
 
   while(n > 0) {
      const auto ny2 = ny.square();
      const auto ny4 = ny2.square();
      const auto t1 = nx.square().mul3();
      const auto t2 = nx * ny2;
      nx = t1.square() - t2.mul2();
      nz *= ny;
      ny = t1 * (t2 - nx).mul2() - ny4;
      n--;
   }
   return ProjectivePoint(nx, ny.div2(), nz);
}

dbl_n_generic()

template<typename ProjectivePoint, typename FieldElement>

ProjectivePoint Botan::dbl_n_generic ( const ProjectivePoint & pt, const FieldElement & A, size_t n )

inlineconstexpr

Definition at line 419 of file pcurves_algos.h.

                                                                                                           {
   auto nx = pt.x();
   auto ny = pt.y().mul2();
   auto nz = pt.z();
   auto w = nz.square().square() * A;
 
   while(n > 0) {
      const auto ny2 = ny.square();
      const auto ny4 = ny2.square();
      const auto t1 = nx.square().mul3() + w;
      const auto t2 = nx * ny2;
      nx = t1.square() - t2.mul2();
      nz *= ny;
      ny = t1 * (t2 - nx).mul2() - ny4;
      n--;
      if(n > 0) {
         w *= ny4;
      }
   }
   return ProjectivePoint(nx, ny.div2(), nz);
}

deallocate_memory()

void Botan::deallocate_memory	(	void *	p,
		size_t	elems,
		size_t	elem_size )

Free a pointer returned by allocate_memory

Parameters

p	the pointer returned by allocate_memory
elems	the number of elements, as passed to allocate_memory
elem_size	the size of each element, as passed to allocate_memory

Definition at line 48 of file allocator.cpp.

                                                                {
   if(p == nullptr) {
      [[unlikely]] return;
   }
 
   secure_scrub_memory(p, elems * elem_size);
 
#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
      return;
   }
#endif
 
   std::free(p);  // NOLINT(*-no-malloc)
}

References Botan::mlock_allocator::instance(), and secure_scrub_memory().

Referenced by Botan::secure_allocator< T >::deallocate().

decode_gf2m()

gf2m Botan::decode_gf2m

(

const uint8_t *

mem

)

Definition at line 101 of file gf2m_small_m.cpp.

                                     {
   gf2m result;
   result = mem[0] << 8;
   result |= mem[1];
   return result;
}

Referenced by Botan::polyn_gf2m::polyn_gf2m().

decode_point()

Point448 Botan::decode_point

(

std::span< const uint8_t >

p_bytes

)

Decode a point from a byte array. RFC 7748 Section 5 (decodeUCoordinate)

Definition at line 25 of file x448_internal.cpp.

                                                      {
   BOTAN_ARG_CHECK(p_bytes.size() == X448_LEN, "Invalid size for X448 point");
   return typecast_copy<Point448>(p_bytes);
}

References BOTAN_ARG_CHECK, typecast_copy(), and X448_LEN.

decode_scalar()

ScalarX448 Botan::decode_scalar

(

std::span< const uint8_t >

scalar_bytes

)

Decode a scalar from a byte array. RFC 7748 Section 5 (decodeScalar448)

Definition at line 30 of file x448_internal.cpp.

                                                              {
   BOTAN_ARG_CHECK(scalar_bytes.size() == X448_LEN, "Invalid size for X448 scalar");
   auto buf = typecast_copy<ScalarX448>(scalar_bytes);
 
   buf[0] &= 0xfc;
   buf[55] |= 0x80;
 
   return buf;
}

References BOTAN_ARG_CHECK, typecast_copy(), and X448_LEN.

dl_exponent_size()

size_t BOTAN_TEST_API Botan::dl_exponent_size

(

size_t

prime_group_size

)

Return the appropriate exponent size to use for a particular prime group. This is twice the size of the estimated cost of breaking the key using an index calculus attack; the assumption is that if an arbitrary discrete log on a group of size bits would take about 2^n effort, and thus using an exponent of size 2^(2*n) implies that all available attacks are about as easy (as e.g Pollard's kangaroo algorithm can compute the DL in sqrt(x) operations) while minimizing the exponent size for performance reasons.

Definition at line 51 of file workfactor.cpp.

                                     {
   if(bits == 0) {
      return 0;
   }
   if(bits <= 256) {
      return bits - 1;
   }
   if(bits <= 1024) {
      return 192;
   }
   if(bits <= 1536) {
      return 224;
   }
   if(bits <= 2048) {
      return 256;
   }
   if(bits <= 4096) {
      return 384;
   }
   return 512;
}

Referenced by Botan::DL_Group::DL_Group().

dl_work_factor()

size_t BOTAN_TEST_API Botan::dl_work_factor

(

size_t

prime_group_size

)

Estimate work factor for discrete logarithm

Parameters

prime_group_size

size of the group in bits

Returns

estimated security level for this group

Definition at line 46 of file workfactor.cpp.

                                   {
   // Lacking better estimates...
   return if_work_factor(bits);
}

References if_work_factor().

do_throw_error()

template<typename E, typename... Args>

void Botan::do_throw_error ( const char * file, int line, const char * func, Args... args )

inline

Definition at line 342 of file exceptn.h.

                                                                                       {
   throw E(file, line, func, args...);
}

ecp_work_factor()

size_t Botan::ecp_work_factor

(

size_t

prime_group_size

)

Estimate work factor for EC discrete logarithm

Parameters

prime_group_size

size of the group in bits

Returns

estimated security level for this group

Definition at line 14 of file workfactor.cpp.

                                    {
   return bits / 2;
}

Referenced by Botan::EC_PublicKey::estimated_strength().

ed25519_gen_keypair() [1/2]

void Botan::ed25519_gen_keypair	(	uint8_t *	pk,
		uint8_t *	sk,
		const uint8_t	seed[32] )

Definition at line 20 of file ed25519.cpp.

                                                                           {
   uint8_t az[64];
 
   SHA_512 sha;
   sha.update(seed, 32);
   sha.final(az);
   az[0] &= 248;
   az[31] &= 63;
   az[31] |= 64;
 
   ge_scalarmult_base(pk, az);
 
   // todo copy_mem
   copy_mem(sk, seed, 32);
   copy_mem(sk + 32, pk, 32);
}

References copy_mem(), Botan::Buffered_Computation::final(), ge_scalarmult_base(), and Botan::Buffered_Computation::update().

Referenced by Botan::Sodium::crypto_sign_ed25519_seed_keypair(), ed25519_gen_keypair(), Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(), Botan::Ed25519_PrivateKey::Ed25519_PrivateKey(), and Botan::Ed25519_PrivateKey::Ed25519_PrivateKey().

ed25519_gen_keypair() [2/2]

void Botan::ed25519_gen_keypair	(	uint8_t	pk[32],
		uint8_t	sk[64],
		const uint8_t	seed[32] )

References BOTAN_DEPRECATED, ed25519_gen_keypair(), and ed25519_sign().

ed25519_sign()

void Botan::ed25519_sign	(	uint8_t	sig[64],
		const uint8_t	m[],
		size_t	mlen,
		const uint8_t	sk[64],
		const uint8_t	domain_sep[],
		size_t	domain_sep_len )

Definition at line 37 of file ed25519.cpp.

                                         {
   uint8_t az[64];
   uint8_t nonce[64];
   uint8_t hram[64];
 
   SHA_512 sha;
 
   sha.update(sk, 32);
   sha.final(az);
   az[0] &= 248;
   az[31] &= 63;
   az[31] |= 64;
 
   sha.update(domain_sep, domain_sep_len);
   sha.update(az + 32, 32);
   sha.update(m, mlen);
   sha.final(nonce);
 
   sc_reduce(nonce);
   ge_scalarmult_base(sig, nonce);
 
   sha.update(domain_sep, domain_sep_len);
   sha.update(sig, 32);
   sha.update(sk + 32, 32);
   sha.update(m, mlen);
   sha.final(hram);
 
   sc_reduce(hram);
   sc_muladd(sig + 32, hram, az, nonce);
}

References Botan::Buffered_Computation::final(), ge_scalarmult_base(), sc_muladd(), sc_reduce(), and Botan::Buffered_Computation::update().

Referenced by Botan::Sodium::crypto_sign_ed25519_detached(), and ed25519_gen_keypair().

ed25519_verify() [1/2]

bool Botan::ed25519_verify	(	const uint8_t *	m,
		size_t	mlen,
		const uint8_t	sig[64],
		const uint8_t *	pk,
		const uint8_t	domain_sep[],
		size_t	domain_sep_len )

Definition at line 73 of file ed25519.cpp.

                                           {
   uint8_t h[64];
   uint8_t rcheck[32];
   ge_p3 A;
   SHA_512 sha;
 
   if(sig[63] & 224) {
      return false;
   }
   if(ge_frombytes_negate_vartime(&A, pk) != 0) {
      return false;
   }
 
   const uint64_t CURVE25519_ORDER[4] = {
      0x1000000000000000,
      0x0000000000000000,
      0x14def9dea2f79cd6,
      0x5812631a5cf5d3ed,
   };
 
   const uint64_t s[4] = {load_le<uint64_t>(sig + 32, 3),
                          load_le<uint64_t>(sig + 32, 2),
                          load_le<uint64_t>(sig + 32, 1),
                          load_le<uint64_t>(sig + 32, 0)};
 
   // RFC 8032 adds the requirement that we verify that s < order in
   // the signature; this did not exist in the original Ed25519 spec.
   for(size_t i = 0; i != 4; ++i) {
      if(s[i] > CURVE25519_ORDER[i]) {
         return false;
      }
      if(s[i] < CURVE25519_ORDER[i]) {
         break;
      }
      if(i == 3) {  // here s == order
         return false;
      }
   }
 
   sha.update(domain_sep, domain_sep_len);
   sha.update(sig, 32);
   sha.update(pk, 32);
   sha.update(m, mlen);
   sha.final(h);
   sc_reduce(h);
 
   ge_double_scalarmult_vartime(rcheck, h, &A, sig + 32);
 
   return CT::is_equal(rcheck, sig, 32).as_bool();
}

References Botan::Buffered_Computation::final(), ge_double_scalarmult_vartime(), ge_frombytes_negate_vartime(), Botan::CT::is_equal(), load_le(), sc_reduce(), and Botan::Buffered_Computation::update().

Referenced by Botan::Sodium::crypto_sign_ed25519_verify_detached(), and ed25519_verify().

ed25519_verify() [2/2]

bool Botan::ed25519_verify	(	const uint8_t	msg[],
		size_t	msg_len,
		const uint8_t	sig[64],
		const uint8_t	pk[32],
		const uint8_t	domain_sep[],
		size_t	domain_sep_len )

References ed25519_verify().

encode_gf2m()

uint32_t Botan::encode_gf2m	(	gf2m	to_enc,
		uint8_t *	mem )

Definition at line 95 of file gf2m_small_m.cpp.

                                                {
   mem[0] = to_enc >> 8;
   mem[1] = to_enc & 0xFF;
   return sizeof(to_enc);
}

encode_point()

secure_vector< uint8_t > Botan::encode_point

(

const Point448 &

p

)

Encode a point to a 56 byte vector. RFC 7748 Section 5 (encodeUCoordinate)

Definition at line 21 of file x448_internal.cpp.

                                                       {
   return {p.begin(), p.end()};
}

References Botan::detail::Container_Strong_Adapter_Base< T >::begin(), and Botan::detail::Container_Strong_Adapter_Base< T >::end().

esdm_rng()

RandomNumberGenerator & Botan::esdm_rng

(

)

Return a shared reference to a global PRNG instance provided by ESDM

Definition at line 99 of file esdm_rng.cpp.

                                  {
   static ESDM_RNG g_esdm_rng;
   return g_esdm_rng;
}

expand_mask_16bit()

template<typename T>

uint16_t Botan::expand_mask_16bit

(

T

tst

)

Expand an input to a bit mask depending on it being being zero or non-zero

Parameters

tst

the input

Returns

the mask 0xFFFF if tst is non-zero and 0 otherwise

Definition at line 25 of file code_based_util.h.

                                  {
   const uint16_t result = (tst != 0);
   return ~(result - 1);
}

Referenced by Botan::polyn_gf2m::calc_degree_secure(), Botan::polyn_gf2m::eea_with_coefficients(), and Botan::polyn_gf2m::patchup_deg_secure().

expand_message_xmd() [1/2]

void BOTAN_TEST_API Botan::expand_message_xmd	(	std::string_view	hash_fn,
		std::span< uint8_t >	output,
		std::span< const uint8_t >	input,
		std::span< const uint8_t >	domain_sep )

XMD hash function from RFC 9380

This is only used internally to implement hash2curve so is not exposed to end users.

Definition at line 17 of file xmd.cpp.

                                                           {
   if(domain_sep.size() > 0xFF) {
      // RFC 9380 has a specification for handling this
      throw Not_Implemented("XMD does not currently implement oversize DST handling");
   }
 
   const uint8_t domain_sep_len = static_cast<uint8_t>(domain_sep.size());
 
   auto hash = HashFunction::create_or_throw(hash_fn);
   const size_t block_size = hash->hash_block_size();
   if(block_size == 0) {
      throw Invalid_Argument(fmt("expand_message_xmd cannot be used with {}", hash_fn));
   }
 
   const size_t hash_output_size = hash->output_length();
   if(output.size() > 255 * hash_output_size || output.size() > 0xFFFF) {
      throw Invalid_Argument("expand_message_xmd requested output length too long");
   }
 
   // Compute b_0 = H(msg_prime) = H(Z_pad || msg || l_i_b_str || 0x00 || DST_prime)
 
   hash->update(std::vector<uint8_t>(block_size));
   hash->update(input);
   hash->update_be(static_cast<uint16_t>(output.size()));
   hash->update(0x00);
   hash->update(domain_sep);
   hash->update(domain_sep_len);
 
   const secure_vector<uint8_t> b_0 = hash->final();
 
   // Compute b_1 = H(b_0 || 0x01 || DST_prime)
 
   hash->update(b_0);
   hash->update(0x01);
   hash->update(domain_sep);
   hash->update(domain_sep_len);
 
   secure_vector<uint8_t> b_i = hash->final();
 
   uint8_t cnt = 2;
   for(;;) {
      const size_t produced = std::min(output.size(), hash_output_size);
 
      copy_mem(&output[0], b_i.data(), produced);
      output = output.subspan(produced);
 
      if(output.empty()) {
         break;
      }
 
      // Now compute the next b_i if needed
 
      b_i ^= b_0;
      hash->update(b_i);
      hash->update(cnt);
      hash->update(domain_sep);
      hash->update(domain_sep_len);
      hash->final(b_i);
      cnt += 1;
   }
}

References copy_mem(), Botan::HashFunction::create_or_throw(), and fmt().

Referenced by expand_message_xmd().

expand_message_xmd() [2/2]

void Botan::expand_message_xmd ( std::string_view hash_fn, std::span< uint8_t > output, std::string_view input_str, std::string_view domain_sep_str )

inline

Definition at line 27 of file xmd.h.

                                                              {
   std::span<const uint8_t> input(reinterpret_cast<const uint8_t*>(input_str.data()), input_str.size());
 
   std::span<const uint8_t> domain_sep(reinterpret_cast<const uint8_t*>(domain_sep_str.data()), domain_sep_str.size());
 
   expand_message_xmd(hash_fn, output, input, domain_sep);
}

References expand_message_xmd().

expand_top_bit()

template<typename T>
requires (std::is_integral<T>::value)

T Botan::expand_top_bit ( T a )

inlineconstexpr

If top bit of arg is set, return ~0. Otherwise return 0.

Definition at line 26 of file bit_ops.h.

{
   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
}

Referenced by ct_is_zero(), and Botan::CT::Mask< T >::expand_top_bit().

extended_euclidean_algorithm()

template<std::integral T>

eea_result< T > Botan::extended_euclidean_algorithm ( T a, T b )

consteval

Run the extended Euclidean algorithm to find the greatest common divisor of a and b and the Bézout coefficients, u and v.

Definition at line 69 of file pqcrystals_helpers.h.

                                                               {
   if(a > b) {
      std::swap(a, b);
   }
 
   T u1 = 0, v1 = 1, u2 = 1, v2 = 0;
 
   if(a != b) {
      while(a != 0) {
         const T q = b / a;
         std::tie(a, b) = std::make_tuple(static_cast<T>(b - q * a), a);
         std::tie(u1, v1, u2, v2) = std::make_tuple(u2, v2, static_cast<T>(u1 - q * u2), static_cast<T>(v1 - q * v2));
      }
   }
 
   return {.gcd = b, .u = u1, .v = v1};
}

Referenced by modular_inverse().

fe_0()

void Botan::fe_0 ( FE_25519 & x )

inline

Definition at line 168 of file ed25519_fe.h.

                              {
   x = FE_25519();
}

fe_1()

void Botan::fe_1 ( FE_25519 & x )

inline

Definition at line 172 of file ed25519_fe.h.

                              {
   x = FE_25519(1);
}

Referenced by ge_frombytes_negate_vartime().

fe_add()

void Botan::fe_add ( FE_25519 & x, const FE_25519 & a, const FE_25519 & b )

inline

Definition at line 176 of file ed25519_fe.h.

                                                                      {
   x = FE_25519::add(a, b);
}

References Botan::FE_25519::add().

Referenced by ge_frombytes_negate_vartime().

fe_copy()

void Botan::fe_copy ( FE_25519 & a, const FE_25519 & b )

inline

Definition at line 156 of file ed25519_fe.h.

                                                    {
   a = b;
}

fe_frombytes()

void Botan::fe_frombytes ( FE_25519 & x, const uint8_t * b )

inline

Definition at line 148 of file ed25519_fe.h.

                                                        {
   x.from_bytes(b);
}

References Botan::FE_25519::from_bytes().

Referenced by ge_frombytes_negate_vartime().

fe_invert()

void Botan::fe_invert ( FE_25519 & x, const FE_25519 & z )

inline

Definition at line 204 of file ed25519_fe.h.

                                                      {
   x = FE_25519::invert(z);
}

References Botan::FE_25519::invert().

fe_isnegative()

int Botan::fe_isnegative ( const FE_25519 & x )

inline

Definition at line 164 of file ed25519_fe.h.

                                            {
   return x.is_negative();
}

References Botan::FE_25519::is_negative().

Referenced by ge_frombytes_negate_vartime().

fe_isnonzero()

int Botan::fe_isnonzero ( const FE_25519 & x )

inline

Definition at line 160 of file ed25519_fe.h.

                                           {
   return x.is_zero() ? 0 : 1;
}

References Botan::FE_25519::is_zero().

Referenced by ge_frombytes_negate_vartime().

fe_mul()

void Botan::fe_mul ( FE_25519 & x, const FE_25519 & a, const FE_25519 & b )

inline

Definition at line 188 of file ed25519_fe.h.

                                                                      {
   x = FE_25519::mul(a, b);
}

References Botan::FE_25519::mul().

Referenced by Botan::EC_Point::_is_x_eq_to_v_mod_order(), Botan::EC_Point::add(), Botan::EC_Point::add_affine(), Botan::EC_Point::force_affine(), Botan::EC_Point::force_all_affine(), ge_frombytes_negate_vartime(), Botan::EC_Point::get_affine_x(), Botan::EC_Point::get_affine_y(), Botan::FE_25519::invert(), Botan::EC_Point::mult2(), Botan::EC_Point::on_the_curve(), Botan::FE_25519::pow_22523(), and Botan::EC_Point::randomize_repr().

fe_neg()

void Botan::fe_neg ( FE_25519 & x, const FE_25519 & z )

inline

Definition at line 184 of file ed25519_fe.h.

                                                   {
   x = FE_25519::negate(z);
}

References Botan::FE_25519::negate().

Referenced by ge_frombytes_negate_vartime().

fe_pow22523()

void Botan::fe_pow22523 ( FE_25519 & x, const FE_25519 & y )

inline

Definition at line 208 of file ed25519_fe.h.

                                                        {
   x = FE_25519::pow_22523(y);
}

References Botan::FE_25519::pow_22523().

Referenced by ge_frombytes_negate_vartime().

fe_sq()

void Botan::fe_sq ( FE_25519 & x, const FE_25519 & z )

inline

Definition at line 192 of file ed25519_fe.h.

                                                  {
   x = FE_25519::sqr(z);
}

References Botan::FE_25519::sqr().

Referenced by ge_frombytes_negate_vartime(), Botan::FE_25519::invert(), and Botan::FE_25519::pow_22523().

fe_sq2()

void Botan::fe_sq2 ( FE_25519 & x, const FE_25519 & z )

inline

Definition at line 200 of file ed25519_fe.h.

                                                   {
   x = FE_25519::sqr2(z);
}

References Botan::FE_25519::sqr2().

fe_sq_iter()

void Botan::fe_sq_iter ( FE_25519 & x, const FE_25519 & z, size_t iter )

inline

Definition at line 196 of file ed25519_fe.h.

                                                                    {
   x = FE_25519::sqr_iter(z, iter);
}

References Botan::FE_25519::sqr_iter().

Referenced by Botan::FE_25519::invert(), and Botan::FE_25519::pow_22523().

fe_sub()

void Botan::fe_sub ( FE_25519 & x, const FE_25519 & a, const FE_25519 & b )

inline

Definition at line 180 of file ed25519_fe.h.

                                                                      {
   x = FE_25519::sub(a, b);
}

References Botan::FE_25519::sub().

Referenced by ge_frombytes_negate_vartime().

fe_tobytes()

void Botan::fe_tobytes ( uint8_t * b, const FE_25519 & x )

inline

Definition at line 152 of file ed25519_fe.h.

                                                      {
   x.to_bytes(b);
}

References Botan::FE_25519::to_bytes().

find_roots_gf2m_decomp()

secure_vector< gf2m > Botan::find_roots_gf2m_decomp	(	const polyn_gf2m &	polyn,
		size_t	code_length )

Find the roots of a polynomial over GF(2^m) using the method by Federenko et al.

Definition at line 255 of file gf2m_rootfind_dcmp.cpp.

                                                                                        {
   gf2m_decomp_rootfind_state state(polyn, code_length);
   return state.find_roots(polyn);
}

References find_roots_gf2m_decomp().

Referenced by find_roots_gf2m_decomp().

floor_log2()

template<typename T>
requires (std::is_unsigned<T>::value)

T Botan::floor_log2 ( T n )

inlineconstexpr

Definition at line 125 of file bit_ops.h.

{
   BOTAN_ARG_CHECK(n != 0, "log2(0) is not defined");
   return static_cast<T>(high_bit(n) - 1);
}

References BOTAN_ARG_CHECK, and high_bit().

Referenced by Botan::Classic_McEliece_GF::log_q_from_mod(), and Botan::Classic_McEliece_Parameters::tau().

fmt()

template<typename... T>

std::string Botan::fmt	(	std::string_view	format,
		const T &...	args )

Simple formatter utility.

Should be replaced with std::format once that's available on all our supported compilers.

'{}' markers in the format string are replaced by the arguments. Unlike std::format, there is no support for escaping or for any kind of conversion flags.

Definition at line 53 of file fmt.h.

                                                       {
   std::ostringstream oss;
   oss.imbue(std::locale::classic());
   fmt_detail::do_fmt(oss, format, args...);
   return oss.str();
}

References Botan::fmt_detail::do_fmt().

Referenced by Botan::AlternativeName::add_attribute(), Botan::GOST_3410_PublicKey::algo_name(), Botan::KEX_to_KEM_Adapter_PublicKey::algo_name(), Botan::Algorithm_Not_Found::Algorithm_Not_Found(), Botan::AlternativeName::AlternativeName(), argon2_generate_pwhash(), assert_unreachable(), Botan::TLS::auth_method_from_string(), Botan::BER_Bad_Tag::BER_Bad_Tag(), Botan::BER_Decoding_Error::BER_Decoding_Error(), Botan::CFB_Mode::CFB_Mode(), Botan::TPM2::cipher_tss2_to_botan(), Botan::CMAC::CMAC(), Botan::CommonCrypto_Error::CommonCrypto_Error(), Botan::Compression_Error::Compression_Error(), Botan::AES_256_CTR_XOF::copy_state(), Botan::KDF::create(), Botan::TPM2::PrivateKey::create(), Botan::TPM2::PublicKey::create(), Botan::Private_Key::create_decryption_op(), Botan::PKCS11::MechanismWrapper::create_ecdh_mechanism(), Botan::PKCS11::MechanismWrapper::create_ecdsa_mechanism(), Botan::Public_Key::create_encryption_op(), Botan::Private_Key::create_kem_decryption_op(), Botan::Public_Key::create_kem_encryption_op(), Botan::Private_Key::create_key_agreement_op(), create_private_key(), Botan::Private_Key::create_signature_op(), Botan::Public_Key::create_verification_op(), Botan::Public_Key::create_x509_verification_op(), Botan::PEM_Code::decode(), Botan::PEM_Code::decode_check_label(), Botan::ASN1_String::decode_from(), Botan::Cert_Extension::TNAuthList::Entry::decode_from(), Botan::Decoding_Error::Decoding_Error(), Botan::DL_Group::DL_Group(), Botan::DL_Group::DL_Group(), Botan::EC_Group::EC_Group(), Botan::PEM_Code::encode(), Botan::TPM2::Error::Error(), Botan::Exception::Exception(), Botan::Exception::Exception(), expand_message_xmd(), Botan::Stream_Decompression::finish(), Botan::PSS_Params::from_emsa_name(), Botan::DL_Group::from_name(), Botan::EC_Group::from_name(), Botan::EC_Group::from_OID(), Botan::Classic_McEliece_Parameter_Set::from_string(), Botan::OID::from_string(), generate_dsa_primes(), Botan::EC_PublicKey::get_int_field(), Botan::TPM2::get_raw_rc(), Botan::GOST_28147_89::GOST_28147_89(), Botan::GOST_28147_89_Params::GOST_28147_89_Params(), Botan::Sphincs_Parameters::hash_name(), hex_decode(), hkdf_expand_label(), Botan::HMAC_DRBG::HMAC_DRBG(), Botan::HSS_LMS_Params::HSS_LMS_Params(), Botan::HTTP::http_sync(), Botan::Hybrid_PublicKey::Hybrid_PublicKey(), Botan::Invalid_Algorithm_Name::Invalid_Algorithm_Name(), Botan::Invalid_Argument::Invalid_Argument(), Botan::Invalid_IV_Length::Invalid_IV_Length(), Botan::Invalid_Key_Length::Invalid_Key_Length(), Botan::Pipe::Invalid_Message_Number::Invalid_Message_Number(), Botan::Keccak_1600::Keccak_1600(), Botan::TLS::kex_method_from_string(), Botan::Key_Not_Set::Key_Not_Set(), Botan::Lion::Lion(), load_private_key(), load_public_key(), Botan::PEM_Code::matches(), Botan::BLAKE2b::name(), Botan::BLAKE2s::name(), Botan::Cascade_Cipher::name(), Botan::CBC_Mode::name(), Botan::CCM_Mode::name(), Botan::CFB_Mode::name(), Botan::ChaCha::name(), Botan::CMAC::name(), Botan::Comb4P::name(), Botan::CTR_BE::name(), Botan::DilithiumMessageHash::name(), Botan::EMSA_Raw::name(), Botan::EMSA_X931::name(), Botan::FPE_FE1::name(), Botan::GCM_Mode::name(), Botan::GeneralName::name(), Botan::GMAC::name(), Botan::HKDF::name(), Botan::HKDF_Expand::name(), Botan::HKDF_Extract::name(), Botan::HMAC::name(), Botan::HMAC_DRBG::name(), Botan::ISO_9796_DS2::name(), Botan::ISO_9796_DS3::name(), Botan::KDF1::name(), Botan::KDF1_18033::name(), Botan::KDF2::name(), Botan::Keccak_1600::name(), Botan::KMAC128::name(), Botan::KMAC256::name(), Botan::Lion::name(), Botan::OFB::name(), Botan::PBKDF2_Family::name(), Botan::PKCS5_PBKDF2::name(), Botan::PSSR::name(), Botan::PSSR_Raw::name(), Botan::RFC4880_S2K_Family::name(), Botan::SHA_3::name(), Botan::SHAKE_128::name(), Botan::SHAKE_256::name(), Botan::SipHash::name(), Botan::Skein_512::name(), Botan::SP800_108_Counter::name(), Botan::SP800_108_Feedback::name(), Botan::SP800_108_Pipeline::name(), Botan::SP800_56C_One_Step_Hash::name(), Botan::SP800_56C_One_Step_HMAC::name(), Botan::SP800_56C_Two_Step::name(), Botan::Streebog::name(), Botan::TLS_12_PRF::name(), Botan::Truncated_Hash::name(), Botan::Asymmetric_Key::object_identifier(), pbes2_decrypt(), Botan::PK_Decryptor_EME::PK_Decryptor_EME(), Botan::PK_Encryptor_EME::PK_Encryptor_EME(), Botan::PK_KEM_Decryptor::PK_KEM_Decryptor(), Botan::PK_KEM_Encryptor::PK_KEM_Encryptor(), Botan::PK_Key_Agreement::PK_Key_Agreement(), Botan::PK_Signer::PK_Signer(), Botan::PK_Verifier::PK_Verifier(), Botan::PK_Verifier::PK_Verifier(), Botan::PRNG_Unseeded::PRNG_Unseeded(), Botan::Provider_Not_Found::Provider_Not_Found(), Botan::Credentials_Manager::psk(), Botan::Dynamically_Loaded_Library::resolve_symbol(), Botan::RFC6979_Nonce_Generator::RFC6979_Nonce_Generator(), Botan::Sqlite3_Database::row_count(), Botan::RSA_PrivateKey::RSA_PrivateKey(), runtime_version_check(), Botan::SHA_3::SHA_3(), Botan::SHAKE_128::SHAKE_128(), Botan::SHAKE_256::SHAKE_256(), split_on(), srp6_client_agree(), srp6_generate_verifier(), Botan::XOF::start(), Botan::SRP6_Server_Session::step1(), Botan::SRP6_Server_Session::step2(), Botan::Streebog::Streebog(), Botan::System_Error::System_Error(), throw_invalid_argument(), throw_invalid_state(), Botan::Argon2::to_string(), Botan::ASN1_Time::to_string(), Botan::Bcrypt_PBKDF::to_string(), Botan::PBKDF2::to_string(), Botan::RFC4880_S2K::to_string(), Botan::Scrypt::to_string(), Botan::Unknown_PK_Field_Name::Unknown_PK_Field_Name(), Botan::TLS::Cipher_State::update_read_keys(), Botan::TLS::Cipher_State::update_write_keys(), Botan::UUID::UUID(), Botan::TLS::Certificate_Type_Base::validate_selection(), Botan::PK_Ops::Verification_with_Hash::Verification_with_Hash(), Botan::XMSS_Hash::XMSS_Hash(), Botan::XMSS_Parameters::xmss_id_from_string(), Botan::XMSS_WOTS_Parameters::xmss_wots_id_from_string(), and Botan::XTS_Mode::XTS_Mode().

format_char_for_display()

std::string Botan::format_char_for_display

(

char

c

)

Return a string containing 'c', quoted and possibly escaped

This is used when creating an error message nothing an invalid character in some codex (for example during hex decoding)

Currently this function escapes tab, newlines and carriage return as "\t", "\n", and "\r", and also escapes characters > 0x7F as "\xHH" where HH is the hex code.

Definition at line 98 of file charset.cpp.

                                          {
   std::ostringstream oss;
 
   oss << "'";
 
   if(c == '\t') {
      oss << "\\t";
   } else if(c == '\n') {
      oss << "\\n";
   } else if(c == '\r') {
      oss << "\\r";
   } else if(static_cast<unsigned char>(c) >= 128) {
      unsigned char z = static_cast<unsigned char>(c);
      oss << "\\x" << std::hex << std::uppercase << static_cast<int>(z);
   } else {
      oss << c;
   }
 
   oss << "'";
 
   return oss.str();
}

Referenced by hex_decode().

fors_public_key_from_signature()

BOTAN_TEST_API SphincsTreeNode Botan::fors_public_key_from_signature	(	const SphincsHashedMessage &	hashed_message,
		StrongSpan< const ForsSignature >	signature,
		const Sphincs_Address &	address,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hash )

FIPS 205, Algorithm 17: fors_pkFromSig.

Reconstructs the FORS public key from a given FORS signature and message. This is tailored for the use case in the SLH-DSA implementation and is not meant for general usability.

Definition at line 129 of file sp_fors.cpp.

                                                                               {
   const auto indices = fors_message_to_indices(hashed_message, params);
 
   auto fors_tree_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTree);
 
   auto fors_pk_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTreeRootsCompression);
 
   BufferSlicer s(signature);
   std::vector<uint8_t> roots_buffer(params.k() * params.n());
   BufferStuffer roots(roots_buffer);
 
   // For each of the k FORS subtrees: Reconstruct the subtree's root node by using the
   // leaf and the authentication path offered in the FORS signature.
   BOTAN_ASSERT_NOMSG(indices.size() == params.k());
   for(uint32_t i = 0; i < params.k(); ++i) {
      uint32_t idx_offset = i * (1 << params.a());
 
      // Compute the FORS leaf by using the secret leaf contained in the signature
      fors_tree_addr.set_tree_height(TreeLayerIndex(0)).set_tree_index(indices[i] + idx_offset);
      auto fors_leaf_secret = s.take<ForsLeafSecret>(params.n());
      auto auth_path = s.take<SphincsAuthenticationPath>(params.n() * params.a());
      auto leaf = hashes.T<SphincsTreeNode>(fors_tree_addr, fors_leaf_secret);
 
      // Reconstruct the subtree's root using the authentication path
      compute_root(roots.next<SphincsTreeNode>(params.n()),
                   params,
                   hashes,
                   leaf,
                   indices[i],
                   idx_offset,
                   auth_path,
                   params.a(),
                   fors_tree_addr);
   }
 
   BOTAN_ASSERT_NOMSG(roots.full());
 
   // Reconstruct the public key the signature creates with the hash of the concatenation of all roots
   // Only if the signature is valid, the pk is the correct FORS pk.
   return hashes.T<SphincsTreeNode>(fors_pk_addr, roots_buffer);
}

References Botan::Sphincs_Parameters::a(), Botan::Sphincs_Address::as_keypair_from(), BOTAN_ASSERT_NOMSG, compute_root(), Botan::BufferStuffer::full(), Botan::Sphincs_Parameters::k(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_type(), Botan::Sphincs_Hash_Functions::T(), and Botan::BufferSlicer::take().

fors_sign_and_pkgen()

BOTAN_TEST_API SphincsTreeNode Botan::fors_sign_and_pkgen	(	StrongSpan< ForsSignature >	sig_out,
		const SphincsHashedMessage &	hashed_message,
		const SphincsSecretSeed &	secret_seed,
		const Sphincs_Address &	address,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 16: fors_sign (with simultaneous FORS pk generation)

Implements a domain specific wrapper for the few-times signature scheme FORS (Forest of Random Subsets). It is meant to be used inside SLH-DSA and does not aim to be applicable for other use cases.

Definition at line 63 of file sp_fors.cpp.

                                                                    {
   BOTAN_ASSERT_NOMSG(sig_out.size() == params.fors_signature_bytes());
 
   const auto indices = fors_message_to_indices(hashed_message, params);
 
   auto fors_tree_addr = Sphincs_Address::as_keypair_from(address);
 
   auto fors_pk_addr = Sphincs_Address::as_keypair_from(address).set_type(Sphincs_Address::ForsTreeRootsCompression);
 
   std::vector<uint8_t> roots_buffer(params.k() * params.n());
   BufferStuffer roots(roots_buffer);
   BufferStuffer sig(sig_out);
 
   // Buffer to hold the FORS leafs during tree traversal
   // (Avoids a secure_vector allocation/deallocation in the hot path)
   ForsLeafSecret fors_leaf_secret(params.n());
 
   // For each of the k FORS subtrees: Compute the secret leaf, the authentication path
   // and the trees' root and append the signature respectively
   BOTAN_ASSERT_NOMSG(indices.size() == params.k());
   for(uint32_t i = 0; i < params.k(); ++i) {
      uint32_t idx_offset = i * (1 << params.a());
 
      // Compute the secret leaf given by the chunk of the message and append it to the signature
      fors_tree_addr.set_type(Sphincs_Address_Type::ForsKeyGeneration)
         .set_tree_height(TreeLayerIndex(0))
         .set_tree_index(indices[i] + idx_offset);
 
      hashes.PRF(sig.next<ForsLeafSecret>(params.n()), secret_seed, fors_tree_addr);
 
      // Compute the authentication path and root for this leaf node
      fors_tree_addr.set_type(Sphincs_Address_Type::ForsTree);
 
      GenerateLeafFunction fors_gen_leaf = [&](StrongSpan<SphincsTreeNode> out_root, TreeNodeIndex address_index) {
         fors_tree_addr.set_tree_index(address_index);
         fors_tree_addr.set_type(Sphincs_Address_Type::ForsKeyGeneration);
 
         hashes.PRF(fors_leaf_secret, secret_seed, fors_tree_addr);
 
         fors_tree_addr.set_type(Sphincs_Address_Type::ForsTree);
         hashes.T(out_root, fors_tree_addr, fors_leaf_secret);
      };
 
      treehash(roots.next<SphincsTreeNode>(params.n()),
               sig.next<SphincsAuthenticationPath>(params.a() * params.n()),
               params,
               hashes,
               indices[i],
               idx_offset,
               params.a(),
               fors_gen_leaf,
               fors_tree_addr);
   }
 
   BOTAN_ASSERT_NOMSG(sig.full());
   BOTAN_ASSERT_NOMSG(roots.full());
 
   // Compute the public key by the hash of the concatenation of all roots
   return hashes.T<SphincsTreeNode>(fors_pk_addr, roots_buffer);
}

References Botan::Sphincs_Parameters::a(), Botan::Sphincs_Address::as_keypair_from(), BOTAN_ASSERT_NOMSG, Botan::Sphincs_Parameters::fors_signature_bytes(), ForsKeyGeneration, ForsTree, Botan::BufferStuffer::full(), Botan::Sphincs_Parameters::k(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Hash_Functions::PRF(), Botan::Sphincs_Address::set_type(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), and treehash().

gcd()

BigInt Botan::gcd	(	const BigInt &	x,
		const BigInt &	y )

Compute the greatest common divisor

Parameters

x	a positive integer
y	a positive integer

Returns

gcd(x,y)

Definition at line 193 of file numthry.cpp.

                                             {
   if(a.is_zero()) {
      return abs(b);
   }
   if(b.is_zero()) {
      return abs(a);
   }
 
   const size_t sz = std::max(a.sig_words(), b.sig_words());
   auto u = BigInt::with_capacity(sz);
   auto v = BigInt::with_capacity(sz);
   u += a;
   v += b;
 
   CT::poison_all(u, v);
 
   u.set_sign(BigInt::Positive);
   v.set_sign(BigInt::Positive);
 
   // In the worst case we have two fully populated big ints. After right
   // shifting so many times, we'll have reached the result for sure.
   const size_t loop_cnt = u.bits() + v.bits();
 
   using WordMask = CT::Mask<word>;
 
   // This temporary is big enough to hold all intermediate results of the
   // algorithm. No reallocation will happen during the loop.
   // Note however, that `ct_cond_assign()` will invalidate the 'sig_words'
   // cache, which _does not_ shrink the capacity of the underlying buffer.
   auto tmp = BigInt::with_capacity(sz);
   size_t factors_of_two = 0;
   for(size_t i = 0; i != loop_cnt; ++i) {
      auto both_odd = WordMask::expand(u.is_odd()) & WordMask::expand(v.is_odd());
 
      // Subtract the smaller from the larger if both are odd
      auto u_gt_v = WordMask::expand(bigint_cmp(u._data(), u.size(), v._data(), v.size()) > 0);
      bigint_sub_abs(tmp.mutable_data(), u._data(), sz, v._data(), sz);
      u.ct_cond_assign((u_gt_v & both_odd).as_bool(), tmp);
      v.ct_cond_assign((~u_gt_v & both_odd).as_bool(), tmp);
 
      const auto u_is_even = WordMask::expand(u.is_even());
      const auto v_is_even = WordMask::expand(v.is_even());
      BOTAN_DEBUG_ASSERT((u_is_even | v_is_even).as_bool());
 
      // When both are even, we're going to eliminate a factor of 2.
      // We have to reapply this factor to the final result.
      factors_of_two += (u_is_even & v_is_even).if_set_return(1);
 
      // remove one factor of 2, if u is even
      bigint_shr2(tmp.mutable_data(), u._data(), sz, 1);
      u.ct_cond_assign(u_is_even.as_bool(), tmp);
 
      // remove one factor of 2, if v is even
      bigint_shr2(tmp.mutable_data(), v._data(), sz, 1);
      v.ct_cond_assign(v_is_even.as_bool(), tmp);
   }
 
   // The GCD (without factors of two) is either in u or v, the other one is
   // zero. The non-zero variable _must_ be odd, because all factors of two were
   // removed in the loop iterations above.
   BOTAN_DEBUG_ASSERT(u.is_zero() || v.is_zero());
   BOTAN_DEBUG_ASSERT(u.is_odd() || v.is_odd());
 
   // make sure that the GCD (without factors of two) is in u
   u.ct_cond_assign(u.is_even() /* .is_zero() would not be constant time */, v);
 
   // re-apply the factors of two
   u.ct_shift_left(factors_of_two);
 
   CT::unpoison_all(u, v);
 
   return u;
}

References abs(), bigint_cmp(), bigint_shr2(), bigint_sub_abs(), BOTAN_DEBUG_ASSERT, Botan::BigInt::is_zero(), Botan::CT::poison_all(), Botan::BigInt::Positive, Botan::BigInt::sig_words(), Botan::CT::unpoison_all(), and Botan::BigInt::with_capacity().

Referenced by botan_mp_gcd(), compute_rsa_secret_exponent(), generate_rsa_prime(), lcm(), and random_prime().

ge_double_scalarmult_vartime() [1/2]

void Botan::ge_double_scalarmult_vartime	(	uint8_t	out[32],
		const uint8_t *	a,
		const ge_p3 *	A,
		const uint8_t *	b )

Definition at line 480 of file ge.cpp.

                                                                                                       {
   static const ge_precomp Bi[8] = {
      {
         {25967493, -14356035, 29566456, 3660896, -12694345, 4014787, 27544626, -11754271, -6079156, 2047605},
         {-12545711, 934262, -2722910, 3049990, -727428, 9406986, 12720692, 5043384, 19500929, -15469378},
         {-8738181, 4489570, 9688441, -14785194, 10184609, -12363380, 29287919, 11864899, -24514362, -4438546},
      },
      {
         {15636291, -9688557, 24204773, -7912398, 616977, -16685262, 27787600, -14772189, 28944400, -1550024},
         {16568933, 4717097, -11556148, -1102322, 15682896, -11807043, 16354577, -11775962, 7689662, 11199574},
         {30464156, -5976125, -11779434, -15670865, 23220365, 15915852, 7512774, 10017326, -17749093, -9920357},
      },
      {
         {10861363, 11473154, 27284546, 1981175, -30064349, 12577861, 32867885, 14515107, -15438304, 10819380},
         {4708026, 6336745, 20377586, 9066809, -11272109, 6594696, -25653668, 12483688, -12668491, 5581306},
         {19563160, 16186464, -29386857, 4097519, 10237984, -4348115, 28542350, 13850243, -23678021, -15815942},
      },
      {
         {5153746, 9909285, 1723747, -2777874, 30523605, 5516873, 19480852, 5230134, -23952439, -15175766},
         {-30269007, -3463509, 7665486, 10083793, 28475525, 1649722, 20654025, 16520125, 30598449, 7715701},
         {28881845, 14381568, 9657904, 3680757, -20181635, 7843316, -31400660, 1370708, 29794553, -1409300},
      },
      {
         {-22518993, -6692182, 14201702, -8745502, -23510406, 8844726, 18474211, -1361450, -13062696, 13821877},
         {-6455177, -7839871, 3374702, -4740862, -27098617, -10571707, 31655028, -7212327, 18853322, -14220951},
         {4566830, -12963868, -28974889, -12240689, -7602672, -2830569, -8514358, -10431137, 2207753, -3209784},
      },
      {
         {-25154831, -4185821, 29681144, 7868801, -6854661, -9423865, -12437364, -663000, -31111463, -16132436},
         {25576264, -2703214, 7349804, -11814844, 16472782, 9300885, 3844789, 15725684, 171356, 6466918},
         {23103977, 13316479, 9739013, -16149481, 817875, -15038942, 8965339, -14088058, -30714912, 16193877},
      },
      {
         {-33521811, 3180713, -2394130, 14003687, -16903474, -16270840, 17238398, 4729455, -18074513, 9256800},
         {-25182317, -4174131, 32336398, 5036987, -21236817, 11360617, 22616405, 9761698, -19827198, 630305},
         {-13720693, 2639453, -24237460, -7406481, 9494427, -5774029, -6554551, -15960994, -2449256, -14291300},
      },
      {
         {-3151181, -5046075, 9282714, 6866145, -31907062, -863023, -18940575, 15033784, 25105118, -7894876},
         {-24326370, 15950226, -31801215, -14592823, -11662737, -5090925, 1573892, -2625887, 2198790, -15804619},
         {-3099351, 10324967, -2241613, 7453183, -5446979, -2735503, -13812022, -16236442, -32461234, -12290683},
      },
   };
 
   int8_t aslide[256];
   int8_t bslide[256];
   ge_cached Ai[8]; /* A,3A,5A,7A,9A,11A,13A,15A */
   ge_p1p1 t;
   ge_p3 u;
   ge_p3 A2;
   ge_p2 r;
   int i;
 
   slide(aslide, a);
   slide(bslide, b);
 
   ge_p3_to_cached(&Ai[0], A);
   ge_p3_dbl(&t, A);
   ge_p1p1_to_p3(&A2, &t);
   ge_add(&t, &A2, &Ai[0]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[1], &u);
   ge_add(&t, &A2, &Ai[1]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[2], &u);
   ge_add(&t, &A2, &Ai[2]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[3], &u);
   ge_add(&t, &A2, &Ai[3]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[4], &u);
   ge_add(&t, &A2, &Ai[4]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[5], &u);
   ge_add(&t, &A2, &Ai[5]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[6], &u);
   ge_add(&t, &A2, &Ai[6]);
   ge_p1p1_to_p3(&u, &t);
   ge_p3_to_cached(&Ai[7], &u);
 
   ge_p2_0(&r);
 
   for(i = 255; i >= 0; --i) {
      if(aslide[i] || bslide[i]) {
         break;
      }
   }
 
   for(; i >= 0; --i) {
      ge_p2_dbl(&t, &r);
 
      if(aslide[i] > 0) {
         ge_p1p1_to_p3(&u, &t);
         ge_add(&t, &u, &Ai[aslide[i] >> 1]);
      } else if(aslide[i] < 0) {
         ge_p1p1_to_p3(&u, &t);
         ge_sub(&t, &u, &Ai[(-aslide[i]) >> 1]);
      }
 
      if(bslide[i] > 0) {
         ge_p1p1_to_p3(&u, &t);
         ge_madd(&t, &u, &Bi[bslide[i] >> 1]);
      } else if(bslide[i] < 0) {
         ge_p1p1_to_p3(&u, &t);
         ge_msub(&t, &u, &Bi[(-bslide[i]) >> 1]);
      }
 
      ge_p1p1_to_p2(&r, &t);
   }
 
   ge_tobytes(out, &r);
}

ge_double_scalarmult_vartime() [2/2]

void Botan::ge_double_scalarmult_vartime	(	uint8_t	out[32],
		const uint8_t	a[],
		const ge_p3 *	A,
		const uint8_t	b[] )

Referenced by Botan::Ed25519_PublicKey::check_key(), and ed25519_verify().

ge_frombytes_negate_vartime()

int Botan::ge_frombytes_negate_vartime	(	ge_p3 *	v,
		const uint8_t *	s )

Definition at line 425 of file ge.cpp.

                                                            {
   static const FE_25519 d = {
      -10913610, 13857413, -15372611, 6949391, 114729, -8787816, -6275908, -3247719, -18696448, -12055116};
   static const FE_25519 sqrtm1 = {
      -32595792, -7943725, 9377950, 3500415, 12389472, -272473, -25146209, -2005654, 326686, 11406482};
 
   FE_25519 u;
   FE_25519 v;
   FE_25519 v3;
   FE_25519 vxx;
   FE_25519 check;
 
   fe_frombytes(h->Y, s);
   fe_1(h->Z);
   fe_sq(u, h->Y);
   fe_mul(v, u, d);
   fe_sub(u, u, h->Z); /* u = y^2-1 */
   fe_add(v, v, h->Z); /* v = dy^2+1 */
 
   fe_sq(v3, v);
   fe_mul(v3, v3, v); /* v3 = v^3 */
   fe_sq(h->X, v3);
   fe_mul(h->X, h->X, v);
   fe_mul(h->X, h->X, u); /* x = uv^7 */
 
   fe_pow22523(h->X, h->X); /* x = (uv^7)^((q-5)/8) */
   fe_mul(h->X, h->X, v3);
   fe_mul(h->X, h->X, u); /* x = uv^3(uv^7)^((q-5)/8) */
 
   fe_sq(vxx, h->X);
   fe_mul(vxx, vxx, v);
   fe_sub(check, vxx, u); /* vx^2-u */
   if(fe_isnonzero(check)) {
      fe_add(check, vxx, u); /* vx^2+u */
      if(fe_isnonzero(check)) {
         return -1;
      }
      fe_mul(h->X, h->X, sqrtm1);
   }
 
   if(fe_isnegative(h->X) == (s[31] >> 7)) {
      fe_neg(h->X, h->X);
   }
 
   fe_mul(h->T, h->X, h->Y);
   return 0;
}

References fe_1(), fe_add(), fe_frombytes(), fe_isnegative(), fe_isnonzero(), fe_mul(), fe_neg(), fe_pow22523(), fe_sq(), fe_sub(), Botan::ge_p3::T, Botan::ge_p3::X, Botan::ge_p3::Y, and Botan::ge_p3::Z.

Referenced by Botan::Ed25519_PublicKey::check_key(), and ed25519_verify().

ge_scalarmult_base()

void Botan::ge_scalarmult_base	(	uint8_t	out[32],
		const uint8_t	in[32] )

Definition at line 2043 of file ge.cpp.

                                                              {
   int8_t e[64];
   int8_t carry;
   ge_p1p1 r;
   ge_p2 s;
   ge_p3 h;
   ge_precomp t;
   int i;
 
   for(i = 0; i < 32; ++i) {
      e[2 * i + 0] = (a[i] >> 0) & 15;
      e[2 * i + 1] = (a[i] >> 4) & 15;
   }
   /* each e[i] is between 0 and 15 */
   /* e[63] is between 0 and 7 */
 
   carry = 0;
   for(i = 0; i < 63; ++i) {
      e[i] += carry;
      carry = e[i] + 8;
      carry >>= 4;
      e[i] -= carry << 4;
   }
   e[63] += carry;
   /* each e[i] is between -8 and 8 */
 
   ge_p3_0(&h);
   for(i = 1; i < 64; i += 2) {
      select(&t, B_precomp[i / 2], e[i]);
      ge_madd(&r, &h, &t);
      ge_p1p1_to_p3(&h, &r);
   }
 
   ge_p3_dbl(&r, &h);
   ge_p1p1_to_p2(&s, &r);
   ge_p2_dbl(&r, &s);
   ge_p1p1_to_p2(&s, &r);
   ge_p2_dbl(&r, &s);
   ge_p1p1_to_p2(&s, &r);
   ge_p2_dbl(&r, &s);
   ge_p1p1_to_p3(&h, &r);
 
   for(i = 0; i < 64; i += 2) {
      select(&t, B_precomp[i / 2], e[i]);
      ge_madd(&r, &h, &t);
      ge_p1p1_to_p3(&h, &r);
   }
 
   ge_p3_tobytes(out, &h);
}

References carry().

Referenced by ed25519_gen_keypair(), and ed25519_sign().

generalize_to() [1/2]

template<typename GeneralVariantT, typename SpecialT>
requires (std::is_constructible_v<GeneralVariantT, std::decay_t<SpecialT>>)

GeneralVariantT Botan::generalize_to ( SpecialT && specific )

constexprnoexcept

Converts a given variant into another variant-ish whose type states are a super set of the given variant.

This is useful to convert restricted variant types into more general variants types.

Definition at line 316 of file stl_util.h.

{
   return std::forward<SpecialT>(specific);
}

Referenced by Botan::TLS::Channel_Impl_13::send_handshake_message(), and Botan::TLS::Channel_Impl_13::send_handshake_message().

generalize_to() [2/2]

template<typename GeneralVariantT, typename... SpecialTs>

GeneralVariantT Botan::generalize_to ( std::variant< SpecialTs... > specific )

constexprnoexcept

Converts a given variant into another variant-ish whose type states are a super set of the given variant.

This is useful to convert restricted variant types into more general variants types.

Definition at line 330 of file stl_util.h.

                                                                                    {
   static_assert(
      is_generalizable_to<GeneralVariantT>(specific),
      "Desired general type must be implicitly constructible by all types of the specialized std::variant<>");
   return std::visit([](auto s) -> GeneralVariantT { return s; }, std::move(specific));
}

References is_generalizable_to().

generate_bcrypt()

std::string Botan::generate_bcrypt	(	std::string_view	password,
		RandomNumberGenerator &	rng,
		uint16_t	work_factor = 12,
		char	version = 'a' )

Create a password hash using Bcrypt

Takes the password to hash, a rng, and a work_factor. The resulting password hash is returned as a string.

Higher work factors increase the amount of time the algorithm runs, increasing the cost of cracking attempts. The increase is exponential, so a work factor of 12 takes roughly twice as long as work factor 11. The default work factor was set to 10 up until the 2.8.0 release.

It is recommended to set the work factor as high as your system can tolerate (from a performance and latency perspective) since higher work factors greatly improve the security against GPU-based attacks. For example, for protecting high value administrator passwords, consider using work factor 15 or 16; at these work factors each bcrypt computation takes several seconds. Since admin logins will be relatively uncommon, it might be acceptable for each login attempt to take some time. As of 2018, a good password cracking rig (with 8 NVIDIA 1080 cards) can attempt about 1 billion bcrypt computations per month for work factor 13. For work factor 12, it can do twice as many. For work factor 15, it can do only one quarter as many attempts.

Due to bugs affecting various implementations of bcrypt, several different variants of the algorithm are defined. As of 2.7.0 Botan supports generating (or checking) the 2a, 2b, and 2y variants. Since Botan has never been affected by any of the bugs which necessitated these version upgrades, all three versions are identical beyond the version identifier. Which variant to use is controlled by the version argument.

The bcrypt work_factor must be at least 4 (though at this work factor bcrypt is not very secure). The bcrypt format allows up to 31, but Botan currently rejects all work factors greater than 18 since even that work factor requires roughly 15 seconds of computation on a fast machine.

Warning

The password is truncated at at most 72 characters; characters after that do not have any effect on the resulting hash. To support longer passwords, consider pre-hashing the password, for example by using the hex encoding of SHA-256 of the password as the input to bcrypt.

Parameters

password	the password.
rng	a random number generator
work_factor	how much work to do to slow down guessing attacks
version	which version to emit (may be 'a', 'b', or 'y' all of which have identical behavior in this implementation).

See also

https://www.usenix.org/events/usenix99/provos/provos_html/

TODO(Botan4) Convert work_factor to a size_t

Definition at line 145 of file bcrypt.cpp.

                                                                                                               {
   /*
   2a, 2b and 2y are identical for our purposes because our implementation of 2a
   never had the truncation or signed char bugs in the first place.
   */
 
   if(version != 'a' && version != 'b' && version != 'y') {
      throw Invalid_Argument("Unknown bcrypt version '" + std::string(1, version) + "'");
   }
 
   std::vector<uint8_t> salt;
   rng.random_vec(salt, 16);
   return make_bcrypt(pass, salt, work_factor, version);
}

References Botan::RandomNumberGenerator::random_vec().

Referenced by botan_bcrypt_generate().

generate_dsa_primes() [1/2]

std::vector< uint8_t > Botan::generate_dsa_primes	(	RandomNumberGenerator &	rng,
		BigInt &	p_out,
		BigInt &	q_out,
		size_t	pbits,
		size_t	qbits )

Generate DSA parameters using the FIPS 186 kosherizer

Parameters

rng	a random number generator
p_out	where the prime p will be stored
q_out	where the prime q will be stored
pbits	how long p will be in bits
qbits	how long q will be in bits

Returns

random seed used to generate this parameter set

Definition at line 136 of file dsa_gen.cpp.

                                                                                                                     {
   while(true) {
      std::vector<uint8_t> seed(qbits / 8);
      rng.randomize(seed.data(), seed.size());
 
      if(generate_dsa_primes(rng, p, q, pbits, qbits, seed)) {
         return seed;
      }
   }
}

References generate_dsa_primes(), and Botan::RandomNumberGenerator::randomize().

generate_dsa_primes() [2/2]

bool BOTAN_TEST_API Botan::generate_dsa_primes	(	RandomNumberGenerator &	rng,
		BigInt &	p_out,
		BigInt &	q_out,
		size_t	pbits,
		size_t	qbits,
		const std::vector< uint8_t > &	seed,
		size_t	offset = 0 )

Generate DSA parameters using the FIPS 186 kosherizer

Parameters

rng	a random number generator
p_out	where the prime p will be stored
q_out	where the prime q will be stored
pbits	how long p will be in bits
qbits	how long q will be in bits
seed	the seed used to generate the parameters
offset	optional offset from seed to start searching at

Returns

true if seed generated a valid DSA parameter set, otherwise false. p_out and q_out are only valid if true was returned.

Definition at line 54 of file dsa_gen.cpp.

                                        {
   if(!fips186_3_valid_size(pbits, qbits)) {
      throw Invalid_Argument(fmt("FIPS 186-3 does not allow DSA domain parameters of {}/{} bits long", pbits, qbits));
   }
 
   if(seed_c.size() * 8 < qbits) {
      throw Invalid_Argument(
         fmt("Generating a DSA parameter set with a {} bit long q requires a seed at least as many bits long", qbits));
   }
 
   const std::string hash_name = hash_function_for(qbits);
   auto hash = HashFunction::create_or_throw(hash_name);
 
   const size_t HASH_SIZE = hash->output_length();
 
   class Seed final {
      public:
         explicit Seed(const std::vector<uint8_t>& s) : m_seed(s) {}
 
         const std::vector<uint8_t>& value() const { return m_seed; }
 
         Seed& operator++() {
            for(size_t j = m_seed.size(); j > 0; --j) {
               if(++m_seed[j - 1]) {
                  break;
               }
            }
            return (*this);
         }
 
      private:
         std::vector<uint8_t> m_seed;
   };
 
   Seed seed(seed_c);
 
   q._assign_from_bytes(hash->process(seed.value()));
   q.set_bit(qbits - 1);
   q.set_bit(0);
 
   if(!is_prime(q, rng, 128, true)) {
      return false;
   }
 
   const size_t n = (pbits - 1) / (HASH_SIZE * 8), b = (pbits - 1) % (HASH_SIZE * 8);
 
   BigInt X;
   std::vector<uint8_t> V(HASH_SIZE * (n + 1));
 
   const BigInt q2 = 2 * q;
 
   for(size_t j = 0; j != 4 * pbits; ++j) {
      for(size_t k = 0; k <= n; ++k) {
         ++seed;
         hash->update(seed.value());
         hash->final(&V[HASH_SIZE * (n - k)]);
      }
 
      if(j >= offset) {
         X._assign_from_bytes(std::span{V}.subspan(HASH_SIZE - 1 - b / 8));
         X.set_bit(pbits - 1);
 
         // Variable time division is OK here since DSA primes are public anyway
         p = X - ((X % q2) - 1);
 
         if(p.bits() == pbits && is_prime(p, rng, 128, true)) {
            return true;
         }
      }
   }
   return false;
}

References Botan::BigInt::_assign_from_bytes(), Botan::BigInt::bits(), Botan::HashFunction::create_or_throw(), fmt(), is_prime(), operator++(), Seed, and Botan::BigInt::set_bit().

Referenced by Botan::DL_Group::DL_Group(), Botan::DL_Group::DL_Group(), and generate_dsa_primes().

generate_mceliece_key()

McEliece_PrivateKey Botan::generate_mceliece_key	(	RandomNumberGenerator &	rng,
		size_t	ext_deg,
		size_t	code_length,
		size_t	t )

Definition at line 184 of file code_based_key_gen.cpp.

                                                                                                                    {
   const size_t codimension = t * ext_deg;
 
   if(code_length <= codimension) {
      throw Invalid_Argument("invalid McEliece parameters");
   }
 
   auto sp_field = std::make_shared<GF2m_Field>(ext_deg);
 
   //pick the support.........
   std::vector<gf2m> L(code_length);
 
   for(size_t i = 0; i != L.size(); i++) {
      L[i] = static_cast<gf2m>(i);
   }
   randomize_support(L, rng);
   polyn_gf2m g(sp_field);  // create as zero
 
   bool success = false;
   std::unique_ptr<binary_matrix> R;
 
   do {
      // create a random irreducible polynomial
      g = polyn_gf2m(t, rng, sp_field);
 
      try {
         R = generate_R(L, &g, *sp_field, code_length, t);
         success = true;
      } catch(const Invalid_State&) {}
   } while(!success);
 
   std::vector<polyn_gf2m> sqrtmod = polyn_gf2m::sqrt_mod_init(g);
   std::vector<polyn_gf2m> F = syndrome_init(g, L, static_cast<int>(code_length));
 
   // Each F[i] is the (precomputed) syndrome of the error vector with
   // a single '1' in i-th position.
   // We do not store the F[i] as polynomials of degree t , but
   // as binary vectors of length ext_deg * t (this will
   // speed up the syndrome computation)
   //
   const size_t co32 = bit_size_to_32bit_size(codimension);
   std::vector<uint32_t> H(co32 * code_length);
   uint32_t* sk = H.data();
   for(size_t i = 0; i < code_length; ++i) {
      for(size_t l = 0; l < t; ++l) {
         const size_t k = (l * ext_deg) / 32;
         const size_t j = (l * ext_deg) % 32;
         sk[k] ^= static_cast<uint32_t>(F[i].get_coef(l)) << j;
         if(j + ext_deg > 32) {
            if(j > 0) {
               sk[k + 1] ^= F[i].get_coef(l) >> (32 - j);
            }
         }
      }
      sk += co32;
   }
 
   // We need the support L for decoding (decryption). In fact the
   // inverse is needed
 
   std::vector<gf2m> Linv(code_length);
   for(size_t i = 0; i != Linv.size(); ++i) {
      Linv[L[i]] = static_cast<gf2m>(i);
   }
   std::vector<uint8_t> pubmat(R->elem().size() * 4);
   for(size_t i = 0; i < R->elem().size(); i++) {
      store_le(R->elem()[i], &pubmat[i * 4]);
   }
 
   return McEliece_PrivateKey(g, H, sqrtmod, Linv, pubmat);
}

References bit_size_to_32bit_size(), Botan::polyn_gf2m::sqrt_mod_init(), store_le(), and syndrome_init().

Referenced by Botan::McEliece_PrivateKey::McEliece_PrivateKey().

generate_passhash9()

std::string Botan::generate_passhash9	(	std::string_view	password,
		RandomNumberGenerator &	rng,
		uint16_t	work_factor = 15,
		uint8_t	alg_id = 4 )

Create a password hash using PBKDF2

Functions much like generate_bcrypt(). The last parameter, alg_id, specifies which PRF to use. Currently defined values are:

• 0: HMAC(SHA-1)
• 1: HMAC(SHA-256)
• 2: CMAC(Blowfish)
• 3: HMAC(SHA-384)
• 4: HMAC(SHA-512)

The work_factor must be greater than zero and less than 512. This performs 10000 * work_factor PBKDF2 iterations, using 96 bits of salt taken from rng. Using work factor of 10 or more is recommended.

Parameters

password	the password
rng	a random number generator
work_factor	how much work to do to slow down guessing attacks
alg_id	specifies which PRF to use with PBKDF2 0 is HMAC(SHA-1) 1 is HMAC(SHA-256) 2 is CMAC(Blowfish) 3 is HMAC(SHA-384) 4 is HMAC(SHA-512) all other values are currently undefined

Definition at line 46 of file passhash9.cpp.

                                               {
   BOTAN_ARG_CHECK(work_factor > 0 && work_factor < 512, "Invalid Passhash9 work factor");
 
   auto prf = get_pbkdf_prf(alg_id);
 
   if(!prf) {
      throw Invalid_Argument("Passhash9: Algorithm id " + std::to_string(alg_id) + " is not defined");
   }
 
   PKCS5_PBKDF2 kdf(std::move(prf));
 
   secure_vector<uint8_t> salt(SALT_BYTES);
   rng.randomize(salt.data(), salt.size());
 
   const size_t kdf_iterations = WORK_FACTOR_SCALE * work_factor;
 
   secure_vector<uint8_t> blob;
   blob.push_back(alg_id);
   blob.push_back(get_byte<0>(work_factor));
   blob.push_back(get_byte<1>(work_factor));
   blob += salt;
   blob += kdf.derive_key(PASSHASH9_PBKDF_OUTPUT_LEN, pass, salt.data(), salt.size(), kdf_iterations).bits_of();
 
   return MAGIC_PREFIX + base64_encode(blob);
}

References base64_encode(), Botan::OctetString::bits_of(), BOTAN_ARG_CHECK, Botan::PBKDF::derive_key(), get_byte(), and Botan::RandomNumberGenerator::randomize().

generate_rfc6979_nonce()

BigInt Botan::generate_rfc6979_nonce ( const BigInt & x, const BigInt & q, const BigInt & h, std::string_view hash )

inline

Parameters

x	the secret (EC)DSA key
q	the group order
h	the message hash already reduced mod q
hash	the hash function used to generate h

Definition at line 52 of file rfc6979.h.

                                                                                                             {
   RFC6979_Nonce_Generator gen(hash, q.bits(), x);
   return gen.nonce_for(q, h);
}

References Botan::BigInt::bits(), and Botan::RFC6979_Nonce_Generator::nonce_for().

generate_rsa_prime()

BigInt Botan::generate_rsa_prime	(	RandomNumberGenerator &	keygen_rng,
		RandomNumberGenerator &	prime_test_rng,
		size_t	bits,
		const BigInt &	coprime,
		size_t	prob = 128 )

Generate a prime suitable for RSA p/q

Parameters

keygen_rng	a random number generator
prime_test_rng	a random number generator
bits	how large the resulting prime should be in bits (must be >= 512)
coprime	a positive integer that (prime - 1) should be coprime to
prob	use test so false positive is bounded by 1/2**prob

Returns

random prime with the specified criteria

Definition at line 211 of file make_prm.cpp.

                                       {
   if(bits < 512) {
      throw Invalid_Argument("generate_rsa_prime bits too small");
   }
 
   /*
   * The restriction on coprime <= 64 bits is arbitrary but generally speaking
   * very large RSA public exponents are a bad idea both for performance and due
   * to attacks on small d.
   */
   if(coprime <= 1 || coprime.is_even() || coprime.bits() > 64) {
      throw Invalid_Argument("generate_rsa_prime coprime must be small odd positive integer");
   }
 
   const size_t MAX_ATTEMPTS = 32 * 1024;
 
   const size_t mr_trials = miller_rabin_test_iterations(bits, prob, true);
 
   while(true) {
      BigInt p(keygen_rng, bits);
 
      /*
      Force high two bits so multiplication always results in expected n bit integer
 
      Force the two low bits, and step by 4, so the generated prime is always == 3 (mod 4).
      This way when we perform the inversion modulo phi(n) it is always of the form 2*o
      with o odd, which allows a fastpath and avoids leaking any information about the
      structure of the prime.
      */
      p.set_bit(bits - 1);
      p.set_bit(bits - 2);
      p.set_bit(1);
      p.set_bit(0);
 
      const word step = 4;
 
      Prime_Sieve sieve(p, bits, step, false);
 
      for(size_t attempt = 0; attempt <= MAX_ATTEMPTS; ++attempt) {
         p += step;
 
         if(!sieve.next()) {
            continue;
         }
 
         BOTAN_DEBUG_ASSERT(no_small_multiples(p, sieve));
 
         auto mod_p = Barrett_Reduction::for_secret_modulus(p);
 
         /*
         * Do a single primality test first before checking coprimality, since
         * currently a single Miller-Rabin test is faster than computing gcd,
         * and this eliminates almost all wasted gcd computations.
         */
         if(is_miller_rabin_probable_prime(p, mod_p, prime_test_rng, 1) == false) {
            continue;
         }
 
         /*
         * Check if p - 1 and coprime are relatively prime.
         */
         if(gcd(p - 1, coprime) > 1) {
            continue;
         }
 
         if(p.bits() > bits) {
            break;
         }
 
         if(is_miller_rabin_probable_prime(p, mod_p, prime_test_rng, mr_trials) == true) {
            return p;
         }
      }
   }
}

References Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, Botan::Barrett_Reduction::for_secret_modulus(), gcd(), Botan::BigInt::is_even(), is_miller_rabin_probable_prime(), miller_rabin_test_iterations(), and Botan::BigInt::set_bit().

Referenced by Botan::RSA_PrivateKey::RSA_PrivateKey().

get_aead()

AEAD_Mode * Botan::get_aead ( std::string_view name, Cipher_Dir direction )

inline

Get an AEAD mode by name (eg "AES-128/GCM" or "Serpent/EAX")

Parameters

name	AEAD name
direction	Cipher_Dir::Encryption or Cipher_Dir::Decryption

Definition at line 140 of file aead.h.

                                                                                                              {
   return AEAD_Mode::create(name, direction, "").release();
}

References Botan::AEAD_Mode::create(), and get_aead().

Referenced by get_aead().

get_byte()

template<size_t B, typename T>
requires (B < sizeof(T))

uint8_t Botan::get_byte ( T input )

inlineconstexpr

Byte extraction

Parameters

input

the value to extract from

Returns

byte byte number B of input

Definition at line 79 of file loadstor.h.

{
   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   return static_cast<uint8_t>((input >> shift) & 0xFF);
}

Referenced by Botan::TLS::TLS_CBC_HMAC_AEAD_Mode::assoc_data_with_len(), Botan::polyn_gf2m::encode(), Botan::detail::fallback_store_any(), Botan::TLS::Connection_Cipher_State::format_ad(), generate_passhash9(), hex_encode(), Botan::TLS::Channel_Impl_12::key_material_export(), Botan::McEliece_PrivateKey::private_key_bits(), Botan::TLS::Application_Layer_Protocol_Notification::serialize(), Botan::TLS::Certificate_Verify::serialize(), Botan::TLS::Cookie::serialize(), Botan::TLS::EarlyDataIndication::serialize(), Botan::TLS::Extensions::serialize(), Botan::TLS::PSK::serialize(), Botan::TLS::Record_Size_Limit::serialize(), Botan::TLS::Server_Hello::serialize(), Botan::TLS::Server_Name_Indicator::serialize(), Botan::TLS::SRTP_Protection_Profiles::serialize(), Botan::TLS::Supported_Groups::serialize(), Botan::TLS::Server_Key_Exchange::Server_Key_Exchange(), Botan::CCM_Mode::set_associated_data_n(), Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n(), sm2_compute_za(), and Botan::RTSS_Share::split().

get_byte_var()

template<typename T>

uint8_t Botan::get_byte_var ( size_t byte_num, T input )

inlineconstexpr

Byte extraction

Parameters

byte_num	which byte to extract, 0 == highest byte
input	the value to extract from

Returns

byte byte_num of input

Definition at line 69 of file loadstor.h.

                                                                {
   return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
}

Referenced by Botan::TLS::append_tls_length_value(), Botan::BigInt::binary_encode(), Botan::BigInt::byte_at(), copy_out_be(), copy_out_le(), Botan::CCM_Mode::encode_length(), Botan::TLS::Certificate_12::serialize(), and Botan::TLS::Certificate_Status::serialize().

get_cipher() [1/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec, Cipher_Dir direction )

inline

Factory method for general symmetric cipher filters. No key will be set in the filter.

Parameters

algo_spec	the name of the desired cipher
direction	determines whether the filter will be an encrypting or decrypting filter

Returns

pointer to the encryption or decryption filter

Definition at line 201 of file filters.h.

                                                                                {
   auto c = Cipher_Mode::create_or_throw(algo_spec, direction);
   return new Cipher_Mode_Filter(c.release());
}

References Botan::Cipher_Mode::create_or_throw().

Referenced by get_cipher(), and get_cipher().

get_cipher() [2/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec, const SymmetricKey & key, Cipher_Dir direction )

inline

Factory method for general symmetric cipher filters.

Parameters

algo_spec	the name of the desired cipher
key	the key to be used for encryption/decryption performed by the filter
direction	determines whether the filter will be an encrypting or decrypting filter

Returns

pointer to the encryption or decryption filter

Definition at line 215 of file filters.h.

                                                                                                         {
   Keyed_Filter* cipher = get_cipher(algo_spec, direction);
   cipher->set_key(key);
   return cipher;
}

References get_cipher(), and Botan::Keyed_Filter::set_key().

get_cipher() [3/3]

Keyed_Filter * Botan::get_cipher ( std::string_view algo_spec, const SymmetricKey & key, const InitializationVector & iv, Cipher_Dir direction )

inline

Factory method for general symmetric cipher filters.

Parameters

algo_spec	the name of the desired cipher
key	the key to be used for encryption/decryption performed by the filter
iv	the initialization vector to be used
direction	determines whether the filter will be an encrypting or decrypting filter

Returns

pointer to newly allocated encryption or decryption filter

Definition at line 231 of file filters.h.

                                                      {
   Keyed_Filter* cipher = get_cipher(algo_spec, key, direction);
   if(iv.length()) {
      cipher->set_iv(iv);
   }
   return cipher;
}

References get_cipher(), Botan::OctetString::length(), and Botan::Keyed_Filter::set_iv().

get_cipher_mode()

Cipher_Mode * Botan::get_cipher_mode ( std::string_view algo_spec, Cipher_Dir direction, std::string_view provider = "" )

inline

Get a cipher mode by name (eg "AES-128/CBC" or "Serpent/XTS")

Parameters

algo_spec	cipher name
direction	Cipher_Dir::Encryption or Cipher_Dir::Decryption
provider	provider implementation to choose

Definition at line 284 of file cipher_mode.h.

                                                                                                                  {
   return Cipher_Mode::create(algo_spec, direction, provider).release();
}

References Botan::Cipher_Mode::create(), and get_cipher_mode().

Referenced by get_cipher_mode().

get_files_recursive()

BOTAN_TEST_API std::vector< std::string > Botan::get_files_recursive

(

std::string_view

dir

)

Definition at line 123 of file filesystem.cpp.

                                                             {
   std::vector<std::string> files;
 
#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
   files = impl_readdir(dir);
#elif defined(BOTAN_TARGET_OS_HAS_WIN32)
   files = impl_win32(dir);
#else
   BOTAN_UNUSED(dir);
   throw No_Filesystem_Access();
#endif
 
   std::sort(files.begin(), files.end());
 
   return files;
}

References BOTAN_UNUSED.

get_kdf()

KDF * Botan::get_kdf ( std::string_view algo_spec )

inline

Factory method for KDF (key derivation function)

Parameters

algo_spec

the name of the KDF to create

Returns

pointer to newly allocated object of that type

Prefer KDF::create

Definition at line 276 of file kdf.h.

                                              {
   if(algo_spec == "Raw") {
      return nullptr;
   }
 
   return KDF::create_or_throw(algo_spec).release();
}

References Botan::KDF::create_or_throw(), and get_kdf().

Referenced by get_kdf().

get_pbkdf()

PBKDF * Botan::get_pbkdf ( std::string_view algo_spec, std::string_view provider = "" )

inline

Password based key derivation function factory method

Parameters

algo_spec	the name of the desired PBKDF algorithm
provider	the provider to use

Returns

pointer to newly allocated object of that type

Definition at line 244 of file pbkdf.h.

                                                                                {
   return PBKDF::create_or_throw(algo_spec, provider).release();
}

References Botan::PBKDF::create_or_throw(), and get_pbkdf().

Referenced by get_pbkdf().

get_s2k()

PBKDF * Botan::get_s2k ( std::string_view algo_spec )

inline

Definition at line 248 of file pbkdf.h.

                                                                                                          {
   return PBKDF::create_or_throw(algo_spec).release();
}

References Botan::PBKDF::create_or_throw(), and get_s2k().

Referenced by get_s2k().

get_uint32()

template<WordType W>

uint32_t Botan::get_uint32 ( const W xw[], size_t i )

constexpr

Definition at line 33 of file pcurves_solinas.h.

                                                      {
   static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
 
   if constexpr(WordInfo<W>::bits == 32) {
      return xw[i];
   } else {
      return static_cast<uint32_t>(xw[i / 2] >> ((i % 2) * 32));
   }
}

gf2p8affine()

template<uint64_t A, uint8_t B>

BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8affine

(

const SIMD_8x32 &

x

)

Definition at line 52 of file simd_avx2_gfni.h.

                                                                                    {
   return SIMD_8x32(_mm256_gf2p8affine_epi64_epi8(x.raw(), _mm256_set1_epi64x(A), B));
}

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

gf2p8affineinv()

template<uint64_t A, uint8_t B>

BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8affineinv

(

const SIMD_8x32 &

x

)

Definition at line 57 of file simd_avx2_gfni.h.

                                                                                       {
   return SIMD_8x32(_mm256_gf2p8affineinv_epi64_epi8(x.raw(), _mm256_set1_epi64x(A), B));
}

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

gf2p8mul()

BOTAN_FORCE_INLINE BOTAN_FN_ISA_AVX2_GFNI SIMD_8x32 Botan::gf2p8mul	(	const SIMD_8x32 &	a,
		const SIMD_8x32 &	b )

Definition at line 61 of file simd_avx2_gfni.h.

                                                                                                     {
   return SIMD_8x32(_mm256_gf2p8mul_epi8(a.raw(), b.raw()));
}

References BOTAN_FORCE_INLINE, and Botan::SIMD_8x32::raw().

gfni_matrix()

uint64_t Botan::gfni_matrix ( std::string_view s )

consteval

Definition at line 19 of file simd_avx2_gfni.h.

                                                 {
   uint64_t matrix = 0;
   size_t bit_cnt = 0;
   uint8_t row = 0;
 
   for(char c : s) {
      if(c == ' ' || c == '\n') {
         continue;
      }
      if(c != '0' && c != '1') {
         throw std::runtime_error("gfni_matrix: invalid bit value");
      }
 
      if(c == '1') {
         row |= 0x80 >> (7 - bit_cnt % 8);
      }
      bit_cnt++;
 
      if(bit_cnt % 8 == 0) {
         matrix <<= 8;
         matrix |= row;
         row = 0;
      }
   }
 
   if(bit_cnt != 64) {
      throw std::runtime_error("gfni_matrix: invalid bit count");
   }
 
   return matrix;
}

gray_to_lex()

gf2m Botan::gray_to_lex ( gf2m gray )

inline

Definition at line 30 of file code_based_util.h.

                                   {
   gf2m result = gray ^ (gray >> 8);
   result ^= (result >> 4);
   result ^= (result >> 2);
   result ^= (result >> 1);
   return result;
}

has_filesystem_impl()

BOTAN_TEST_API bool Botan::has_filesystem_impl

(

)

Definition at line 113 of file filesystem.cpp.

                           {
#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
   return true;
#elif defined(BOTAN_TARGET_OS_HAS_WIN32)
   return true;
#else
   return false;
#endif
}

hex_decode() [1/6]

std::vector< uint8_t > Botan::hex_decode	(	const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

input	some hex input
input_length	the length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded hex output

Definition at line 149 of file hex.cpp.

                                                                                       {
   std::vector<uint8_t> bin(1 + input_length / 2);
 
   size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
 
   bin.resize(written);
   return bin;
}

References hex_decode().

hex_decode() [2/6]

size_t Botan::hex_decode	(	std::span< uint8_t >	output,
		std::string_view	input,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

output	a contiguous byte buffer of at least input_length/2 bytes
input	some hex input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 132 of file hex.cpp.

                                                                                 {
   return hex_decode(output.data(), input.data(), input.length(), ignore_ws);
}

References hex_decode().

hex_decode() [3/6]

std::vector< uint8_t > Botan::hex_decode	(	std::string_view	input,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

input	some hex input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded hex output

Definition at line 158 of file hex.cpp.

                                                                    {
   return hex_decode(input.data(), input.size(), ignore_ws);
}

References hex_decode().

hex_decode() [4/6]

size_t Botan::hex_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

output	an array of at least input_length/2 bytes
input	some hex input
input_length	length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 117 of file hex.cpp.

                                                                                             {
   size_t consumed = 0;
   size_t written = hex_decode(output, input, input_length, consumed, ignore_ws);
 
   if(consumed != input_length) {
      throw Invalid_Argument("hex_decode: input did not have full bytes");
   }
 
   return written;
}

References hex_decode().

hex_decode() [5/6]

size_t Botan::hex_decode	(	uint8_t	output[],
		const char	input[],
		size_t	input_length,
		size_t &	input_consumed,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

output	an array of at least input_length/2 bytes
input	some hex input
input_length	length of input in bytes
input_consumed	is an output parameter which says how many bytes of input were actually consumed. If less than input_length, then the range input[consumed:length] should be passed in later along with more input.
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 73 of file hex.cpp.

                                                                                                                     {
   uint8_t* out_ptr = output;
   bool top_nibble = true;
 
   clear_mem(output, input_length / 2);
 
   for(size_t i = 0; i != input_length; ++i) {
      const uint8_t bin = hex_char_to_bin(input[i]);
 
      if(bin >= 0x10) {
         if(bin == 0x80 && ignore_ws) {
            continue;
         }
 
         throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i])));
      }
 
      if(top_nibble) {
         *out_ptr |= bin << 4;
      } else {
         *out_ptr |= bin;
      }
 
      top_nibble = !top_nibble;
      if(top_nibble) {
         ++out_ptr;
      }
   }
 
   input_consumed = input_length;
   size_t written = (out_ptr - output);
 
   /*
   * We only got half of a uint8_t at the end; zap the half-written
   * output and mark it as unread
   */
   if(!top_nibble) {
      *out_ptr = 0;
      input_consumed -= 1;
   }
 
   return written;
}

References clear_mem(), fmt(), format_char_for_display(), and out_ptr().

Referenced by botan_hex_decode(), Botan::Hex_Decoder::end_msg(), Botan::TLS::Session_Manager_SQL::find_some(), hex_decode(), hex_decode(), hex_decode(), hex_decode(), hex_decode(), hex_decode_locked(), Botan::OctetString::OctetString(), Botan::UUID::UUID(), and Botan::Hex_Decoder::write().

hex_decode() [6/6]

size_t Botan::hex_decode	(	uint8_t	output[],
		std::string_view	input,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

output	an array of at least input_length/2 bytes
input	some hex input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

number of bytes written to output

Definition at line 128 of file hex.cpp.

                                                                          {
   return hex_decode(output, input.data(), input.length(), ignore_ws);
}

References hex_decode().

hex_decode_locked() [1/2]

secure_vector< uint8_t > Botan::hex_decode_locked	(	const char	input[],
		size_t	input_length,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

input	some hex input
input_length	the length of input in bytes
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded hex output

Definition at line 136 of file hex.cpp.

                                                                                                  {
   secure_vector<uint8_t> bin(1 + input_length / 2);
 
   size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
 
   bin.resize(written);
   return bin;
}

References hex_decode().

Referenced by Botan::BigInt::decode(), hex_decode_locked(), and Botan::RTSS_Share::RTSS_Share().

hex_decode_locked() [2/2]

secure_vector< uint8_t > Botan::hex_decode_locked	(	std::string_view	input,
		bool	ignore_ws = true )

Perform hex decoding

Parameters

input	some hex input
ignore_ws	ignore whitespace on input; if false, throw an exception if whitespace is encountered

Returns

decoded hex output

Definition at line 145 of file hex.cpp.

                                                                               {
   return hex_decode_locked(input.data(), input.size(), ignore_ws);
}

References hex_decode_locked().

hex_encode() [1/3]

void Botan::hex_encode	(	char	output[],
		const uint8_t	input[],
		size_t	input_length,
		bool	uppercase = true )

Perform hex encoding

Parameters

output	an array of at least input_length*2 bytes
input	is some binary data
input_length	length of input in bytes
uppercase	should output be upper or lower case?

Definition at line 35 of file hex.cpp.

                                                                                           {
   for(size_t i = 0; i != input_length; ++i) {
      const uint16_t h = hex_encode_2nibble(input[i], uppercase);
      output[2 * i] = get_byte<0>(h);
      output[2 * i + 1] = get_byte<1>(h);
   }
}

References get_byte().

Referenced by botan_hex_encode(), create_hex_fingerprint(), hex_encode(), hex_encode(), Botan::TLS::Session_Manager_SQL::remove(), Botan::TLS::Session_Manager_SQL::retrieve_one(), Botan::TLS::Session_Manager_SQL::store(), Botan::BigInt::to_hex_string(), Botan::OctetString::to_string(), Botan::RTSS_Share::to_string(), Botan::UUID::to_string(), Botan::X509_Certificate::to_string(), Botan::HTTP::url_encode(), and Botan::UUID::UUID().

hex_encode() [2/3]

std::string Botan::hex_encode	(	const uint8_t	input[],
		size_t	input_length,
		bool	uppercase = true )

Perform hex encoding

Parameters

input	some input
input_length	length of input in bytes
uppercase	should output be upper or lower case?

Returns

hexadecimal representation of input

Definition at line 43 of file hex.cpp.

                                                                                 {
   std::string output(2 * input_length, 0);
 
   if(input_length) {
      hex_encode(&output.front(), input, input_length, uppercase);
   }
 
   return output;
}

References hex_encode().

hex_encode() [3/3]

std::string Botan::hex_encode ( std::span< const uint8_t > input, bool uppercase = true )

inline

Perform hex encoding

Parameters

input	some input
uppercase	should output be upper or lower case?

Returns

hexadecimal representation of input

Definition at line 43 of file hex.h.

                                                                                 {
   return hex_encode(input.data(), input.size(), uppercase);
}

References hex_encode().

hex_to_words()

template<WordType W, size_t N>

auto Botan::hex_to_words ( const char(&) s[N] )

constexpr

Definition at line 824 of file mp_core.h.

                                                {
   // Char count includes null terminator which we ignore
   const constexpr size_t C = N - 1;
 
   // Number of nibbles that a word can hold
   const constexpr size_t NPW = (WordInfo<W>::bits / 4);
 
   // Round up to the next number of words that will fit the input
   const constexpr size_t S = (C + NPW - 1) / NPW;
 
   auto hex2int = [](char c) -> int8_t {
      if(c >= '0' && c <= '9') {
         return static_cast<int8_t>(c - '0');
      } else if(c >= 'a' && c <= 'f') {
         return static_cast<int8_t>(c - 'a' + 10);
      } else if(c >= 'A' && c <= 'F') {
         return static_cast<int8_t>(c - 'A' + 10);
      } else {
         return -1;
      }
   };
 
   std::array<W, S> r = {0};
 
   for(size_t i = 0; i != C; ++i) {
      const int8_t c = hex2int(s[i]);
      if(c >= 0) {
         shift_left<4>(r);
         r[0] += c;
      }
   }
 
   return r;
}

References shift_left().

high_bit()

template<typename T>
requires (std::is_unsigned<T>::value)

size_t Botan::high_bit ( T n )

inlineconstexpr

Return the index of the highest set bit T is an unsigned integer type

Parameters

n	an integer value

Returns

index of the highest set bit in n

Definition at line 61 of file bit_ops.h.

{
   size_t hb = 0;
 
   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
      hb += z;
      n >>= z;
   }
 
   hb += n;
 
   return hb;
}

References ct_is_zero().

Referenced by Botan::OID::encode_into(), floor_log2(), random_prime(), and Botan::BigInt::top_bits_free().

hkdf_expand_label()

secure_vector< uint8_t > BOTAN_TEST_API Botan::hkdf_expand_label	(	std::string_view	hash_fn,
		std::span< const uint8_t >	secret,
		std::string_view	label,
		std::span< const uint8_t >	hash_val,
		size_t	length )

HKDF-Expand-Label from TLS 1.3/QUIC

Parameters

hash_fn	the hash to use
secret	the secret bits
label	the full label (no "TLS 1.3, " or "tls13 " prefix is applied)
hash_val	the previous hash value (used for chaining, may be empty)
length	the desired output length

Definition at line 118 of file hkdf.cpp.

                                                        {
   BOTAN_ARG_CHECK(length <= 0xFFFF, "HKDF-Expand-Label requested output too large");
   BOTAN_ARG_CHECK(label.size() <= 0xFF, "HKDF-Expand-Label label too long");
   BOTAN_ARG_CHECK(hash_val.size() <= 0xFF, "HKDF-Expand-Label hash too long");
 
   HKDF_Expand hkdf(MessageAuthenticationCode::create_or_throw(fmt("HMAC({})", hash_fn)));
 
   const auto prefix = concat<std::vector<uint8_t>>(store_be(static_cast<uint16_t>(length)),
                                                    store_be(static_cast<uint8_t>(label.size())),
                                                    std::span{cast_char_ptr_to_uint8(label.data()), label.size()},
                                                    store_be(static_cast<uint8_t>(hash_val.size())));
 
   /*
   * We do something a little dirty here to avoid copying the hash_val,
   * making use of the fact that Botan's KDF interface supports label+salt,
   * and knowing that our HKDF hashes first param label then param salt.
   */
   return hkdf.derive_key(length, secret, hash_val, prefix);
}

References BOTAN_ARG_CHECK, cast_char_ptr_to_uint8(), concat(), Botan::MessageAuthenticationCode::create_or_throw(), Botan::KDF::derive_key(), fmt(), and store_be().

holds_any_of()

template<typename... Alts, typename... Ts>

bool Botan::holds_any_of ( const std::variant< Ts... > & v )

constexprnoexcept

Definition at line 294 of file stl_util.h.

                                                                 {
   return (std::holds_alternative<Alts>(v) || ...);
}

Referenced by Botan::TLS::Channel_Impl_13::from_peer().

host_wildcard_match()

BOTAN_TEST_API bool Botan::host_wildcard_match	(	std::string_view	wildcard,
		std::string_view	host )

Check if the given hostname is a match for the specified wildcard

Definition at line 252 of file parsing.cpp.

                                                                       {
   const std::string issued = tolower_string(issued_);
   const std::string host = tolower_string(host_);
 
   if(host.empty() || issued.empty()) {
      return false;
   }
 
   /*
   If there are embedded nulls in your issued name
   Well I feel bad for you son
   */
   if(std::count(issued.begin(), issued.end(), char(0)) > 0) {
      return false;
   }
 
   // If more than one wildcard, then issued name is invalid
   const size_t stars = std::count(issued.begin(), issued.end(), '*');
   if(stars > 1) {
      return false;
   }
 
   // '*' is not a valid character in DNS names so should not appear on the host side
   if(std::count(host.begin(), host.end(), '*') != 0) {
      return false;
   }
 
   // Similarly a DNS name can't end in .
   if(host[host.size() - 1] == '.') {
      return false;
   }
 
   // And a host can't have an empty name component, so reject that
   if(host.find("..") != std::string::npos) {
      return false;
   }
 
   // Exact match: accept
   if(issued == host) {
      return true;
   }
 
   /*
   Otherwise it might be a wildcard
 
   If the issued size is strictly longer than the hostname size it
   couldn't possibly be a match, even if the issued value is a
   wildcard. The only exception is when the wildcard ends up empty
   (eg www.example.com matches www*.example.com)
   */
   if(issued.size() > host.size() + 1) {
      return false;
   }
 
   // If no * at all then not a wildcard, and so not a match
   if(stars != 1) {
      return false;
   }
 
   /*
   Now walk through the issued string, making sure every character
   matches. When we come to the (singular) '*', jump forward in the
   hostname by the corresponding amount. We know exactly how much
   space the wildcard takes because it must be exactly `len(host) -
   len(issued) + 1 chars`.
 
   We also verify that the '*' comes in the leftmost component, and
   doesn't skip over any '.' in the hostname.
   */
   size_t dots_seen = 0;
   size_t host_idx = 0;
 
   for(size_t i = 0; i != issued.size(); ++i) {
      dots_seen += (issued[i] == '.');
 
      if(issued[i] == '*') {
         // Fail: wildcard can only come in leftmost component
         if(dots_seen > 0) {
            return false;
         }
 
         /*
         Since there is only one * we know the tail of the issued and
         hostname must be an exact match. In this case advance host_idx
         to match.
         */
         const size_t advance = (host.size() - issued.size() + 1);
 
         if(host_idx + advance > host.size()) {  // shouldn't happen
            return false;
         }
 
         // Can't be any intervening .s that we would have skipped
         if(std::count(host.begin() + host_idx, host.begin() + host_idx + advance, '.') != 0) {
            return false;
         }
 
         host_idx += advance;
      } else {
         if(issued[i] != host[host_idx]) {
            return false;
         }
 
         host_idx += 1;
      }
   }
 
   // Wildcard issued name must have at least 3 components
   if(dots_seen < 2) {
      return false;
   }
 
   return true;
}

References tolower_string().

Referenced by Botan::X509_Certificate::matches_dns_name().

ht_sign()

void Botan::ht_sign	(	StrongSpan< SphincsHypertreeSignature >	out_sig,
		const SphincsTreeNode &	message_to_sign,
		const SphincsSecretSeed &	secret_seed,
		XmssTreeIndexInLayer	tree_index_in_layer,
		TreeNodeIndex	idx_leaf,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 12: ht_sign.

Creates a SLH-DSA XMSS hypertree signature of message_to_sign. The signature is written into the buffer defined by out_sig. tree_index_in_layer and idx_leaf define which XMSS tree of the hypertree and which leaf of this XMSS tree is used for signing.

Definition at line 21 of file sp_hypertree.cpp.

                                             {
   BOTAN_ASSERT_NOMSG(out_sig.size() == params.ht_signature_bytes());
   BufferStuffer ht_signature(out_sig);
 
   Sphincs_Address wots_addr(Sphincs_Address_Type::WotsHash);
   wots_addr.set_tree_address(tree_index_in_layer).set_keypair_address(idx_leaf);
 
   Sphincs_Address tree_addr(Sphincs_Address_Type::HashTree);
 
   SphincsTreeNode xmss_root;
   for(HypertreeLayerIndex layer_idx(0); layer_idx < params.d(); layer_idx++) {
      // The first XMSS tree signs the message, the others their underlying XMSS tree root
      const SphincsTreeNode& node_to_xmss_sign = (layer_idx == 0U) ? message_to_sign : xmss_root;
 
      tree_addr.set_layer_address(layer_idx).set_tree_address(tree_index_in_layer);
      wots_addr.copy_subtree_from(tree_addr).set_keypair_address(idx_leaf);
 
      xmss_root = xmss_sign_and_pkgen(ht_signature.next<SphincsXmssSignature>(params.xmss_signature_bytes()),
                                      node_to_xmss_sign,
                                      secret_seed,
                                      wots_addr,
                                      tree_addr,
                                      idx_leaf,
                                      params,
                                      hashes);
 
      // Update the indices for the next layer.
      idx_leaf = TreeNodeIndex(tree_index_in_layer.get() & ((1 << params.xmss_tree_height()) - 1));
      tree_index_in_layer = tree_index_in_layer >> params.xmss_tree_height();
   }
 
   BOTAN_ASSERT_NOMSG(ht_signature.full());
}

References BOTAN_ASSERT_NOMSG, Botan::Sphincs_Address::copy_subtree_from(), Botan::Sphincs_Parameters::d(), Botan::BufferStuffer::full(), Botan::detail::Strong_Base< T >::get(), HashTree, Botan::Sphincs_Parameters::ht_signature_bytes(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Address::set_tree_address(), Botan::StrongSpan< T >::size(), WotsHash, xmss_sign_and_pkgen(), Botan::Sphincs_Parameters::xmss_signature_bytes(), and Botan::Sphincs_Parameters::xmss_tree_height().

ht_verify()

bool Botan::ht_verify	(	const SphincsTreeNode &	signed_msg,
		StrongSpan< const SphincsHypertreeSignature >	ht_sig,
		const SphincsTreeNode &	pk_root,
		XmssTreeIndexInLayer	tree_index_in_layer,
		TreeNodeIndex	idx_leaf,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 13: ht_verify.

Given a message signed_msg the SLH-DSA XMSS hypertree is reconstructed using a hypertree signature ht_sig. tree_index_in_layer and idx_leaf define which XMSS tree of the hypertree and which leaf of this XMSS tree was used for signing.

Returns

true iff the top-most reconstructed root equals pk_root

Definition at line 61 of file sp_hypertree.cpp.

                                               {
   BOTAN_ASSERT_NOMSG(ht_sig.size() == params.ht_signature_bytes());
   BufferSlicer sig_s(ht_sig);
 
   Sphincs_Address wots_addr(Sphincs_Address_Type::WotsHash);
   Sphincs_Address tree_addr(Sphincs_Address_Type::HashTree);
   Sphincs_Address wots_pk_addr(Sphincs_Address_Type::WotsPublicKeyCompression);
 
   SphincsTreeNode reconstructed_root(params.n());
 
   // Each iteration reconstructs the root of one XMSS tree of the hypertree
   for(HypertreeLayerIndex layer_idx(0); layer_idx < params.d(); layer_idx++) {
      // The first XMSS tree signs the message, the others their underlying XMSS tree root
      const SphincsTreeNode& current_root = (layer_idx == 0U) ? signed_msg : reconstructed_root;
 
      tree_addr.set_layer_address(layer_idx);
      tree_addr.set_tree_address(tree_index_in_layer);
 
      wots_addr.copy_subtree_from(tree_addr);
      wots_addr.set_keypair_address(idx_leaf);
 
      wots_pk_addr.copy_keypair_from(wots_addr);
 
      const auto wots_pk = wots_public_key_from_signature(
         current_root, sig_s.take<WotsSignature>(params.wots_bytes()), wots_addr, params, hashes);
 
      // Compute the leaf node using the WOTS public key.
      const auto leaf = hashes.T<SphincsTreeNode>(wots_pk_addr, wots_pk);
 
      // Compute the root node of this subtree.
      compute_root(StrongSpan<SphincsTreeNode>(reconstructed_root),
                   params,
                   hashes,
                   leaf,
                   idx_leaf,
                   0,
                   sig_s.take<SphincsAuthenticationPath>(params.xmss_tree_height() * params.n()),
                   params.xmss_tree_height(),
                   tree_addr);
 
      // Update the indices for the next layer.
      idx_leaf = TreeNodeIndex(tree_index_in_layer.get() & ((1 << params.xmss_tree_height()) - 1));
      tree_index_in_layer = tree_index_in_layer >> params.xmss_tree_height();
   }
 
   BOTAN_ASSERT_NOMSG(sig_s.empty());
 
   // Check if the root node equals the root node in the public key.
   return reconstructed_root == pk_root;
}

References BOTAN_ASSERT_NOMSG, compute_root(), Botan::Sphincs_Address::copy_keypair_from(), Botan::Sphincs_Address::copy_subtree_from(), Botan::Sphincs_Parameters::d(), Botan::BufferSlicer::empty(), Botan::detail::Strong_Base< T >::get(), HashTree, Botan::Sphincs_Parameters::ht_signature_bytes(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Address::set_tree_address(), Botan::StrongSpan< T >::size(), Botan::Sphincs_Hash_Functions::T(), Botan::BufferSlicer::take(), Botan::Sphincs_Parameters::wots_bytes(), wots_public_key_from_signature(), WotsHash, WotsPublicKeyCompression, and Botan::Sphincs_Parameters::xmss_tree_height().

ieee1363_hash_id()

uint8_t Botan::ieee1363_hash_id

(

std::string_view

hash_name

)

Return the IEEE 1363 hash identifier

Parameters

hash_name

the name of the hash function

Returns

uint8_t code identifying the hash, or 0 if not known

Definition at line 144 of file hash_id.cpp.

                                              {
   if(name == "SHA-1") {
      return 0x33;
   }
 
   if(name == "SHA-224") {
      return 0x38;
   }
   if(name == "SHA-256") {
      return 0x34;
   }
   if(name == "SHA-384") {
      return 0x36;
   }
   if(name == "SHA-512") {
      return 0x35;
   }
 
   if(name == "RIPEMD-160") {
      return 0x31;
   }
 
   if(name == "Whirlpool") {
      return 0x37;
   }
 
   return 0;
}

Referenced by Botan::EMSA_X931::EMSA_X931().

if_work_factor()

size_t BOTAN_TEST_API Botan::if_work_factor

(

size_t

n_bits

)

Estimate work factor for integer factorization

Parameters

n_bits

size of modulus in bits

Returns

estimated security level for this modulus

Definition at line 35 of file workfactor.cpp.

                                   {
   if(bits < 512) {
      return 0;
   }
 
   // RFC 3766 estimates k at .02 and o(1) to be effectively zero for sizes of interest
 
   const double log2_k = -5.6438;  // log2(.02)
   return nfs_workfactor(bits, log2_k);
}

Referenced by dl_work_factor(), Botan::RSA_PublicKey::estimated_strength(), and Botan::TPM_PrivateKey::estimated_strength().

ignore_param()

template<typename T>

void Botan::ignore_param ( T && )

constexpr

Mark variable as unused.

Takes any number of arguments and marks all as unused, for instance BOTAN_UNUSED(a); or BOTAN_UNUSED(x, y, z);

Definition at line 113 of file assert.h.

{}

References ignore_param().

Referenced by ignore_param(), and ignore_params().

ignore_params()

template<typename... T>

void Botan::ignore_params ( T &&... args )

constexpr

Definition at line 116 of file assert.h.

                                          {
   (ignore_param(args), ...);
}

References ignore_param(), and ignore_params().

Referenced by ignore_params().

index_of_first_set_byte()

template<std::unsigned_integral T>

size_t Botan::index_of_first_set_byte ( T v )

constexpr

Return the index of the first byte with the high bit set

Definition at line 130 of file int_utils.h.

                                              {
   // The constant 0x010101... as a T
   constexpr T lo1 = (static_cast<T>(-1) / 255);
   // The constant 0x808080... as a T
   constexpr T hi1 = lo1 << 7;
   // How many bits to shift in order to get the top byte
   constexpr size_t bits = (sizeof(T) * 8) - 8;
 
   return static_cast<size_t>((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1);
}

initialize_allocator()

void BOTAN_UNSTABLE_API Botan::initialize_allocator

(

)

Ensure the allocator is initialized

Definition at line 64 of file allocator.cpp.

                            {
#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   mlock_allocator::instance();
#endif
}

References Botan::mlock_allocator::instance().

Referenced by Botan::Allocator_Initializer::Allocator_Initializer().

intersects()

bool Botan::intersects ( ASN1_Class x, ASN1_Class y )

inline

Definition at line 71 of file asn1_obj.h.

                                                   {
   return static_cast<uint32_t>(x) & static_cast<uint32_t>(y);
}

inverse_mod()

BigInt Botan::inverse_mod	(	const BigInt &	x,
		const BigInt &	modulus )

Modular inversion. This algorithm is const time with respect to x, as long as x is less than modulus. It also avoids leaking information about the modulus, except that it does leak which of 3 categories the modulus is in: an odd integer, a power of 2, or some other even number, and if the modulus is even, leaks the power of 2 which divides the modulus.

Parameters

x	a positive integer
modulus	a positive integer

Returns

y st (x*y) % modulus == 1 or 0 if no such value

Definition at line 369 of file mod_inv.cpp.

                                                       {
   BOTAN_ARG_CHECK(!mod.is_zero(), "modulus cannot be zero");
   BOTAN_ARG_CHECK(!mod.is_negative(), "modulus cannot be negative");
   BOTAN_ARG_CHECK(!n.is_negative(), "value cannot be negative");
 
   if(n.is_zero() || (n.is_even() && mod.is_even())) {
      return BigInt::zero();
   }
 
   if(n >= mod) {
      return inverse_mod(ct_modulo(n, mod), mod);
   }
 
   return inverse_mod_general(n, mod).value_or(BigInt::zero());
}

References BOTAN_ARG_CHECK, ct_modulo(), inverse_mod(), inverse_mod_general(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), and Botan::BigInt::zero().

Referenced by inverse_mod().

inverse_mod_general()

std::optional< BigInt > BOTAN_TEST_API Botan::inverse_mod_general	(	const BigInt &	x,
		const BigInt &	m )

Compute the inverse of x modulo some integer m

Returns nullopt if no such integer exists eg if gcd(x, m) > 1

This algorithm is const time with respect to x, aside from its length. It also avoids leaking information about the modulus m, except that it does leak which of 3 categories the modulus is in:

• An odd integer
• A power of 2
• Some even number not a power of 2

And if the modulus is even, it leaks the power of 2 which divides the modulus.

Parameters

x	a positive integer less than m
m	a positive integer

Throws Invalid_Argument if x or m are negative

Definition at line 177 of file mod_inv.cpp.

                                                                            {
   BOTAN_ARG_CHECK(x > 0, "x must be greater than zero");
   BOTAN_ARG_CHECK(mod > 0, "mod must be greater than zero");
   BOTAN_ARG_CHECK(x < mod, "x must be less than m");
 
   // Easy case where gcd > 1 so no inverse exists
   if(x.is_even() && mod.is_even()) {
      return std::nullopt;
   }
 
   if(mod.is_odd()) {
      BigInt z = inverse_mod_odd_modulus(x, mod);
      if(z.is_zero()) {
         return std::nullopt;
      } else {
         return z;
      }
   }
 
   // If x is even and mod is even we already returned 0
   // If x is even and mod is odd we jumped directly to odd-modulus algo
   BOTAN_ASSERT_NOMSG(x.is_odd());
 
   const size_t mod_lz = low_zero_bits(mod);
   BOTAN_ASSERT_NOMSG(mod_lz > 0);
   const size_t mod_bits = mod.bits();
   BOTAN_ASSERT_NOMSG(mod_bits > mod_lz);
 
   if(mod_lz == mod_bits - 1) {
      // In this case we are performing an inversion modulo 2^k
      auto z = inverse_mod_pow2(x, mod_lz);
      if(z.is_zero()) {
         return std::nullopt;
      } else {
         return z;
      }
   }
 
   if(mod_lz == 1) {
      /*
      Inversion modulo 2*o is an easier special case of CRT
 
      This is exactly the main CRT flow below but taking advantage of
      the fact that any odd number ^-1 modulo 2 is 1. As a result both
      inv_2k and c can be taken to be 1, m2k is 2, and h is always
      either 0 or 1, and its value depends only on the low bit of inv_o.
 
      This is worth special casing because we generate RSA primes such
      that phi(n) is of this form. However this only works for keys
      that we generated in this way; pre-existing keys will typically
      fall back to the general algorithm below.
      */
 
      const BigInt o = mod >> 1;
      const BigInt inv_o = inverse_mod_odd_modulus(ct_modulo(x, o), o);
 
      // No modular inverse in this case:
      if(inv_o == 0) {
         return std::nullopt;
      }
 
      BigInt h = inv_o;
      h.ct_cond_add(!inv_o.get_bit(0), o);
      return h;
   }
 
   /*
   * In this case we are performing an inversion modulo 2^k*o for
   * some k >= 2 and some odd (not necessarily prime) integer.
   * Compute the inversions modulo 2^k and modulo o, then combine them
   * using CRT, which is possible because 2^k and o are relatively prime.
   */
 
   const BigInt o = mod >> mod_lz;
   const BigInt inv_o = inverse_mod_odd_modulus(ct_modulo(x, o), o);
   const BigInt inv_2k = inverse_mod_pow2(x, mod_lz);
 
   // No modular inverse in this case:
   if(inv_o == 0 || inv_2k == 0) {
      return std::nullopt;
   }
 
   const BigInt m2k = BigInt::power_of_2(mod_lz);
   // Compute the CRT parameter
   const BigInt c = inverse_mod_pow2(o, mod_lz);
 
   // This should never happen; o is odd so gcd is 1 and inverse mod 2^k exists
   BOTAN_ASSERT_NOMSG(!c.is_zero());
 
   // Compute h = c*(inv_2k-inv_o) mod 2^k
   BigInt h = c * (inv_2k - inv_o);
   const bool h_neg = h.is_negative();
   h.set_sign(BigInt::Positive);
   h.mask_bits(mod_lz);
   const bool h_nonzero = h.is_nonzero();
   h.ct_cond_assign(h_nonzero && h_neg, m2k - h);
 
   // Return result inv_o + h * o
   h *= o;
   h += inv_o;
   return h;
}

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::BigInt::ct_cond_add(), Botan::BigInt::ct_cond_assign(), ct_modulo(), Botan::BigInt::get_bit(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_nonzero(), Botan::BigInt::is_odd(), Botan::BigInt::is_zero(), low_zero_bits(), Botan::BigInt::mask_bits(), Botan::BigInt::Positive, Botan::BigInt::power_of_2(), and Botan::BigInt::set_sign().

Referenced by botan_mp_mod_inverse(), compute_rsa_secret_exponent(), and inverse_mod().

inverse_mod_public_prime()

BigInt BOTAN_TEST_API Botan::inverse_mod_public_prime	(	const BigInt &	x,
		const BigInt &	p )

Compute the inverse of x modulo a public prime p

This algorithm is constant time with respect to x. The prime p is assumed to be public.

Parameters

x	a positive integer less than p
p	an odd prime

Returns

y such that (x*y) % p == 1

This always returns a result since any integer in [1,p) has an inverse modulo a prime p.

This function assumes as a precondition that p truly is prime; the results may not be correct if this does not hold.

Throws Invalid_Argument if x is less than or equal to zero, or if p is even or less than 3.

Definition at line 291 of file mod_inv.cpp.

                                                                  {
   return inverse_mod_secret_prime(x, p);
}

References inverse_mod_secret_prime().

Referenced by Botan::DL_Group::inverse_mod_p(), Botan::DL_Group::inverse_mod_q(), Botan::EC_Scalar_Data_BN::invert(), and Botan::EC_Scalar_Data_BN::invert_vartime().

inverse_mod_rsa_public_modulus()

BigInt Botan::inverse_mod_rsa_public_modulus	(	const BigInt &	x,
		const BigInt &	n )

Compute the inverse of x modulo a public RSA modulus n

This algorithm is constant time with respect to x. The RSA modulus is assumed to be public.

Parameters

x	a positive integer less than n
n	a RSA public modulus

Returns

y such that (x*y) % n == 1

This always returns a result since any integer in [1,n) has an inverse modulo a RSA public modulus n, unless you have happened to guess one of the factors at random. In the unlikely event of this occuring, Internal_Error will be thrown.

Definition at line 295 of file mod_inv.cpp.

                                                                        {
   BOTAN_ARG_CHECK(n.is_positive() && n.is_odd(), "RSA public modulus must be odd and positive");
   BOTAN_ARG_CHECK(x.is_positive() && x < n, "Input must be positive and less than RSA modulus");
   BigInt z = inverse_mod_odd_modulus(x, n);
   BOTAN_ASSERT(!z.is_zero(), "Accidentally factored the public modulus");  // whoops
   return z;
}

References BOTAN_ARG_CHECK, BOTAN_ASSERT, Botan::BigInt::is_odd(), Botan::BigInt::is_positive(), and Botan::BigInt::is_zero().

inverse_mod_secret_prime()

BigInt BOTAN_TEST_API Botan::inverse_mod_secret_prime	(	const BigInt &	x,
		const BigInt &	p )

Compute the inverse of x modulo a secret prime p

This algorithm is constant time with respect to x and p, aside from leaking the length of p. (In particular it should not leak the length of x, if x is shorter)

Parameters

x	a positive integer less than p
p	an odd prime

Returns

y such that (x*y) % p == 1

This always returns a result since any integer in [1,p) has an inverse modulo a prime p.

This function assumes as a precondition that p truly is prime; the results may not be correct if this does not hold.

Throws Invalid_Argument if x is less than or equal to zero, or if p is even or less than 3.

Definition at line 280 of file mod_inv.cpp.

                                                                  {
   BOTAN_ARG_CHECK(x.is_positive() && p.is_positive(), "Parameters must be positive");
   BOTAN_ARG_CHECK(x < p, "x must be less than p");
   BOTAN_ARG_CHECK(p.is_odd() and p > 1, "Primes are odd integers greater than 1");
 
   // TODO possibly use FLT, or the algorithm presented for this case in
   // Handbook of Elliptic and Hyperelliptic Curve Cryptography
 
   return inverse_mod_odd_modulus(x, p);
}

References BOTAN_ARG_CHECK, Botan::BigInt::is_odd(), and Botan::BigInt::is_positive().

Referenced by Botan::RSA_PrivateKey::check_key(), inverse_mod_public_prime(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

invert_field_element()

template<typename C>

auto Botan::invert_field_element ( const typename C::FieldElement & fe )

inlineconstexpr

Field inversion

Uses the specialized fe_invert2 if available, or otherwise the standard (FLT-based) field inversion.

Definition at line 34 of file pcurves_algos.h.

                                                                             {
   if constexpr(curve_supports_fe_invert2<C>) {
      return C::fe_invert2(fe) * fe;
   } else {
      return fe.invert();
   }
}

Referenced by to_affine(), to_affine_batch(), and to_affine_x().

ipv4_to_string()

std::string BOTAN_TEST_API Botan::ipv4_to_string

(

uint32_t

ip_addr

)

Convert an IPv4 address to a string

Parameters

ip_addr

the IPv4 address to convert

Returns

string representation of the IPv4 address

Definition at line 225 of file parsing.cpp.

                                      {
   uint8_t bits[4];
   store_be(ip, bits);
 
   std::string str;
 
   for(size_t i = 0; i != 4; ++i) {
      if(i > 0) {
         str += ".";
      }
      str += std::to_string(bits[i]);
   }
 
   return str;
}

References store_be().

Referenced by Botan::AlternativeName::contents(), Botan::AlternativeName::get_attribute(), and Botan::GeneralName::name().

is_bailie_psw_probable_prime()

bool BOTAN_TEST_API Botan::is_bailie_psw_probable_prime	(	const BigInt &	n,
		const Barrett_Reduction &	mod_n )

Perform Bailie-PSW primality test

This is a combination of Miller-Rabin with base 2 and a Lucas test. No known composite integer passes both tests, though it is conjectured that infinitely many composite counterexamples exist.

Parameters

n	the positive integer to test
mod_n	a pre-created Barrett_Reduction for n

Returns

true if n seems probably prime, false if n is composite

Definition at line 96 of file primality.cpp.

                                                                                   {
   if(n == 2) {
      return true;
   } else if(n <= 1 || n.is_even()) {
      return false;
   }
 
   auto monty_n = std::make_shared<Montgomery_Params>(n, mod_n);
   const auto base = BigInt::from_word(2);
   return passes_miller_rabin_test(n, mod_n, monty_n, base) && is_lucas_probable_prime(n, mod_n);
}

References Botan::BigInt::from_word(), Botan::BigInt::is_even(), is_lucas_probable_prime(), and passes_miller_rabin_test().

Referenced by Botan::EC_Group::EC_Group(), and is_prime().

is_generalizable_to() [1/2]

template<typename GeneralVariantT, typename SpecialT>

bool Botan::is_generalizable_to ( const SpecialT & )

constexprnoexcept

Definition at line 299 of file stl_util.h.

                                                             {
   return std::is_constructible_v<GeneralVariantT, SpecialT>;
}

Referenced by generalize_to(), and Botan::TLS::Handshake_State_13< Connection_Side::Client, Client_Handshake_13_Message, Server_Handshake_13_Message, Server_Post_Handshake_13_Message >::sending().

is_generalizable_to() [2/2]

template<typename GeneralVariantT, typename... SpecialTs>

bool Botan::is_generalizable_to ( const std::variant< SpecialTs... > & )

constexprnoexcept

Definition at line 304 of file stl_util.h.

                                                                             {
   return (std::is_constructible_v<GeneralVariantT, SpecialTs> && ...);
}

is_lucas_probable_prime()

bool BOTAN_TEST_API Botan::is_lucas_probable_prime	(	const BigInt &	n,
		const Barrett_Reduction &	mod_n )

Perform Lucas primality test

See also

FIPS 186-4 C.3.3

Warning

it is possible to construct composite integers which pass this test alone.

Parameters

n	the positive integer to test
mod_n	a pre-created Barrett_Reduction for n

Returns

true if n seems probably prime, false if n is composite

Definition at line 19 of file primality.cpp.

                                                                              {
   BOTAN_ARG_CHECK(C.is_positive(), "Argument should be a positive integer");
 
   if(C == 2 || C == 3 || C == 5 || C == 7 || C == 11 || C == 13) {
      return true;
   }
 
   if(C <= 1 || C.is_even()) {
      return false;
   }
 
   BigInt D = BigInt::from_word(5);
 
   for(;;) {
      int32_t j = jacobi(D, C);
      if(j == 0) {
         return false;
      }
 
      if(j == -1) {
         break;
      }
 
      // Check 5, -7, 9, -11, 13, -15, 17, ...
      if(D.is_negative()) {
         D.flip_sign();
         D += 2;
      } else {
         D += 2;
         D.flip_sign();
      }
 
      if(D == 17 && is_perfect_square(C).is_nonzero()) {
         return false;
      }
   }
 
   if(D.is_negative()) {
      D += C;
   }
 
   const BigInt K = C + 1;
   const size_t K_bits = K.bits() - 1;
 
   BigInt U = BigInt::one();
   BigInt V = BigInt::one();
 
   BigInt Ut, Vt, U2, V2;
 
   for(size_t i = 0; i != K_bits; ++i) {
      const bool k_bit = K.get_bit(K_bits - 1 - i);
 
      Ut = mod_C.multiply(U, V);
 
      Vt = mod_C.reduce(mod_C.square(V) + mod_C.multiply(D, mod_C.square(U)));
      Vt.ct_cond_add(Vt.is_odd(), C);
      Vt >>= 1;
      Vt = mod_C.reduce(Vt);
 
      U = Ut;
      V = Vt;
 
      U2 = mod_C.reduce(Ut + Vt);
      U2.ct_cond_add(U2.is_odd(), C);
      U2 >>= 1;
 
      V2 = mod_C.reduce(Vt + mod_C.multiply(Ut, D));
      V2.ct_cond_add(V2.is_odd(), C);
      V2 >>= 1;
 
      U.ct_cond_assign(k_bit, U2);
      V.ct_cond_assign(k_bit, V2);
   }
 
   return (U == 0);
}

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, Botan::BigInt::ct_cond_add(), Botan::BigInt::ct_cond_assign(), Botan::BigInt::flip_sign(), Botan::BigInt::from_word(), Botan::BigInt::get_bit(), Botan::BigInt::is_even(), Botan::BigInt::is_negative(), Botan::BigInt::is_odd(), is_perfect_square(), Botan::BigInt::is_positive(), jacobi(), Botan::Barrett_Reduction::multiply(), Botan::BigInt::one(), Botan::Barrett_Reduction::reduce(), and Botan::Barrett_Reduction::square().

Referenced by is_bailie_psw_probable_prime(), is_prime(), and random_prime().

is_miller_rabin_probable_prime()

bool BOTAN_TEST_API Botan::is_miller_rabin_probable_prime	(	const BigInt &	n,
		const Barrett_Reduction &	mod_n,
		RandomNumberGenerator &	rng,
		size_t	t )

Perform t iterations of a Miller-Rabin primality test with random bases

Parameters

n	the positive integer to test
mod_n	a pre-created Barrett_Reduction for n
rng	a random number generator
t	number of tests to perform

Returns

result of primality test

Definition at line 152 of file primality.cpp.

                                                            {
   if(n < 3 || n.is_even()) {
      return false;
   }
 
   auto monty_n = std::make_shared<Montgomery_Params>(n, mod_n);
 
   for(size_t i = 0; i != test_iterations; ++i) {
      const BigInt a = BigInt::random_integer(rng, BigInt::from_word(2), n);
 
      if(!passes_miller_rabin_test(n, mod_n, monty_n, a)) {
         return false;
      }
   }
 
   // Failed to find a counterexample
   return true;
}

References Botan::BigInt::from_word(), Botan::BigInt::is_even(), passes_miller_rabin_test(), and Botan::BigInt::random_integer().

Referenced by generate_rsa_prime(), is_prime(), and random_prime().

is_passhash9_alg_supported()

bool Botan::is_passhash9_alg_supported

(

uint8_t

alg_id

)

Check if the PRF used with PBKDF2 is supported

Parameters

alg_id

alg_id used in generate_passhash9()

Definition at line 128 of file passhash9.cpp.

                                                {
   if(get_pbkdf_prf(alg_id)) {
      return true;
   }
   return false;
}

is_perfect_square()

BigInt Botan::is_perfect_square

(

const BigInt &

x

)

Test if the positive integer x is a perfect square ie if there exists some positive integer y st y*y == x See FIPS 186-4 sec C.4

Returns

0 if the integer is not a perfect square, otherwise returns the positive y st y*y == x

Definition at line 321 of file numthry.cpp.

                                          {
   if(C < 1) {
      throw Invalid_Argument("is_perfect_square requires C >= 1");
   }
   if(C == 1) {
      return BigInt::one();
   }
 
   const size_t n = C.bits();
   const size_t m = (n + 1) / 2;
   const BigInt B = C + BigInt::power_of_2(m);
 
   BigInt X = BigInt::power_of_2(m) - 1;
   BigInt X2 = (X * X);
 
   for(;;) {
      X = (X2 + C) / (2 * X);
      X2 = (X * X);
 
      if(X2 < B) {
         break;
      }
   }
 
   if(X2 == C) {
      return X;
   } else {
      return BigInt::zero();
   }
}

References Botan::BigInt::bits(), Botan::BigInt::one(), Botan::BigInt::power_of_2(), and Botan::BigInt::zero().

Referenced by is_lucas_probable_prime().

is_power_of_2()

template<typename T>
requires (std::is_unsigned<T>::value)

bool Botan::is_power_of_2 ( T arg )

inlineconstexpr

Power of 2 test. T should be an unsigned integer type

Parameters

arg	an integer value

Returns

true iff arg is 2^n for some n > 0

Definition at line 48 of file bit_ops.h.

{
   return (arg != 0) && (arg != 1) && ((arg & static_cast<T>(arg - 1)) == 0);
}

Referenced by operator%(), Botan::BigInt::operator%=(), Botan::BigInt::operator/=(), Botan::Scrypt::Scrypt(), and Botan::CTR_BE::seek().

is_prime()

bool Botan::is_prime	(	const BigInt &	n,
		RandomNumberGenerator &	rng,
		size_t	prob = 64,
		bool	is_random = false )

Check for primality

This uses probabilistic algorithms - there is some non-zero (but very low) probability that this function will return true even if n is actually composite.

Parameters

n	a positive integer to test for primality
rng	a random number generator
prob	chance of false positive is bounded by 1/2**prob
is_random	true if n was randomly chosen by us

Returns

true if all primality tests passed, otherwise false

Definition at line 355 of file numthry.cpp.

                                                                                        {
   if(n == 2) {
      return true;
   }
   if(n <= 1 || n.is_even()) {
      return false;
   }
 
   const size_t n_bits = n.bits();
 
   // Fast path testing for small numbers (<= 65521)
   if(n_bits <= 16) {
      const uint16_t num = static_cast<uint16_t>(n.word_at(0));
 
      return std::binary_search(PRIMES, PRIMES + PRIME_TABLE_SIZE, num);
   }
 
   auto mod_n = Barrett_Reduction::for_secret_modulus(n);
 
   if(rng.is_seeded()) {
      const size_t t = miller_rabin_test_iterations(n_bits, prob, is_random);
 
      if(is_miller_rabin_probable_prime(n, mod_n, rng, t) == false) {
         return false;
      }
 
      if(is_random) {
         return true;
      } else {
         return is_lucas_probable_prime(n, mod_n);
      }
   } else {
      return is_bailie_psw_probable_prime(n, mod_n);
   }
}

References Botan::BigInt::bits(), Botan::Barrett_Reduction::for_secret_modulus(), is_bailie_psw_probable_prime(), Botan::BigInt::is_even(), is_lucas_probable_prime(), is_miller_rabin_probable_prime(), Botan::RandomNumberGenerator::is_seeded(), miller_rabin_test_iterations(), PRIME_TABLE_SIZE, PRIMES, and Botan::BigInt::word_at().

Referenced by botan_mp_is_prime(), Botan::RSA_PrivateKey::check_key(), Botan::DL_Group::DL_Group(), generate_dsa_primes(), random_safe_prime(), Botan::DL_Group::verify_group(), and Botan::EC_Group::verify_group().

is_sub_element_of()

std::optional< uint32_t > Botan::is_sub_element_of ( const OID & oid, std::initializer_list< uint32_t > prefix )

inline

Definition at line 16 of file x509_utils.h.

                                                                                                     {
   const auto& c = oid.get_components();
 
   if(c.size() != prefix.size() + 1) {
      return {};
   }
 
   if(!std::equal(c.begin(), c.end() - 1, prefix.begin(), prefix.end())) {
      return {};
   }
 
   return c[c.size() - 1];
}

References Botan::OID::get_components().

Referenced by Botan::X509_DN::lookup_ub().

jacobi()

int32_t Botan::jacobi	(	const BigInt &	a,
		const BigInt &	n )

Compute the Jacobi symbol. If n is prime, this is equivalent to the Legendre symbol.

See also

http://mathworld.wolfram.com/JacobiSymbol.html

Parameters

a	is a non-negative integer
n	is an odd integer > 1

Returns

(n / m)

Definition at line 116 of file numthry.cpp.

                                                 {
   if(n.is_even() || n < 2) {
      throw Invalid_Argument("jacobi: second argument must be odd and > 1");
   }
 
   BigInt x = a % n;
   BigInt y = n;
   int32_t J = 1;
 
   while(y > 1) {
      x %= y;
      if(x > y / 2) {
         x = y - x;
         if(y % 4 == 3) {
            J = -J;
         }
      }
      if(x.is_zero()) {
         return 0;
      }
 
      size_t shifts = low_zero_bits(x);
      x >>= shifts;
      if(shifts % 2) {
         word y_mod_8 = y % 8;
         if(y_mod_8 == 3 || y_mod_8 == 5) {
            J = -J;
         }
      }
 
      if(x % 4 == 3 && y % 4 == 3) {
         J = -J;
      }
      std::swap(x, y);
   }
   return J;
}

References Botan::BigInt::is_even(), Botan::BigInt::is_zero(), and low_zero_bits().

Referenced by Botan::DL_Group::DL_Group(), is_lucas_probable_prime(), and sqrt_modulo_prime().

keccak_absorb_padded_strings_encoding()

template<absorbing_object T, typename... Ts>
requires (std::constructible_from<std::span<const uint8_t>, Ts> && ...)

size_t Botan::keccak_absorb_padded_strings_encoding	(	T &	sink,
		size_t	padding_mod,
		Ts...	byte_strings )

This is a combination of the functions encode_string() and bytepad() defined in NIST SP.800-185 Section 2.3. Additionally, the result is directly streamed into the provided XOF to avoid unneccessary memory allocation or a byte vector.

Parameters

sink	the XOF or byte vector to absorb the byte_strings into
padding_mod	the modulus value to create a padding for (NIST calls this 'w')
byte_strings	a variable-length list of byte strings to be encoded and absorbed into the given xof

Returns

the number of bytes absorbed into the xof

Definition at line 91 of file keccak_helpers.h.

                                                                                              {
   BOTAN_ASSERT_NOMSG(padding_mod > 0);
 
   // used as temporary storage for all integer encodings in this function
   std::array<uint8_t, keccak_max_int_encoding_size()> int_encoding_buffer;
 
   // absorbs byte strings and counts the number of absorbed bytes
   size_t bytes_absorbed = 0;
   auto absorb = [&](std::span<const uint8_t> bytes) {
      if constexpr(updatable_object<T>) {
         sink.update(bytes);
      } else if constexpr(appendable_object<T>) {
         sink.insert(sink.end(), bytes.begin(), bytes.end());
      }
      bytes_absorbed += bytes.size();
   };
 
   // encodes a given string and absorbs it into the XOF straight away
   auto encode_string_and_absorb = [&](std::span<const uint8_t> bytes) {
      absorb(keccak_int_left_encode(int_encoding_buffer, bytes.size() * 8));
      absorb(bytes);
   };
 
   // absorbs as many zero-bytes as requested into the XOF
   auto absorb_padding = [&](size_t padding_bytes) {
      for(size_t i = 0; i < padding_bytes; ++i) {
         const uint8_t zero_byte = 0;
         absorb({&zero_byte, 1});
      }
   };
 
   // implementation of bytepad(encode_string(Ts) || ...) that absorbs the result
   // staight into the given xof
   absorb(keccak_int_left_encode(int_encoding_buffer, padding_mod));
   (encode_string_and_absorb(byte_strings), ...);
   absorb_padding(padding_mod - (bytes_absorbed % padding_mod));
 
   return bytes_absorbed;
}

References BOTAN_ASSERT_NOMSG, keccak_absorb_padded_strings_encoding(), keccak_int_left_encode(), and keccak_max_int_encoding_size().

Referenced by keccak_absorb_padded_strings_encoding().

keccak_int_encoding_size()

BOTAN_TEST_API size_t Botan::keccak_int_encoding_size

(

size_t

x

)

Returns

the required bytes for encodings of keccak_int_left_encode() or keccak_int_right_encode() given an integer x

Definition at line 54 of file keccak_helpers.cpp.

                                          {
   return int_encoding_size(x) + 1 /* the length tag */;
}

keccak_int_left_encode()

BOTAN_TEST_API std::span< const uint8_t > Botan::keccak_int_left_encode	(	std::span< uint8_t >	buffer,
		size_t	x )

Integer encoding defined in NIST SP.800-185 that can be unambiguously parsed from the beginning of the string.

This function does not allocate any memory and requires the caller to provide a sufficiently large buffer. For a given x, this will need exactly keccak_int_encoding_size() bytes. For an arbitrary x it will generate keccak_max_int_encoding_size() bytes at most.

Parameters

buffer	buffer to write the left-encoding of x to. It is assumed that the buffer will hold at least keccak_int_encoding_size() bytes.
x	the integer to be left-encoded

Returns

the byte span that represents the bytes written to buffer.

Definition at line 41 of file keccak_helpers.cpp.

                                                                              {
   BOTAN_ASSERT_NOMSG(!out.empty());
   out[0] = encode(out.last(out.size() - 1), x);
   return out.first(out[0] + 1 /* the length tag */);
}

References BOTAN_ASSERT_NOMSG.

Referenced by keccak_absorb_padded_strings_encoding().

keccak_int_right_encode()

BOTAN_TEST_API std::span< const uint8_t > Botan::keccak_int_right_encode	(	std::span< uint8_t >	out,
		size_t	x )

Integer encoding defined in NIST SP.800-185 that can be unambiguously parsed from the end of the string.

This function does not allocate any memory and requires the caller to provide a sufficiently large buffer. For a given x, this will need exactly keccak_int_encoding_size() bytes. For an arbitrary x it will generate keccak_max_int_encoding_size() bytes at most.

Parameters

out	buffer to write the right-encoding of x to. It is assumed that the buffer will hold at least keccak_int_encoding_size() bytes.
x	the integer to be right-encoded

Returns

the byte span that represents the bytes written to buffer.

Definition at line 47 of file keccak_helpers.cpp.

                                                                               {
   const auto bytes_needed = encode(out, x);
   BOTAN_ASSERT_NOMSG(out.size() >= bytes_needed + size_t(1));
   out[bytes_needed] = bytes_needed;
   return out.first(bytes_needed + 1 /* the length tag */);
}

References BOTAN_ASSERT_NOMSG.

keccak_max_int_encoding_size()

size_t Botan::keccak_max_int_encoding_size ( )

constexpr

Returns

the maximum required bytes for encodings of keccak_int_left_encode() or keccak_int_right_encode()

Definition at line 65 of file keccak_helpers.h.

                                                {
   return sizeof(size_t) + 1 /* the length tag */;
}

Referenced by keccak_absorb_padded_strings_encoding().

Keccak_Permutation_round()

void Botan::Keccak_Permutation_round ( uint64_t T[25], const uint64_t A[25], uint64_t RC )

inline

Definition at line 15 of file keccak_perm_round.h.

                                                                                        {
   const uint64_t C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
   const uint64_t C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
   const uint64_t C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
   const uint64_t C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
   const uint64_t C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
 
   const uint64_t D0 = rotl<1>(C0) ^ C3;
   const uint64_t D1 = rotl<1>(C1) ^ C4;
   const uint64_t D2 = rotl<1>(C2) ^ C0;
   const uint64_t D3 = rotl<1>(C3) ^ C1;
   const uint64_t D4 = rotl<1>(C4) ^ C2;
 
   const uint64_t B00 = A[0] ^ D1;
   const uint64_t B01 = rotl<44>(A[6] ^ D2);
   const uint64_t B02 = rotl<43>(A[12] ^ D3);
   const uint64_t B03 = rotl<21>(A[18] ^ D4);
   const uint64_t B04 = rotl<14>(A[24] ^ D0);
   T[0] = B00 ^ (~B01 & B02) ^ RC;
   T[1] = B01 ^ (~B02 & B03);
   T[2] = B02 ^ (~B03 & B04);
   T[3] = B03 ^ (~B04 & B00);
   T[4] = B04 ^ (~B00 & B01);
 
   const uint64_t B05 = rotl<28>(A[3] ^ D4);
   const uint64_t B06 = rotl<20>(A[9] ^ D0);
   const uint64_t B07 = rotl<3>(A[10] ^ D1);
   const uint64_t B08 = rotl<45>(A[16] ^ D2);
   const uint64_t B09 = rotl<61>(A[22] ^ D3);
   T[5] = B05 ^ (~B06 & B07);
   T[6] = B06 ^ (~B07 & B08);
   T[7] = B07 ^ (~B08 & B09);
   T[8] = B08 ^ (~B09 & B05);
   T[9] = B09 ^ (~B05 & B06);
 
   const uint64_t B10 = rotl<1>(A[1] ^ D2);
   const uint64_t B11 = rotl<6>(A[7] ^ D3);
   const uint64_t B12 = rotl<25>(A[13] ^ D4);
   const uint64_t B13 = rotl<8>(A[19] ^ D0);
   const uint64_t B14 = rotl<18>(A[20] ^ D1);
   T[10] = B10 ^ (~B11 & B12);
   T[11] = B11 ^ (~B12 & B13);
   T[12] = B12 ^ (~B13 & B14);
   T[13] = B13 ^ (~B14 & B10);
   T[14] = B14 ^ (~B10 & B11);
 
   const uint64_t B15 = rotl<27>(A[4] ^ D0);
   const uint64_t B16 = rotl<36>(A[5] ^ D1);
   const uint64_t B17 = rotl<10>(A[11] ^ D2);
   const uint64_t B18 = rotl<15>(A[17] ^ D3);
   const uint64_t B19 = rotl<56>(A[23] ^ D4);
   T[15] = B15 ^ (~B16 & B17);
   T[16] = B16 ^ (~B17 & B18);
   T[17] = B17 ^ (~B18 & B19);
   T[18] = B18 ^ (~B19 & B15);
   T[19] = B19 ^ (~B15 & B16);
 
   const uint64_t B20 = rotl<62>(A[2] ^ D3);
   const uint64_t B21 = rotl<55>(A[8] ^ D4);
   const uint64_t B22 = rotl<39>(A[14] ^ D0);
   const uint64_t B23 = rotl<41>(A[15] ^ D1);
   const uint64_t B24 = rotl<2>(A[21] ^ D2);
   T[20] = B20 ^ (~B21 & B22);
   T[21] = B21 ^ (~B22 & B23);
   T[22] = B22 ^ (~B23 & B24);
   T[23] = B23 ^ (~B24 & B20);
   T[24] = B24 ^ (~B20 & B21);
}

References rotl().

key_constraints_to_string()

std::string Botan::key_constraints_to_string ( Key_Constraints c )

inline

Definition at line 33 of file pkix_types.h.

                                                              {
   return c.to_string();
}

References key_constraints_to_string().

Referenced by key_constraints_to_string().

latin1_to_utf8()

BOTAN_TEST_API std::string Botan::latin1_to_utf8	(	const uint8_t	chars[],
		size_t	len )

Definition at line 89 of file charset.cpp.

                                                            {
   std::string s;
   for(size_t i = 0; i != len; ++i) {
      const uint32_t c = static_cast<uint8_t>(chars[i]);
      append_utf8_for(s, c);
   }
   return s;
}

Referenced by Botan::ASN1_String::decode_from().

lcm()

BigInt Botan::lcm	(	const BigInt &	x,
		const BigInt &	y )

Least common multiple

Parameters

x	a positive integer
y	a positive integer

Returns

z, smallest integer such that z % x == 0 and z % y == 0

Definition at line 270 of file numthry.cpp.

                                             {
   if(a == b) {
      return a;
   }
 
   auto ab = a * b;
   ab.set_sign(BigInt::Positive);  // ignore the signs of a & b
   const auto g = gcd(a, b);
   return ct_divide(ab, g);
}

References ct_divide(), gcd(), Botan::BigInt::Positive, and Botan::BigInt::set_sign().

Referenced by Botan::Cascade_Cipher::Cascade_Cipher(), Botan::RSA_PrivateKey::check_key(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and Botan::RSA_PrivateKey::RSA_PrivateKey().

lex_to_gray()

gf2m Botan::lex_to_gray ( gf2m lex )

inline

Definition at line 38 of file code_based_util.h.

                                  {
   return (lex >> 1) ^ lex;
}

Referenced by syndrome_init().

lmots_compute_pubkey_from_sig()

BOTAN_TEST_API LMOTS_K Botan::lmots_compute_pubkey_from_sig	(	const LMOTS_Signature &	sig,
		const LMS_Message &	msg,
		const LMS_Identifier &	identifier,
		LMS_Tree_Node_Idx	q )

Compute a public key candidate for an OTS-signature-message pair and the OTS instance parameters.

Defined in RFC 8554 4.6 - Algorithm 4b

Definition at line 327 of file lm_ots.cpp.

                                                           {
   auto params = LMOTS_Params::create_or_throw(sig.algorithm_type());
 
   // Alg. 4b 3.
 
   const auto Q_with_cksm = gen_Q_with_cksm(params, identifier, q, sig.C(), msg);
 
   // Prefill the final hash object
   const auto pk_hash = params.hash();
   pk_hash->update(identifier);
   pk_hash->update(store_be(q));
   pk_hash->update(store_be(D_PBLC));
 
   Chain_Generator chain_gen(identifier, q);
   const auto hash = params.hash();
   LMOTS_Node tmp(params.n());
   for(uint16_t i = 0; i < params.p(); ++i) {
      const uint8_t a = coef(Q_with_cksm, i, params);
      chain_gen.process(*hash, i, a, params.coef_max(), sig.y(i), tmp);
      pk_hash->update(tmp);
   }
   // Alg. 4b 4.
   return pk_hash->final<LMOTS_K>();
}

References Botan::LMOTS_Signature::algorithm_type(), Botan::LMOTS_Signature::C(), Botan::LMOTS_Params::create_or_throw(), store_be(), and Botan::LMOTS_Signature::y().

load_3()

uint64_t Botan::load_3 ( const uint8_t in[3] )

inline

Definition at line 19 of file ed25519_internal.h.

                                            {
   return static_cast<uint64_t>(in[0]) | (static_cast<uint64_t>(in[1]) << 8) | (static_cast<uint64_t>(in[2]) << 16);
}

Referenced by Botan::FE_25519::from_bytes(), sc_muladd(), and sc_reduce().

load_4()

uint64_t Botan::load_4 ( const uint8_t * in )

inline

Definition at line 23 of file ed25519_internal.h.

                                          {
   return load_le<uint32_t>(in, 0);
}

References load_le().

Referenced by Botan::FE_25519::from_bytes(), sc_muladd(), and sc_reduce().

load_be()

template<typename OutT = detail::AutoDetect, typename... ParamTs>

auto Botan::load_be ( ParamTs &&... params )

inlineconstexpr

Load "something" in big endian byte order See the documentation of this file for more details.

Definition at line 504 of file loadstor.h.

                                                   {
   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
}

References Botan::detail::load_any().

Referenced by Botan::TLS::Datagram_Handshake_IO::add_record(), base58_check_decode(), check_passhash9(), Botan::SHA_256::compress_digest(), Botan::SHA_512::compress_digest(), Botan::SHA_1::compress_n(), Botan::SM3::compress_n(), Botan::Whirlpool::compress_n(), Botan::AlternativeName::decode_from(), Botan::GeneralName::decode_from(), Botan::TLS::Session::decrypt(), Botan::CryptoBox::decrypt_bin(), Botan::Blowfish::decrypt_n(), Botan::CAST_128::decrypt_n(), Botan::DES::decrypt_n(), Botan::Noekeon::decrypt_n(), Botan::SEED::decrypt_n(), Botan::SHACAL2::decrypt_n(), Botan::SM4::decrypt_n(), Botan::TripleDES::decrypt_n(), Botan::Blowfish::encrypt_n(), Botan::CAST_128::encrypt_n(), Botan::DES::encrypt_n(), Botan::Noekeon::encrypt_n(), Botan::SEED::encrypt_n(), Botan::SHACAL2::encrypt_n(), Botan::SM4::encrypt_n(), Botan::TripleDES::encrypt_n(), Botan::HSS_LMS_PrivateKeyInternal::from_bytes_or_throw(), Botan::HSS_LMS_PublicKeyInternal::from_bytes_or_throw(), Botan::HSS_Signature::from_bytes_or_throw(), Botan::LMOTS_Signature::from_bytes_or_throw(), Botan::LMS_PublicKey::from_bytes_or_throw(), Botan::LMS_Signature::from_bytes_or_throw(), Botan::HOTP::generate_hotp(), Botan::TLS::TLS_Data_Reader::get_elem(), Botan::SIMD_4x32::load_be(), nist_key_unwrap(), nist_key_unwrap_padded(), Botan::TLS::Server_Hello_12::random_signals_downgrade(), Botan::TLS::Server_Hello_13::random_signals_downgrade(), Botan::CTR_BE::seek(), Botan::TLS::Session::Session(), ucs2_to_utf8(), and ucs4_to_utf8().

load_le()

template<typename OutT = detail::AutoDetect, typename... ParamTs>

auto Botan::load_le ( ParamTs &&... params )

inlineconstexpr

Load "something" in little endian byte order See the documentation of this file for more details.

Definition at line 495 of file loadstor.h.

                                                   {
   return detail::load_any<std::endian::little, OutT>(std::forward<ParamTs>(params)...);
}

References Botan::detail::load_any().

Referenced by Botan::Keccak_Permutation::absorb(), Botan::Gf448Elem::bytes_are_canonical_representation(), Botan::MD4::compress_n(), Botan::MD5::compress_n(), Botan::RIPEMD_160::compress_n(), Botan::Classic_McEliece_Field_Ordering::create_field_ordering(), Botan::Sodium::crypto_core_hsalsa20(), Botan::GOST_28147_89::decrypt_n(), Botan::Kuznyechik::decrypt_n(), Botan::Serpent::decrypt_n(), Botan::Threefish_512::decrypt_n(), Botan::Twofish::decrypt_n(), Botan::FrodoMatrix::deserialize(), ed25519_verify(), Botan::GOST_28147_89::encrypt_n(), Botan::Kuznyechik::encrypt_n(), Botan::Serpent::encrypt_n(), Botan::Threefish_512::encrypt_n(), Botan::Twofish::encrypt_n(), Botan::Dilithium_Algos::expand_A(), Botan::Classic_McEliece_Minimal_Polynomial::from_bytes(), Botan::Gf448Elem::Gf448Elem(), load_4(), Botan::SIMD_4x32::load_le(), Botan::Kyber_Algos::load_le3(), Botan::FrodoMatrix::mul_add_as_plus_e(), Botan::FrodoMatrix::mul_add_sa_plus_e(), random_prime(), Botan::FrodoMatrix::sample(), Botan::Dilithium_Algos::sample_in_ball(), Botan::ChaCha::seek(), Botan::Salsa20::seek(), Botan::Salsa20::set_iv_bytes(), Botan::Threefish_512::set_tweak(), Botan::Sodium::sodium_free(), Botan::bitvector_base< secure_allocator >::subvector(), Botan::CRYSTALS::unpack(), and xts_update_tweak_block().

load_private_key()

std::unique_ptr< Private_Key > Botan::load_private_key	(	const AlgorithmIdentifier &	alg_id,
		std::span< const uint8_t >	key_bits )

Definition at line 283 of file pk_algs.cpp.

                                                                                                {
   const std::string oid_str = alg_id.oid().to_formatted_string();
   const std::vector<std::string> alg_info = split_on(oid_str, '/');
   std::string_view alg_name = alg_info[0];
 
#if defined(BOTAN_HAS_RSA)
   if(alg_name == "RSA") {
      return std::make_unique<RSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_X25519)
   if(alg_name == "X25519" || alg_name == "Curve25519") {
      return std::make_unique<X25519_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_X448)
   if(alg_name == "X448") {
      return std::make_unique<X448_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECDSA)
   if(alg_name == "ECDSA") {
      return std::make_unique<ECDSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECDH)
   if(alg_name == "ECDH") {
      return std::make_unique<ECDH_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
   if(alg_name == "DH") {
      return std::make_unique<DH_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DSA)
   if(alg_name == "DSA") {
      return std::make_unique<DSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_FRODOKEM)
   if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) {
      return std::make_unique<FrodoKEM_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
   if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
      return std::make_unique<Kyber_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ML_KEM)
   if(alg_name.starts_with("ML-KEM-")) {
      return std::make_unique<ML_KEM_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_MCELIECE)
   if(alg_name == "McEliece") {
      return std::make_unique<McEliece_PrivateKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECGDSA)
   if(alg_name == "ECGDSA") {
      return std::make_unique<ECGDSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECKCDSA)
   if(alg_name == "ECKCDSA") {
      return std::make_unique<ECKCDSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ED25519)
   if(alg_name == "Ed25519") {
      return std::make_unique<Ed25519_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ED448)
   if(alg_name == "Ed448") {
      return std::make_unique<Ed448_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_GOST_34_10_2001)
   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
      return std::make_unique<GOST_3410_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SM2)
   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
      return std::make_unique<SM2_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ELGAMAL)
   if(alg_name == "ElGamal") {
      return std::make_unique<ElGamal_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_XMSS_RFC8391)
   if(alg_name == "XMSS") {
      return std::make_unique<XMSS_PrivateKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
      return std::make_unique<Dilithium_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ML_DSA)
   if(alg_name.starts_with("ML-DSA-")) {
      return std::make_unique<ML_DSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_HSS_LMS)
   if(alg_name == "HSS-LMS-Private-Key") {
      return std::make_unique<HSS_LMS_PrivateKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
   if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) {
      return std::make_unique<SphincsPlus_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
   if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) {
      return std::make_unique<SLH_DSA_PrivateKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_CLASSICMCELIECE)
   if(alg_name.starts_with("ClassicMcEliece")) {
      return std::make_unique<Classic_McEliece_PrivateKey>(alg_id, key_bits);
   }
#endif
 
   throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
}

References fmt(), Botan::AlgorithmIdentifier::oid(), split_on(), and Botan::OID::to_formatted_string().

load_public_key()

std::unique_ptr< Public_Key > Botan::load_public_key	(	const AlgorithmIdentifier &	alg_id,
		std::span< const uint8_t >	key_bits )

Definition at line 124 of file pk_algs.cpp.

                                                                                              {
   const std::string oid_str = alg_id.oid().to_formatted_string();
   const std::vector<std::string> alg_info = split_on(oid_str, '/');
   std::string_view alg_name = alg_info[0];
 
#if defined(BOTAN_HAS_RSA)
   if(alg_name == "RSA") {
      return std::make_unique<RSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_X25519)
   if(alg_name == "X25519" || alg_name == "Curve25519") {
      return std::make_unique<X25519_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_X448)
   if(alg_name == "X448") {
      return std::make_unique<X448_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_MCELIECE)
   if(alg_name == "McEliece") {
      return std::make_unique<McEliece_PublicKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_FRODOKEM)
   if(alg_name == "FrodoKEM" || alg_name.starts_with("FrodoKEM-") || alg_name.starts_with("eFrodoKEM-")) {
      return std::make_unique<FrodoKEM_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
   if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
      return std::make_unique<Kyber_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ML_KEM)
   if(alg_name.starts_with("ML-KEM-")) {
      return std::make_unique<ML_KEM_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECDSA)
   if(alg_name == "ECDSA") {
      return std::make_unique<ECDSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECDH)
   if(alg_name == "ECDH") {
      return std::make_unique<ECDH_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
   if(alg_name == "DH") {
      return std::make_unique<DH_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DSA)
   if(alg_name == "DSA") {
      return std::make_unique<DSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ELGAMAL)
   if(alg_name == "ElGamal") {
      return std::make_unique<ElGamal_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECGDSA)
   if(alg_name == "ECGDSA") {
      return std::make_unique<ECGDSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ECKCDSA)
   if(alg_name == "ECKCDSA") {
      return std::make_unique<ECKCDSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ED25519)
   if(alg_name == "Ed25519") {
      return std::make_unique<Ed25519_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ED448)
   if(alg_name == "Ed448") {
      return std::make_unique<Ed448_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_GOST_34_10_2001)
   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
      return std::make_unique<GOST_3410_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SM2)
   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
      return std::make_unique<SM2_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_XMSS_RFC8391)
   if(alg_name == "XMSS") {
      return std::make_unique<XMSS_PublicKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
      return std::make_unique<Dilithium_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_ML_DSA)
   if(alg_name.starts_with("ML-DSA-")) {
      return std::make_unique<ML_DSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_HSS_LMS)
   if(alg_name == "HSS-LMS") {
      return std::make_unique<HSS_LMS_PublicKey>(key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2) || defined(BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE)
   if(alg_name == "SPHINCS+" || alg_name.starts_with("SphincsPlus-")) {
      return std::make_unique<SphincsPlus_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_SLH_DSA_WITH_SHA2) || defined(BOTAN_HAS_SLH_DSA_WITH_SHAKE)
   if(alg_name.starts_with("SLH-DSA-") || alg_name.starts_with("Hash-SLH-DSA-")) {
      return std::make_unique<SLH_DSA_PublicKey>(alg_id, key_bits);
   }
#endif
 
#if defined(BOTAN_HAS_CLASSICMCELIECE)
   if(alg_name.starts_with("ClassicMcEliece")) {
      return std::make_unique<Classic_McEliece_PublicKey>(alg_id, key_bits);
   }
#endif
 
   throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
}

References fmt(), Botan::AlgorithmIdentifier::oid(), split_on(), and Botan::OID::to_formatted_string().

Referenced by Botan::TLS::Hybrid_KEM_PublicKey::load_for_group(), and Botan::X509::load_key().

lock()

template<typename T>

secure_vector< T > Botan::lock

(

const std::vector< T > &

in

)

Definition at line 77 of file secmem.h.

                                              {
   return secure_vector<T>(in.begin(), in.end());
}

Referenced by Botan::Semaphore::acquire(), Botan::OID_Map::add_oid(), Botan::OID_Map::add_oid2str(), Botan::OID_Map::add_str2oid(), Botan::Memory_Pool::allocate(), Botan::Stateful_RNG::clear(), Botan::Memory_Pool::deallocate(), Botan::Stateful_RNG::force_reseed(), Botan::Stateful_RNG::initialize_with(), Botan::Stateful_RNG::is_seeded(), Botan::OID_Map::oid2str(), Botan::Thread_Pool::queue_thunk(), Botan::TPM2::PrivateKey::raw_private_key_bits(), Botan::Semaphore::release(), Botan::Stateful_RNG::reseed(), Botan::Stateful_RNG::reseed_from_rng(), Botan::Thread_Pool::shutdown(), Botan::OID_Map::str2oid(), Botan::Barrier::sync(), and Botan::Barrier::wait().

low_zero_bits()

size_t Botan::low_zero_bits

(

const BigInt &

x

)

Parameters

x	an integer

Returns

count of the low zero bits in x, or, equivalently, the largest value of n such that 2^n divides x evenly. Returns zero if x is equal to zero.

Definition at line 167 of file numthry.cpp.

                                      {
   size_t low_zero = 0;
 
   auto seen_nonempty_word = CT::Mask<word>::cleared();
 
   for(size_t i = 0; i != n.size(); ++i) {
      const word x = n.word_at(i);
 
      // ctz(0) will return sizeof(word)
      const size_t tz_x = ctz(x);
 
      // if x > 0 we want to count tz_x in total but not any
      // further words, so set the mask after the addition
      low_zero += seen_nonempty_word.if_not_set_return(tz_x);
 
      seen_nonempty_word |= CT::Mask<word>::expand(x);
   }
 
   // if we saw no words with x > 0 then n == 0 and the value we have
   // computed is meaningless. Instead return BigInt::zero() in that case.
   return static_cast<size_t>(seen_nonempty_word.if_set_return(low_zero));
}

References Botan::CT::Mask< T >::cleared(), ctz(), Botan::CT::Mask< T >::expand(), Botan::BigInt::size(), and Botan::BigInt::word_at().

Referenced by inverse_mod_general(), jacobi(), passes_miller_rabin_test(), Botan::RSA_PrivateKey::RSA_PrivateKey(), and sqrt_modulo_prime().

majority()

template<typename T>

T Botan::majority ( T a, T b, T c )

inlineconstexpr

Definition at line 210 of file bit_ops.h.

                                           {
   /*
   Considering each bit of a, b, c individually
 
   If a xor b is set, then c is the deciding vote.
 
   If a xor b is not set then either a and b are both set or both unset.
   In either case the value of c doesn't matter, and examining b (or a)
   allows us to determine which case we are in.
   */
   return choose(a ^ b, c, b);
}

References choose().

Referenced by SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

make_commoncrypto_block_cipher()

std::unique_ptr< BlockCipher > Botan::make_commoncrypto_block_cipher

(

std::string_view

name

)

Definition at line 133 of file commoncrypto_block.cpp.

                                                                               {
   try {
      CommonCryptor_Opts opts = commoncrypto_opts_from_algo_name(name);
      return std::make_unique<CommonCrypto_BlockCipher>(name, opts);
   } catch(CommonCrypto_Error& e) {
      return nullptr;
   }
}

References commoncrypto_opts_from_algo_name(), and make_commoncrypto_block_cipher().

Referenced by Botan::BlockCipher::create(), and make_commoncrypto_block_cipher().

make_commoncrypto_cipher_mode()

std::unique_ptr< Cipher_Mode > Botan::make_commoncrypto_cipher_mode	(	std::string_view	name,
		Cipher_Dir	direction )

Definition at line 213 of file commoncrypto_mode.cpp.

                                                                                                    {
   try {
      CommonCryptor_Opts opts = commoncrypto_opts_from_algo(name);
      return std::make_unique<CommonCrypto_Cipher_Mode>(name, direction, opts);
   } catch(CommonCrypto_Error& e) {
      return nullptr;
   }
}

References commoncrypto_opts_from_algo(), and make_commoncrypto_cipher_mode().

Referenced by Botan::Cipher_Mode::create(), and make_commoncrypto_cipher_mode().

make_commoncrypto_hash()

std::unique_ptr< HashFunction > Botan::make_commoncrypto_hash

(

std::string_view

name

)

Definition at line 80 of file commoncrypto_hash.cpp.

                                                                        {
#define MAKE_COMMONCRYPTO_HASH_3(name, hash, ctx)                                                          \
   std::unique_ptr<HashFunction>(new CommonCrypto_HashFunction<CC_##ctx##_CTX>({std::string(name),         \
                                                                                CC_##hash##_DIGEST_LENGTH, \
                                                                                CC_##hash##_BLOCK_BYTES,   \
                                                                                CC_##hash##_Init,          \
                                                                                CC_##hash##_Update,        \
                                                                                CC_##hash##_Final}));
 
#define MAKE_COMMONCRYPTO_HASH_2(name, id) MAKE_COMMONCRYPTO_HASH_3(name, id, id)
 
#define MAKE_COMMONCRYPTO_HASH_1(id) MAKE_COMMONCRYPTO_HASH_2(#id, id)
 
#if defined(BOTAN_HAS_SHA2_32)
   if(name == "SHA-224")
      return MAKE_COMMONCRYPTO_HASH_3(name, SHA224, SHA256);
   if(name == "SHA-256")
      return MAKE_COMMONCRYPTO_HASH_2(name, SHA256);
#endif
#if defined(BOTAN_HAS_SHA2_64)
   if(name == "SHA-384")
      return MAKE_COMMONCRYPTO_HASH_3(name, SHA384, SHA512);
   if(name == "SHA-512")
      return MAKE_COMMONCRYPTO_HASH_2(name, SHA512);
#endif
 
#if defined(BOTAN_HAS_SHA1)
   if(name == "SHA-1")
      return MAKE_COMMONCRYPTO_HASH_2(name, SHA1);
#endif
 
   return nullptr;
}

References MAKE_COMMONCRYPTO_HASH_2, and MAKE_COMMONCRYPTO_HASH_3.

Referenced by Botan::HashFunction::create().

make_compressor()

Compression_Algorithm * Botan::make_compressor ( std::string_view type )

inline

Definition at line 154 of file compression.h.

                                                                   {
   return Compression_Algorithm::create(type).release();
}

References Botan::Compression_Algorithm::create(), and make_compressor().

Referenced by make_compressor().

make_decompressor()

Decompression_Algorithm * Botan::make_decompressor ( std::string_view type )

inline

Definition at line 160 of file compression.h.

                                                                       {
   return Decompression_Algorithm::create(type).release();
}

References Botan::Decompression_Algorithm::create(), and make_decompressor().

Referenced by make_decompressor().

make_uint16()

uint16_t Botan::make_uint16 ( uint8_t i0, uint8_t i1 )

inlineconstexpr

Make a uint16_t from two bytes

Parameters

i0	the first byte
i1	the second byte

Returns

i0 || i1

Definition at line 92 of file loadstor.h.

                                                              {
   return static_cast<uint16_t>((static_cast<uint16_t>(i0) << 8) | i1);
}

Referenced by Botan::TLS::Certificate_Request_12::Certificate_Request_12(), Botan::TLS::TLS_Data_Reader::get_uint16_t(), Botan::Kyber_Modern_Symmetric_Primitives::get_XOF(), Botan::ML_KEM_Symmetric_Primitives::get_XOF(), Botan::TLS::TLS_Data_Reader::peek_uint16_t(), random_gf2m(), Botan::RTSS_Share::reconstruct(), and Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n().

make_uint32()

uint32_t Botan::make_uint32 ( uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3 )

inlineconstexpr

Make a uint32_t from four bytes

Parameters

i0	the first byte
i1	the second byte
i2	the third byte
i3	the fourth byte

Returns

i0 || i1 || i2 || i3

Definition at line 104 of file loadstor.h.

                                                                                      {
   return ((static_cast<uint32_t>(i0) << 24) | (static_cast<uint32_t>(i1) << 16) | (static_cast<uint32_t>(i2) << 8) |
           (static_cast<uint32_t>(i3)));
}

Referenced by Botan::TLS::Certificate_12::Certificate_12(), Botan::TLS::Certificate_Status::Certificate_Status(), Botan::TLS::Stream_Handshake_IO::get_next_record(), Botan::TLS::TLS_Data_Reader::get_uint24_t(), Botan::TLS::TLS_Data_Reader::get_uint32_t(), and Botan::SIMD_4x32::splat_u8().

make_uint64()

uint64_t Botan::make_uint64 ( uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3, uint8_t i4, uint8_t i5, uint8_t i6, uint8_t i7 )

inlineconstexpr

Make a uint64_t from eight bytes

Parameters

i0	the first byte
i1	the second byte
i2	the third byte
i3	the fourth byte
i4	the fifth byte
i5	the sixth byte
i6	the seventh byte
i7	the eighth byte

Returns

i0 || i1 || i2 || i3 || i4 || i5 || i6 || i7

Definition at line 121 of file loadstor.h.

                                                                                                   {
   return ((static_cast<uint64_t>(i0) << 56) | (static_cast<uint64_t>(i1) << 48) | (static_cast<uint64_t>(i2) << 40) |
           (static_cast<uint64_t>(i3) << 32) | (static_cast<uint64_t>(i4) << 24) | (static_cast<uint64_t>(i5) << 16) |
           (static_cast<uint64_t>(i6) << 8) | (static_cast<uint64_t>(i7)));
}

map_remove_if()

template<typename T, typename Pred>

void Botan::map_remove_if	(	Pred	pred,
		T &	assoc )

Definition at line 71 of file stl_util.h.

                                        {
   auto i = assoc.begin();
   while(i != assoc.end()) {
      if(pred(i->first)) {
         assoc.erase(i++);
      } else {
         i++;
      }
   }
}

Referenced by Botan::TLS::Channel_Impl_12::activate_session().

mceliece_decrypt() [1/3]

secure_vector< uint8_t > Botan::mceliece_decrypt	(	secure_vector< gf2m > &	error_pos,
		const uint8_t *	ciphertext,
		size_t	ciphertext_len,
		const McEliece_PrivateKey &	key )

p_err_pos_len must point to the available length of error_pos on input, the function will set it to the actual number of errors returned in the error_pos array

Definition at line 148 of file goppa_code.cpp.

                                                                        {
   const size_t dimension = key.get_dimension();
   const size_t codimension = key.get_codimension();
   const uint32_t t = key.get_goppa_polyn().get_degree();
   polyn_gf2m syndrome_polyn(key.get_goppa_polyn().get_sp_field());  // init as zero polyn
   const unsigned unused_pt_bits = dimension % 8;
   const uint8_t unused_pt_bits_mask = (1 << unused_pt_bits) - 1;
 
   if(ciphertext_len != (key.get_code_length() + 7) / 8) {
      throw Invalid_Argument("wrong size of McEliece ciphertext");
   }
   const size_t cleartext_len = (key.get_message_word_bit_length() + 7) / 8;
 
   if(cleartext_len != bit_size_to_byte_size(dimension)) {
      throw Invalid_Argument("mce-decryption: wrong length of cleartext buffer");
   }
 
   secure_vector<uint32_t> syndrome_vec(bit_size_to_32bit_size(codimension));
   matrix_arr_mul(key.get_H_coeffs(),
                  key.get_code_length(),
                  bit_size_to_32bit_size(codimension),
                  ciphertext,
                  syndrome_vec.data(),
                  syndrome_vec.size());
 
   secure_vector<uint8_t> syndrome_byte_vec(bit_size_to_byte_size(codimension));
   const size_t syndrome_byte_vec_size = syndrome_byte_vec.size();
   for(size_t i = 0; i < syndrome_byte_vec_size; i++) {
      syndrome_byte_vec[i] = static_cast<uint8_t>(syndrome_vec[i / 4] >> (8 * (i % 4)));
   }
 
   syndrome_polyn = polyn_gf2m(
      t - 1, syndrome_byte_vec.data(), bit_size_to_byte_size(codimension), key.get_goppa_polyn().get_sp_field());
 
   syndrome_polyn.get_degree();
   error_pos = goppa_decode(syndrome_polyn, key.get_goppa_polyn(), key.get_sqrtmod(), key.get_Linv());
 
   const size_t nb_err = error_pos.size();
 
   secure_vector<uint8_t> cleartext(cleartext_len);
   copy_mem(cleartext.data(), ciphertext, cleartext_len);
 
   for(size_t i = 0; i < nb_err; i++) {
      gf2m current = error_pos[i];
 
      if(current >= cleartext_len * 8) {
         // an invalid position, this shouldn't happen
         continue;
      }
      cleartext[current / 8] ^= (1 << (current % 8));
   }
 
   if(unused_pt_bits) {
      cleartext[cleartext_len - 1] &= unused_pt_bits_mask;
   }
 
   return cleartext;
}

References bit_size_to_32bit_size(), bit_size_to_byte_size(), copy_mem(), Botan::McEliece_PublicKey::get_code_length(), Botan::McEliece_PrivateKey::get_codimension(), Botan::polyn_gf2m::get_degree(), Botan::McEliece_PrivateKey::get_dimension(), Botan::McEliece_PrivateKey::get_goppa_polyn(), Botan::McEliece_PrivateKey::get_H_coeffs(), Botan::McEliece_PrivateKey::get_Linv(), Botan::McEliece_PublicKey::get_message_word_bit_length(), Botan::polyn_gf2m::get_sp_field(), and Botan::McEliece_PrivateKey::get_sqrtmod().

mceliece_decrypt() [2/3]

void Botan::mceliece_decrypt	(	secure_vector< uint8_t > &	plaintext,
		secure_vector< uint8_t > &	error_mask,
		const uint8_t	ciphertext[],
		size_t	ciphertext_len,
		const McEliece_PrivateKey &	key )

Definition at line 124 of file goppa_code.cpp.

                                                      {
   secure_vector<gf2m> error_pos;
   plaintext = mceliece_decrypt(error_pos, ciphertext, ciphertext_len, key);
 
   const size_t code_length = key.get_code_length();
   secure_vector<uint8_t> result((code_length + 7) / 8);
   for(auto&& pos : error_pos) {
      if(pos > code_length) {
         throw Invalid_Argument("error position larger than code size");
      }
      result[pos / 8] |= (1 << (pos % 8));
   }
 
   error_mask = result;
}

References Botan::McEliece_PublicKey::get_code_length(), and mceliece_decrypt().

mceliece_decrypt() [3/3]

void Botan::mceliece_decrypt	(	secure_vector< uint8_t > &	plaintext_out,
		secure_vector< uint8_t > &	error_mask_out,
		const secure_vector< uint8_t > &	ciphertext,
		const McEliece_PrivateKey &	key )

Definition at line 117 of file goppa_code.cpp.

                                                      {
   mceliece_decrypt(plaintext_out, error_mask_out, ciphertext.data(), ciphertext.size(), key);
}

References mceliece_decrypt().

Referenced by Botan::McEliece_PrivateKey::check_key(), mceliece_decrypt(), and mceliece_decrypt().

mceliece_encrypt()

void Botan::mceliece_encrypt	(	secure_vector< uint8_t > &	ciphertext_out,
		secure_vector< uint8_t > &	error_mask_out,
		const secure_vector< uint8_t > &	plaintext,
		const McEliece_PublicKey &	key,
		RandomNumberGenerator &	rng )

Definition at line 109 of file mceliece.cpp.

                                                  {
   const uint16_t code_length = static_cast<uint16_t>(key.get_code_length());
 
   secure_vector<uint8_t> error_mask = create_random_error_vector(code_length, key.get_t(), rng);
 
   secure_vector<uint8_t> ciphertext =
      mult_by_pubkey(plaintext, key.get_public_matrix(), key.get_code_length(), key.get_t());
 
   ciphertext ^= error_mask;
 
   ciphertext_out.swap(ciphertext);
   error_mask_out.swap(error_mask);
}

References Botan::McEliece_PublicKey::get_code_length(), Botan::McEliece_PublicKey::get_public_matrix(), and Botan::McEliece_PublicKey::get_t().

Referenced by Botan::McEliece_PrivateKey::check_key().

mceliece_work_factor()

size_t Botan::mceliece_work_factor	(	size_t	code_size,
		size_t	t )

Estimate work factor for McEliece

Returns

estimated security level for these key parameters

Definition at line 90 of file mce_workfactor.cpp.

                                                {
   const size_t k = n - ceil_log2(n) * t;
 
   double min = cout_total(n, k, t, 0, 0);  // correspond a p=1
   for(size_t p = 0; p != t / 2; ++p) {
      double lwf = best_wf(n, k + 1, t, p);
      if(lwf < 0) {
         break;
      }
 
      min = std::min(min, lwf);
   }
 
   return static_cast<size_t>(min);
}

References ceil_log2().

Referenced by Botan::McEliece_PublicKey::estimated_strength().

measure_cost()

template<typename F>

uint64_t Botan::measure_cost	(	std::chrono::milliseconds	trial_msec,
		F	func )

Definition at line 21 of file time_utils.h.

                                                                {
#if defined(BOTAN_HAS_OS_UTILS)
   const uint64_t trial_nsec = std::chrono::duration_cast<std::chrono::nanoseconds>(trial_msec).count();
 
   uint64_t total_nsec = 0;
   uint64_t trials = 0;
 
   auto trial_start = OS::get_system_timestamp_ns();
 
   for(;;) {
      const auto start = OS::get_system_timestamp_ns();
      func();
      const auto end = OS::get_system_timestamp_ns();
 
      if(end >= start) {
         total_nsec += (end - start);
         trials += 1;
 
         if((end - trial_start) >= trial_nsec) {
            return (total_nsec / trials);
         }
      }
   }
 
#else
   BOTAN_UNUSED(trial_msec, func);
   throw Not_Implemented("No system clock available");
#endif
}

References BOTAN_UNUSED, and Botan::OS::get_system_timestamp_ns().

Referenced by Botan::Argon2_Family::tune(), Botan::Bcrypt_PBKDF_Family::tune(), Botan::RFC4880_S2K_Family::tune(), and Botan::Scrypt_Family::tune().

mgf1_mask() [1/2]

void Botan::mgf1_mask	(	HashFunction &	hash,
		const uint8_t	in[],
		size_t	in_len,
		uint8_t	out[],
		size_t	out_len )

MGF1 from PKCS #1 v2.0

Parameters

hash	hash function to use
in	input buffer
in_len	size of the input buffer in bytes
out	output buffer. The buffer is XORed with the output of MGF1.
out_len	size of the output buffer in bytes

Definition at line 16 of file mgf1.cpp.

                                                                                                     {
   uint32_t counter = 0;
 
   std::vector<uint8_t> buffer(hash.output_length());
   while(out_len) {
      hash.update(in, in_len);
      hash.update_be(counter);
      hash.final(buffer.data());
 
      const size_t xored = std::min<size_t>(buffer.size(), out_len);
      xor_buf(out, buffer.data(), xored);
      out += xored;
      out_len -= xored;
 
      ++counter;
   }
}

References Botan::Buffered_Computation::final(), Botan::Buffered_Computation::output_length(), Botan::Buffered_Computation::update(), Botan::Buffered_Computation::update_be(), and xor_buf().

Referenced by mgf1_mask().

mgf1_mask() [2/2]

void Botan::mgf1_mask ( HashFunction & hash, std::span< const uint8_t > input, std::span< uint8_t > output )

inline

Definition at line 28 of file mgf1.h.

                                                                                                 {
   mgf1_mask(hash, input.data(), input.size(), output.data(), output.size());
}

References mgf1_mask().

miller_rabin_test_iterations()

size_t Botan::miller_rabin_test_iterations	(	size_t	n_bits,
		size_t	prob,
		bool	random )

Return required number of Miller-Rabin tests in order to reach the specified probability of error.

Parameters

n_bits	the bit-length of the integer being tested
prob	chance of false positive is bounded by 1/2**prob
random	is set if (and only if) the integer was randomly generated by us and thus cannot have been maliciously constructed.

Definition at line 174 of file primality.cpp.

                                                                             {
   const size_t base = (prob + 2) / 2;  // worst case 4^-t error rate
 
   /*
   * If the candidate prime was maliciously constructed, we can't rely
   * on arguments based on p being random.
   */
   if(random == false) {
      return base;
   }
 
   /*
   * For randomly chosen numbers we can use the estimates from
   * http://www.math.dartmouth.edu/~carlp/PDF/paper88.pdf
   *
   * These values are derived from the inequality for p(k,t) given on
   * the second page.
   */
   if(prob <= 128) {
      if(n_bits >= 1536) {
         return 4;  // < 2^-133
      }
      if(n_bits >= 1024) {
         return 6;  // < 2^-133
      }
      if(n_bits >= 512) {
         return 12;  // < 2^-129
      }
      if(n_bits >= 256) {
         return 29;  // < 2^-128
      }
   }
 
   /*
   If the user desires a smaller error probability than we have
   precomputed error estimates for, just fall back to using the worst
   case error rate.
   */
   return base;
}

Referenced by generate_rsa_prime(), is_prime(), and random_prime().

modular_inverse()

template<std::integral T, std::integral T2 = next_longer_int_t<T>>
requires (sizeof(T) <= 4)

T Botan::modular_inverse ( T q, T2 m = T2(1) << sizeof(T) * 8 )

consteval

Calculate the modular multiplacative inverse of q modulo m. By default, this assumes m to be 2^bitlength of T for application in a Montgomery reduction.

Definition at line 94 of file pqcrystals_helpers.h.

                                                                {
   return static_cast<T>(extended_euclidean_algorithm<T2>(q, m).u);
}

References extended_euclidean_algorithm().

montgomery_R()

template<std::integral T>
requires (size_t(sizeof(T)) <= 4)

T Botan::montgomery_R ( T q )

consteval

Definition at line 44 of file pqcrystals_helpers.h.

                              {
   using T_unsigned = std::make_unsigned_t<T>;
   using T2 = next_longer_uint_t<T_unsigned>;
   return (T2(1) << (sizeof(T) * 8)) % q;
}

Referenced by montgomery_R2().

montgomery_R2()

template<std::integral T>
requires (size_t(sizeof(T)) <= 4)

T Botan::montgomery_R2 ( T q )

consteval

Definition at line 52 of file pqcrystals_helpers.h.

                               {
   using T2 = next_longer_int_t<T>;
   return (static_cast<T2>(montgomery_R(q)) * static_cast<T2>(montgomery_R(q))) % q;
}

References montgomery_R().

monty_execute()

Montgomery_Int Botan::monty_execute	(	const Montgomery_Exponentation_State &	precomputed_state,
		const BigInt &	k,
		size_t	max_k_bits )

Definition at line 152 of file monty_exp.cpp.

                                                {
   return precomputed_state.exponentiation(k, max_k_bits);
}

References monty_execute().

Referenced by monty_execute(), monty_exp(), and passes_miller_rabin_test().

monty_execute_vartime()

Montgomery_Int Botan::monty_execute_vartime	(	const Montgomery_Exponentation_State &	precomputed_state,
		const BigInt &	k )

Definition at line 158 of file monty_exp.cpp.

                                                                                                               {
   return precomputed_state.exponentiation_vartime(k);
}

References monty_execute_vartime().

Referenced by monty_execute_vartime(), and monty_exp_vartime().

monty_exp()

Montgomery_Int Botan::monty_exp ( const std::shared_ptr< const Montgomery_Params > & params_p, const BigInt & g, const BigInt & k, size_t max_k_bits )

inline

Definition at line 48 of file monty_exp.h.

                                                   {
   auto precomputed = monty_precompute(params_p, g, 4, true);
   return monty_execute(*precomputed, k, max_k_bits);
}

References monty_execute(), and monty_precompute().

Referenced by power_mod().

monty_exp_vartime()

Montgomery_Int Botan::monty_exp_vartime ( const std::shared_ptr< const Montgomery_Params > & params_p, const BigInt & g, const BigInt & k )

inline

Definition at line 56 of file monty_exp.h.

                                                         {
   auto precomputed = monty_precompute(params_p, g, 4, false);
   return monty_execute_vartime(*precomputed, k);
}

References monty_execute_vartime(), and monty_precompute().

Referenced by sqrt_modulo_prime().

monty_inverse()

template<WordType W>

auto Botan::monty_inverse ( W a ) -> W

inlineconstexpr

Definition at line 766 of file mp_core.h.

                                              {
   if(a % 2 == 0) {
      throw Invalid_Argument("monty_inverse only valid for odd integers");
   }
 
   /*
   * From "A New Algorithm for Inversion mod p^k" by Çetin Kaya Koç
   * https://eprint.iacr.org/2017/411.pdf sections 5 and 7.
   */
 
   W b = 1;
   W r = 0;
 
   for(size_t i = 0; i != WordInfo<W>::bits; ++i) {
      const W bi = b % 2;
      r >>= 1;
      r += bi << (WordInfo<W>::bits - 1);
 
      b -= a * bi;
      b >>= 1;
   }
 
   // Now invert in addition space
   r = (WordInfo<W>::max - r) + 1;
 
   return r;
}

Referenced by Botan::Montgomery_Params::Montgomery_Params(), and Botan::Montgomery_Params::Montgomery_Params().

monty_multi_exp()

Montgomery_Int Botan::monty_multi_exp	(	const std::shared_ptr< const Montgomery_Params > &	params_p,
		const BigInt &	x,
		const BigInt &	z1,
		const BigInt &	y,
		const BigInt &	z2 )

Return (x^z1 * y^z2) % p

Definition at line 162 of file monty_exp.cpp.

                                                 {
   if(z1.is_negative() || z2.is_negative()) {
      throw Invalid_Argument("multi_exponentiate exponents must be positive");
   }
 
   const size_t z_bits = round_up(std::max(z1.bits(), z2.bits()), 2);
 
   secure_vector<word> ws;
 
   const Montgomery_Int one(params_p, params_p->R1(), false);
   //const Montgomery_Int one(params_p, 1);
 
   const Montgomery_Int x1(params_p, x_bn);
   const Montgomery_Int x2 = x1.square(ws);
   const Montgomery_Int x3 = x2.mul(x1, ws);
 
   const Montgomery_Int y1(params_p, y_bn);
   const Montgomery_Int y2 = y1.square(ws);
   const Montgomery_Int y3 = y2.mul(y1, ws);
 
   const Montgomery_Int y1x1 = y1.mul(x1, ws);
   const Montgomery_Int y1x2 = y1.mul(x2, ws);
   const Montgomery_Int y1x3 = y1.mul(x3, ws);
 
   const Montgomery_Int y2x1 = y2.mul(x1, ws);
   const Montgomery_Int y2x2 = y2.mul(x2, ws);
   const Montgomery_Int y2x3 = y2.mul(x3, ws);
 
   const Montgomery_Int y3x1 = y3.mul(x1, ws);
   const Montgomery_Int y3x2 = y3.mul(x2, ws);
   const Montgomery_Int y3x3 = y3.mul(x3, ws);
 
   const Montgomery_Int* M[16] = {&one,
                                  &x1,  // 0001
                                  &x2,  // 0010
                                  &x3,  // 0011
                                  &y1,  // 0100
                                  &y1x1,
                                  &y1x2,
                                  &y1x3,
                                  &y2,  // 1000
                                  &y2x1,
                                  &y2x2,
                                  &y2x3,
                                  &y3,  // 1100
                                  &y3x1,
                                  &y3x2,
                                  &y3x3};
 
   Montgomery_Int H = one;
 
   for(size_t i = 0; i != z_bits; i += 2) {
      if(i > 0) {
         H.square_this(ws);
         H.square_this(ws);
      }
 
      const uint32_t z1_b = z1.get_substring(z_bits - i - 2, 2);
      const uint32_t z2_b = z2.get_substring(z_bits - i - 2, 2);
 
      const uint32_t z12 = (4 * z2_b) + z1_b;
 
      H.mul_by(*M[z12], ws);
   }
 
   return H;
}

References Botan::BigInt::bits(), Botan::BigInt::get_substring(), Botan::BigInt::is_negative(), monty_multi_exp(), Botan::Montgomery_Int::mul(), Botan::Montgomery_Int::mul_by(), round_up(), Botan::Montgomery_Int::square(), and Botan::Montgomery_Int::square_this().

Referenced by monty_multi_exp(), and Botan::DL_Group::multi_exponentiate().

monty_precompute() [1/2]

std::shared_ptr< const Montgomery_Exponentation_State > Botan::monty_precompute	(	const Montgomery_Int &	g,
		size_t	window_bits,
		bool	const_time )

Definition at line 139 of file monty_exp.cpp.

                                                                                        {
   return std::make_shared<const Montgomery_Exponentation_State>(g, window_bits, const_time);
}

References monty_precompute().

Referenced by monty_exp(), monty_exp_vartime(), monty_precompute(), monty_precompute(), and passes_miller_rabin_test().

monty_precompute() [2/2]

std::shared_ptr< const Montgomery_Exponentation_State > Botan::monty_precompute	(	const std::shared_ptr< const Montgomery_Params > &	params,
		const BigInt &	g,
		size_t	window_bits,
		bool	const_time )

Definition at line 145 of file monty_exp.cpp.

                                                                                                               {
   BOTAN_ARG_CHECK(g < params->p(), "Montgomery base too big");
   Montgomery_Int monty_g(params, g);
   return monty_precompute(monty_g, window_bits, const_time);
}

References BOTAN_ARG_CHECK, and monty_precompute().

mul2_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>

C::ProjectivePoint Botan::mul2_exec	(	const AffinePointTable< C > &	table,
		const BlindedScalar &	x,
		const BlindedScalar &	y,
		RandomNumberGenerator &	rng )

Definition at line 372 of file pcurves_mul.h.

                                                                  {
   const size_t Windows = (x.bits() + WindowBits - 1) / WindowBits;
 
   auto accum = [&]() {
      const size_t w_1 = x.get_window((Windows - 1) * WindowBits);
      const size_t w_2 = y.get_window((Windows - 1) * WindowBits);
      const size_t window = w_1 + (w_2 << WindowBits);
      auto pt = C::ProjectivePoint::from_affine(table.ct_select(window));
      CT::poison(pt);
      pt.randomize_rep(rng);
      return pt;
   }();
 
   for(size_t i = 1; i != Windows; ++i) {
      accum = accum.dbl_n(WindowBits);
 
      const size_t w_1 = x.get_window((Windows - i - 1) * WindowBits);
      const size_t w_2 = y.get_window((Windows - i - 1) * WindowBits);
      const size_t window = w_1 + (w_2 << WindowBits);
      accum += table.ct_select(window);
 
      if(i <= 3) {
         accum.randomize_rep(rng);
      }
   }
 
   CT::unpoison(accum);
   return accum;
}

References Botan::AffinePointTable< C, R >::ct_select(), Botan::CT::poison(), and Botan::CT::unpoison().

mul2_setup()

template<typename C, size_t WindowBits>

std::vector< typename C::ProjectivePoint > Botan::mul2_setup	(	const typename C::AffinePoint &	p,
		const typename C::AffinePoint &	q )

Definition at line 312 of file pcurves_mul.h.

                                                                                    {
   static_assert(WindowBits >= 1 && WindowBits <= 4);
 
   // 2^(2*W) elements, less the identity element
   constexpr size_t TableSize = (1 << (2 * WindowBits)) - 1;
   constexpr size_t WindowSize = (1 << WindowBits);
 
   std::vector<typename C::ProjectivePoint> table;
   table.reserve(TableSize);
 
   for(size_t i = 0; i != TableSize; ++i) {
      const size_t t_i = (i + 1);
      const size_t p_i = t_i % WindowSize;
      const size_t q_i = (t_i >> WindowBits) % WindowSize;
 
      // Returns x_i * x + y_i * y
      auto next_tbl_e = [&]() {
         if(p_i % 2 == 0 && q_i % 2 == 0) {
            // Where possible using doubling (eg indices 1, 7, 9 in
            // the table above)
            return table[(t_i / 2) - 1].dbl();
         } else if(p_i > 0 && q_i > 0) {
            // A combination of p and q
            if(p_i == 1) {
               return p + table[(q_i << WindowBits) - 1];
            } else if(q_i == 1) {
               return table[p_i - 1] + q;
            } else {
               return table[p_i - 1] + table[(q_i << WindowBits) - 1];
            }
         } else if(p_i > 0 && q_i == 0) {
            // A multiple of p without a q component
            if(p_i == 1) {
               // Just p
               return C::ProjectivePoint::from_affine(p);
            } else {
               // p * p_{i-1}
               return p + table[p_i - 1 - 1];
            }
         } else if(p_i == 0 && q_i > 0) {
            if(q_i == 1) {
               // Just q
               return C::ProjectivePoint::from_affine(q);
            } else {
               // q * q_{i-1}
               return q + table[((q_i - 1) << WindowBits) - 1];
            }
         } else {
            BOTAN_ASSERT_UNREACHABLE();
         }
      };
 
      table.emplace_back(next_tbl_e());
   }
 
   return table;
}

References BOTAN_ASSERT_UNREACHABLE.

mul64x64_128()

void Botan::mul64x64_128 ( uint64_t a, uint64_t b, uint64_t * lo, uint64_t * hi )

inlineconstexpr

Perform a 64x64->128 bit multiplication

Definition at line 24 of file mul128.h.

                                                                                       {
   if(!std::is_constant_evaluated()) {
#if defined(BOTAN_BUILD_COMPILER_IS_MSVC) && defined(BOTAN_TARGET_ARCH_IS_X86_64)
      *lo = _umul128(a, b, hi);
      return;
 
#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC) && defined(BOTAN_TARGET_ARCH_IS_ARM64)
      *lo = a * b;
      *hi = __umulh(a, b);
      return;
#endif
   }
 
#if defined(BOTAN_TARGET_HAS_NATIVE_UINT128)
   const uint128_t r = static_cast<uint128_t>(a) * b;
   *hi = (r >> 64) & 0xFFFFFFFFFFFFFFFF;
   *lo = (r) & 0xFFFFFFFFFFFFFFFF;
#else
 
   /*
   * Do a 64x64->128 multiply using four 32x32->64 multiplies plus
   * some adds and shifts.
   */
   const size_t HWORD_BITS = 32;
   const uint32_t HWORD_MASK = 0xFFFFFFFF;
 
   const uint32_t a_hi = (a >> HWORD_BITS);
   const uint32_t a_lo = (a & HWORD_MASK);
   const uint32_t b_hi = (b >> HWORD_BITS);
   const uint32_t b_lo = (b & HWORD_MASK);
 
   const uint64_t x0 = static_cast<uint64_t>(a_hi) * b_hi;
   const uint64_t x1 = static_cast<uint64_t>(a_lo) * b_hi;
   const uint64_t x2 = static_cast<uint64_t>(a_hi) * b_lo;
   const uint64_t x3 = static_cast<uint64_t>(a_lo) * b_lo;
 
   // this cannot overflow as (2^32-1)^2 + 2^32-1 + 2^32-1 = 2^64-1
   const uint64_t middle = x2 + (x3 >> HWORD_BITS) + (x1 & HWORD_MASK);
 
   // likewise these cannot overflow
   *hi = x0 + (middle >> HWORD_BITS) + (x1 >> HWORD_BITS);
   *lo = (middle << HWORD_BITS) + (x3 & HWORD_MASK);
#endif
}

Referenced by operator*().

multi_exponentiate()

EC_Point Botan::multi_exponentiate	(	const EC_Point &	p1,
		const BigInt &	z1,
		const EC_Point &	p2,
		const BigInt &	z2 )

ECC point multiexponentiation - not constant time!

Parameters

p1	a point
z1	a scalar
p2	a point
z2	a scalar

Returns

(p1 * z1 + p2 * z2)

Definition at line 35 of file point_mul.cpp.

                                                                                                      {
   EC_Point_Multi_Point_Precompute xy_mul(x, y);
   return xy_mul.multi_exp(z1, z2);
}

References Botan::EC_Point_Multi_Point_Precompute::multi_exp().

nist_key_unwrap()

secure_vector< uint8_t > Botan::nist_key_unwrap	(	const uint8_t	input[],
		size_t	input_len,
		const BlockCipher &	bc )

Parameters

input	the value to be decrypted, output of nist_key_wrap
input_len	length of input
bc	a keyed 128-bit block cipher that will be used to decrypt input

Returns

input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 116 of file nist_keywrap.cpp.

                                                                                                       {
   if(bc.block_size() != 16) {
      throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
   }
 
   if(input_len < 16 || input_len % 8 != 0) {
      throw Invalid_Argument("Bad input size for NIST key unwrap");
   }
 
   const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
 
   uint64_t ICV_out = 0;
   secure_vector<uint8_t> R;
 
   if(input_len == 16) {
      secure_vector<uint8_t> block(input, input + input_len);
      bc.decrypt(block);
 
      ICV_out = load_be<uint64_t>(block.data(), 0);
      R.resize(8);
      copy_mem(R.data(), block.data() + 8, 8);
   } else {
      R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
   }
 
   if(ICV_out != ICV) {
      throw Invalid_Authentication_Tag("NIST key unwrap failed");
   }
 
   return R;
}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::decrypt(), and load_be().

Referenced by botan_nist_kw_dec(), and rfc3394_keyunwrap().

nist_key_unwrap_padded()

secure_vector< uint8_t > Botan::nist_key_unwrap_padded	(	const uint8_t	input[],
		size_t	input_len,
		const BlockCipher &	bc )

Parameters

input	the value to be decrypted, output of nist_key_wrap
input_len	length of input
bc	a keyed 128-bit block cipher that will be used to decrypt input

Returns

input decrypted under NIST key wrap algorithm Throws an exception if decryption fails.

Definition at line 169 of file nist_keywrap.cpp.

                                                                                                              {
   if(bc.block_size() != 16) {
      throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
   }
 
   if(input_len < 16 || input_len % 8 != 0) {
      throw Invalid_Argument("Bad input size for NIST key unwrap");
   }
 
   uint64_t ICV_out = 0;
   secure_vector<uint8_t> R;
 
   if(input_len == 16) {
      secure_vector<uint8_t> block(input, input + input_len);
      bc.decrypt(block);
 
      ICV_out = load_be<uint64_t>(block.data(), 0);
      R.resize(8);
      copy_mem(R.data(), block.data() + 8, 8);
   } else {
      R = raw_nist_key_unwrap(input, input_len, bc, ICV_out);
   }
 
   if((ICV_out >> 32) != 0xA65959A6) {
      throw Invalid_Authentication_Tag("NIST key unwrap failed");
   }
 
   const size_t len = (ICV_out & 0xFFFFFFFF);
 
   if(R.size() < 8 || len > R.size() || len <= R.size() - 8) {
      throw Invalid_Authentication_Tag("NIST key unwrap failed");
   }
 
   const size_t padding = R.size() - len;
 
   for(size_t i = 0; i != padding; ++i) {
      if(R[R.size() - i - 1] != 0) {
         throw Invalid_Authentication_Tag("NIST key unwrap failed");
      }
   }
 
   R.resize(R.size() - padding);
 
   return R;
}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::decrypt(), and load_be().

Referenced by botan_nist_kw_dec(), Botan::Encrypted_PSK_Database::get(), and Botan::Encrypted_PSK_Database::list_names().

nist_key_wrap()

std::vector< uint8_t > Botan::nist_key_wrap	(	const uint8_t	input[],
		size_t	input_len,
		const BlockCipher &	bc )

Key wrap. See RFC 3394 and NIST SP800-38F

Parameters

input	the value to be encrypted
input_len	length of input, must be a multiple of 8
bc	a keyed 128-bit block cipher that will be used to encrypt input

Returns

input encrypted under NIST key wrap algorithm

Definition at line 90 of file nist_keywrap.cpp.

                                                                                                 {
   if(bc.block_size() != 16) {
      throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
   }
 
   if(input_len % 8 != 0) {
      throw Invalid_Argument("Bad input size for NIST key wrap");
   }
 
   const uint64_t ICV = 0xA6A6A6A6A6A6A6A6;
 
   if(input_len == 8) {
      /*
      * Special case for small inputs: if input == 8 bytes just use ECB
      * (see RFC 3394 Section 2)
      */
      std::vector<uint8_t> block(16);
      store_be(ICV, block.data());
      copy_mem(block.data() + 8, input, input_len);
      bc.encrypt(block);
      return block;
   } else {
      return raw_nist_key_wrap(input, input_len, bc, ICV);
   }
}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::encrypt(), and store_be().

Referenced by botan_nist_kw_enc(), and rfc3394_keywrap().

nist_key_wrap_padded()

std::vector< uint8_t > Botan::nist_key_wrap_padded	(	const uint8_t	input[],
		size_t	input_len,
		const BlockCipher &	bc )

KWP (key wrap with padding). See RFC 5649 and NIST SP800-38F

Parameters

input	the value to be encrypted
input_len	length of input
bc	a keyed 128-bit block cipher that will be used to encrypt input

Returns

input encrypted under NIST key wrap algorithm

Definition at line 148 of file nist_keywrap.cpp.

                                                                                                        {
   if(bc.block_size() != 16) {
      throw Invalid_Argument("NIST key wrap algorithm requires a 128-bit cipher");
   }
 
   const uint64_t ICV = 0xA65959A600000000 | static_cast<uint32_t>(input_len);
 
   if(input_len <= 8) {
      /*
      * Special case for small inputs: if input <= 8 bytes just use ECB
      */
      std::vector<uint8_t> block(16);
      store_be(ICV, block.data());
      copy_mem(block.data() + 8, input, input_len);
      bc.encrypt(block);
      return block;
   } else {
      return raw_nist_key_wrap(input, input_len, bc, ICV);
   }
}

References Botan::BlockCipher::block_size(), copy_mem(), Botan::BlockCipher::encrypt(), and store_be().

Referenced by botan_nist_kw_enc(), Botan::Encrypted_PSK_Database::get(), Botan::Encrypted_PSK_Database::remove(), and Botan::Encrypted_PSK_Database::set().

oaep_find_delim()

BOTAN_FUZZER_API CT::Option< size_t > Botan::oaep_find_delim	(	std::span< const uint8_t >	input,
		std::span< const uint8_t >	phash )

Definition at line 102 of file oaep.cpp.

                                                                                             {
   // Too short to be valid, reject immediately
   if(input.size() < 1 + 2 * phash.size()) {
      return {};
   }
 
   size_t delim_idx = 2 * phash.size();
   CT::Mask<uint8_t> waiting_for_delim = CT::Mask<uint8_t>::set();
   CT::Mask<uint8_t> bad_input_m = CT::Mask<uint8_t>::cleared();
 
   for(uint8_t ib : input.subspan(2 * phash.size())) {
      const auto zero_m = CT::Mask<uint8_t>::is_zero(ib);
      const auto one_m = CT::Mask<uint8_t>::is_equal(ib, 1);
 
      const auto add_m = waiting_for_delim & zero_m;
 
      bad_input_m |= waiting_for_delim & ~(zero_m | one_m);
 
      delim_idx += add_m.if_set_return(1);
 
      waiting_for_delim &= zero_m;
   }
 
   // If we never saw any non-zero byte, then it's not valid input
   bad_input_m |= waiting_for_delim;
 
   // If the P hash is wrong, then it's not valid
   bad_input_m |= CT::is_not_equal(&input[phash.size()], phash.data(), phash.size());
 
   delim_idx += 1;
 
   const auto accept = !(bad_input_m.as_choice());
 
   return CT::Option(delim_idx, accept);
}

References Botan::CT::Mask< T >::as_choice(), Botan::CT::Mask< T >::cleared(), Botan::CT::Mask< T >::if_set_return(), Botan::CT::Mask< T >::is_equal(), Botan::CT::is_not_equal(), Botan::CT::Mask< T >::is_zero(), and Botan::CT::Mask< T >::set().

operator!=() [1/12]

bool Botan::operator!=	(	const AlgorithmIdentifier &	a1,
		const AlgorithmIdentifier &	a2 )

Definition at line 69 of file alg_id.cpp.

                                                                              {
   return !(a1 == a2);
}

operator!=() [2/12]

bool Botan::operator!=	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 264 of file asn1_time.cpp.

                                                          {
   return (t1.cmp(t2) != 0);
}

References Botan::ASN1_Time::cmp().

operator!=() [3/12]

bool Botan::operator!= ( const BigInt & a, const BigInt & b )

inline

Definition at line 1124 of file bigint.h.

                                                         {
   return !a.is_equal(b);
}

References Botan::BigInt::is_equal().

operator!=() [4/12]

bool Botan::operator!= ( const BigInt & a, word b )

inline

Definition at line 1148 of file bigint.h.

                                                {
   return (a.cmp_word(b) != 0);
}

References Botan::BigInt::cmp_word().

operator!=() [5/12]

bool Botan::operator!=	(	const CRL_Entry &	,
		const CRL_Entry &	)

Test two CRL entries for inequality in at least one field.

Definition at line 58 of file crl_ent.cpp.

                                                          {
   return !(a1 == a2);
}

operator!=() [6/12]

bool Botan::operator!= ( const EC_Group & lhs, const EC_Group & rhs )

inline

Definition at line 730 of file ec_group.h.

                                                                 {
   return !(lhs == rhs);
}

operator!=() [7/12]

bool Botan::operator!=	(	const OctetString &	x,
		const OctetString &	y )

Compare two strings

Parameters

x	an octet string
y	an octet string

Returns

if x is not equal to y

Definition at line 92 of file symkey.cpp.

                                                              {
   return !(s1 == s2);
}

operator!=() [8/12]

bool Botan::operator!= ( const OID & a, const OID & b )

inline

Compare two OIDs.

Parameters

a	the first OID
b	the second OID

Returns

true if a is not equal to b

Definition at line 341 of file asn1_obj.h.

                                                   {
   return !(a == b);
}

operator!=() [9/12]

template<typename T, typename U>

bool Botan::operator!= ( const secure_allocator< T > & , const secure_allocator< U > &  )

inline

Definition at line 60 of file secmem.h.

                                                                               {
   return false;
}

operator!=() [10/12]

template<bitvectorish T1, bitvectorish T2>

bool Botan::operator!=	(	const T1 &	lhs,
		const T2 &	rhs )

Definition at line 1348 of file bitvector.h.

                                              {
   return lhs.equals_vartime(rhs);
}

operator!=() [11/12]

bool Botan::operator!=	(	const X509_Certificate &	cert1,
		const X509_Certificate &	cert2 )

Check two certificates for inequality

Parameters

cert1	The first certificate
cert2	The second certificate

Returns

true if the arguments represent different certificates, false if they are binary identical

Definition at line 695 of file x509cert.cpp.

                                                                              {
   return !(cert1 == cert2);
}

operator!=() [12/12]

bool Botan::operator!=	(	const X509_DN &	dn1,
		const X509_DN &	dn2 )

Definition at line 256 of file x509_dn.cpp.

                                                        {
   return !(dn1 == dn2);
}

operator%() [1/2]

BigInt Botan::operator%	(	const BigInt &	n,
		const BigInt &	mod )

Definition at line 122 of file big_ops3.cpp.

                                                     {
   if(mod.is_zero()) {
      throw Invalid_Argument("BigInt::operator% divide by zero");
   }
   if(mod.is_negative()) {
      throw Invalid_Argument("BigInt::operator% modulus must be > 0");
   }
   if(n.is_positive() && mod.is_positive() && n < mod) {
      return n;
   }
 
   if(mod.sig_words() == 1) {
      return BigInt::from_word(n % mod.word_at(0));
   }
 
   BigInt q, r;
   vartime_divide(n, mod, q, r);
   return r;
}

References Botan::BigInt::from_word(), Botan::BigInt::is_negative(), Botan::BigInt::is_positive(), Botan::BigInt::is_zero(), Botan::BigInt::sig_words(), vartime_divide(), and Botan::BigInt::word_at().

operator%() [2/2]

word Botan::operator%	(	const BigInt &	n,
		word	mod )

Definition at line 145 of file big_ops3.cpp.

                                          {
   if(mod == 0) {
      throw Invalid_Argument("BigInt::operator% divide by zero");
   }
 
   if(mod == 1) {
      return 0;
   }
 
   word remainder = 0;
 
   if(is_power_of_2(mod)) {
      remainder = (n.word_at(0) & (mod - 1));
   } else {
      const size_t sw = n.sig_words();
      for(size_t i = sw; i > 0; --i) {
         remainder = bigint_modop_vartime(remainder, n.word_at(i - 1), mod);
      }
   }
 
   if(remainder && n.sign() == BigInt::Negative) {
      return mod - remainder;
   }
   return remainder;
}

References bigint_modop_vartime(), is_power_of_2(), Botan::BigInt::Negative, Botan::BigInt::sig_words(), Botan::BigInt::sign(), and Botan::BigInt::word_at().

operator&() [1/5]

template<bitvectorish T1, bitvectorish T2>

auto Botan::operator&	(	const T1 &	lhs,
		const T2 &	rhs )

Definition at line 1329 of file bitvector.h.

                                             {
   auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
   res &= rhs;
   return res;
}

References Botan::detail::copy_lhs_allocator_aware().

operator&() [2/5]

ECIES_Flags Botan::operator& ( ECIES_Flags a, ECIES_Flags b )

inline

Definition at line 70 of file ecies.h.

                                                           {
   return static_cast<ECIES_Flags>(static_cast<uint32_t>(a) & static_cast<uint32_t>(b));
}

operator&() [3/5]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator& ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 425 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() & b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator&() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator& ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 420 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() & b);
}

References Botan::detail::Strong_Base< T >::get().

operator&() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator& ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 414 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a & b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator&=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator&= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 553 of file strong_type.h.

                                                                       {
   a.get() &= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator&=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator&= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 547 of file strong_type.h.

                                                        {
   a.get() &= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator*() [1/11]

EC_Point Botan::operator* ( const BigInt & scalar, const EC_Point & point )

inline

Definition at line 398 of file ec_point.h.

                                                                       {
   return point.mul(scalar);
}

References Botan::EC_Point::mul().

operator*() [2/11]

BigInt Botan::operator*	(	const BigInt &	x,
		const BigInt &	y )

Definition at line 46 of file big_ops3.cpp.

                                                   {
   const size_t x_sw = x.sig_words();
   const size_t y_sw = y.sig_words();
 
   BigInt z = BigInt::with_capacity(x.size() + y.size());
 
   if(x_sw == 1 && y_sw) {
      bigint_linmul3(z.mutable_data(), y._data(), y_sw, x.word_at(0));
   } else if(y_sw == 1 && x_sw) {
      bigint_linmul3(z.mutable_data(), x._data(), x_sw, y.word_at(0));
   } else if(x_sw && y_sw) {
      secure_vector<word> workspace(z.size());
 
      bigint_mul(z.mutable_data(),
                 z.size(),
                 x._data(),
                 x.size(),
                 x_sw,
                 y._data(),
                 y.size(),
                 y_sw,
                 workspace.data(),
                 workspace.size());
   }
 
   z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
 
   return z;
}

References Botan::BigInt::_data(), bigint_linmul3(), bigint_mul(), Botan::BigInt::cond_flip_sign(), Botan::BigInt::mutable_data(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::BigInt::size(), Botan::BigInt::with_capacity(), and Botan::BigInt::word_at().

operator*() [3/11]

BigInt Botan::operator*	(	const BigInt &	x,
		word	y )

Definition at line 79 of file big_ops3.cpp.

                                          {
   const size_t x_sw = x.sig_words();
 
   BigInt z = BigInt::with_capacity(x_sw + 1);
 
   if(x_sw && y) {
      bigint_linmul3(z.mutable_data(), x._data(), x_sw, y);
      z.set_sign(x.sign());
   }
 
   return z;
}

References Botan::BigInt::_data(), bigint_linmul3(), Botan::BigInt::mutable_data(), Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), and Botan::BigInt::with_capacity().

operator*() [4/11]

template<std::unsigned_integral T>

donna128 Botan::operator* ( const donna128 & x, T y )

inlineconstexpr

Definition at line 100 of file donna128.h.

                                                            {
   BOTAN_ARG_CHECK(x.hi() == 0, "High 64 bits of donna128 set to zero during multiply");
 
   uint64_t lo = 0, hi = 0;
   mul64x64_128(x.lo(), static_cast<uint64_t>(y), &lo, &hi);
   return donna128(lo, hi);
}

References BOTAN_ARG_CHECK, Botan::donna128::hi(), Botan::donna128::lo(), and mul64x64_128().

operator*() [5/11]

EC_Point Botan::operator* ( const EC_Point & point, const BigInt & scalar )

inline

Definition at line 394 of file ec_point.h.

                                                                       {
   return point.mul(scalar);
}

References Botan::EC_Point::mul().

operator*() [6/11]

Ed448Point Botan::operator*	(	const Scalar448 &	lhs,
		const Ed448Point &	rhs )

Syntax sugar for scalar multiplication.

Definition at line 220 of file ed448_internal.cpp.

                                                                  {
   return rhs.scalar_mul(lhs);
}

References Botan::Ed448Point::scalar_mul().

operator*() [7/11]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator* ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 374 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() * b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator*() [8/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator* ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 369 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() * b);
}

References Botan::detail::Strong_Base< T >::get().

operator*() [9/11]

template<std::unsigned_integral T>

donna128 Botan::operator* ( T y, const donna128 & x )

inlineconstexpr

Definition at line 109 of file donna128.h.

                                                            {
   return x * y;
}

operator*() [10/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator* ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 363 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a * b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator*() [11/11]

BigInt Botan::operator* ( word x, const BigInt & y )

inline

Definition at line 1106 of file bigint.h.

                                                 {
   return y * x;
}

operator*=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator*= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 514 of file strong_type.h.

                                                                       {
   a.get() *= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator*=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator*= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 508 of file strong_type.h.

                                                        {
   a.get() *= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator+() [1/10]

BigInt Botan::operator+ ( const BigInt & x, const BigInt & y )

inline

Definition at line 1083 of file bigint.h.

                                                          {
   return BigInt::add2(x, y._data(), y.sig_words(), y.sign());
}

References Botan::BigInt::_data(), Botan::BigInt::add2(), Botan::BigInt::sig_words(), and Botan::BigInt::sign().

operator+() [2/10]

BigInt Botan::operator+ ( const BigInt & x, word y )

inline

Definition at line 1087 of file bigint.h.

                                                 {
   return BigInt::add2(x, &y, 1, BigInt::Positive);
}

References Botan::BigInt::add2(), and Botan::BigInt::Positive.

operator+() [3/10]

donna128 Botan::operator+ ( const donna128 & x, const donna128 & y )

inlineconstexpr

Definition at line 113 of file donna128.h.

                                                                          {
   donna128 z = x;
   z += y;
   return z;
}

operator+() [4/10]

donna128 Botan::operator+ ( const donna128 & x, uint64_t y )

inlineconstexpr

Definition at line 119 of file donna128.h.

                                                                   {
   donna128 z = x;
   z += y;
   return z;
}

operator+() [5/10]

EC_Point Botan::operator+ ( const EC_Point & lhs, const EC_Point & rhs )

inline

Definition at line 384 of file ec_point.h.

                                                                    {
   EC_Point tmp(lhs);
   return tmp += rhs;
}

operator+() [6/10]

OctetString Botan::operator+	(	const OctetString &	x,
		const OctetString &	y )

Concatenate two strings

Parameters

x	an octet string
y	an octet string

Returns

x concatenated with y

Definition at line 99 of file symkey.cpp.

                                                                    {
   secure_vector<uint8_t> out;
   out += k1.bits_of();
   out += k2.bits_of();
   return OctetString(out);
}

References Botan::OctetString::bits_of(), and OctetString.

operator+() [7/10]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator+ ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 340 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() + b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator+() [8/10]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator+ ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 335 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() + b);
}

References Botan::detail::Strong_Base< T >::get().

operator+() [9/10]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator+ ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 329 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a + b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator+() [10/10]

BigInt Botan::operator+ ( word x, const BigInt & y )

inline

Definition at line 1091 of file bigint.h.

                                                 {
   return y + x;
}

operator++() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator++ ( Strong< T, Tags... > & a )

constexpr

Definition at line 605 of file strong_type.h.

                                                 {
   ++a.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator++() [2/2]

template<std::integral T, typename... Tags>

auto Botan::operator++ ( Strong< T, Tags... > & a, int  )

constexpr

Definition at line 598 of file strong_type.h.

                                                      {
   auto tmp = a;
   ++a.get();
   return tmp;
}

References Botan::detail::Strong_Base< T >::get().

Referenced by generate_dsa_primes().

operator+=() [1/6]

template<typename T, typename Alloc, typename L>

std::vector< T, Alloc > & Botan::operator+=	(	std::vector< T, Alloc > &	out,
		const std::pair< const T *, L > &	in )

Definition at line 99 of file secmem.h.

                                                                                          {
   out.insert(out.end(), in.first, in.first + in.second);
   return out;
}

operator+=() [2/6]

template<typename T, typename Alloc, typename L>

std::vector< T, Alloc > & Botan::operator+=	(	std::vector< T, Alloc > &	out,
		const std::pair< T *, L > &	in )

Definition at line 105 of file secmem.h.

                                                                                    {
   out.insert(out.end(), in.first, in.first + in.second);
   return out;
}

operator+=() [3/6]

template<typename T, typename Alloc, typename Alloc2>

std::vector< T, Alloc > & Botan::operator+=	(	std::vector< T, Alloc > &	out,
		const std::vector< T, Alloc2 > &	in )

Definition at line 87 of file secmem.h.

                                                                                          {
   out.insert(out.end(), in.begin(), in.end());
   return out;
}

operator+=() [4/6]

template<typename T, typename Alloc>

std::vector< T, Alloc > & Botan::operator+=	(	std::vector< T, Alloc > &	out,
		T	in )

Definition at line 93 of file secmem.h.

                                                                {
   out.push_back(in);
   return out;
}

operator+=() [5/6]

template<std::integral T, typename... Tags>

auto Botan::operator+= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 488 of file strong_type.h.

                                                                       {
   a.get() += b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator+=() [6/6]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator+= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 482 of file strong_type.h.

                                                        {
   a.get() += b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator-() [1/7]

BigInt Botan::operator- ( const BigInt & x, const BigInt & y )

inline

Definition at line 1095 of file bigint.h.

                                                          {
   return BigInt::add2(x, y._data(), y.sig_words(), y.reverse_sign());
}

References Botan::BigInt::_data(), Botan::BigInt::add2(), Botan::BigInt::reverse_sign(), and Botan::BigInt::sig_words().

operator-() [2/7]

BigInt Botan::operator- ( const BigInt & x, word y )

inline

Definition at line 1099 of file bigint.h.

                                                 {
   return BigInt::add2(x, &y, 1, BigInt::Negative);
}

References Botan::BigInt::add2(), and Botan::BigInt::Negative.

operator-() [3/7]

EC_Point Botan::operator- ( const EC_Point & lhs )

inline

Definition at line 380 of file ec_point.h.

                                               {
   return EC_Point(lhs).negate();
}

References Botan::EC_Point::negate().

operator-() [4/7]

EC_Point Botan::operator- ( const EC_Point & lhs, const EC_Point & rhs )

inline

Definition at line 389 of file ec_point.h.

                                                                    {
   EC_Point tmp(lhs);
   return tmp -= rhs;
}

operator-() [5/7]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator- ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 357 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() - b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator-() [6/7]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator- ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 352 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() - b);
}

References Botan::detail::Strong_Base< T >::get().

operator-() [7/7]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator- ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 346 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a - b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator--() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator-- ( Strong< T, Tags... > & a )

constexpr

Definition at line 618 of file strong_type.h.

                                                 {
   --a.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator--() [2/2]

template<std::integral T, typename... Tags>

auto Botan::operator-- ( Strong< T, Tags... > & a, int  )

constexpr

Definition at line 611 of file strong_type.h.

                                                      {
   auto tmp = a;
   --a.get();
   return tmp;
}

References Botan::detail::Strong_Base< T >::get().

operator-=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator-= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 501 of file strong_type.h.

                                                                       {
   a.get() -= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator-=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator-= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 495 of file strong_type.h.

                                                        {
   a.get() -= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator/() [1/5]

BigInt Botan::operator/	(	const BigInt &	x,
		const BigInt &	y )

Definition at line 95 of file big_ops3.cpp.

                                                   {
   if(y.sig_words() == 1) {
      return x / y.word_at(0);
   }
 
   BigInt q, r;
   vartime_divide(x, y, q, r);
   return q;
}

References Botan::BigInt::sig_words(), vartime_divide(), and Botan::BigInt::word_at().

operator/() [2/5]

BigInt Botan::operator/	(	const BigInt &	x,
		word	y )

Definition at line 108 of file big_ops3.cpp.

                                          {
   if(y == 0) {
      throw Invalid_Argument("BigInt::operator/ divide by zero");
   }
 
   BigInt q;
   word r;
   ct_divide_word(x, y, q, r);
   return q;
}

References ct_divide_word().

operator/() [3/5]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator/ ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 391 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() / b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator/() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator/ ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 386 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() / b);
}

References Botan::detail::Strong_Base< T >::get().

operator/() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator/ ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 380 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a / b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator/=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator/= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 527 of file strong_type.h.

                                                                       {
   a.get() /= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator/=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator/= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 521 of file strong_type.h.

                                                        {
   a.get() /= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator<() [1/5]

bool Botan::operator<	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 276 of file asn1_time.cpp.

                                                         {
   return (t1.cmp(t2) < 0);
}

References Botan::ASN1_Time::cmp().

operator<() [2/5]

bool Botan::operator< ( const BigInt & a, const BigInt & b )

inline

Definition at line 1136 of file bigint.h.

                                                        {
   return a.is_less_than(b);
}

References Botan::BigInt::is_less_than().

operator<() [3/5]

bool Botan::operator< ( const BigInt & a, word b )

inline

Definition at line 1160 of file bigint.h.

                                               {
   return (a.cmp_word(b) < 0);
}

References Botan::BigInt::cmp_word().

operator<() [4/5]

bool Botan::operator<	(	const OID &	a,
		const OID &	b )

Compare two OIDs.

Parameters

a	the first OID
b	the second OID

Returns

true if a is lexicographically smaller than b

Definition at line 167 of file asn1_oid.cpp.

                                           {
   const std::vector<uint32_t>& oid1 = a.get_components();
   const std::vector<uint32_t>& oid2 = b.get_components();
 
   return std::lexicographical_compare(oid1.begin(), oid1.end(), oid2.begin(), oid2.end());
}

References Botan::OID::get_components().

operator<() [5/5]

bool Botan::operator<	(	const X509_DN &	dn1,
		const X509_DN &	dn2 )

Definition at line 263 of file x509_dn.cpp.

                                                       {
   auto attr1 = dn1.get_attributes();
   auto attr2 = dn2.get_attributes();
 
   // If they are not the same size, choose the smaller as the "lessor"
   if(attr1.size() < attr2.size()) {
      return true;
   }
   if(attr1.size() > attr2.size()) {
      return false;
   }
 
   // We know they are the same # of elements, now compare the OIDs:
   auto p1 = attr1.begin();
   auto p2 = attr2.begin();
 
   while(p1 != attr1.end() && p2 != attr2.end()) {
      if(p1->first != p2->first) {
         return (p1->first < p2->first);
      }
 
      ++p1;
      ++p2;
   }
 
   // We know this is true because maps have the same size
   BOTAN_ASSERT_NOMSG(p1 == attr1.end());
   BOTAN_ASSERT_NOMSG(p2 == attr2.end());
 
   // Now we know all elements have the same OIDs, compare
   // their string values:
 
   p1 = attr1.begin();
   p2 = attr2.begin();
   while(p1 != attr1.end() && p2 != attr2.end()) {
      BOTAN_DEBUG_ASSERT(p1->first == p2->first);
 
      // They may be binary different but same by X.500 rules, check this
      if(!x500_name_cmp(p1->second, p2->second)) {
         // If they are not (by X.500) the same string, pick the
         // lexicographic first as the lessor
         return (p1->second < p2->second);
      }
 
      ++p1;
      ++p2;
   }
 
   // if we reach here, then the DNs should be identical
   BOTAN_DEBUG_ASSERT(dn1 == dn2);
   return false;
}

References BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, and Botan::X509_DN::get_attributes().

operator<<() [1/12]

BigInt Botan::operator<<	(	const BigInt &	x,
		size_t	shift )

Definition at line 174 of file big_ops3.cpp.

                                                 {
   const size_t x_sw = x.sig_words();
 
   const size_t new_size = x_sw + (shift + WordInfo<word>::bits - 1) / WordInfo<word>::bits;
   BigInt y = BigInt::with_capacity(new_size);
   bigint_shl2(y.mutable_data(), x._data(), x_sw, shift);
   y.set_sign(x.sign());
   return y;
}

References Botan::BigInt::_data(), bigint_shl2(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), and Botan::BigInt::with_capacity().

operator<<() [2/12]

int Botan::operator<<	(	int	out,
		Pipe &	pipe )

Stream output operator; dumps the results from pipe's default message to the output stream.

Parameters

out	file descriptor for an open output stream
pipe	the pipe

Definition at line 18 of file fd_unix.cpp.

                                   {
   secure_vector<uint8_t> buffer(DefaultBufferSize);
   while(pipe.remaining()) {
      size_t got = pipe.read(buffer.data(), buffer.size());
      size_t position = 0;
      while(got) {
         ssize_t ret = ::write(fd, &buffer[position], got);
         if(ret < 0) {
            throw Stream_IO_Error("Pipe output operator (unixfd) has failed");
         }
 
         position += static_cast<size_t>(ret);
         got -= static_cast<size_t>(ret);
      }
   }
   return fd;
}

References DefaultBufferSize, Botan::Pipe::read(), and Botan::Pipe::remaining().

operator<<() [3/12]

std::ostream & Botan::operator<<	(	std::ostream &	os,
		const GeneralName &	gn )

Definition at line 260 of file name_constraint.cpp.

                                                              {
   os << gn.type() << ":" << gn.name();
   return os;
}

References Botan::GeneralName::name(), and Botan::GeneralName::type().

operator<<() [4/12]

std::ostream & Botan::operator<<	(	std::ostream &	os,
		const GeneralSubtree &	gs )

Definition at line 284 of file name_constraint.cpp.

                                                                 {
   os << gs.base();
   return os;
}

References Botan::GeneralSubtree::base().

operator<<() [5/12]

template<typename T, typename... Tags>
requires (concepts::streamable<T>)

decltype(auto) Botan::operator<<	(	std::ostream &	os,
		const Strong< T, Tags... > &	v )

Definition at line 291 of file strong_type.h.

                                                                       {
   return os << v.get();
}

References Botan::detail::Strong_Base< T >::get().

operator<<() [6/12]

std::ostream & Botan::operator<< ( std::ostream & out, const OID & oid )

inline

Definition at line 330 of file asn1_obj.h.

                                                               {
   out << oid.to_string();
   return out;
}

References Botan::OID::to_string().

operator<<() [7/12]

std::ostream & Botan::operator<<	(	std::ostream &	out,
		const X509_DN &	dn )

Definition at line 408 of file x509_dn.cpp.

                                                           {
   const auto& info = dn.dn_info();
 
   for(size_t i = 0; i != info.size(); ++i) {
      out << to_short_form(info[i].first) << "=\"";
      for(char c : info[i].second.value()) {
         if(c == '\\' || c == '\"') {
            out << "\\";
         }
         out << c;
      }
      out << "\"";
 
      if(i + 1 < info.size()) {
         out << ",";
      }
   }
   return out;
}

References Botan::X509_DN::dn_info().

operator<<() [8/12]

std::ostream & Botan::operator<<	(	std::ostream &	out,
		Pipe &	pipe )

Stream output operator; dumps the results from pipe's default message to the output stream.

Parameters

out	an output stream
pipe	the pipe

Definition at line 19 of file pipe_io.cpp.

                                                       {
   secure_vector<uint8_t> buffer(DefaultBufferSize);
   while(stream.good() && pipe.remaining()) {
      const size_t got = pipe.read(buffer.data(), buffer.size());
      stream.write(cast_uint8_ptr_to_char(buffer.data()), got);
   }
   if(!stream.good()) {
      throw Stream_IO_Error("Pipe output operator (iostream) has failed");
   }
   return stream;
}

References cast_uint8_ptr_to_char(), DefaultBufferSize, Botan::Pipe::read(), and Botan::Pipe::remaining().

operator<<() [9/12]

std::ostream & Botan::operator<<	(	std::ostream &	stream,
		const BigInt &	n )

Definition at line 17 of file big_io.cpp.

                                                            {
   const auto stream_flags = stream.flags();
   // NOLINTNEXTLINE(*-non-zero-enum-to-bool-conversion)
   if(stream_flags & std::ios::oct) {
      throw Invalid_Argument("Octal output of BigInt not supported");
   }
 
   // NOLINTNEXTLINE(*-non-zero-enum-to-bool-conversion)
   const size_t base = (stream_flags & std::ios::hex) ? 16 : 10;
 
   if(base == 10) {
      stream << n.to_dec_string();
   } else {
      stream << n.to_hex_string();
   }
 
   if(!stream.good()) {
      throw Stream_IO_Error("BigInt output operator has failed");
   }
   return stream;
}

References Botan::BigInt::to_dec_string(), and Botan::BigInt::to_hex_string().

operator<<() [10/12]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator<< ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 476 of file strong_type.h.

                                                                                {
   return Strong<T, Tags...>(a.get() << b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator<<() [11/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator<< ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 471 of file strong_type.h.

                                                                 {
   return Strong<T1, Tags...>(a.get() << b);
}

References Botan::detail::Strong_Base< T >::get().

operator<<() [12/12]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator<< ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 465 of file strong_type.h.

                                                                 {
   return Strong<T2, Tags...>(a << b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator<<=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator<<= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 592 of file strong_type.h.

                                                                        {
   a.get() <<= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator<<=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator<<= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 586 of file strong_type.h.

                                                         {
   a.get() <<= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator<=() [1/3]

bool Botan::operator<=	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 268 of file asn1_time.cpp.

                                                          {
   return (t1.cmp(t2) <= 0);
}

References Botan::ASN1_Time::cmp().

operator<=() [2/3]

bool Botan::operator<= ( const BigInt & a, const BigInt & b )

inline

Definition at line 1128 of file bigint.h.

                                                         {
   return (a.cmp(b) <= 0);
}

References Botan::BigInt::cmp().

operator<=() [3/3]

bool Botan::operator<= ( const BigInt & a, word b )

inline

Definition at line 1152 of file bigint.h.

                                                {
   return (a.cmp_word(b) <= 0);
}

References Botan::BigInt::cmp_word().

operator<=>() [1/3]

template<typename T, typename... Tags>
requires (std::three_way_comparable<T>)

auto Botan::operator<=>	(	const Strong< T, Tags... > &	lhs,
		const Strong< T, Tags... > &	rhs )

Definition at line 303 of file strong_type.h.

                                                                               {
   return lhs.get() <=> rhs.get();
}

References Botan::detail::Strong_Base< T >::get(), and operator<=>().

Referenced by operator<=>().

operator<=>() [2/3]

template<std::integral T1, std::integral T2, typename... Tags>

auto Botan::operator<=>	(	Strong< T1, Tags... >	a,
		T2	b )

Definition at line 313 of file strong_type.h.

                                              {
   return a.get() <=> b;
}

References Botan::detail::Strong_Base< T >::get().

operator<=>() [3/3]

template<std::integral T1, std::integral T2, typename... Tags>

auto Botan::operator<=>	(	T1	a,
		Strong< T2, Tags... >	b )

Definition at line 308 of file strong_type.h.

                                              {
   return a <=> b.get();
}

References Botan::detail::Strong_Base< T >::get().

operator==() [1/13]

bool Botan::operator==	(	const AlgorithmIdentifier &	a1,
		const AlgorithmIdentifier &	a2 )

Definition at line 54 of file alg_id.cpp.

                                                                              {
   if(a1.oid() != a2.oid()) {
      return false;
   }
 
   /*
   * Treat NULL and empty as equivalent
   */
   if(a1.parameters_are_null_or_empty() && a2.parameters_are_null_or_empty()) {
      return true;
   }
 
   return (a1.parameters() == a2.parameters());
}

References Botan::AlgorithmIdentifier::oid(), Botan::AlgorithmIdentifier::parameters(), and Botan::AlgorithmIdentifier::parameters_are_null_or_empty().

operator==() [2/13]

bool Botan::operator==	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 260 of file asn1_time.cpp.

                                                          {
   return (t1.cmp(t2) == 0);
}

References Botan::ASN1_Time::cmp().

operator==() [3/13]

bool Botan::operator== ( const BigInt & a, const BigInt & b )

inline

Definition at line 1120 of file bigint.h.

                                                         {
   return a.is_equal(b);
}

operator==() [4/13]

bool Botan::operator== ( const BigInt & a, word b )

inline

Definition at line 1144 of file bigint.h.

                                                {
   return (a.cmp_word(b) == 0);
}

References Botan::BigInt::cmp_word().

operator==() [5/13]

bool Botan::operator==	(	const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &	lhs,
		const Classic_McEliece_Polynomial_Ring::Big_F_Coefficient &	rhs )

Definition at line 67 of file cmce_poly.cpp.

                                                                              {
   return lhs.coeff == rhs.coeff && lhs.idx == rhs.idx;
}

References Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::coeff, and Botan::Classic_McEliece_Polynomial_Ring::Big_F_Coefficient::idx.

operator==() [6/13]

bool Botan::operator==	(	const CRL_Entry &	,
		const CRL_Entry &	)

Test two CRL entries for equality in all fields.

Definition at line 42 of file crl_ent.cpp.

                                                          {
   if(a1.serial_number() != a2.serial_number()) {
      return false;
   }
   if(a1.expire_time() != a2.expire_time()) {
      return false;
   }
   if(a1.reason_code() != a2.reason_code()) {
      return false;
   }
   return true;
}

References Botan::CRL_Entry::expire_time(), Botan::CRL_Entry::reason_code(), and Botan::CRL_Entry::serial_number().

operator==() [7/13]

bool Botan::operator==	(	const OctetString &	x,
		const OctetString &	y )

Compare two strings

Parameters

x	an octet string
y	an octet string

Returns

if x is equal to y

Definition at line 85 of file symkey.cpp.

                                                              {
   return (s1.bits_of() == s2.bits_of());
}

References Botan::OctetString::bits_of().

operator==() [8/13]

template<typename T, typename U>

bool Botan::operator== ( const secure_allocator< T > & , const secure_allocator< U > &  )

inline

Definition at line 55 of file secmem.h.

                                                                               {
   return true;
}

operator==() [9/13]

template<typename T, typename... Tags>
requires (std::equality_comparable<T>)

bool Botan::operator==	(	const Strong< T, Tags... > &	lhs,
		const Strong< T, Tags... > &	rhs )

Definition at line 297 of file strong_type.h.

                                                                              {
   return lhs.get() == rhs.get();
}

References Botan::detail::Strong_Base< T >::get().

operator==() [10/13]

template<bitvectorish T1, bitvectorish T2>

bool Botan::operator==	(	const T1 &	lhs,
		const T2 &	rhs )

Definition at line 1343 of file bitvector.h.

                                              {
   return lhs.equals_vartime(rhs);
}

operator==() [11/13]

bool Botan::operator==	(	const X509_DN &	dn1,
		const X509_DN &	dn2 )

Definition at line 220 of file x509_dn.cpp.

                                                        {
   auto attr1 = dn1.get_attributes();
   auto attr2 = dn2.get_attributes();
 
   if(attr1.size() != attr2.size()) {
      return false;
   }
 
   auto p1 = attr1.begin();
   auto p2 = attr2.begin();
 
   while(true) {
      if(p1 == attr1.end() && p2 == attr2.end()) {
         break;
      }
      if(p1 == attr1.end()) {
         return false;
      }
      if(p2 == attr2.end()) {
         return false;
      }
      if(p1->first != p2->first) {
         return false;
      }
      if(!x500_name_cmp(p1->second, p2->second)) {
         return false;
      }
      ++p1;
      ++p2;
   }
   return true;
}

References Botan::X509_DN::get_attributes().

operator==() [12/13]

template<std::integral T1, std::integral T2, typename... Tags>

auto Botan::operator==	(	Strong< T1, Tags... >	a,
		T2	b )

Definition at line 323 of file strong_type.h.

                                             {
   return a.get() == b;
}

References Botan::detail::Strong_Base< T >::get().

operator==() [13/13]

template<std::integral T1, std::integral T2, typename... Tags>

auto Botan::operator==	(	T1	a,
		Strong< T2, Tags... >	b )

Definition at line 318 of file strong_type.h.

                                             {
   return a == b.get();
}

References Botan::detail::Strong_Base< T >::get().

operator>() [1/3]

bool Botan::operator>	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 280 of file asn1_time.cpp.

                                                         {
   return (t1.cmp(t2) > 0);
}

References Botan::ASN1_Time::cmp().

operator>() [2/3]

bool Botan::operator> ( const BigInt & a, const BigInt & b )

inline

Definition at line 1140 of file bigint.h.

                                                        {
   return b.is_less_than(a);
}

References Botan::BigInt::is_less_than().

operator>() [3/3]

bool Botan::operator> ( const BigInt & a, word b )

inline

Definition at line 1164 of file bigint.h.

                                               {
   return (a.cmp_word(b) > 0);
}

References Botan::BigInt::cmp_word().

operator>=() [1/3]

bool Botan::operator>=	(	const ASN1_Time &	t1,
		const ASN1_Time &	t2 )

Definition at line 272 of file asn1_time.cpp.

                                                          {
   return (t1.cmp(t2) >= 0);
}

References Botan::ASN1_Time::cmp().

operator>=() [2/3]

bool Botan::operator>= ( const BigInt & a, const BigInt & b )

inline

Definition at line 1132 of file bigint.h.

                                                         {
   return (a.cmp(b) >= 0);
}

References Botan::BigInt::cmp().

operator>=() [3/3]

bool Botan::operator>= ( const BigInt & a, word b )

inline

Definition at line 1156 of file bigint.h.

                                                {
   return (a.cmp_word(b) >= 0);
}

References Botan::BigInt::cmp_word().

operator>>() [1/8]

BigInt Botan::operator>>	(	const BigInt &	x,
		size_t	shift )

Definition at line 187 of file big_ops3.cpp.

                                                 {
   const size_t shift_words = shift / WordInfo<word>::bits;
   const size_t x_sw = x.sig_words();
 
   if(shift_words >= x_sw) {
      return BigInt::zero();
   }
 
   BigInt y = BigInt::with_capacity(x_sw - shift_words);
   bigint_shr2(y.mutable_data(), x._data(), x_sw, shift);
 
   if(x.is_negative() && y.is_zero()) {
      y.set_sign(BigInt::Positive);
   } else {
      y.set_sign(x.sign());
   }
 
   return y;
}

References Botan::BigInt::_data(), bigint_shr2(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::Positive, Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::sign(), Botan::BigInt::with_capacity(), and Botan::BigInt::zero().

operator>>() [2/8]

int Botan::operator>>	(	int	in,
		Pipe &	pipe )

File descriptor input operator; dumps the remaining bytes of input to the (assumed open) pipe message.

Parameters

in	file descriptor for an open input stream
pipe	the pipe

Definition at line 39 of file fd_unix.cpp.

                                   {
   secure_vector<uint8_t> buffer(DefaultBufferSize);
   while(true) {
      ssize_t ret = ::read(fd, buffer.data(), buffer.size());
      if(ret < 0) {
         throw Stream_IO_Error("Pipe input operator (unixfd) has failed");
      } else if(ret == 0) {
         break;
      }
      pipe.write(buffer.data(), static_cast<size_t>(ret));
   }
   return fd;
}

References DefaultBufferSize, and Botan::Pipe::write().

operator>>() [3/8]

std::istream & Botan::operator>>	(	std::istream &	in,
		Pipe &	pipe )

Stream input operator; dumps the remaining bytes of input to the (assumed open) pipe message.

Parameters

in	the input stream
pipe	the pipe

Definition at line 34 of file pipe_io.cpp.

                                                       {
   secure_vector<uint8_t> buffer(DefaultBufferSize);
   while(stream.good()) {
      stream.read(cast_uint8_ptr_to_char(buffer.data()), buffer.size());
      const size_t got = static_cast<size_t>(stream.gcount());
      pipe.write(buffer.data(), got);
   }
   if(stream.bad() || (stream.fail() && !stream.eof())) {
      throw Stream_IO_Error("Pipe input operator (iostream) has failed");
   }
   return stream;
}

References cast_uint8_ptr_to_char(), DefaultBufferSize, and Botan::Pipe::write().

operator>>() [4/8]

std::istream & Botan::operator>>	(	std::istream &	in,
		X509_DN &	dn )

Definition at line 428 of file x509_dn.cpp.

                                                    {
   in >> std::noskipws;
   do {
      std::string key;
      std::string val;
      char c;
 
      while(in.good()) {
         in >> c;
 
         if(std::isspace(c) && key.empty()) {
            continue;
         } else if(!std::isspace(c)) {
            key.push_back(c);
            break;
         } else {
            break;
         }
      }
 
      while(in.good()) {
         in >> c;
 
         if(!std::isspace(c) && c != '=') {
            key.push_back(c);
         } else if(c == '=') {
            break;
         } else {
            throw Invalid_Argument("Ill-formed X.509 DN");
         }
      }
 
      bool in_quotes = false;
      while(in.good()) {
         in >> c;
 
         if(std::isspace(c)) {
            if(!in_quotes && !val.empty()) {
               break;
            } else if(in_quotes) {
               val.push_back(' ');
            }
         } else if(c == '"') {
            in_quotes = !in_quotes;
         } else if(c == '\\') {
            if(in.good()) {
               in >> c;
            }
            val.push_back(c);
         } else if(c == ',' && !in_quotes) {
            break;
         } else {
            val.push_back(c);
         }
      }
 
      if(!key.empty() && !val.empty()) {
         dn.add_attribute(X509_DN::deref_info_field(key), val);
      } else {
         break;
      }
   } while(in.good());
   return in;
}

References Botan::X509_DN::add_attribute(), and Botan::X509_DN::deref_info_field().

operator>>() [5/8]

std::istream & Botan::operator>>	(	std::istream &	stream,
		BigInt &	n )

Definition at line 42 of file big_io.cpp.

                                                      {
   std::string str;
   std::getline(stream, str);
   if(stream.bad() || (stream.fail() && !stream.eof())) {
      throw Stream_IO_Error("BigInt input operator has failed");
   }
   n = BigInt(str);
   return stream;
}

operator>>() [6/8]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator>> ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 459 of file strong_type.h.

                                                                                {
   return Strong<T, Tags...>(a.get() >> b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator>>() [7/8]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator>> ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 454 of file strong_type.h.

                                                                 {
   return Strong<T1, Tags...>(a.get() >> b);
}

References Botan::detail::Strong_Base< T >::get().

operator>>() [8/8]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator>> ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 448 of file strong_type.h.

                                                                 {
   return Strong<T2, Tags...>(a >> b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator>>=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator>>= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 579 of file strong_type.h.

                                                                        {
   a.get() >>= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator>>=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator>>= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 573 of file strong_type.h.

                                                         {
   a.get() >>= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator^() [1/5]

OctetString Botan::operator^	(	const OctetString &	x,
		const OctetString &	y )

XOR two strings

Parameters

x	an octet string
y	an octet string

Returns

x XORed with y

Definition at line 109 of file symkey.cpp.

                                                                    {
   secure_vector<uint8_t> out(std::max(k1.length(), k2.length()));
 
   copy_mem(out.data(), k1.begin(), k1.length());
   xor_buf(out.data(), k2.begin(), k2.length());
   return OctetString(out);
}

References Botan::OctetString::begin(), copy_mem(), Botan::OctetString::length(), OctetString, and xor_buf().

operator^() [2/5]

template<bitvectorish T1, bitvectorish T2>

auto Botan::operator^	(	const T1 &	lhs,
		const T2 &	rhs )

Definition at line 1336 of file bitvector.h.

                                             {
   auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
   res ^= rhs;
   return res;
}

References Botan::detail::copy_lhs_allocator_aware().

operator^() [3/5]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator^ ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 408 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() ^ b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator^() [4/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator^ ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 403 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() ^ b);
}

References Botan::detail::Strong_Base< T >::get().

operator^() [5/5]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator^ ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 397 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a ^ b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator^=() [1/3]

template<typename Alloc, typename Alloc2>

std::vector< uint8_t, Alloc > & Botan::operator^=	(	std::vector< uint8_t, Alloc > &	out,
		const std::vector< uint8_t, Alloc2 > &	in )

Definition at line 448 of file mem_ops.h.

                                                                                                            {
   if(out.size() < in.size()) {
      out.resize(in.size());
   }
 
   xor_buf(std::span{out}.first(in.size()), in);
   return out;
}

References xor_buf().

operator^=() [2/3]

template<std::integral T, typename... Tags>

auto Botan::operator^= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 540 of file strong_type.h.

                                                                       {
   a.get() ^= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator^=() [3/3]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator^= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 534 of file strong_type.h.

                                                        {
   a.get() ^= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator|() [1/11]

ASN1_Class Botan::operator| ( ASN1_Class x, ASN1_Class y )

inline

Definition at line 79 of file asn1_obj.h.

                                                        {
   return static_cast<ASN1_Class>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
}

operator|() [2/11]

uint32_t Botan::operator| ( ASN1_Class x, ASN1_Type y )

inline

Definition at line 87 of file asn1_obj.h.

                                                     {
   return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
}

operator|() [3/11]

uint32_t Botan::operator| ( ASN1_Type x, ASN1_Class y )

inline

Definition at line 83 of file asn1_obj.h.

                                                     {
   return static_cast<uint32_t>(x) | static_cast<uint32_t>(y);
}

operator|() [4/11]

ASN1_Type Botan::operator| ( ASN1_Type x, ASN1_Type y )

inline

Definition at line 75 of file asn1_obj.h.

                                                     {
   return static_cast<ASN1_Type>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
}

operator|() [5/11]

donna128 Botan::operator| ( const donna128 & x, const donna128 & y )

inlineconstexpr

Definition at line 125 of file donna128.h.

                                                                          {
   return donna128(x.lo() | y.lo(), x.hi() | y.hi());
}

References Botan::donna128::hi(), and Botan::donna128::lo().

operator|() [6/11]

donna128 Botan::operator| ( const donna128 & x, uint64_t y )

inlineconstexpr

Definition at line 129 of file donna128.h.

                                                                   {
   return donna128(x.lo() | y, x.hi());
}

References Botan::donna128::hi(), and Botan::donna128::lo().

operator|() [7/11]

template<bitvectorish T1, bitvectorish T2>

auto Botan::operator|	(	const T1 &	lhs,
		const T2 &	rhs )

Definition at line 1322 of file bitvector.h.

                                             {
   auto res = detail::copy_lhs_allocator_aware(lhs, rhs);
   res |= rhs;
   return res;
}

References Botan::detail::copy_lhs_allocator_aware().

operator|() [8/11]

ECIES_Flags Botan::operator| ( ECIES_Flags a, ECIES_Flags b )

inline

Definition at line 65 of file ecies.h.

                                                           {
   // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange)
   return static_cast<ECIES_Flags>(static_cast<uint32_t>(a) | static_cast<uint32_t>(b));
}

operator|() [9/11]

template<std::integral T, typename... Tags>

decltype(auto) Botan::operator| ( Strong< T, Tags... > a, Strong< T, Tags... > b )

constexpr

Definition at line 442 of file strong_type.h.

                                                                               {
   return Strong<T, Tags...>(a.get() | b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator|() [10/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator| ( Strong< T1, Tags... > a, T2 b )

constexpr

Definition at line 437 of file strong_type.h.

                                                                {
   return Strong<T1, Tags...>(a.get() | b);
}

References Botan::detail::Strong_Base< T >::get().

operator|() [11/11]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

decltype(auto) Botan::operator| ( T1 a, Strong< T2, Tags... > b )

constexpr

Definition at line 431 of file strong_type.h.

                                                                {
   return Strong<T2, Tags...>(a | b.get());
}

References Botan::detail::Strong_Base< T >::get().

operator|=() [1/2]

template<std::integral T, typename... Tags>

auto Botan::operator|= ( Strong< T, Tags... > & a, Strong< T, Tags... > b )

constexpr

Definition at line 566 of file strong_type.h.

                                                                       {
   a.get() |= b.get();
   return a;
}

References Botan::detail::Strong_Base< T >::get().

operator|=() [2/2]

template<std::integral T1, std::integral T2, typename... Tags>
requires (detail::has_capability<EnableArithmeticWithPlainNumber, Tags...>)

auto Botan::operator|= ( Strong< T1, Tags... > & a, T2 b )

constexpr

Definition at line 560 of file strong_type.h.

                                                        {
   a.get() |= b;
   return a;
}

References Botan::detail::Strong_Base< T >::get().

OS2ECP() [1/3]

EC_Point Botan::OS2ECP	(	const uint8_t	data[],
		size_t	data_len,
		const CurveGFp &	curve )

Perform point decoding Use EC_Group::OS2ECP instead

Definition at line 850 of file ec_point.cpp.

                                                                              {
   if(data_len == 1 && data[0] == 0) {
      // SEC1 standard representation of the point at infinity
      return EC_Point(curve);
   }
 
   const auto [g_x, g_y] = OS2ECP(data, data_len, curve.get_p(), curve.get_a(), curve.get_b());
 
   EC_Point point(curve, g_x, g_y);
 
   if(!point.on_the_curve()) {
      throw Decoding_Error("OS2ECP: Decoded point was not on the curve");
   }
 
   return point;
}

References Botan::CurveGFp::get_a(), Botan::CurveGFp::get_b(), Botan::CurveGFp::get_p(), Botan::EC_Point::on_the_curve(), and OS2ECP().

OS2ECP() [2/3]

std::pair< BigInt, BigInt > BOTAN_UNSTABLE_API Botan::OS2ECP	(	const uint8_t	data[],
		size_t	data_len,
		const BigInt &	curve_p,
		const BigInt &	curve_a,
		const BigInt &	curve_b )

Perform point decoding

This is an internal function which was accidentally made public. Do not use it; it will be removed in Botan4.

Parameters

data	the encoded point
data_len	length of data in bytes
curve_p	the curve equation prime
curve_a	the curve equation a parameter
curve_b	the curve equation b parameter

Definition at line 867 of file ec_point.cpp.

                                                                                                                     {
   if(pt_len <= 1) {
      throw Decoding_Error("OS2ECP invalid point encoding");
   }
 
   const uint8_t pc = pt[0];
   const size_t p_bytes = p.bytes();
 
   BigInt x, y;
 
   if(pc == 2 || pc == 3) {
      if(pt_len != 1 + p_bytes) {
         throw Decoding_Error("OS2ECP invalid point encoding");
      }
      x = BigInt::decode(&pt[1], pt_len - 1);
 
      const bool y_mod_2 = ((pc & 0x01) == 1);
      y = decompress_point(y_mod_2, x, p, a, b);
   } else if(pc == 4) {
      if(pt_len != 1 + 2 * p_bytes) {
         throw Decoding_Error("OS2ECP invalid point encoding");
      }
 
      x = BigInt::decode(&pt[1], p_bytes);
      y = BigInt::decode(&pt[p_bytes + 1], p_bytes);
   } else if(pc == 6 || pc == 7) {
      if(pt_len != 1 + 2 * p_bytes) {
         throw Decoding_Error("OS2ECP invalid point encoding");
      }
 
      x = BigInt::decode(&pt[1], p_bytes);
      y = BigInt::decode(&pt[p_bytes + 1], p_bytes);
 
      const bool y_mod_2 = ((pc & 0x01) == 1);
 
      if(decompress_point(y_mod_2, x, p, a, b) != y) {
         throw Decoding_Error("OS2ECP: Decoding error in hybrid format");
      }
   } else {
      throw Decoding_Error("OS2ECP: Unknown format type " + std::to_string(static_cast<int>(pc)));
   }
 
   if(x >= p || y >= p) {
      throw Decoding_Error("OS2ECP invalid point encoding");
   }
 
   return std::make_pair(x, y);
}

References Botan::BigInt::bytes(), and Botan::BigInt::decode().

OS2ECP() [3/3]

EC_Point BOTAN_UNSTABLE_API Botan::OS2ECP	(	std::span< const uint8_t >	data,
		const CurveGFp &	curve )

Definition at line 846 of file ec_point.cpp.

                                                                    {
   return OS2ECP(data.data(), data.size(), curve);
}

References OS2ECP().

Referenced by OS2ECP(), OS2ECP(), and Botan::EC_Group_Data::point_deserialize().

out_opt()

template<typename T>
requires std::is_default_constructible_v<T>

auto Botan::out_opt ( std::optional< T > & outopt )

nodiscardconstexprnoexcept

Definition at line 448 of file stl_util.h.

                                                                      {
   class out_opt_t {
      public:
         constexpr ~out_opt_t() noexcept { m_opt = m_raw; }
 
         constexpr out_opt_t(std::optional<T>& outopt) noexcept : m_opt(outopt) {}
 
         out_opt_t(const out_opt_t&) = delete;
         out_opt_t(out_opt_t&&) = delete;
         out_opt_t& operator=(const out_opt_t&) = delete;
         out_opt_t& operator=(out_opt_t&&) = delete;
 
         [[nodiscard]] constexpr operator T*() && noexcept { return &m_raw; }
 
      private:
         std::optional<T>& m_opt;
         T m_raw;
   };
 
   return out_opt_t{outopt};
}

out_ptr()

template<typename T>

auto Botan::out_ptr ( T & outptr )

nodiscardconstexprnoexcept

Definition at line 421 of file stl_util.h.

                                                         {
   class out_ptr_t {
      public:
         constexpr ~out_ptr_t() noexcept {
            m_ptr.reset(m_rawptr);
            m_rawptr = nullptr;
         }
 
         constexpr out_ptr_t(T& outptr) noexcept : m_ptr(outptr), m_rawptr(nullptr) {}
 
         out_ptr_t(const out_ptr_t&) = delete;
         out_ptr_t(out_ptr_t&&) = delete;
         out_ptr_t& operator=(const out_ptr_t&) = delete;
         out_ptr_t& operator=(out_ptr_t&&) = delete;
 
         [[nodiscard]] constexpr operator typename T::element_type **() && noexcept { return &m_rawptr; }
 
      private:
         T& m_ptr;
         typename T::element_type* m_rawptr;
   };
 
   return out_ptr_t{outptr};
}

Referenced by Botan::TPM2::Object::_public_info(), base_decode(), Botan::TPM2::PrivateKey::create_transient_from_template(), Botan::TPM2::HashFunction::final_with_ticket(), hex_decode(), Botan::TPM2::Signature_Operation::sign(), Botan::TLS::Extensions::take(), and Botan::TPM2::Session::tpm_nonce().

overloaded()

template<class... Ts>

Botan::overloaded

(

Ts...

)

-> overloaded< Ts... >

parse_algorithm_name()

std::vector< std::string > Botan::parse_algorithm_name

(

std::string_view

scan_name

)

Parse a SCAN-style algorithm name

Parameters

scan_name

the name

Returns

the name components

Definition at line 57 of file parsing.cpp.

                                                                {
   if(namex.find('(') == std::string::npos && namex.find(')') == std::string::npos) {
      return {std::string(namex)};
   }
 
   std::string name(namex);
   std::string substring;
   std::vector<std::string> elems;
   size_t level = 0;
 
   elems.push_back(name.substr(0, name.find('(')));
   name = name.substr(name.find('('));
 
   for(auto i = name.begin(); i != name.end(); ++i) {
      char c = *i;
 
      if(c == '(') {
         ++level;
      }
      if(c == ')') {
         if(level == 1 && i == name.end() - 1) {
            if(elems.size() == 1) {
               elems.push_back(substring.substr(1));
            } else {
               elems.push_back(substring);
            }
            return elems;
         }
 
         if(level == 0 || (level == 1 && i != name.end() - 1)) {
            throw Invalid_Algorithm_Name(namex);
         }
         --level;
      }
 
      if(c == ',' && level == 1) {
         if(elems.size() == 1) {
            elems.push_back(substring.substr(1));
         } else {
            elems.push_back(substring);
         }
         substring.clear();
      } else {
         substring += c;
      }
   }
 
   if(!substring.empty()) {
      throw Invalid_Algorithm_Name(namex);
   }
 
   return elems;
}

Referenced by Botan::AEAD_Mode::create(), Botan::Cipher_Mode::create(), and Botan::EME::create().

passes_miller_rabin_test()

bool Botan::passes_miller_rabin_test	(	const BigInt &	n,
		const Barrett_Reduction &	mod_n,
		const std::shared_ptr< Montgomery_Params > &	monty_n,
		const BigInt &	a )

Perform a single Miller-Rabin test with specified base

Parameters

n	the positive integer to test
mod_n	a pre-created Barrett_Reduction for n
monty_n	Montgomery parameters for n
a	the base to check

Returns

result of primality test

Definition at line 108 of file primality.cpp.

                                               {
   if(n < 3 || n.is_even()) {
      return false;
   }
 
   BOTAN_ASSERT_NOMSG(n > 1);
 
   const BigInt n_minus_1 = n - 1;
   const size_t s = low_zero_bits(n_minus_1);
   const BigInt nm1_s = n_minus_1 >> s;
   const size_t n_bits = n.bits();
 
   const size_t powm_window = 4;
 
   auto powm_a_n = monty_precompute(monty_n, a, powm_window);
 
   BigInt y = monty_execute(*powm_a_n, nm1_s, n_bits).value();
 
   if(y == 1 || y == n_minus_1) {
      return true;
   }
 
   for(size_t i = 1; i != s; ++i) {
      y = mod_n.square(y);
 
      if(y == 1) {  // found a non-trivial square root
         return false;
      }
 
      /*
      -1 is the trivial square root of unity, so ``a`` is not a
      witness for this number - give up
      */
      if(y == n_minus_1) {
         return true;
      }
   }
 
   return false;
}

References Botan::BigInt::bits(), BOTAN_ASSERT_NOMSG, Botan::BigInt::is_even(), low_zero_bits(), monty_execute(), monty_precompute(), Botan::Barrett_Reduction::square(), and Botan::Montgomery_Int::value().

Referenced by is_bailie_psw_probable_prime(), and is_miller_rabin_probable_prime().

pbes2_decrypt()

secure_vector< uint8_t > Botan::pbes2_decrypt	(	std::span< const uint8_t >	key_bits,
		std::string_view	passphrase,
		const std::vector< uint8_t > &	params )

Decrypt a PKCS #5 v2.0 encrypted stream

Parameters

key_bits	the input
passphrase	the passphrase to use for decryption
params	the PBES2 parameters

Definition at line 280 of file pbes2.cpp.

                                                                       {
   AlgorithmIdentifier kdf_algo, enc_algo;
 
   BER_Decoder(params).start_sequence().decode(kdf_algo).decode(enc_algo).end_cons();
 
   const std::string cipher = enc_algo.oid().human_name_or_empty();
   const auto cipher_spec = split_on(cipher, '/');
   if(cipher_spec.size() != 2 || !known_pbes_cipher_mode(cipher_spec[1])) {
      throw Decoding_Error(fmt("PBE-PKCS5 v2.0: Unknown/invalid cipher OID {}", enc_algo.oid()));
   }
 
   secure_vector<uint8_t> iv;
   BER_Decoder(enc_algo.parameters()).decode(iv, ASN1_Type::OctetString).verify_end();
 
   auto dec = Cipher_Mode::create(cipher, Cipher_Dir::Decryption);
   if(!dec) {
      throw Decoding_Error(fmt("PBE-PKCS5 cannot decrypt no cipher '{}'", cipher));
   }
 
   dec->set_key(derive_key(passphrase, kdf_algo, dec->key_spec().maximum_keylength()));
 
   dec->start(iv);
 
   secure_vector<uint8_t> buf(key_bits.begin(), key_bits.end());
   dec->finish(buf);
 
   return buf;
}

References Botan::Cipher_Mode::create(), Botan::BER_Decoder::decode(), Decryption, Botan::BER_Decoder::end_cons(), fmt(), Botan::OID::human_name_or_empty(), OctetString, Botan::AlgorithmIdentifier::oid(), Botan::AlgorithmIdentifier::parameters(), split_on(), Botan::BER_Decoder::start_sequence(), and Botan::BER_Decoder::verify_end().

pbes2_encrypt()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt	(	std::span< const uint8_t >	key_bits,
		std::string_view	passphrase,
		std::chrono::milliseconds	msec,
		std::string_view	cipher,
		std::string_view	digest,
		RandomNumberGenerator &	rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters

key_bits	the input
passphrase	the passphrase to use for encryption
msec	how many milliseconds to run PBKDF2
cipher	specifies the block cipher to use to encrypt
digest	specifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rng	a random number generator

Definition at line 242 of file pbes2.cpp.

                                                                                               {
   size_t msec_in_iterations_out = static_cast<size_t>(msec.count());
   return pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
   // return value msec_in_iterations_out discarded
}

pbes2_encrypt_iter()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt_iter	(	std::span< const uint8_t >	key_bits,
		std::string_view	passphrase,
		size_t	iterations,
		std::string_view	cipher,
		std::string_view	digest,
		RandomNumberGenerator &	rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters

key_bits	the input
passphrase	the passphrase to use for encryption
iterations	how many iterations to run PBKDF2
cipher	specifies the block cipher to use to encrypt
digest	specifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rng	a random number generator

Definition at line 271 of file pbes2.cpp.

                                                                                                    {
   return pbes2_encrypt_shared(key_bits, passphrase, nullptr, pbkdf_iter, cipher, digest, rng);
}

Referenced by Botan::PKCS8::BER_encode_encrypted_pbkdf_iter().

pbes2_encrypt_msec()

std::pair< AlgorithmIdentifier, std::vector< uint8_t > > Botan::pbes2_encrypt_msec	(	std::span< const uint8_t >	key_bits,
		std::string_view	passphrase,
		std::chrono::milliseconds	msec,
		size_t *	out_iterations_if_nonnull,
		std::string_view	cipher,
		std::string_view	digest,
		RandomNumberGenerator &	rng )

Encrypt with PBES2 from PKCS #5 v2.0

Parameters

key_bits	the input
passphrase	the passphrase to use for encryption
msec	how many milliseconds to run PBKDF2
out_iterations_if_nonnull	if not null, set to the number of PBKDF iterations used
cipher	specifies the block cipher to use to encrypt
digest	specifies the PRF to use with PBKDF2 (eg "HMAC(SHA-1)")
rng	a random number generator

Definition at line 253 of file pbes2.cpp.

                                                                                                    {
   size_t msec_in_iterations_out = static_cast<size_t>(msec.count());
 
   auto ret = pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
 
   if(out_iterations_if_nonnull) {
      *out_iterations_if_nonnull = msec_in_iterations_out;
   }
 
   return ret;
}

Referenced by Botan::PKCS8::BER_encode(), and Botan::PKCS8::BER_encode_encrypted_pbkdf_msec().

pbkdf2() [1/2]

void Botan::pbkdf2	(	MessageAuthenticationCode &	prf,
		uint8_t	out[],
		size_t	out_len,
		const uint8_t	salt[],
		size_t	salt_len,
		size_t	iterations )

Perform PBKDF2. The prf is assumed to be keyed already.

Definition at line 90 of file pbkdf2.cpp.

                               {
   if(iterations == 0) {
      throw Invalid_Argument("PBKDF2: Invalid iteration count");
   }
 
   clear_mem(out, out_len);
 
   if(out_len == 0) {
      return;
   }
 
   const size_t prf_sz = prf.output_length();
   BOTAN_ASSERT_NOMSG(prf_sz > 0);
 
   secure_vector<uint8_t> U(prf_sz);
 
   uint32_t counter = 1;
   while(out_len) {
      const size_t prf_output = std::min<size_t>(prf_sz, out_len);
 
      prf.update(salt, salt_len);
      prf.update_be(counter++);
      prf.final(U.data());
 
      xor_buf(out, U.data(), prf_output);
 
      for(size_t i = 1; i != iterations; ++i) {
         prf.update(U);
         prf.final(U.data());
         xor_buf(out, U.data(), prf_output);
      }
 
      out_len -= prf_output;
      out += prf_output;
   }
}

References BOTAN_ASSERT_NOMSG, clear_mem(), Botan::Buffered_Computation::final(), Botan::Buffered_Computation::output_length(), Botan::Buffered_Computation::update(), Botan::Buffered_Computation::update_be(), and xor_buf().

pbkdf2() [2/2]

size_t Botan::pbkdf2	(	MessageAuthenticationCode &	prf,
		uint8_t	out[],
		size_t	out_len,
		std::string_view	password,
		const uint8_t	salt[],
		size_t	salt_len,
		size_t	iterations,
		std::chrono::milliseconds	msec )

Definition at line 71 of file pbkdf2.cpp.

                                          {
   if(iterations == 0) {
      iterations = tune_pbkdf2(prf, out_len, msec);
   }
 
   PBKDF2 pbkdf2(prf, iterations);
 
   pbkdf2.derive_key(out, out_len, password.data(), password.size(), salt, salt_len);
 
   return iterations;
}

References pbkdf2().

Referenced by Botan::PBKDF2::derive_key(), Botan::Scrypt::derive_key(), Botan::PKCS5_PBKDF2::pbkdf(), and pbkdf2().

pkcs_hash_id()

std::vector< uint8_t > BOTAN_TEST_API Botan::pkcs_hash_id

(

std::string_view

hash_name

)

Return the PKCS #1 hash identifier

See also

RFC 3447 section 9.2

Parameters

hash_name

the name of the hash function

Returns

uint8_t sequence identifying the hash

Exceptions

Invalid_Argument

if the hash has no known PKCS #1 hash id

Definition at line 78 of file hash_id.cpp.

                                                     {
   // Special case for SSL/TLS RSA signatures
   if(name == "Parallel(MD5,SHA-1)") {
      return std::vector<uint8_t>();
   }
 
   // If you add a value to this function, also update test_hash_id.cpp
 
   if(name == "MD5") {
      return std::vector<uint8_t>(MD5_PKCS_ID, MD5_PKCS_ID + sizeof(MD5_PKCS_ID));
   }
 
   if(name == "RIPEMD-160") {
      return std::vector<uint8_t>(RIPEMD_160_PKCS_ID, RIPEMD_160_PKCS_ID + sizeof(RIPEMD_160_PKCS_ID));
   }
 
   if(name == "SHA-1") {
      return std::vector<uint8_t>(SHA_1_PKCS_ID, SHA_1_PKCS_ID + sizeof(SHA_1_PKCS_ID));
   }
 
   if(name == "SHA-224") {
      return std::vector<uint8_t>(SHA_224_PKCS_ID, SHA_224_PKCS_ID + sizeof(SHA_224_PKCS_ID));
   }
 
   if(name == "SHA-256") {
      return std::vector<uint8_t>(SHA_256_PKCS_ID, SHA_256_PKCS_ID + sizeof(SHA_256_PKCS_ID));
   }
 
   if(name == "SHA-384") {
      return std::vector<uint8_t>(SHA_384_PKCS_ID, SHA_384_PKCS_ID + sizeof(SHA_384_PKCS_ID));
   }
 
   if(name == "SHA-512") {
      return std::vector<uint8_t>(SHA_512_PKCS_ID, SHA_512_PKCS_ID + sizeof(SHA_512_PKCS_ID));
   }
 
   if(name == "SHA-512-256") {
      return std::vector<uint8_t>(SHA_512_256_PKCS_ID, SHA_512_256_PKCS_ID + sizeof(SHA_512_256_PKCS_ID));
   }
 
   if(name == "SHA-3(224)") {
      return std::vector<uint8_t>(SHA3_224_PKCS_ID, SHA3_224_PKCS_ID + sizeof(SHA3_224_PKCS_ID));
   }
 
   if(name == "SHA-3(256)") {
      return std::vector<uint8_t>(SHA3_256_PKCS_ID, SHA3_256_PKCS_ID + sizeof(SHA3_256_PKCS_ID));
   }
 
   if(name == "SHA-3(384)") {
      return std::vector<uint8_t>(SHA3_384_PKCS_ID, SHA3_384_PKCS_ID + sizeof(SHA3_384_PKCS_ID));
   }
 
   if(name == "SHA-3(512)") {
      return std::vector<uint8_t>(SHA3_512_PKCS_ID, SHA3_512_PKCS_ID + sizeof(SHA3_512_PKCS_ID));
   }
 
   if(name == "SM3") {
      return std::vector<uint8_t>(SM3_PKCS_ID, SM3_PKCS_ID + sizeof(SM3_PKCS_ID));
   }
 
   throw Invalid_Argument("No PKCS #1 identifier for " + std::string(name));
}

Referenced by botan_pkcs_hash_id(), Botan::EMSA_PKCS1v15::EMSA_PKCS1v15(), and Botan::EMSA_PKCS1v15_Raw::EMSA_PKCS1v15_Raw().

point_add()

template<typename ProjectivePoint, typename FieldElement>

ProjectivePoint Botan::point_add ( const ProjectivePoint & a, const ProjectivePoint & b )

inlineconstexpr

Definition at line 145 of file pcurves_algos.h.

                                                                                               {
   const auto a_is_identity = a.is_identity();
   const auto b_is_identity = b.is_identity();
 
   if((a_is_identity && b_is_identity).as_bool()) {
      return a;
   }
 
   const auto Z1Z1 = a.z().square();
   const auto Z2Z2 = b.z().square();
   const auto U1 = a.x() * Z2Z2;
   const auto U2 = b.x() * Z1Z1;
   const auto S1 = a.y() * b.z() * Z2Z2;
   const auto S2 = b.y() * a.z() * Z1Z1;
   const auto H = U2 - U1;
   const auto r = S2 - S1;
 
   // If a == -b then H == 0 && r != 0, in which case
   // at the end we'll set z = a.z * b.z * H = 0, resulting
   // in the correct output (point at infinity)
   if((r.is_zero() && H.is_zero()).as_bool()) {
      return a.dbl();
   }
 
   const auto HH = H.square();
   const auto HHH = H * HH;
   const auto V = U1 * HH;
   const auto t2 = r.square();
   const auto t3 = V + V;
   const auto t4 = t2 - HHH;
   auto X3 = t4 - t3;
   const auto t5 = V - X3;
   const auto t6 = S1 * HHH;
   const auto t7 = r * t5;
   auto Y3 = t7 - t6;
   const auto t8 = b.z() * H;
   auto Z3 = a.z() * t8;
 
   // if a is identity then return b
   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
 
   // if b is identity then return a
   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
 
   return ProjectivePoint(X3, Y3, Z3);
}

point_add_mixed()

template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>

ProjectivePoint Botan::point_add_mixed ( const ProjectivePoint & a, const AffinePoint & b, const FieldElement & one )

inlineconstexpr

Definition at line 193 of file pcurves_algos.h.

                                                                          {
   const auto a_is_identity = a.is_identity();
   const auto b_is_identity = b.is_identity();
   if((a_is_identity && b_is_identity).as_bool()) {
      return a;
   }
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
 
   Cost: 8M + 3S + 6add + 1*2
   */
 
   const auto Z1Z1 = a.z().square();
   const auto U2 = b.x() * Z1Z1;
   const auto S2 = b.y() * a.z() * Z1Z1;
   const auto H = U2 - a.x();
   const auto r = S2 - a.y();
 
   // If r == H == 0 then we are in the doubling case
   // For a == -b we compute the correct result because
   // H will be zero, leading to Z3 being zero also
   if((r.is_zero() && H.is_zero()).as_bool()) {
      return a.dbl();
   }
 
   const auto HH = H.square();
   const auto HHH = H * HH;
   const auto V = a.x() * HH;
   const auto t2 = r.square();
   const auto t3 = V + V;
   const auto t4 = t2 - HHH;
   auto X3 = t4 - t3;
   const auto t5 = V - X3;
   const auto t6 = a.y() * HHH;
   const auto t7 = r * t5;
   auto Y3 = t7 - t6;
   auto Z3 = a.z() * H;
 
   // if a is identity then return b
   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), one);
 
   // if b is identity then return a
   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
 
   return ProjectivePoint(X3, Y3, Z3);
}

point_add_or_sub_mixed()

template<typename ProjectivePoint, typename AffinePoint, typename FieldElement>

ProjectivePoint Botan::point_add_or_sub_mixed ( const ProjectivePoint & a, const AffinePoint & b, CT::Choice sub, const FieldElement & one )

inlineconstexpr

Definition at line 244 of file pcurves_algos.h.

                                                                                 {
   const auto a_is_identity = a.is_identity();
   const auto b_is_identity = b.is_identity();
   if((a_is_identity && b_is_identity).as_bool()) {
      return a;
   }
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
 
   Cost: 8M + 3S + 6add + 1*2
   */
 
   auto by = b.y();
   by.conditional_assign(sub, by.negate());
 
   const auto Z1Z1 = a.z().square();
   const auto U2 = b.x() * Z1Z1;
   const auto S2 = by * a.z() * Z1Z1;
   const auto H = U2 - a.x();
   const auto r = S2 - a.y();
 
   // If r == H == 0 then we are in the doubling case
   // For a == -b we compute the correct result because
   // H will be zero, leading to Z3 being zero also
   if((r.is_zero() && H.is_zero()).as_bool()) {
      return a.dbl();
   }
 
   const auto HH = H.square();
   const auto HHH = H * HH;
   const auto V = a.x() * HH;
   const auto t2 = r.square();
   const auto t3 = V + V;
   const auto t4 = t2 - HHH;
   auto X3 = t4 - t3;
   const auto t5 = V - X3;
   const auto t6 = a.y() * HHH;
   const auto t7 = r * t5;
   auto Y3 = t7 - t6;
   auto Z3 = a.z() * H;
 
   // if a is identity then return b
   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), by, one);
 
   // if b is identity then return a
   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
 
   return ProjectivePoint(X3, Y3, Z3);
}

poly_double_n() [1/2]

void Botan::poly_double_n ( uint8_t buf[], size_t n )

inline

Definition at line 26 of file poly_dbl.h.

                                                   {
   return poly_double_n(buf, buf, n);
}

References poly_double_n().

poly_double_n() [2/2]

void BOTAN_TEST_API Botan::poly_double_n	(	uint8_t	out[],
		const uint8_t	in[],
		size_t	n )

Polynomial doubling in GF(2^n)

Definition at line 81 of file poly_dbl.cpp.

                                                                {
   switch(n) {
      case 8:
         return poly_double<1, MinWeightPolynomial::P64>(out, in);
      case 16:
         return poly_double<2, MinWeightPolynomial::P128>(out, in);
      case 24:
         return poly_double<3, MinWeightPolynomial::P192>(out, in);
      case 32:
         return poly_double<4, MinWeightPolynomial::P256>(out, in);
      case 64:
         return poly_double<8, MinWeightPolynomial::P512>(out, in);
      case 128:
         return poly_double<16, MinWeightPolynomial::P1024>(out, in);
      default:
         throw Invalid_Argument("Unsupported size for poly_double_n");
   }
}

Referenced by poly_double_n(), and Botan::SIV_Mode::S2V().

poly_double_n_le()

void BOTAN_TEST_API Botan::poly_double_n_le	(	uint8_t	out[],
		const uint8_t	in[],
		size_t	n )

Definition at line 100 of file poly_dbl.cpp.

                                                                   {
   switch(n) {
      case 8:
         return poly_double_le<1, MinWeightPolynomial::P64>(out, in);
      case 16:
         return poly_double_le<2, MinWeightPolynomial::P128>(out, in);
      case 24:
         return poly_double_le<3, MinWeightPolynomial::P192>(out, in);
      case 32:
         return poly_double_le<4, MinWeightPolynomial::P256>(out, in);
      case 64:
         return poly_double_le<8, MinWeightPolynomial::P512>(out, in);
      case 128:
         return poly_double_le<16, MinWeightPolynomial::P1024>(out, in);
      default:
         throw Invalid_Argument("Unsupported size for poly_double_n_le");
   }
}

Referenced by Botan::XTS_Mode::update_tweak(), and xts_update_tweak_block().

poly_double_supported_size()

bool Botan::poly_double_supported_size ( size_t n )

inline

Returns true iff poly_double_n is implemented for this size.

Definition at line 22 of file poly_dbl.h.

                                                 {
   return (n == 8 || n == 16 || n == 24 || n == 32 || n == 64 || n == 128);
}

Referenced by Botan::CMAC::CMAC(), and Botan::XTS_Mode::XTS_Mode().

power_mod()

BigInt Botan::power_mod	(	const BigInt &	b,
		const BigInt &	x,
		const BigInt &	m )

Modular exponentation

Parameters

b	an integer base
x	a positive exponent
m	a positive modulus

Returns

(b^x) % m

Definition at line 284 of file numthry.cpp.

                                                                           {
   if(mod.is_negative() || mod == 1) {
      return BigInt::zero();
   }
 
   if(base.is_zero() || mod.is_zero()) {
      if(exp.is_zero()) {
         return BigInt::one();
      }
      return BigInt::zero();
   }
 
   auto reduce_mod = Barrett_Reduction::for_secret_modulus(mod);
 
   const size_t exp_bits = exp.bits();
 
   if(mod.is_odd()) {
      auto monty_params = std::make_shared<Montgomery_Params>(mod, reduce_mod);
      return monty_exp(monty_params, ct_modulo(base, mod), exp, exp_bits).value();
   }
 
   /*
   Support for even modulus is just a convenience and not considered
   cryptographically important, so this implementation is slow ...
   */
   BigInt accum = BigInt::one();
   BigInt g = ct_modulo(base, mod);
   BigInt t;
 
   for(size_t i = 0; i != exp_bits; ++i) {
      t = reduce_mod.multiply(g, accum);
      g = reduce_mod.square(g);
      accum.ct_cond_assign(exp.get_bit(i), t);
   }
   return accum;
}

References Botan::BigInt::bits(), Botan::BigInt::ct_cond_assign(), ct_modulo(), Botan::Barrett_Reduction::for_secret_modulus(), Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), Botan::BigInt::is_odd(), Botan::BigInt::is_zero(), monty_exp(), Botan::BigInt::one(), Botan::BigInt::square(), Botan::Montgomery_Int::value(), and Botan::BigInt::zero().

Referenced by botan_mp_powmod().

prefetch_array_raw()

uint64_t Botan::prefetch_array_raw ( size_t bytes, const void * array )

noexcept

Prefetch an array

This function returns a uint64_t which is accumulated from values read from the array. This may help confuse the compiler sufficiently to not elide otherwise "useless" reads. The return value will always be zero.

Definition at line 14 of file prefetch.cpp.

                                                                       {
#if defined(__cpp_lib_hardware_interference_size)
   const size_t cache_line_size = std::hardware_destructive_interference_size;
#else
   // We arbitrarily use a 64 byte cache line, which is by far the most
   // common size.
   //
   // Runtime detection adds too much overhead to this function.
   const size_t cache_line_size = 64;
#endif
 
   const uint8_t* array = static_cast<const uint8_t*>(arrayv);
 
   volatile uint64_t combiner = 1;
 
   for(size_t idx = 0; idx < bytes; idx += cache_line_size) {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_prefetch)
      // we have no way of knowing if the compiler will emit anything here
      __builtin_prefetch(&array[idx]);
#endif
 
      combiner = combiner | array[idx];
   }
 
   /*
   * The combiner variable is initialized with 1, and we accumulate using OR, so
   * now combiner must be a value other than zero. This being the case we will
   * always return zero here. Hopefully the compiler will not figure this out.
   */
   return ct_is_zero(combiner);
}

References ct_is_zero().

Referenced by prefetch_arrays().

prefetch_arrays()

template<typename T, size_t... Ns>
requires std::is_integral<T>::value

T Botan::prefetch_arrays ( T(&... arr) [Ns] )

noexcept

Prefetch several arrays

This function returns a uint64_t which is accumulated from values read from the array. This may help confuse the compiler sufficiently to not elide otherwise "useless" reads. The return value will always be zero.

Definition at line 34 of file prefetch.h.

{
   return (static_cast<T>(prefetch_array_raw(sizeof(T) * Ns, arr)) & ...);
}

References prefetch_array_raw().

Referenced by Botan::SEED::decrypt_n(), and Botan::SEED::encrypt_n().

probe_provider_private_key()

std::vector< std::string > Botan::probe_provider_private_key	(	std::string_view	alg_name,
		const std::vector< std::string > &	possible )

Definition at line 730 of file pk_algs.cpp.

                                                                                          {
   std::vector<std::string> providers;
 
   for(auto&& prov : possible) {
      if(prov == "base") {
         providers.push_back(prov);
      }
   }
 
   BOTAN_UNUSED(alg_name);
 
   return providers;
}

References BOTAN_UNUSED.

probe_providers_of()

template<typename T>

std::vector< std::string > Botan::probe_providers_of	(	std::string_view	algo_spec,
		const std::vector< std::string > &	possible = {"base"} )

Definition at line 105 of file scan_name.h.

                                                                                   {"base"}) {
   std::vector<std::string> providers;
   for(auto&& prov : possible) {
      auto o = T::create(algo_spec, prov);
      if(o) {
         providers.push_back(prov);  // available
      }
   }
   return providers;
}

Referenced by Botan::BlockCipher::providers(), Botan::HashFunction::providers(), Botan::KDF::providers(), Botan::MessageAuthenticationCode::providers(), Botan::PasswordHashFamily::providers(), Botan::PBKDF::providers(), Botan::StreamCipher::providers(), and Botan::XOF::providers().

random_code_element()

gf2m Botan::random_code_element	(	uint16_t	code_length,
		RandomNumberGenerator &	rng )

Definition at line 80 of file polyn_gf2m.cpp.

                                                                           {
   if(code_length == 0) {
      throw Invalid_Argument("random_code_element() was supplied a code length of zero");
   }
   const unsigned nlz = nlz_16bit(code_length - 1);
   const gf2m mask = (1 << (16 - nlz)) - 1;
 
   gf2m result;
 
   do {
      result = random_gf2m(rng);
      result &= mask;
   } while(result >= code_length);  // rejection sampling
 
   return result;
}

References random_gf2m().

Referenced by Botan::polyn_gf2m::polyn_gf2m().

random_gf2m()

gf2m Botan::random_gf2m

(

RandomNumberGenerator &

rng

)

Definition at line 74 of file polyn_gf2m.cpp.

                                             {
   uint8_t b[2];
   rng.randomize(b, sizeof(b));
   return make_uint16(b[1], b[0]);
}

References make_uint16(), and Botan::RandomNumberGenerator::randomize().

Referenced by random_code_element().

random_prime()

BigInt Botan::random_prime	(	RandomNumberGenerator &	rng,
		size_t	bits,
		const BigInt &	coprime = BigInt::from_u64(0),
		size_t	equiv = 1,
		size_t	equiv_mod = 2,
		size_t	prob = 128 )

Randomly generate a prime suitable for discrete logarithm parameters

Parameters

rng	a random number generator
bits	how large the resulting prime should be in bits
coprime	a positive integer that (prime - 1) should be coprime to
equiv	a non-negative number that the result should be equivalent to modulo equiv_mod
equiv_mod	the modulus equiv should be checked against
prob	use test so false positive is bounded by 1/2**prob

Returns

random prime with the specified criteria

Definition at line 97 of file make_prm.cpp.

                                                                                                             {
   if(bits <= 1) {
      throw Invalid_Argument("random_prime: Can't make a prime of " + std::to_string(bits) + " bits");
   }
   if(coprime.is_negative() || (!coprime.is_zero() && coprime.is_even()) || coprime.bits() >= bits) {
      throw Invalid_Argument("random_prime: invalid coprime");
   }
   if(modulo == 0 || modulo >= 100000) {
      throw Invalid_Argument("random_prime: Invalid modulo value");
   }
 
   equiv %= modulo;
 
   if(equiv == 0) {
      throw Invalid_Argument("random_prime Invalid value for equiv/modulo");
   }
 
   // Handle small values:
 
   if(bits <= 16) {
      if(equiv != 1 || modulo != 2 || coprime != 0) {
         throw Not_Implemented("random_prime equiv/modulo/coprime options not usable for small primes");
      }
 
      if(bits == 2) {
         return BigInt::from_word(((rng.next_byte() % 2) ? 2 : 3));
      } else if(bits == 3) {
         return BigInt::from_word(((rng.next_byte() % 2) ? 5 : 7));
      } else if(bits == 4) {
         return BigInt::from_word(((rng.next_byte() % 2) ? 11 : 13));
      } else {
         for(;;) {
            // This is slightly biased, but for small primes it does not seem to matter
            uint8_t b[4] = {0};
            rng.randomize(b, 4);
            const size_t idx = load_le<uint32_t>(b, 0) % PRIME_TABLE_SIZE;
            const uint16_t small_prime = PRIMES[idx];
 
            if(high_bit(small_prime) == bits) {
               return BigInt::from_word(small_prime);
            }
         }
      }
   }
 
   const size_t MAX_ATTEMPTS = 32 * 1024;
 
   const size_t mr_trials = miller_rabin_test_iterations(bits, prob, true);
 
   while(true) {
      BigInt p(rng, bits);
 
      // Force lowest and two top bits on
      p.set_bit(bits - 1);
      p.set_bit(bits - 2);
      p.set_bit(0);
 
      // Force p to be equal to equiv mod modulo
      p += (modulo - (p % modulo)) + equiv;
 
      Prime_Sieve sieve(p, bits, modulo, true);
 
      for(size_t attempt = 0; attempt <= MAX_ATTEMPTS; ++attempt) {
         p += modulo;
 
         if(!sieve.next()) {
            continue;
         }
 
         // here p can be even if modulo is odd, continue on in that case
         if(p.is_even()) {
            continue;
         }
 
         BOTAN_DEBUG_ASSERT(no_small_multiples(p, sieve));
 
         auto mod_p = Barrett_Reduction::for_secret_modulus(p);
 
         if(coprime > 1) {
            /*
            First do a single M-R iteration to quickly elimate most non-primes,
            before doing the coprimality check which is expensive
            */
            if(is_miller_rabin_probable_prime(p, mod_p, rng, 1) == false) {
               continue;
            }
 
            /*
            * Check if p - 1 and coprime are relatively prime, using gcd.
            * The gcd computation is const-time
            */
            if(gcd(p - 1, coprime) > 1) {
               continue;
            }
         }
 
         if(p.bits() > bits) {
            break;
         }
 
         if(is_miller_rabin_probable_prime(p, mod_p, rng, mr_trials) == false) {
            continue;
         }
 
         if(prob > 32 && !is_lucas_probable_prime(p, mod_p)) {
            continue;
         }
 
         return p;
      }
   }
}

References Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, Botan::Barrett_Reduction::for_secret_modulus(), Botan::BigInt::from_word(), gcd(), high_bit(), Botan::BigInt::is_even(), is_lucas_probable_prime(), is_miller_rabin_probable_prime(), Botan::BigInt::is_negative(), Botan::BigInt::is_zero(), load_le(), miller_rabin_test_iterations(), Botan::RandomNumberGenerator::next_byte(), PRIME_TABLE_SIZE, PRIMES, Botan::RandomNumberGenerator::randomize(), and Botan::BigInt::set_bit().

Referenced by Botan::DL_Group::DL_Group(), and random_safe_prime().

random_safe_prime()

BigInt Botan::random_safe_prime	(	RandomNumberGenerator &	rng,
		size_t	bits )

Return a 'safe' prime, of the form p=2*q+1 with q prime

Parameters

rng	a random number generator
bits	is how long the resulting prime should be

Returns

prime randomly chosen from safe primes of length bits

Definition at line 294 of file make_prm.cpp.

                                                                  {
   if(bits <= 64) {
      throw Invalid_Argument("random_safe_prime: Can't make a prime of " + std::to_string(bits) + " bits");
   }
 
   const size_t error_bound = 128;
 
   BigInt q, p;
   for(;;) {
      /*
      Generate q == 2 (mod 3), since otherwise [in the case of q == 1 (mod 3)],
      2*q+1 == 3 (mod 3) and so certainly not prime.
      */
      q = random_prime(rng, bits - 1, BigInt::zero(), 2, 3, error_bound);
      p = (q << 1) + 1;
 
      if(is_prime(p, rng, error_bound, true)) {
         return p;
      }
   }
}

References is_prime(), random_prime(), and Botan::BigInt::zero().

Referenced by Botan::DL_Group::DL_Group().

read_cfg()

std::map< std::string, std::string > Botan::read_cfg

(

std::istream &

is

)

Definition at line 34 of file read_cfg.cpp.

                                                      {
   std::map<std::string, std::string> kv;
   size_t line = 0;
 
   while(is.good()) {
      std::string s;
 
      std::getline(is, s);
 
      ++line;
 
      if(s.empty() || s[0] == '#') {
         continue;
      }
 
      s = clean_ws(s.substr(0, s.find('#')));
 
      if(s.empty()) {
         continue;
      }
 
      auto eq = s.find('=');
 
      if(eq == std::string::npos || eq == 0 || eq == s.size() - 1) {
         throw Decoding_Error("Bad read_cfg input '" + s + "' on line " + std::to_string(line));
      }
 
      const std::string key = clean_ws(s.substr(0, eq));
      const std::string val = clean_ws(s.substr(eq + 1, std::string::npos));
 
      kv[key] = val;
   }
 
   return kv;
}

Referenced by Botan::TLS::Text_Policy::Text_Policy(), and Botan::TLS::Text_Policy::Text_Policy().

read_kv()

std::map< std::string, std::string > Botan::read_kv

(

std::string_view

kv

)

Accepts key value pairs deliminated by commas:

"" (returns empty map) "K=V" (returns map {'K': 'V'}) "K1=V1,K2=V2" "K1=V1,K2=V2,K3=V3" "K1=V1,K2=V2,K3=a_value\,with\,commas_and_\=equals"

Values may be empty, keys must be non-empty and unique. Duplicate keys cause an exception.

Within both key and value, comma and equals can be escaped with backslash. Backslash can also be escaped.

Definition at line 13 of file read_kv.cpp.

                                                        {
   std::map<std::string, std::string> m;
   if(kv.empty()) {
      return m;
   }
 
   std::vector<std::string> parts;
 
   try {
      parts = split_on(kv, ',');
   } catch(std::exception&) {
      throw Invalid_Argument("Bad KV spec");
   }
 
   bool escaped = false;
   bool reading_key = true;
   std::string cur_key;
   std::string cur_val;
 
   for(char c : kv) {
      if(c == '\\' && !escaped) {
         escaped = true;
      } else if(c == ',' && !escaped) {
         if(cur_key.empty()) {
            throw Invalid_Argument("Bad KV spec empty key");
         }
 
         if(m.find(cur_key) != m.end()) {
            throw Invalid_Argument("Bad KV spec duplicated key");
         }
         m[cur_key] = cur_val;
         cur_key = "";
         cur_val = "";
         reading_key = true;
      } else if(c == '=' && !escaped) {
         if(reading_key == false) {
            throw Invalid_Argument("Bad KV spec unexpected equals sign");
         }
         reading_key = false;
      } else {
         if(reading_key) {
            cur_key += c;
         } else {
            cur_val += c;
         }
 
         if(escaped) {
            escaped = false;
         }
      }
   }
 
   if(!cur_key.empty()) {
      if(reading_key == false) {
         if(m.find(cur_key) != m.end()) {
            throw Invalid_Argument("Bad KV spec duplicated key");
         }
         m[cur_key] = cur_val;
      } else {
         throw Invalid_Argument("Bad KV spec incomplete string");
      }
   }
 
   return m;
}

References split_on().

read_window_bits()

template<size_t WindowBits, typename W, size_t N>

size_t Botan::read_window_bits ( std::span< const W, N > words, size_t offset )

constexpr

Definition at line 1145 of file mp_core.h.

                                                                            {
   static_assert(WindowBits >= 1 && WindowBits <= 7);
 
   constexpr uint8_t WindowMask = static_cast<uint8_t>(1 << WindowBits) - 1;
 
   constexpr size_t W_bits = sizeof(W) * 8;
   const auto bit_shift = offset % W_bits;
   const auto word_offset = words.size() - 1 - (offset / W_bits);
 
   const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0;
 
   const auto w0 = words[word_offset];
 
   if(single_byte_window) {
      return (w0 >> bit_shift) & WindowMask;
   } else {
      // Otherwise we must join two words and extract the result
      const auto w1 = words[word_offset - 1];
      const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift)));
      return combined & WindowMask;
   }
}

redc_crandall()

template<WordType W, size_t N, W C>

std::array< W, N > Botan::redc_crandall ( std::span< const W, 2 *N > z )

constexpr

Reduce z modulo p = 2**B - C where C is small

z is assumed to be at most (p-1)**2

For details on the algorithm see

• Handbook of Applied Cryptography, Algorithm 14.47
• Guide to Elliptic Curve Cryptography, Algorithm 2.54 and Note 2.55

Definition at line 1056 of file mp_core.h.

                                                                  {
   static_assert(N >= 2);
 
   std::array<W, N> hi = {};
 
   // hi = hi * c + lo
 
   W carry = 0;
   for(size_t i = 0; i != N; ++i) {
      hi[i] = word_madd3(z[i + N], C, z[i], &carry);
   }
 
   // hi += carry * C
   word carry_c[2] = {0};
   carry_c[0] = word_madd2(carry, C, &carry_c[1]);
 
   carry = bigint_add2_nc(hi.data(), N, carry_c, 2);
 
   constexpr W P0 = WordInfo<W>::max - (C - 1);
 
   std::array<W, N> r = {};
 
   W borrow = 0;
 
   /*
   * For undetermined reasons, on GCC (only) removing this asm block causes
   * massive (up to 20%) performance regressions in secp256k1.
   *
   * The generated code without the asm seems quite reasonable, and timing
   * repeated calls to redc_crandall with the cycle counter show that GCC
   * computes it in about the same number of cycles with or without the asm.
   *
   * So the cause of the regression is unclear. But it is reproducible across
   * machines and GCC versions.
   */
#if defined(BOTAN_MP_USE_X86_64_ASM) && defined(__GNUC__) && !defined(__clang__)
   if constexpr(N == 4 && std::same_as<W, uint64_t>) {
      if(!std::is_constant_evaluated()) {
         asm volatile(R"(
                      movq 0(%[x]), %[borrow]
                      subq %[p0], %[borrow]
                      movq %[borrow], 0(%[r])
                      movq 16(%[x]), %[borrow]
                      sbbq $-1, %[borrow]
                      movq %[borrow], 8(%[r])
                      movq 16(%[x]), %[borrow]
                      sbbq $-1, %[borrow]
                      movq %[borrow], 16(%[r])
                      movq 24(%[x]), %[borrow]
                      sbbq $-1, %[borrow]
                      movq %[borrow], 24(%[r])
                      sbbq %[borrow],%[borrow]
                      negq %[borrow]
                      )"
                      : [borrow] "=r"(borrow)
                      : [x] "r"(hi.data()), [p0] "r"(P0), [r] "r"(r.data()), "0"(borrow)
                      : "cc", "memory");
      }
 
      borrow = (carry - borrow) > carry;
      CT::conditional_assign_mem(borrow, r.data(), hi.data(), N);
      return r;
   }
#endif
 
   r[0] = word_sub(hi[0], P0, &borrow);
   for(size_t i = 1; i != N; ++i) {
      r[i] = word_sub(hi[i], WordInfo<W>::max, &borrow);
   }
 
   borrow = (carry - borrow) > carry;
 
   CT::conditional_assign_mem(borrow, r.data(), hi.data(), N);
 
   return r;
}

References bigint_add2_nc(), carry(), Botan::CT::conditional_assign_mem(), word_madd2(), word_madd3(), and word_sub().

redc_mul()

void Botan::redc_mul ( int64_t & s1, int64_t & s2, int64_t & s3, int64_t & s4, int64_t & s5, int64_t & s6, int64_t & X )

inline

Definition at line 58 of file ed25519_internal.h.

                                                                                                               {
   s1 += X * 666643;
   s2 += X * 470296;
   s3 += X * 654183;
   s4 -= X * 997805;
   s5 += X * 136657;
   s6 -= X * 683901;
   X = 0;
}

Referenced by sc_muladd(), and sc_reduce().

reduce()

template<typename RetT, typename KeyT, typename ReducerT>
requires std::is_convertible_v<ReducerT, std::function<RetT(RetT, const KeyT&)>>

RetT Botan::reduce	(	const std::vector< KeyT > &	keys,
		RetT	acc,
		ReducerT	reducer )

Reduce the values of keys into an accumulator initialized with acc using the reducer function reducer.

The reducer is a function taking the accumulator and a single key to return the new accumulator. Keys are consecutively reduced into the accumulator.

Returns

the accumulator containing the reduction of keys

Definition at line 48 of file stl_util.h.

{
   for(const KeyT& key : keys) {
      acc = reducer(std::move(acc), key);
   }
   return acc;
}

Referenced by Botan::Hybrid_PrivateKey::check_key(), Botan::Hybrid_PublicKey::check_key(), Botan::TLS::Hybrid_KEM_PublicKey::load_for_group(), Botan::Hybrid_PublicKey::raw_public_key_bits(), and Botan::TLS::Hybrid_KEM_PublicKey::raw_public_key_bits().

reverse_bytes()

template<std::unsigned_integral T>
requires (sizeof(T) == 1 || sizeof(T) == 2 || sizeof(T) == 4 || sizeof(T) == 8)

T Botan::reverse_bytes ( T x )

inlineconstexpr

Swap the byte order of an unsigned integer

Definition at line 27 of file bswap.h.

                                      {
   if constexpr(sizeof(T) == 1) {
      return x;
   } else if constexpr(sizeof(T) == 2) {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
      return static_cast<T>(__builtin_bswap16(x));
#else
      return static_cast<T>((x << 8) | (x >> 8));
#endif
   } else if constexpr(sizeof(T) == 4) {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
      return static_cast<T>(__builtin_bswap32(x));
#else
      // MSVC at least recognizes this as a bswap
      return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
                            ((x & 0xFF000000) >> 24));
#endif
   } else if constexpr(sizeof(T) == 8) {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
      return static_cast<T>(__builtin_bswap64(x));
#else
      uint32_t hi = static_cast<uint32_t>(x >> 32);
      uint32_t lo = static_cast<uint32_t>(x);
 
      hi = reverse_bytes(hi);
      lo = reverse_bytes(lo);
 
      return (static_cast<T>(lo) << 32) | hi;
#endif
   }
}

References reverse_bytes().

Referenced by ct_reverse_bits(), Botan::detail::load_any(), reverse_bytes(), and Botan::detail::store_any().

rfc3394_keyunwrap()

secure_vector< uint8_t > Botan::rfc3394_keyunwrap	(	const secure_vector< uint8_t > &	key,
		const SymmetricKey &	kek )

Decrypt a key under a key encryption key using the algorithm described in RFC 3394

Parameters

key	the encrypted key to decrypt
kek	the key encryption key

Returns

key decrypted under kek

Definition at line 27 of file rfc3394.cpp.

                                                                                                     {
   BOTAN_ARG_CHECK(kek.size() == 16 || kek.size() == 24 || kek.size() == 32, "Invalid KEK length for NIST key wrap");
 
   BOTAN_ARG_CHECK(key.size() >= 16 && key.size() % 8 == 0, "Bad input key size for NIST key unwrap");
 
   const std::string cipher_name = "AES-" + std::to_string(8 * kek.size());
   auto aes = BlockCipher::create_or_throw(cipher_name);
   aes->set_key(kek);
 
   return nist_key_unwrap(key.data(), key.size(), *aes);
}

References BOTAN_ARG_CHECK, Botan::BlockCipher::create_or_throw(), nist_key_unwrap(), and Botan::OctetString::size().

rfc3394_keywrap()

secure_vector< uint8_t > Botan::rfc3394_keywrap	(	const secure_vector< uint8_t > &	key,
		const SymmetricKey &	kek )

Encrypt a key under a key encryption key using the algorithm described in RFC 3394

Parameters

key	the plaintext key to encrypt
kek	the key encryption key

Returns

key encrypted under kek

Definition at line 16 of file rfc3394.cpp.

                                                                                                   {
   BOTAN_ARG_CHECK(kek.size() == 16 || kek.size() == 24 || kek.size() == 32, "Invalid KEK length for NIST key wrap");
 
   const std::string cipher_name = "AES-" + std::to_string(8 * kek.size());
   auto aes = BlockCipher::create_or_throw(cipher_name);
   aes->set_key(kek);
 
   std::vector<uint8_t> wrapped = nist_key_wrap(key.data(), key.size(), *aes);
   return secure_vector<uint8_t>(wrapped.begin(), wrapped.end());
}

References BOTAN_ARG_CHECK, Botan::BlockCipher::create_or_throw(), nist_key_wrap(), and Botan::OctetString::size().

RFC4880_decode_count()

size_t Botan::RFC4880_decode_count

(

uint8_t

encoded_iter

)

Decode the iteration count from RFC 4880 encoding

Definition at line 61 of file rfc4880.cpp.

                                          {
   return OPENPGP_S2K_ITERS[iter];
}

Referenced by Botan::OpenPGP_S2K::decode_count(), and RFC4880_round_iterations().

RFC4880_encode_count()

uint8_t Botan::RFC4880_encode_count

(

size_t

iterations

)

RFC 4880 encodes the iteration count to a single-byte value

Definition at line 47 of file rfc4880.cpp.

                                                        {
   if(desired_iterations <= OPENPGP_S2K_ITERS[0]) {
      return 0;
   }
 
   if(desired_iterations >= OPENPGP_S2K_ITERS[255]) {
      return 255;
   }
 
   const uint32_t* i = std::lower_bound(OPENPGP_S2K_ITERS, OPENPGP_S2K_ITERS + 256, desired_iterations);
 
   return static_cast<uint8_t>(i - OPENPGP_S2K_ITERS);
}

Referenced by Botan::OpenPGP_S2K::encode_count(), and RFC4880_round_iterations().

RFC4880_round_iterations()

size_t Botan::RFC4880_round_iterations ( size_t iterations )

inline

Round an arbitrary iteration count to next largest iteration count supported by RFC4880 encoding.

Definition at line 32 of file rfc4880.h.

                                                          {
   return RFC4880_decode_count(RFC4880_encode_count(iterations));
}

References RFC4880_decode_count(), RFC4880_encode_count(), and RFC4880_round_iterations().

Referenced by RFC4880_round_iterations(), and Botan::RFC4880_S2K_Family::tune().

rho()

template<size_t R1, size_t R2, size_t R3, typename T>

T Botan::rho ( T x )

inlineconstexpr

SHA-2 Sigma style function

Definition at line 51 of file rotate.h.

                            {
   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
}

References rotr().

Referenced by Botan::Dilithium_Algos::decode_public_key(), Botan::Dilithium_Algos::encode_public_key(), Botan::Dilithium_Algos::expand_A(), Botan::Dilithium_Algos::expand_keypair(), Botan::Kyber_Algos::expand_keypair(), Botan::Dilithium_Symmetric_Primitives_Base::H(), Botan::Kyber_KEM_Operation_Base::Kyber_KEM_Operation_Base(), Botan::Kyber_PublicKey::Kyber_PublicKey(), SHA2_32_F(), SHA2_32_F(), SHA2_64_F(), and SHA2_64_F().

root()

Gf448Elem Botan::root

(

const Gf448Elem &

elem

)

Compute the root of elem in the field.

The root of a in GF(p) is computed as r = a^((p+1)/4) mod p. Note that the root is not unique, i.e. r and p-r are both roots.

Returns

GfPElem The root of this element.

Definition at line 354 of file curve448_gf.cpp.

                                      {
   Gf448Elem res(1);
 
   // (P-3)/4 is an 445 bit integer with one zero bits at 222. All others are one.
   for(int16_t t = 445; t >= 0; --t) {
      gf_square(res.words(), res.words());
      if(t != 222) {
         gf_mul(res.words(), res.words(), elem.words());
      }
   }
 
   return res;
}

References Botan::Gf448Elem::words().

Referenced by Botan::Ed448Point::decode(), Botan::Sphincs_Hash_Functions::H_msg(), Botan::XMSS_Hash::h_msg(), Botan::Sphincs_Hash_Functions::H_msg_digest(), Botan::XMSS_Hash::h_msg_init(), Botan::SphincsPlus_PrivateKey::SphincsPlus_PrivateKey(), xmss_gen_root(), and Botan::Sphincs_Hash_Functions::~Sphincs_Hash_Functions().

rotl() [1/4]

template<size_t R>

SIMD_16x32 Botan::rotl ( SIMD_16x32 input )

inline

Definition at line 310 of file simd_avx512.h.

                                         {
   return input.rotl<R>();
}

References Botan::SIMD_16x32::rotl().

rotl() [2/4]

template<size_t R>

SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 Botan::rotl ( SIMD_4x32 input )

inline

Definition at line 763 of file simd_4x32.h.

                                                              {
   return input.rotl<R>();
}

References Botan::SIMD_4x32::rotl().

rotl() [3/4]

template<size_t R>

SIMD_8x32 Botan::rotl ( SIMD_8x32 input )

inline

Definition at line 332 of file simd_avx2.h.

                                       {
   return input.rotl<R>();
}

References Botan::SIMD_8x32::rotl().

rotl() [4/4]

template<size_t ROT, typename T>
requires (ROT > 0 && ROT < 8 * sizeof(T))

T Botan::rotl ( T input )

inlineconstexpr

Bit rotation left by a compile-time constant amount

Parameters

input

the input word

Returns

input rotated left by ROT bits

Definition at line 21 of file rotate.h.

{
   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
}

Referenced by Botan::SHA_1::compress_n(), Botan::Noekeon::decrypt_n(), Botan::Noekeon::encrypt_n(), Botan::GOST_28147_89::GOST_28147_89(), Keccak_Permutation_round(), and Botan::Serpent_F::transform().

rotl_var()

template<typename T>

T Botan::rotl_var ( T input, size_t rot )

inlineconstexpr

Bit rotation left, variable rotation amount

Parameters

input	the input word
rot	the number of bits to rotate, must be between 0 and sizeof(T)*8-1

Returns

input rotated left by rot bits

Definition at line 62 of file rotate.h.

                                                 {
   return rot ? static_cast<T>((input << rot) | (input >> (sizeof(T) * 8 - rot))) : input;
}

rotr() [1/4]

template<size_t R>

SIMD_16x32 Botan::rotr ( SIMD_16x32 input )

inline

Definition at line 315 of file simd_avx512.h.

                                         {
   return input.rotr<R>();
}

References Botan::SIMD_16x32::rotr().

rotr() [2/4]

template<size_t R>

SIMD_4x32 BOTAN_FN_ISA_SIMD_4X32 Botan::rotr ( SIMD_4x32 input )

inline

Definition at line 768 of file simd_4x32.h.

                                                              {
   return input.rotr<R>();
}

References Botan::SIMD_4x32::rotr().

rotr() [3/4]

template<size_t R>

SIMD_8x32 Botan::rotr ( SIMD_8x32 input )

inline

Definition at line 337 of file simd_avx2.h.

                                       {
   return input.rotr<R>();
}

References Botan::SIMD_8x32::rotr().

rotr() [4/4]

template<size_t ROT, typename T>
requires (ROT > 0 && ROT < 8 * sizeof(T))

T Botan::rotr ( T input )

inlineconstexpr

Bit rotation right by a compile-time constant amount

Parameters

input

the input word

Returns

input rotated right by ROT bits

Definition at line 33 of file rotate.h.

{
   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
}

Referenced by Botan::Noekeon::decrypt_n(), Botan::Noekeon::encrypt_n(), Botan::Serpent_F::i_transform(), rho(), and sigma().

rotr_var()

template<typename T>

T Botan::rotr_var ( T input, size_t rot )

inlineconstexpr

Bit rotation right, variable rotation amount

Parameters

input	the input word
rot	the number of bits to rotate, must be between 0 and sizeof(T)*8-1

Returns

input rotated right by rot bits

Definition at line 73 of file rotate.h.

                                                 {
   return rot ? static_cast<T>((input >> rot) | (input << (sizeof(T) * 8 - rot))) : input;
}

round_up()

size_t Botan::round_up ( size_t n, size_t align_to )

inlineconstexpr

Integer rounding

Returns an integer z such that n <= z <= n + align_to and z % align_to == 0

Parameters

n	an integer
align_to	the alignment boundary

Returns

n rounded up to a multiple of align_to

Definition at line 26 of file rounding.h.

                                                            {
   // Arguably returning n in this case would also be sensible
   BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
 
   if(n % align_to > 0) {
      const size_t adj = align_to - (n % align_to);
      BOTAN_ARG_CHECK(n + adj >= n, "Integer overflow during rounding");
      n += adj;
   }
   return n;
}

References BOTAN_ARG_CHECK.

Referenced by Botan::BigInt::bytes(), Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), monty_multi_exp(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), Botan::CBC_Encryption::output_length(), Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::output_length(), Botan::BigInt::randomize(), and Botan::TLS::TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n().

runtime_version_check()

std::string Botan::runtime_version_check	(	uint32_t	major,
		uint32_t	minor,
		uint32_t	patch )

Usable for checking that the DLL version loaded at runtime exactly matches the compile-time version. Call using BOTAN_VERSION_* macro values, like so:

Botan::runtime_version_check(BOTAN_VERSION_MAJOR, BOTAN_VERSION_MINOR, BOTAN_VERSION_PATCH);

It will return an empty string if the versions match, or otherwise an error message indicating the discrepancy. This only is useful in dynamic libraries, where it is possible to compile and run against different versions.

Definition at line 75 of file version.cpp.

                                                                                {
   if(major != version_major() || minor != version_minor() || patch != version_patch()) {
      return fmt("Warning: linked version ({}) does not match version built against ({}.{}.{})\n",
                 short_version_cstr(),
                 major,
                 minor,
                 patch);
   }
 
   return "";
}

References fmt(), short_version_cstr(), version_major(), version_minor(), and version_patch().

same_mem()

template<typename T>

bool Botan::same_mem ( const T * p1, const T * p2, size_t n )

inline

Memory comparison, input insensitive

Parameters

p1	a pointer to an array
p2	a pointer to another array
n	the number of Ts in p1 and p2

Returns

true iff p1[i] == p2[i] forall i in [0...n)

Definition at line 302 of file mem_ops.h.

                                                         {
   volatile T difference = 0;
 
   for(size_t i = 0; i != n; ++i) {
      difference = difference | (p1[i] ^ p2[i]);
   }
 
   return difference == 0;
}

References same_mem().

Referenced by same_mem().

sc_muladd()

void Botan::sc_muladd	(	uint8_t *	s,
		const uint8_t *	a,
		const uint8_t *	b,
		const uint8_t *	c )

Definition at line 26 of file sc_muladd.cpp.

                                                                                 {
   const int32_t MASK = 0x1fffff;
 
   const int64_t a0 = MASK & load_3(a);
   const int64_t a1 = MASK & (load_4(a + 2) >> 5);
   const int64_t a2 = MASK & (load_3(a + 5) >> 2);
   const int64_t a3 = MASK & (load_4(a + 7) >> 7);
   const int64_t a4 = MASK & (load_4(a + 10) >> 4);
   const int64_t a5 = MASK & (load_3(a + 13) >> 1);
   const int64_t a6 = MASK & (load_4(a + 15) >> 6);
   const int64_t a7 = MASK & (load_3(a + 18) >> 3);
   const int64_t a8 = MASK & load_3(a + 21);
   const int64_t a9 = MASK & (load_4(a + 23) >> 5);
   const int64_t a10 = MASK & (load_3(a + 26) >> 2);
   const int64_t a11 = (load_4(a + 28) >> 7);
   const int64_t b0 = MASK & load_3(b);
   const int64_t b1 = MASK & (load_4(b + 2) >> 5);
   const int64_t b2 = MASK & (load_3(b + 5) >> 2);
   const int64_t b3 = MASK & (load_4(b + 7) >> 7);
   const int64_t b4 = MASK & (load_4(b + 10) >> 4);
   const int64_t b5 = MASK & (load_3(b + 13) >> 1);
   const int64_t b6 = MASK & (load_4(b + 15) >> 6);
   const int64_t b7 = MASK & (load_3(b + 18) >> 3);
   const int64_t b8 = MASK & load_3(b + 21);
   const int64_t b9 = MASK & (load_4(b + 23) >> 5);
   const int64_t b10 = MASK & (load_3(b + 26) >> 2);
   const int64_t b11 = (load_4(b + 28) >> 7);
   const int64_t c0 = MASK & load_3(c);
   const int64_t c1 = MASK & (load_4(c + 2) >> 5);
   const int64_t c2 = MASK & (load_3(c + 5) >> 2);
   const int64_t c3 = MASK & (load_4(c + 7) >> 7);
   const int64_t c4 = MASK & (load_4(c + 10) >> 4);
   const int64_t c5 = MASK & (load_3(c + 13) >> 1);
   const int64_t c6 = MASK & (load_4(c + 15) >> 6);
   const int64_t c7 = MASK & (load_3(c + 18) >> 3);
   const int64_t c8 = MASK & load_3(c + 21);
   const int64_t c9 = MASK & (load_4(c + 23) >> 5);
   const int64_t c10 = MASK & (load_3(c + 26) >> 2);
   const int64_t c11 = (load_4(c + 28) >> 7);
 
   int64_t s0 = c0 + a0 * b0;
   int64_t s1 = c1 + a0 * b1 + a1 * b0;
   int64_t s2 = c2 + a0 * b2 + a1 * b1 + a2 * b0;
   int64_t s3 = c3 + a0 * b3 + a1 * b2 + a2 * b1 + a3 * b0;
   int64_t s4 = c4 + a0 * b4 + a1 * b3 + a2 * b2 + a3 * b1 + a4 * b0;
   int64_t s5 = c5 + a0 * b5 + a1 * b4 + a2 * b3 + a3 * b2 + a4 * b1 + a5 * b0;
   int64_t s6 = c6 + a0 * b6 + a1 * b5 + a2 * b4 + a3 * b3 + a4 * b2 + a5 * b1 + a6 * b0;
   int64_t s7 = c7 + a0 * b7 + a1 * b6 + a2 * b5 + a3 * b4 + a4 * b3 + a5 * b2 + a6 * b1 + a7 * b0;
   int64_t s8 = c8 + a0 * b8 + a1 * b7 + a2 * b6 + a3 * b5 + a4 * b4 + a5 * b3 + a6 * b2 + a7 * b1 + a8 * b0;
   int64_t s9 = c9 + a0 * b9 + a1 * b8 + a2 * b7 + a3 * b6 + a4 * b5 + a5 * b4 + a6 * b3 + a7 * b2 + a8 * b1 + a9 * b0;
   int64_t s10 = c10 + a0 * b10 + a1 * b9 + a2 * b8 + a3 * b7 + a4 * b6 + a5 * b5 + a6 * b4 + a7 * b3 + a8 * b2 +
                 a9 * b1 + a10 * b0;
   int64_t s11 = c11 + a0 * b11 + a1 * b10 + a2 * b9 + a3 * b8 + a4 * b7 + a5 * b6 + a6 * b5 + a7 * b4 + a8 * b3 +
                 a9 * b2 + a10 * b1 + a11 * b0;
   int64_t s12 =
      a1 * b11 + a2 * b10 + a3 * b9 + a4 * b8 + a5 * b7 + a6 * b6 + a7 * b5 + a8 * b4 + a9 * b3 + a10 * b2 + a11 * b1;
   int64_t s13 = a2 * b11 + a3 * b10 + a4 * b9 + a5 * b8 + a6 * b7 + a7 * b6 + a8 * b5 + a9 * b4 + a10 * b3 + a11 * b2;
   int64_t s14 = a3 * b11 + a4 * b10 + a5 * b9 + a6 * b8 + a7 * b7 + a8 * b6 + a9 * b5 + a10 * b4 + a11 * b3;
   int64_t s15 = a4 * b11 + a5 * b10 + a6 * b9 + a7 * b8 + a8 * b7 + a9 * b6 + a10 * b5 + a11 * b4;
   int64_t s16 = a5 * b11 + a6 * b10 + a7 * b9 + a8 * b8 + a9 * b7 + a10 * b6 + a11 * b5;
   int64_t s17 = a6 * b11 + a7 * b10 + a8 * b9 + a9 * b8 + a10 * b7 + a11 * b6;
   int64_t s18 = a7 * b11 + a8 * b10 + a9 * b9 + a10 * b8 + a11 * b7;
   int64_t s19 = a8 * b11 + a9 * b10 + a10 * b9 + a11 * b8;
   int64_t s20 = a9 * b11 + a10 * b10 + a11 * b9;
   int64_t s21 = a10 * b11 + a11 * b10;
   int64_t s22 = a11 * b11;
   int64_t s23 = 0;
 
   carry<21>(s0, s1);
   carry<21>(s2, s3);
   carry<21>(s4, s5);
   carry<21>(s6, s7);
   carry<21>(s8, s9);
   carry<21>(s10, s11);
   carry<21>(s12, s13);
   carry<21>(s14, s15);
   carry<21>(s16, s17);
   carry<21>(s18, s19);
   carry<21>(s20, s21);
   carry<21>(s22, s23);
 
   carry<21>(s1, s2);
   carry<21>(s3, s4);
   carry<21>(s5, s6);
   carry<21>(s7, s8);
   carry<21>(s9, s10);
   carry<21>(s11, s12);
   carry<21>(s13, s14);
   carry<21>(s15, s16);
   carry<21>(s17, s18);
   carry<21>(s19, s20);
   carry<21>(s21, s22);
 
   redc_mul(s11, s12, s13, s14, s15, s16, s23);
   redc_mul(s10, s11, s12, s13, s14, s15, s22);
   redc_mul(s9, s10, s11, s12, s13, s14, s21);
   redc_mul(s8, s9, s10, s11, s12, s13, s20);
   redc_mul(s7, s8, s9, s10, s11, s12, s19);
   redc_mul(s6, s7, s8, s9, s10, s11, s18);
 
   carry<21>(s6, s7);
   carry<21>(s8, s9);
   carry<21>(s10, s11);
   carry<21>(s12, s13);
   carry<21>(s14, s15);
   carry<21>(s16, s17);
 
   carry<21>(s7, s8);
   carry<21>(s9, s10);
   carry<21>(s11, s12);
   carry<21>(s13, s14);
   carry<21>(s15, s16);
 
   redc_mul(s5, s6, s7, s8, s9, s10, s17);
   redc_mul(s4, s5, s6, s7, s8, s9, s16);
   redc_mul(s3, s4, s5, s6, s7, s8, s15);
   redc_mul(s2, s3, s4, s5, s6, s7, s14);
   redc_mul(s1, s2, s3, s4, s5, s6, s13);
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry<21>(s0, s1);
   carry<21>(s2, s3);
   carry<21>(s4, s5);
   carry<21>(s6, s7);
   carry<21>(s8, s9);
   carry<21>(s10, s11);
 
   carry<21>(s1, s2);
   carry<21>(s3, s4);
   carry<21>(s5, s6);
   carry<21>(s7, s8);
   carry<21>(s9, s10);
   carry<21>(s11, s12);
 
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry0<21>(s0, s1);
   carry0<21>(s1, s2);
   carry0<21>(s2, s3);
   carry0<21>(s3, s4);
   carry0<21>(s4, s5);
   carry0<21>(s5, s6);
   carry0<21>(s6, s7);
   carry0<21>(s7, s8);
   carry0<21>(s8, s9);
   carry0<21>(s9, s10);
   carry0<21>(s10, s11);
   carry0<21>(s11, s12);
 
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry0<21>(s0, s1);
   carry0<21>(s1, s2);
   carry0<21>(s2, s3);
   carry0<21>(s3, s4);
   carry0<21>(s4, s5);
   carry0<21>(s5, s6);
   carry0<21>(s6, s7);
   carry0<21>(s7, s8);
   carry0<21>(s8, s9);
   carry0<21>(s9, s10);
   carry0<21>(s10, s11);
 
   s[0] = static_cast<uint8_t>(s0 >> 0);
   s[1] = static_cast<uint8_t>(s0 >> 8);
   s[2] = static_cast<uint8_t>((s0 >> 16) | (s1 << 5));
   s[3] = static_cast<uint8_t>(s1 >> 3);
   s[4] = static_cast<uint8_t>(s1 >> 11);
   s[5] = static_cast<uint8_t>((s1 >> 19) | (s2 << 2));
   s[6] = static_cast<uint8_t>(s2 >> 6);
   s[7] = static_cast<uint8_t>((s2 >> 14) | (s3 << 7));
   s[8] = static_cast<uint8_t>(s3 >> 1);
   s[9] = static_cast<uint8_t>(s3 >> 9);
   s[10] = static_cast<uint8_t>((s3 >> 17) | (s4 << 4));
   s[11] = static_cast<uint8_t>(s4 >> 4);
   s[12] = static_cast<uint8_t>(s4 >> 12);
   s[13] = static_cast<uint8_t>((s4 >> 20) | (s5 << 1));
   s[14] = static_cast<uint8_t>(s5 >> 7);
   s[15] = static_cast<uint8_t>((s5 >> 15) | (s6 << 6));
   s[16] = static_cast<uint8_t>(s6 >> 2);
   s[17] = static_cast<uint8_t>(s6 >> 10);
   s[18] = static_cast<uint8_t>((s6 >> 18) | (s7 << 3));
   s[19] = static_cast<uint8_t>(s7 >> 5);
   s[20] = static_cast<uint8_t>(s7 >> 13);
   s[21] = static_cast<uint8_t>(s8 >> 0);
   s[22] = static_cast<uint8_t>(s8 >> 8);
   s[23] = static_cast<uint8_t>((s8 >> 16) | (s9 << 5));
   s[24] = static_cast<uint8_t>(s9 >> 3);
   s[25] = static_cast<uint8_t>(s9 >> 11);
   s[26] = static_cast<uint8_t>((s9 >> 19) | (s10 << 2));
   s[27] = static_cast<uint8_t>(s10 >> 6);
   s[28] = static_cast<uint8_t>((s10 >> 14) | (s11 << 7));
   s[29] = static_cast<uint8_t>(s11 >> 1);
   s[30] = static_cast<uint8_t>(s11 >> 9);
   s[31] = static_cast<uint8_t>(s11 >> 17);
}

References carry(), carry0(), load_3(), load_4(), and redc_mul().

Referenced by ed25519_sign().

sc_reduce()

void Botan::sc_reduce

(

uint8_t *

s

)

Definition at line 25 of file sc_reduce.cpp.

                           {
   const uint32_t MASK = 0x1fffff;
 
   int64_t s0 = MASK & load_3(s);
   int64_t s1 = MASK & (load_4(s + 2) >> 5);
   int64_t s2 = MASK & (load_3(s + 5) >> 2);
   int64_t s3 = MASK & (load_4(s + 7) >> 7);
   int64_t s4 = MASK & (load_4(s + 10) >> 4);
   int64_t s5 = MASK & (load_3(s + 13) >> 1);
   int64_t s6 = MASK & (load_4(s + 15) >> 6);
   int64_t s7 = MASK & (load_3(s + 18) >> 3);
   int64_t s8 = MASK & load_3(s + 21);
   int64_t s9 = MASK & (load_4(s + 23) >> 5);
   int64_t s10 = MASK & (load_3(s + 26) >> 2);
   int64_t s11 = MASK & (load_4(s + 28) >> 7);
   int64_t s12 = MASK & (load_4(s + 31) >> 4);
   int64_t s13 = MASK & (load_3(s + 34) >> 1);
   int64_t s14 = MASK & (load_4(s + 36) >> 6);
   int64_t s15 = MASK & (load_3(s + 39) >> 3);
   int64_t s16 = MASK & load_3(s + 42);
   int64_t s17 = MASK & (load_4(s + 44) >> 5);
   int64_t s18 = MASK & (load_3(s + 47) >> 2);
   int64_t s19 = MASK & (load_4(s + 49) >> 7);
   int64_t s20 = MASK & (load_4(s + 52) >> 4);
   int64_t s21 = MASK & (load_3(s + 55) >> 1);
   int64_t s22 = MASK & (load_4(s + 57) >> 6);
   int64_t s23 = (load_4(s + 60) >> 3);
 
   redc_mul(s11, s12, s13, s14, s15, s16, s23);
   redc_mul(s10, s11, s12, s13, s14, s15, s22);
   redc_mul(s9, s10, s11, s12, s13, s14, s21);
   redc_mul(s8, s9, s10, s11, s12, s13, s20);
   redc_mul(s7, s8, s9, s10, s11, s12, s19);
   redc_mul(s6, s7, s8, s9, s10, s11, s18);
 
   carry<21>(s6, s7);
   carry<21>(s8, s9);
   carry<21>(s10, s11);
   carry<21>(s12, s13);
   carry<21>(s14, s15);
   carry<21>(s16, s17);
 
   carry<21>(s7, s8);
   carry<21>(s9, s10);
   carry<21>(s11, s12);
   carry<21>(s13, s14);
   carry<21>(s15, s16);
 
   redc_mul(s5, s6, s7, s8, s9, s10, s17);
   redc_mul(s4, s5, s6, s7, s8, s9, s16);
   redc_mul(s3, s4, s5, s6, s7, s8, s15);
   redc_mul(s2, s3, s4, s5, s6, s7, s14);
   redc_mul(s1, s2, s3, s4, s5, s6, s13);
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry<21>(s0, s1);
   carry<21>(s2, s3);
   carry<21>(s4, s5);
   carry<21>(s6, s7);
   carry<21>(s8, s9);
   carry<21>(s10, s11);
 
   carry<21>(s1, s2);
   carry<21>(s3, s4);
   carry<21>(s5, s6);
   carry<21>(s7, s8);
   carry<21>(s9, s10);
   carry<21>(s11, s12);
 
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry0<21>(s0, s1);
   carry0<21>(s1, s2);
   carry0<21>(s2, s3);
   carry0<21>(s3, s4);
   carry0<21>(s4, s5);
   carry0<21>(s5, s6);
   carry0<21>(s6, s7);
   carry0<21>(s7, s8);
   carry0<21>(s8, s9);
   carry0<21>(s9, s10);
   carry0<21>(s10, s11);
   carry0<21>(s11, s12);
 
   redc_mul(s0, s1, s2, s3, s4, s5, s12);
 
   carry0<21>(s0, s1);
   carry0<21>(s1, s2);
   carry0<21>(s2, s3);
   carry0<21>(s3, s4);
   carry0<21>(s4, s5);
   carry0<21>(s5, s6);
   carry0<21>(s6, s7);
   carry0<21>(s7, s8);
   carry0<21>(s8, s9);
   carry0<21>(s9, s10);
   carry0<21>(s10, s11);
   carry0<21>(s11, s12);
 
   s[0] = static_cast<uint8_t>(s0 >> 0);
   s[1] = static_cast<uint8_t>(s0 >> 8);
   s[2] = static_cast<uint8_t>((s0 >> 16) | (s1 << 5));
   s[3] = static_cast<uint8_t>(s1 >> 3);
   s[4] = static_cast<uint8_t>(s1 >> 11);
   s[5] = static_cast<uint8_t>((s1 >> 19) | (s2 << 2));
   s[6] = static_cast<uint8_t>(s2 >> 6);
   s[7] = static_cast<uint8_t>((s2 >> 14) | (s3 << 7));
   s[8] = static_cast<uint8_t>(s3 >> 1);
   s[9] = static_cast<uint8_t>(s3 >> 9);
   s[10] = static_cast<uint8_t>((s3 >> 17) | (s4 << 4));
   s[11] = static_cast<uint8_t>(s4 >> 4);
   s[12] = static_cast<uint8_t>(s4 >> 12);
   s[13] = static_cast<uint8_t>((s4 >> 20) | (s5 << 1));
   s[14] = static_cast<uint8_t>(s5 >> 7);
   s[15] = static_cast<uint8_t>((s5 >> 15) | (s6 << 6));
   s[16] = static_cast<uint8_t>(s6 >> 2);
   s[17] = static_cast<uint8_t>(s6 >> 10);
   s[18] = static_cast<uint8_t>((s6 >> 18) | (s7 << 3));
   s[19] = static_cast<uint8_t>(s7 >> 5);
   s[20] = static_cast<uint8_t>(s7 >> 13);
   s[21] = static_cast<uint8_t>(s8 >> 0);
   s[22] = static_cast<uint8_t>(s8 >> 8);
   s[23] = static_cast<uint8_t>((s8 >> 16) | (s9 << 5));
   s[24] = static_cast<uint8_t>(s9 >> 3);
   s[25] = static_cast<uint8_t>(s9 >> 11);
   s[26] = static_cast<uint8_t>((s9 >> 19) | (s10 << 2));
   s[27] = static_cast<uint8_t>(s10 >> 6);
   s[28] = static_cast<uint8_t>((s10 >> 14) | (s11 << 7));
   s[29] = static_cast<uint8_t>(s11 >> 1);
   s[30] = static_cast<uint8_t>(s11 >> 9);
   s[31] = static_cast<uint8_t>(s11 >> 17);
}

References carry(), carry0(), load_3(), load_4(), and redc_mul().

Referenced by ed25519_sign(), and ed25519_verify().

scrypt() [1/2]

void Botan::scrypt ( uint8_t output[], size_t output_len, const char * password, size_t password_len, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p )

inline

Scrypt key derivation function (RFC 7914)

Parameters

output	the output will be placed here
output_len	length of output
password	the user password
password_len	length of password
salt	the salt
salt_len	length of salt
N	the CPU/Memory cost parameter, must be power of 2
r	the block size parameter
p	the parallelization parameter

Suitable parameters for most uses would be N = 32768, r = 8, p = 1

Scrypt uses approximately (p + N + 1) * 128 * r bytes of memory

Definition at line 86 of file scrypt.h.

                             {
   auto pwdhash_fam = PasswordHashFamily::create_or_throw("Scrypt");
   auto pwdhash = pwdhash_fam->from_params(N, r, p);
   pwdhash->derive_key(output, output_len, password, password_len, salt, salt_len);
}

References Botan::PasswordHashFamily::create_or_throw(), and scrypt().

Referenced by scrypt(), and scrypt().

scrypt() [2/2]

void Botan::scrypt ( uint8_t output[], size_t output_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t N, size_t r, size_t p )

inline

Scrypt key derivation function (RFC 7914) Before 2.8 this function was the primary interface for scrypt

Parameters

output	the output will be placed here
output_len	length of output
password	the user password
salt	the salt
salt_len	length of salt
N	the CPU/Memory cost parameter, must be power of 2
r	the block size parameter
p	the parallelization parameter

Suitable parameters for most uses would be N = 32768, r = 8, p = 1

Scrypt uses approximately (p + N + 1) * 128 * r bytes of memory

Definition at line 118 of file scrypt.h.

                             {
   auto pwdhash_fam = PasswordHashFamily::create_or_throw("Scrypt");
   auto pwdhash = pwdhash_fam->from_params(N, r, p);
   pwdhash->derive_key(output, output_len, password.data(), password.size(), salt, salt_len);
}

References Botan::PasswordHashFamily::create_or_throw(), and scrypt().

secure_scrub_memory() [1/2]

void Botan::secure_scrub_memory

(

ranges::contiguous_output_range auto &&

data

)

Scrub memory contents in a way that a compiler should not elide, using some system specific technique. Note that this function might not zero the memory.

Parameters

data	the data region to be scrubbed

Definition at line 60 of file mem_ops.h.

                                                                    {
   secure_scrub_memory(std::ranges::data(data), ranges::size_bytes(data));
}

References secure_scrub_memory(), and Botan::ranges::size_bytes().

secure_scrub_memory() [2/2]

void Botan::secure_scrub_memory	(	void *	ptr,
		size_t	n )

Scrub memory contents in a way that a compiler should not elide, using some system specific technique. Note that this function might not zero the memory (for example, in some hypothetical implementation it might combine the memory contents with the output of a system PRNG), but if you can detect any difference in behavior at runtime then the clearing is side-effecting and you can just use clear_mem.

Use this function to scrub memory just before deallocating it, or on a stack buffer before returning from the function.

Parameters

ptr	a pointer to memory to scrub
n	the number of bytes pointed to by ptr

Definition at line 24 of file mem_utils.cpp.

                                              {
#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   ::RtlSecureZeroMemory(ptr, n);
 
#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   ::explicit_bzero(ptr, n);
 
#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   (void)::explicit_memset(ptr, 0, n);
 
#else
   /*
   * Call memset through a static volatile pointer, which the compiler should
   * not elide. This construct should be safe in conforming compilers, but who
   * knows. This has been checked to generate the expected code, which saves the
   * memset address in the data segment and unconditionally loads and jumps to
   * that address, with the following targets:
   *
   * x86-64: Clang 19, GCC 6, 11, 13, 14
   * riscv64: GCC 14
   * aarch64: GCC 14
   * armv7: GCC 14
   *
   * Actually all of them generated the expected jump even without marking the
   * function pointer as volatile. However this seems worth including as an
   * additional precaution.
   */
   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   (memset_ptr)(ptr, 0, n);
#endif
}

Referenced by botan_scrub_mem(), Botan::Kuznyechik::clear(), deallocate_memory(), Botan::GHASH::final(), Botan::OS::free_locked_pages(), Botan::GHASH::reset(), secure_scrub_memory(), Botan::Sodium::sodium_free(), Botan::Sodium::sodium_memzero(), Botan::AlignmentBuffer< T, BLOCK_SIZE, FINAL_BLOCK_STRATEGY >::~AlignmentBuffer(), Botan::BLAKE2s::~BLAKE2s(), and Botan::FE_25519::~FE_25519().

set_mem()

void Botan::set_mem ( uint8_t * ptr, size_t n, uint8_t val )

inlineconstexpr

Set memory to a fixed value

Parameters

ptr	a pointer to an array of bytes
n	the number of Ts pointed to by ptr
val	the value to set each byte to

Definition at line 269 of file mem_ops.h.

                                                                                                                   {
   if(n > 0) {
      std::memset(ptr, val, n);
   }
}

References set_mem().

Referenced by set_mem().

SHA2_32_F() [1/2]

BOTAN_FORCE_INLINE void Botan::SHA2_32_F	(	uint32_t	A,
		uint32_t	B,
		uint32_t	C,
		uint32_t &	D,
		uint32_t	E,
		uint32_t	F,
		uint32_t	G,
		uint32_t &	H,
		uint32_t &	M1,
		uint32_t	M2,
		uint32_t	M3,
		uint32_t	M4,
		uint32_t	magic )

Definition at line 19 of file sha2_32_f.h.

                                                  {
   uint32_t A_rho = rho<2, 13, 22>(A);
   uint32_t E_rho = rho<6, 11, 25>(E);
   uint32_t M2_sigma = sigma<17, 19, 10>(M2);
   uint32_t M4_sigma = sigma<7, 18, 3>(M4);
   H += magic + E_rho + choose(E, F, G) + M1;
   D += H;
   H += A_rho + majority(A, B, C);
   M1 += M2_sigma + M3 + M4_sigma;
}

References BOTAN_FORCE_INLINE, choose(), majority(), rho(), and sigma().

Referenced by Botan::SHA_256::compress_digest().

SHA2_32_F() [2/2]

BOTAN_FORCE_INLINE void Botan::SHA2_32_F	(	uint32_t	A,
		uint32_t	B,
		uint32_t	C,
		uint32_t &	D,
		uint32_t	E,
		uint32_t	F,
		uint32_t	G,
		uint32_t &	H,
		uint32_t	M )

Definition at line 45 of file sha2_32_f.h.

                                                                                                                 {
   uint32_t A_rho = rho<2, 13, 22>(A);
   uint32_t E_rho = rho<6, 11, 25>(E);
   H += E_rho + choose(E, F, G) + M;
   D += H;
   H += A_rho + majority(A, B, C);
}

References BOTAN_FORCE_INLINE, choose(), majority(), and rho().

SHA2_64_F() [1/2]

BOTAN_FORCE_INLINE void Botan::SHA2_64_F	(	uint64_t	A,
		uint64_t	B,
		uint64_t	C,
		uint64_t &	D,
		uint64_t	E,
		uint64_t	F,
		uint64_t	G,
		uint64_t &	H,
		uint64_t &	M1,
		uint64_t	M2,
		uint64_t	M3,
		uint64_t	M4,
		uint64_t	magic )

Definition at line 19 of file sha2_64_f.h.

                                                  {
   const uint64_t E_rho = rho<14, 18, 41>(E);
   const uint64_t A_rho = rho<28, 34, 39>(A);
   const uint64_t M2_sigma = sigma<19, 61, 6>(M2);
   const uint64_t M4_sigma = sigma<1, 8, 7>(M4);
   H += magic + E_rho + choose(E, F, G) + M1;
   D += H;
   H += A_rho + majority(A, B, C);
   M1 += M2_sigma + M3 + M4_sigma;
}

References BOTAN_FORCE_INLINE, choose(), majority(), rho(), and sigma().

Referenced by Botan::SHA_512::compress_digest().

SHA2_64_F() [2/2]

BOTAN_FORCE_INLINE void Botan::SHA2_64_F	(	uint64_t	A,
		uint64_t	B,
		uint64_t	C,
		uint64_t &	D,
		uint64_t	E,
		uint64_t	F,
		uint64_t	G,
		uint64_t &	H,
		uint64_t	M )

Definition at line 45 of file sha2_64_f.h.

                                                                                                                 {
   const uint64_t E_rho = rho<14, 18, 41>(E);
   const uint64_t A_rho = rho<28, 34, 39>(A);
   H += E_rho + choose(E, F, G) + M;
   D += H;
   H += A_rho + majority(A, B, C);
}

References BOTAN_FORCE_INLINE, choose(), majority(), and rho().

shift_left()

template<size_t S, WordType W, size_t N>

W Botan::shift_left ( std::array< W, N > & x )

inlineconstexpr

Definition at line 795 of file mp_core.h.

                                                 {
   static_assert(S < WordInfo<W>::bits, "Shift too large");
 
   W carry = 0;
   for(size_t i = 0; i != N; ++i) {
      const W w = x[i];
      x[i] = (w << S) | carry;
      carry = w >> (WordInfo<W>::bits - S);
   }
 
   return carry;
}

References carry().

Referenced by hex_to_words().

shift_right()

template<size_t S, WordType W, size_t N>

W Botan::shift_right ( std::array< W, N > & x )

inlineconstexpr

Definition at line 809 of file mp_core.h.

                                                  {
   static_assert(S < WordInfo<W>::bits, "Shift too large");
 
   W carry = 0;
   for(size_t i = 0; i != N; ++i) {
      const W w = x[N - 1 - i];
      x[N - 1 - i] = (w >> S) | carry;
      carry = w << (WordInfo<W>::bits - S);
   }
 
   return carry;
}

References carry().

shl() [1/3]

template<size_t S>

SIMD_16x32 Botan::shl ( SIMD_16x32 input )

inline

Definition at line 321 of file simd_avx512.h.

                                        {
   return input.shl<S>();
}

References Botan::SIMD_16x32::shl().

shl() [2/3]

template<size_t S>

SIMD_4x32 Botan::shl ( SIMD_4x32 input )

inline

Definition at line 774 of file simd_4x32.h.

                                      {
   return input.shl<S>();
}

References Botan::SIMD_4x32::shl().

shl() [3/3]

template<size_t S>

SIMD_8x32 Botan::shl ( SIMD_8x32 input )

inline

Definition at line 343 of file simd_avx2.h.

                                      {
   return input.shl<S>();
}

References Botan::SIMD_8x32::shl().

short_version_cstr()

const char * Botan::short_version_cstr

(

)

Same as version_short_string except returning a pointer to the string.

Definition at line 16 of file version.cpp.

                                 {
   return BOTAN_SHORT_VERSION_STRING;
}

Referenced by runtime_version_check(), and short_version_string().

short_version_string()

std::string Botan::short_version_string

(

)

Return a version string of the form "MAJOR.MINOR.PATCH" where each of the values is an integer.

Definition at line 28 of file version.cpp.

                                 {
   return std::string(short_version_cstr());
}

References short_version_cstr().

sigma()

template<size_t R1, size_t R2, size_t S, typename T>

T Botan::sigma ( T x )

inlineconstexpr

SHA-2 Sigma style function

Definition at line 43 of file rotate.h.

                              {
   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
}

References rotr().

Referenced by Botan::Kyber_Algos::expand_keypair(), SHA2_32_F(), and SHA2_64_F().

sign_message()

std::array< uint8_t, 114 > Botan::sign_message	(	std::span< const uint8_t, ED448_LEN >	sk,
		std::span< const uint8_t, ED448_LEN >	pk,
		bool	f,
		std::span< const uint8_t >	context,
		std::span< const uint8_t >	msg )

Sign a message using a keypair (RFC 8032 5.2.6)

Parameters

sk	the secret key
pk	the public key
f	the prehash flag (true iff using Ed448ph)
context	the context string
msg	the message to sign

Returns

the signature

Definition at line 237 of file ed448_internal.cpp.

                                                                            {
   // 5.2.6. Signature Generation
   // The inputs to the signing procedure is the private key, a 57-octet
   // string, a flag F, which is 0 for Ed448, 1 for Ed448ph, context C of
   // at most 255 octets, and a message M of arbitrary size.
   // 1. Hash the private key, 57 octets, using SHAKE256(x, 114). Let h
   //    denote the resulting digest. Construct the secret scalar s from
   //    the first half of the digest, and the corresponding public key A,
   //    as described in the previous section. Let prefix denote the
   //    second half of the hash digest, h[57],...,h[113].
   auto shake_xof = SHAKE_256_XOF();
   shake_xof.update(sk);
   const Scalar448 s = scalar_from_xof(shake_xof);
   std::array<uint8_t, ED448_LEN> prefix;
   shake_xof.output(prefix);
   // 2. Compute SHAKE256(dom4(F, C) || prefix || PH(M), 114), where M is
   //    the message to be signed, F is 1 for Ed448ph, 0 for Ed448, and C
   //    is the context to use. Interpret the 114-octet digest as a
   //    little-endian integer r.
   const Scalar448 r(shake(pgflag, context, prefix, msg));
   // 3. Compute the point [r]B. For efficiency, do this by first
   //    reducing r modulo L, the group order of B. Let the string R be
   //    the encoding of this point.
   const auto big_r = (r * Ed448Point::base_point()).encode();
   // 4. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114), and
   //    interpret the 114-octet digest as a little-endian integer k.
   const Scalar448 k(shake(pgflag, context, big_r, pk, msg));
   // 5. Compute S = (r + k * s) mod L. For efficiency, again reduce k
   //    modulo L first.
   const auto big_s = r + k * s;  //r_plus_ks_mod_L(r, k, s);
   // 6. Form the signature of the concatenation of R (57 octets) and the
   //    little-endian encoding of S (57 octets; the ten most significant
   //    bits of the final octets are always zero).
   std::array<uint8_t, 2 * ED448_LEN> sig;
   BufferStuffer stuf(sig);
   stuf.append(big_r);
   stuf.append(big_s.to_bytes<ED448_LEN>());
   BOTAN_ASSERT(stuf.full(), "Buffer is full");
 
   return sig;
}

References Botan::BufferStuffer::append(), Botan::Ed448Point::base_point(), BOTAN_ASSERT, ED448_LEN, and Botan::BufferStuffer::full().

significant_bytes()

template<typename T>
requires (std::is_integral<T>::value)

size_t Botan::significant_bytes ( T n )

inlineconstexpr

Return the number of significant bytes in n

Parameters

n	an integer value

Returns

number of significant bytes in n

Definition at line 83 of file bit_ops.h.

{
   size_t b = 0;
 
   for(size_t s = 8 * sizeof(n) / 2; s >= 8; s /= 2) {
      const size_t z = s * (~ct_is_zero(n >> s) & 1);
      b += z / 8;
      n >>= z;
   }
 
   b += (n != 0);
 
   return b;
}

References ct_is_zero().

sm2_compute_za()

std::vector< uint8_t > Botan::sm2_compute_za	(	HashFunction &	hash,
		std::string_view	user_id,
		const EC_Group &	group,
		const EC_AffinePoint &	pubkey )

Definition at line 68 of file sm2.cpp.

                                                                  {
   if(user_id.size() >= 8192) {
      throw Invalid_Argument("SM2 user id too long to represent");
   }
 
   const uint16_t uid_len = static_cast<uint16_t>(8 * user_id.size());
 
   hash.update(get_byte<0>(uid_len));
   hash.update(get_byte<1>(uid_len));
   hash.update(user_id);
 
   const size_t p_bytes = group.get_p_bytes();
 
   hash.update(group.get_a().serialize(p_bytes));
   hash.update(group.get_b().serialize(p_bytes));
   hash.update(group.get_g_x().serialize(p_bytes));
   hash.update(group.get_g_y().serialize(p_bytes));
   hash.update(pubkey.xy_bytes());
 
   return hash.final<std::vector<uint8_t>>();
}

References Botan::Buffered_Computation::final(), Botan::EC_Group::get_a(), Botan::EC_Group::get_b(), get_byte(), Botan::EC_Group::get_g_x(), Botan::EC_Group::get_g_y(), Botan::EC_Group::get_p_bytes(), Botan::BigInt::serialize(), Botan::Buffered_Computation::update(), and Botan::EC_AffinePoint::xy_bytes().

Referenced by botan_pubkey_sm2_compute_za().

split_on()

BOTAN_TEST_API std::vector< std::string > Botan::split_on	(	std::string_view	str,
		char	delim )

Split a string

Parameters

str	the input string
delim	the delimitor

Returns

string split by delim

Definition at line 111 of file parsing.cpp.

                                                              {
   std::vector<std::string> elems;
   if(str.empty()) {
      return elems;
   }
 
   std::string substr;
   for(auto i = str.begin(); i != str.end(); ++i) {
      if(*i == delim) {
         if(!substr.empty()) {
            elems.push_back(substr);
         }
         substr.clear();
      } else {
         substr += *i;
      }
   }
 
   if(substr.empty()) {
      throw Invalid_Argument(fmt("Unable to split string '{}", str));
   }
   elems.push_back(substr);
 
   return elems;
}

References fmt().

Referenced by argon2_check_pwhash(), Botan::AEAD_Mode::create(), Botan::Cipher_Mode::create(), Botan::PKCS11::MechanismWrapper::create_ecdh_mechanism(), create_private_key(), Botan::TLS::Text_Policy::get_list(), load_private_key(), load_public_key(), pbes2_decrypt(), Botan::TLS::Text_Policy::read_cert_type_list(), Botan::TLS::Text_Policy::read_group_list(), read_kv(), Botan::PK_Ops::Verification_with_Hash::Verification_with_Hash(), and Botan::X509_Cert_Options::X509_Cert_Options().

sqrt_modulo_prime()

BigInt Botan::sqrt_modulo_prime	(	const BigInt &	x,
		const BigInt &	p )

Compute the square root of x modulo a prime using the Tonelli-Shanks algorithm. This algorithm is primarily used for EC point decompression which takes only public inputs, as a consequence it is not written to be constant-time and may leak side-channel information about its arguments.

Parameters

x	the input
p	the prime modulus

Returns

y such that (y*y)p == x, or -1 if no such integer

Definition at line 26 of file numthry.cpp.

                                                           {
   BOTAN_ARG_CHECK(p > 1, "invalid prime");
   BOTAN_ARG_CHECK(a < p, "value to solve for must be less than p");
   BOTAN_ARG_CHECK(a >= 0, "value to solve for must not be negative");
 
   // some very easy cases
   if(p == 2 || a <= 1) {
      return a;
   }
 
   BOTAN_ARG_CHECK(p.is_odd(), "invalid prime");
 
   if(jacobi(a, p) != 1) {  // not a quadratic residue
      return BigInt::from_s32(-1);
   }
 
   auto mod_p = Barrett_Reduction::for_public_modulus(p);
   auto monty_p = std::make_shared<Montgomery_Params>(p, mod_p);
 
   // If p == 3 (mod 4) there is a simple solution
   if(p % 4 == 3) {
      return monty_exp_vartime(monty_p, a, ((p + 1) >> 2)).value();
   }
 
   // Otherwise we have to use Shanks-Tonelli
   size_t s = low_zero_bits(p - 1);
   BigInt q = p >> s;
 
   q -= 1;
   q >>= 1;
 
   BigInt r = monty_exp_vartime(monty_p, a, q).value();
   BigInt n = mod_p.multiply(a, mod_p.square(r));
   r = mod_p.multiply(r, a);
 
   if(n == 1) {
      return r;
   }
 
   // find random quadratic nonresidue z
   word z = 2;
   for(;;) {
      if(jacobi(BigInt::from_word(z), p) == -1) {  // found one
         break;
      }
 
      z += 1;  // try next z
 
      /*
      * The expected number of tests to find a non-residue modulo a
      * prime is 2. If we have not found one after 256 then almost
      * certainly we have been given a non-prime p.
      */
      if(z >= 256) {
         return BigInt::from_s32(-1);
      }
   }
 
   BigInt c = monty_exp_vartime(monty_p, BigInt::from_word(z), (q << 1) + 1).value();
 
   while(n > 1) {
      q = n;
 
      size_t i = 0;
      while(q != 1) {
         q = mod_p.square(q);
         ++i;
 
         if(i >= s) {
            return BigInt::from_s32(-1);
         }
      }
 
      BOTAN_ASSERT_NOMSG(s >= (i + 1));  // No underflow!
      c = monty_exp_vartime(monty_p, c, BigInt::power_of_2(s - i - 1)).value();
      r = mod_p.multiply(r, c);
      c = mod_p.square(c);
      n = mod_p.multiply(n, c);
 
      // s decreases as the algorithm proceeds
      BOTAN_ASSERT_NOMSG(s >= i);
      s = i;
   }
 
   return r;
}

References BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::Barrett_Reduction::for_public_modulus(), Botan::BigInt::from_s32(), Botan::BigInt::from_word(), Botan::BigInt::is_odd(), jacobi(), low_zero_bits(), monty_exp_vartime(), Botan::BigInt::power_of_2(), Botan::BigInt::square(), and Botan::Montgomery_Int::value().

square() [1/2]

BigInt Botan::square

(

const BigInt &

x

)

Parameters

x	an integer

Returns

(x*x)

Definition at line 157 of file numthry.cpp.

                               {
   BigInt z = x;
   secure_vector<word> ws;
   z.square(ws);
   return z;
}

References Botan::BigInt::square().

Referenced by Botan::Ed448Point::decode(), Botan::Ed448Point::double_point(), Botan::Ed448Point::operator+(), Botan::PCurve::GenericPrimeOrderCurve::scalar_square(), Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_square(), and x448().

square() [2/2]

Gf448Elem Botan::square

(

const Gf448Elem &

elem

)

Computes elem^2. Faster than operator*.

Definition at line 348 of file curve448_gf.cpp.

                                        {
   Gf448Elem res(0);
   gf_square(res.words(), elem.words());
   return res;
}

References Botan::Gf448Elem::words().

srp6_client_agree() [1/2]

std::pair< BigInt, SymmetricKey > Botan::srp6_client_agree	(	std::string_view	username,
		std::string_view	password,
		const DL_Group &	group,
		std::string_view	hash_id,
		const std::vector< uint8_t > &	salt,
		const BigInt &	B,
		size_t	a_bits,
		RandomNumberGenerator &	rng )

SRP6a Client side

Parameters

username	the username we are attempting login for
password	the password we are attempting to use
group	specifies the shared SRP group
hash_id	specifies a secure hash function
salt	is the salt value sent by the server
B	is the server's public value
a_bits	size of secret exponent in bits
rng	is a random number generator

Returns

(A,K) the client public key and the shared secret key

Definition at line 78 of file srp6.cpp.

                                                                              {
   BOTAN_ARG_CHECK(a_bits <= group.p_bits(), "Invalid a_bits");
 
   const BigInt& g = group.get_g();
   const BigInt& p = group.get_p();
 
   const size_t p_bytes = group.p_bytes();
 
   if(B <= 0 || B >= p) {
      throw Decoding_Error("Invalid SRP parameter from server");
   }
 
   auto hash_fn = HashFunction::create_or_throw(hash_id);
   if(8 * hash_fn->output_length() >= group.p_bits()) {
      throw Invalid_Argument(fmt("Hash function {} too large for SRP6 with this group", hash_fn->name()));
   }
 
   const BigInt k = hash_seq(*hash_fn, p_bytes, p, g);
 
   const BigInt a(rng, a_bits);
 
   const BigInt A = group.power_g_p(a, a_bits);
 
   const BigInt u = hash_seq(*hash_fn, p_bytes, A, B);
 
   const BigInt x = compute_x(*hash_fn, identifier, password, salt);
 
   const BigInt g_x_p = group.power_g_p(x, hash_fn->output_length() * 8);
 
   const BigInt B_k_g_x_p = group.mod_p(B + group.mod_p(p - group.multiply_mod_p(k, g_x_p)));
 
   const BigInt a_ux = a + u * x;
 
   const size_t max_aux_bits = std::max<size_t>(a_bits + 1, 2 * 8 * hash_fn->output_length());
   BOTAN_ASSERT_NOMSG(max_aux_bits >= a_ux.bits());
 
   const BigInt S = group.power_b_p(B_k_g_x_p, a_ux, max_aux_bits);
 
   const SymmetricKey Sk(S.serialize<secure_vector<uint8_t>>(p_bytes));
 
   return std::make_pair(A, Sk);
}

References Botan::BigInt::bits(), BOTAN_ARG_CHECK, BOTAN_ASSERT_NOMSG, Botan::HashFunction::create_or_throw(), fmt(), Botan::DL_Group::get_g(), Botan::DL_Group::get_p(), Botan::DL_Group::mod_p(), Botan::DL_Group::multiply_mod_p(), Botan::DL_Group::p_bits(), Botan::DL_Group::p_bytes(), Botan::DL_Group::power_b_p(), Botan::DL_Group::power_g_p(), and Botan::BigInt::serialize().

srp6_client_agree() [2/2]

std::pair< BigInt, SymmetricKey > Botan::srp6_client_agree	(	std::string_view	username,
		std::string_view	password,
		std::string_view	group_id,
		std::string_view	hash_id,
		const std::vector< uint8_t > &	salt,
		const BigInt &	B,
		RandomNumberGenerator &	rng )

SRP6a Client side

Parameters

username	the username we are attempting login for
password	the password we are attempting to use
group_id	specifies the shared SRP group
hash_id	specifies a secure hash function
salt	is the salt value sent by the server
B	is the server's public value
rng	is a random number generator

Returns

(A,K) the client public key and the shared secret key

Definition at line 65 of file srp6.cpp.

                                                                              {
   auto group = DL_Group::from_name(group_id);
   const size_t a_bits = group.exponent_bits();
 
   return srp6_client_agree(identifier, password, group, hash_id, salt, B, a_bits, rng);
}

References Botan::DL_Group::from_name(), and srp6_client_agree().

Referenced by botan_srp6_client_agree(), and srp6_client_agree().

srp6_generate_verifier() [1/2]

BigInt Botan::srp6_generate_verifier	(	std::string_view	identifier,
		std::string_view	password,
		const std::vector< uint8_t > &	salt,
		const DL_Group &	group,
		std::string_view	hash_id )

Generate a new SRP-6 verifier

Parameters

identifier	a username or other client identifier
password	the secret used to authenticate user
salt	a randomly chosen value, at least 128 bits long
group	specifies the shared SRP group
hash_id	specifies a secure hash function

Definition at line 137 of file srp6.cpp.

                                                      {
   auto hash_fn = HashFunction::create_or_throw(hash_id);
   if(8 * hash_fn->output_length() >= group.p_bits()) {
      throw Invalid_Argument(fmt("Hash function {} too large for SRP6 with this group", hash_fn->name()));
   }
 
   const BigInt x = compute_x(*hash_fn, identifier, password, salt);
   return group.power_g_p(x, hash_fn->output_length() * 8);
}

References Botan::HashFunction::create_or_throw(), fmt(), Botan::DL_Group::p_bits(), and Botan::DL_Group::power_g_p().

srp6_generate_verifier() [2/2]

BigInt Botan::srp6_generate_verifier	(	std::string_view	identifier,
		std::string_view	password,
		const std::vector< uint8_t > &	salt,
		std::string_view	group_id,
		std::string_view	hash_id )

Generate a new SRP-6 verifier

Parameters

identifier	a username or other client identifier
password	the secret used to authenticate user
salt	a randomly chosen value, at least 128 bits long
group_id	specifies the shared SRP group
hash_id	specifies a secure hash function

Definition at line 128 of file srp6.cpp.

                                                      {
   auto group = DL_Group::from_name(group_id);
   return srp6_generate_verifier(identifier, password, salt, group, hash_id);
}

References Botan::DL_Group::from_name(), and srp6_generate_verifier().

Referenced by botan_srp6_generate_verifier(), and srp6_generate_verifier().

srp6_group_identifier()

std::string Botan::srp6_group_identifier	(	const BigInt &	N,
		const BigInt &	g )

Return the group id for this SRP param set, or else thrown an exception

Parameters

N	the group modulus
g	the group generator

Returns

group identifier

Definition at line 46 of file srp6.cpp.

                                                                  {
   /*
   This function assumes that only one 'standard' SRP parameter set has
   been defined for a particular bitsize. As of this writing that is the case.
   */
   try {
      const std::string group_name = "modp/srp/" + std::to_string(N.bits());
 
      auto group = DL_Group::from_name(group_name);
 
      if(group.get_p() == N && group.get_g() == g) {
         return group_name;
      }
   } catch(...) {}
 
   // If we didn't return, the group was unknown or did not match
   throw Invalid_Argument("Invalid or unknown SRP group parameters");
}

References Botan::BigInt::bits(), and Botan::DL_Group::from_name().

store_be()

template<typename ModifierT = detail::AutoDetect, typename... ParamTs>

auto Botan::store_be ( ParamTs &&... params )

inlineconstexpr

Store "something" in big endian byte order See the documentation of this file for more details.

Definition at line 745 of file loadstor.h.

                                                    {
   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
}

References Botan::detail::store_any().

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::BigInt::binary_encode(), Botan::FPE_FE1::decrypt(), Botan::Blowfish::decrypt_n(), Botan::CAST_128::decrypt_n(), Botan::DES::decrypt_n(), Botan::Noekeon::decrypt_n(), Botan::SEED::decrypt_n(), Botan::SHACAL2::decrypt_n(), Botan::SM4::decrypt_n(), Botan::TripleDES::decrypt_n(), Botan::AlternativeName::encode_into(), Botan::CryptoBox::encrypt(), Botan::FPE_FE1::encrypt(), Botan::TLS::Session::encrypt(), Botan::Blowfish::encrypt_n(), Botan::CAST_128::encrypt_n(), Botan::DES::encrypt_n(), Botan::Noekeon::encrypt_n(), Botan::SEED::encrypt_n(), Botan::SHACAL2::encrypt_n(), Botan::SM4::encrypt_n(), Botan::TripleDES::encrypt_n(), Botan::TLS::Connection_Cipher_State::format_ad(), Botan::Kyber_Modern_Symmetric_Primitives::get_PRF(), Botan::ML_KEM_Symmetric_Primitives::get_PRF(), Botan::Kyber_Modern_Symmetric_Primitives::get_XOF(), Botan::ML_KEM_Symmetric_Primitives::get_XOF(), hkdf_expand_label(), ipv4_to_string(), lmots_compute_pubkey_from_sig(), Botan::LMOTS_Public_Key::LMOTS_Public_Key(), Botan::TLS::make_hello_random(), Botan::TPM2::Context::manufacturer(), Botan::TLS::Cipher_State::next_ticket_nonce(), nist_key_wrap(), nist_key_wrap_padded(), Botan::XMSS_PublicKey::raw_public_key_bits(), Botan::CTR_BE::seek(), Botan::TLS::New_Session_Ticket_12::serialize(), Botan::TLS::New_Session_Ticket_13::serialize(), Botan::PseudorandomKeyGeneration::set_i(), Botan::PseudorandomKeyGeneration::set_j(), Botan::PseudorandomKeyGeneration::set_q(), Botan::HSS_LMS_PrivateKeyInternal::sign(), Botan::LMOTS_Private_Key::sign(), Botan::LMS_PrivateKey::sign_and_get_pk(), Botan::SIMD_4x32::store_be(), Botan::HSS_LMS_PrivateKeyInternal::to_bytes(), Botan::HSS_LMS_PublicKeyInternal::to_bytes(), Botan::LMS_PublicKey::to_bytes(), Botan::Sphincs_Address::to_bytes(), Botan::Sphincs_Address::to_bytes_compressed(), Botan::Buffered_Computation::update_be(), Botan::Buffered_Computation::update_be(), Botan::Buffered_Computation::update_be(), and Botan::TPM2::Context::vendor().

store_le()

template<typename ModifierT = detail::AutoDetect, typename... ParamTs>

auto Botan::store_le ( ParamTs &&... params )

inlineconstexpr

Store "something" in little endian byte order See the documentation of this file for more details.

Definition at line 736 of file loadstor.h.

                                                    {
   return detail::store_any<std::endian::little, ModifierT>(std::forward<ParamTs>(params)...);
}

References Botan::detail::store_any().

Referenced by create_aes_row_generator(), create_shake_row_generator(), Botan::Sodium::crypto_core_hsalsa20(), Botan::GOST_28147_89::decrypt_n(), Botan::Kuznyechik::decrypt_n(), Botan::Serpent::decrypt_n(), Botan::Threefish_512::decrypt_n(), Botan::Twofish::decrypt_n(), Botan::GOST_28147_89::encrypt_n(), Botan::Kuznyechik::encrypt_n(), Botan::Serpent::encrypt_n(), Botan::Threefish_512::encrypt_n(), Botan::Twofish::encrypt_n(), Botan::Streebog::final_result(), generate_mceliece_key(), Botan::CRYSTALS::pack(), Botan::RandomNumberGenerator::randomize_with_ts_input(), Botan::Salsa20::salsa_core(), Botan::ChaCha::seek(), Botan::Salsa20::seek(), Botan::Classic_McEliece_Minimal_Polynomial::serialize(), Botan::FrodoMatrix::serialize(), Botan::Sodium::sodium_malloc(), Botan::Keccak_Permutation::squeeze(), Botan::SIMD_4x32::store_le(), Botan::bitvector_base< secure_allocator >::subvector_replace(), Botan::Gf448Elem::to_bytes(), Botan::Scalar448::to_bytes(), Botan::Buffered_Computation::update_le(), Botan::Buffered_Computation::update_le(), Botan::Buffered_Computation::update_le(), and Botan::ChaCha20Poly1305_Mode::update_len().

string_join()

std::string Botan::string_join	(	const std::vector< std::string > &	strs,
		char	delim )

Join a string

Parameters

strs	strings to join
delim	the delimitor

Returns

string joined by delim

Definition at line 140 of file parsing.cpp.

                                                                    {
   std::ostringstream out;
 
   for(size_t i = 0; i != strs.size(); ++i) {
      if(i != 0) {
         out << delim;
      }
      out << strs[i];
   }
 
   return out.str();
}

Referenced by Botan::CPUID::to_string(), and Botan::Key_Constraints::to_string().

string_to_ipv4()

std::optional< uint32_t > BOTAN_TEST_API Botan::string_to_ipv4

(

std::string_view

ip_str

)

Convert a string representation of an IPv4 address to a number

Parameters

ip_str

the string representation

Returns

integer IPv4 address

Definition at line 156 of file parsing.cpp.

                                                         {
   // At least 3 dots + 4 1-digit integers
   // At most 3 dots + 4 3-digit integers
   if(str.size() < 3 + 4 * 1 || str.size() > 3 + 4 * 3) {
      return {};
   }
 
   // the final result
   uint32_t ip = 0;
   // the number of '.' seen so far
   size_t dots = 0;
   // accumulates one quad (range 0-255)
   uint32_t accum = 0;
   // # of digits pushed to accum since last dot
   size_t cur_digits = 0;
 
   for(char c : str) {
      if(c == '.') {
         // . without preceding digit is invalid
         if(cur_digits == 0) {
            return {};
         }
         dots += 1;
         // too many dots
         if(dots > 3) {
            return {};
         }
 
         cur_digits = 0;
         ip = (ip << 8) | accum;
         accum = 0;
      } else if(c >= '0' && c <= '9') {
         const auto d = static_cast<uint8_t>(c - '0');
 
         // prohibit leading zero in quad (used for octal)
         if(cur_digits > 0 && accum == 0) {
            return {};
         }
         accum = (accum * 10) + d;
 
         if(accum > 255) {
            return {};
         }
 
         cur_digits++;
         BOTAN_ASSERT_NOMSG(cur_digits <= 3);
      } else {
         return {};
      }
   }
 
   // no trailing digits?
   if(cur_digits == 0) {
      return {};
   }
 
   // insufficient # of dots
   if(dots != 3) {
      return {};
   }
 
   ip = (ip << 8) | accum;
 
   return ip;
}

References BOTAN_ASSERT_NOMSG.

Referenced by Botan::AlternativeName::add_attribute(), Botan::AlternativeName::AlternativeName(), Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), Botan::GeneralName::matches(), and Botan::X509_Certificate::matches_dns_name().

swap_bits()

template<typename T>

void Botan::swap_bits ( T & x, T & y, T mask, size_t shift )

inlineconstexpr

Definition at line 197 of file bit_ops.h.

                                                                  {
   const T swap = ((x >> shift) ^ y) & mask;
   x ^= swap << shift;
   y ^= swap;
}

swar_in_range()

template<std::unsigned_integral T>

T Botan::swar_in_range ( T v, T lower, T upper )

constexpr

SWAR (SIMD within a word) byte-by-byte comparison

This individually compares each byte of the provided words. It returns a mask which contains, for each byte, 0x80 if the byte in a was less than the byte in b. Otherwise the mask is 00.

This implementation assumes that the high bits of each byte in both lower and upper are clear! It is possible to support the full range of bytes, but this requires additional comparisons.

Definition at line 114 of file int_utils.h.

                                                 {
   // The constant 0x808080... as a T
   constexpr T hi1 = (static_cast<T>(-1) / 255) << 7;
   // The constant 0x7F7F7F... as a T
   constexpr T lo7 = ~hi1;
 
   const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1);
   const T a_lo = sub & lo7;
   const T a_hi = sub & hi1;
   return (lo7 - a_lo + upper) & hi1 & ~a_hi;
}

swar_lt()

template<std::unsigned_integral T>

T Botan::swar_lt ( T a, T b )

constexpr

SWAR (SIMD within a word) byte-by-byte comparison

This individually compares each byte of the provided words. It returns a mask which contains, for each byte, 0xFF if the byte in a was less than the byte in b. Otherwise the mask is 00.

This implementation assumes that the high bits of each byte in both a and b are clear! It is possible to support the full range of bytes, but this requires additional comparisons.

Definition at line 91 of file int_utils.h.

                              {
   // The constant 0x808080... as a T
   constexpr T hi1 = (static_cast<T>(-1) / 255) << 7;
   // The constant 0x7F7F7F... as a T
   constexpr T lo7 = static_cast<T>(~hi1);
   T r = (lo7 - a + b) & hi1;
   // Currently the mask is 80 if lt, otherwise 00. Convert to FF/00
   return (r << 1) - (r >> 7);
}

syndrome_init()

std::vector< polyn_gf2m > Botan::syndrome_init	(	const polyn_gf2m &	generator,
		const std::vector< gf2m > &	support,
		int	n )

Definition at line 608 of file polyn_gf2m.cpp.

                                                                                                        {
   int i, j, t;
   gf2m a;
 
   std::shared_ptr<GF2m_Field> m_sp_field = generator.get_sp_field();
 
   std::vector<polyn_gf2m> result;
   t = generator.get_degree();
 
   //g(z)=g_t+g_(t-1).z^(t-1)+......+g_1.z+g_0
   //f(z)=f_(t-1).z^(t-1)+......+f_1.z+f_0
 
   for(j = 0; j < n; j++) {
      result.push_back(polyn_gf2m(t - 1, m_sp_field));
 
      (*&result[j]).set_coef(t - 1, 1);
      for(i = t - 2; i >= 0; i--) {
         (*&result[j]).set_coef(i, (generator)[i + 1] ^ m_sp_field->gf_mul(lex_to_gray(support[j]), result[j][i + 1]));
      }
      a = ((generator)[0] ^ m_sp_field->gf_mul(lex_to_gray(support[j]), result[j][0]));
      for(i = 0; i < t; i++) {
         (*&result[j]).set_coef(i, m_sp_field->gf_div(result[j][i], a));
      }
   }
   return result;
}

References Botan::polyn_gf2m::get_degree(), Botan::polyn_gf2m::get_sp_field(), and lex_to_gray().

Referenced by generate_mceliece_key().

system_rng()

RandomNumberGenerator & Botan::system_rng

(

)

Return a shared reference to a global PRNG instance provided by the operating system. For instance might be instantiated by /dev/urandom or CryptGenRandom.

Definition at line 371 of file system_rng.cpp.

                                    {
   static System_RNG_Impl g_system_rng;
   return g_system_rng;
}

Referenced by Botan::System_RNG::accepts_input(), Botan::AutoSeeded_RNG::AutoSeeded_RNG(), botan_pk_op_decrypt_create(), botan_pk_op_encrypt_create(), botan_pk_op_kem_decrypt_create(), botan_pk_op_key_agreement_create(), botan_pk_op_sign_create(), botan_rng_reseed(), botan_system_rng_get(), Botan::System_RNG::clear(), Botan::System_RNG::fill_bytes_with_input(), Botan::System_RNG::is_seeded(), Botan::System_RNG::name(), Botan::Sodium::randombytes_buf(), and Botan::RandomNumberGenerator::randomize_with_ts_input().

throw_invalid_argument()

void BOTAN_UNSTABLE_API Botan::throw_invalid_argument	(	const char *	message,
		const char *	func,
		const char *	file )

Called when an invalid argument is used Throws Invalid_Argument

Definition at line 22 of file assert.cpp.

                                                                                     {
   throw Invalid_Argument(fmt("{} in {}:{}", message, func, file));
}

References fmt().

throw_invalid_state()

void BOTAN_UNSTABLE_API Botan::throw_invalid_state	(	const char *	message,
		const char *	func,
		const char *	file )

Called when an invalid state is encountered Throws Invalid_State

Definition at line 26 of file assert.cpp.

                                                                               {
   throw Invalid_State(fmt("Invalid state: expr {} was false in {}:{}", expr, func, file));
}

References fmt().

to_affine()

template<typename C>

auto Botan::to_affine ( const typename C::ProjectivePoint & pt )

inlineconstexpr

Convert a projective point into affine

Definition at line 46 of file pcurves_algos.h.

                                                                     {
   // Not strictly required right? - default should work as long
   // as (0,0) is identity and invert returns 0 on 0
 
   if constexpr(curve_supports_fe_invert2<C>) {
      const auto z2_inv = C::fe_invert2(pt.z());
      const auto z3_inv = z2_inv.square() * pt.z();
      return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv);
   } else {
      const auto z_inv = invert_field_element<C>(pt.z());
      const auto z2_inv = z_inv.square();
      const auto z3_inv = z_inv * z2_inv;
      return typename C::AffinePoint(pt.x() * z2_inv, pt.y() * z3_inv);
   }
}

References invert_field_element().

Referenced by Botan::PCurve::GenericPrimeOrderCurve::point_to_affine(), Botan::PCurve::PrimeOrderCurveImpl< C >::point_to_affine(), and to_affine_batch().

to_affine_batch()

template<typename C>

auto Botan::to_affine_batch

(

std::span< const typename C::ProjectivePoint >

projective

)

Definition at line 77 of file pcurves_algos.h.

                                                                          {
   using AffinePoint = typename C::AffinePoint;
 
   const size_t N = projective.size();
   std::vector<AffinePoint> affine;
   affine.reserve(N);
 
   CT::Choice any_identity = CT::Choice::no();
 
   for(const auto& pt : projective) {
      any_identity = any_identity || pt.is_identity();
   }
 
   if(N <= 2 || any_identity.as_bool()) {
      // If there are identity elements, using the batch inversion gets
      // tricky. It can be done, but this should be a rare situation so
      // just punt to the serial conversion if it occurs
      for(size_t i = 0; i != N; ++i) {
         affine.push_back(to_affine<C>(projective[i]));
      }
   } else {
      std::vector<typename C::FieldElement> c;
      c.reserve(N);
 
      /*
      Batch projective->affine using Montgomery's trick
 
      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
      (Hankerson, Menezes, Vanstone)
      */
 
      c.push_back(projective[0].z());
      for(size_t i = 1; i != N; ++i) {
         c.push_back(c[i - 1] * projective[i].z());
      }
 
      auto s_inv = invert_field_element<C>(c[N - 1]);
 
      for(size_t i = N - 1; i > 0; --i) {
         const auto& p = projective[i];
 
         const auto z_inv = s_inv * c[i - 1];
         const auto z2_inv = z_inv.square();
         const auto z3_inv = z_inv * z2_inv;
 
         s_inv = s_inv * p.z();
 
         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
      }
 
      const auto z2_inv = s_inv.square();
      const auto z3_inv = s_inv * z2_inv;
      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
      std::reverse(affine.begin(), affine.end());
      return affine;
   }
 
   return affine;
}

References Botan::CT::Choice::as_bool(), invert_field_element(), Botan::CT::Choice::no(), and to_affine().

Referenced by Botan::AffinePointTable< C, R >::AffinePointTable(), and basemul_setup().

to_affine_x()

template<typename C>

auto Botan::to_affine_x

(

const typename C::ProjectivePoint &

pt

)

Convert a projective point into affine and return x coordinate only

Definition at line 66 of file pcurves_algos.h.

                                                      {
   if constexpr(curve_supports_fe_invert2<C>) {
      return pt.x() * C::fe_invert2(pt.z());
   } else {
      const auto z_inv = invert_field_element<C>(pt.z());
      const auto z2_inv = z_inv.square();
      return pt.x() * z2_inv;
   }
}

References invert_field_element().

Referenced by Botan::PCurve::GenericPrimeOrderCurve::base_point_mul_x_mod_order(), Botan::PCurve::PrimeOrderCurveImpl< C >::base_point_mul_x_mod_order(), Botan::PCurve::GenericPrimeOrderCurve::mul_x_only(), and Botan::PCurve::PrimeOrderCurveImpl< C >::mul_x_only().

to_byte_vector()

template<concepts::contiguous_container T = std::vector<uint8_t>>

T Botan::to_byte_vector ( std::string_view s )

inline

Definition at line 30 of file stl_util.h.

                                          {
   return T(s.cbegin(), s.cend());
}

Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), Botan::TLS::Channel_Impl_12::key_material_export(), and Botan::TLS::PskIdentity::PskIdentity().

to_string() [1/3]

const char * Botan::to_string

(

Certificate_Status_Code

code

)

Convert a status code to a human readable diagnostic message

Parameters

code	the certifcate status

Returns

string literal constant, or nullptr if code unknown

Definition at line 11 of file cert_status.cpp.

                                                    {
   switch(code) {
      case Certificate_Status_Code::VERIFIED:
         return "Verified";
      case Certificate_Status_Code::OCSP_RESPONSE_GOOD:
         return "OCSP response accepted as affirming unrevoked status for certificate";
      case Certificate_Status_Code::OCSP_SIGNATURE_OK:
         return "Signature on OCSP response was found valid";
      case Certificate_Status_Code::VALID_CRL_CHECKED:
         return "Valid CRL examined";
 
      case Certificate_Status_Code::CERT_SERIAL_NEGATIVE:
         return "Certificate serial number is negative";
      case Certificate_Status_Code::DN_TOO_LONG:
         return "Distinguished name too long";
      case Certificate_Status_Code::OCSP_NO_REVOCATION_URL:
         return "OCSP URL not available";
      case Certificate_Status_Code::OCSP_SERVER_NOT_AVAILABLE:
         return "OCSP server not available";
      case Certificate_Status_Code::TRUSTED_CERT_NOT_YET_VALID:
         return "Trusted certificate is not yet valid";
      case Certificate_Status_Code::TRUSTED_CERT_HAS_EXPIRED:
         return "Trusted certificate has expired";
      case Certificate_Status_Code::OCSP_ISSUER_NOT_TRUSTED:
         return "OCSP issuer is not trustworthy";
 
      case Certificate_Status_Code::NO_REVOCATION_DATA:
         return "No revocation data";
      case Certificate_Status_Code::SIGNATURE_METHOD_TOO_WEAK:
         return "Signature method too weak";
      case Certificate_Status_Code::UNTRUSTED_HASH:
         return "Hash function used is considered too weak for security";
 
      case Certificate_Status_Code::CERT_NOT_YET_VALID:
         return "Certificate is not yet valid";
      case Certificate_Status_Code::CERT_HAS_EXPIRED:
         return "Certificate has expired";
      case Certificate_Status_Code::OCSP_NOT_YET_VALID:
         return "OCSP is not yet valid";
      case Certificate_Status_Code::OCSP_HAS_EXPIRED:
         return "OCSP response has expired";
      case Certificate_Status_Code::OCSP_IS_TOO_OLD:
         return "OCSP response is too old";
      case Certificate_Status_Code::CRL_NOT_YET_VALID:
         return "CRL response is not yet valid";
      case Certificate_Status_Code::CRL_HAS_EXPIRED:
         return "CRL has expired";
 
      case Certificate_Status_Code::CERT_ISSUER_NOT_FOUND:
         return "Certificate issuer not found";
      case Certificate_Status_Code::CANNOT_ESTABLISH_TRUST:
         return "Cannot establish trust";
      case Certificate_Status_Code::CERT_CHAIN_LOOP:
         return "Loop in certificate chain";
      case Certificate_Status_Code::CHAIN_LACKS_TRUST_ROOT:
         return "Certificate chain does not end in a CA certificate";
      case Certificate_Status_Code::CHAIN_NAME_MISMATCH:
         return "Certificate issuer does not match subject of issuing cert";
 
      case Certificate_Status_Code::POLICY_ERROR:
         return "Certificate policy error";
      case Certificate_Status_Code::DUPLICATE_CERT_POLICY:
         return "Certificate contains duplicate policy";
      case Certificate_Status_Code::INVALID_USAGE:
         return "Certificate does not allow the requested usage";
      case Certificate_Status_Code::CERT_CHAIN_TOO_LONG:
         return "Certificate chain too long";
      case Certificate_Status_Code::CA_CERT_NOT_FOR_CERT_ISSUER:
         return "CA certificate not allowed to issue certs";
      case Certificate_Status_Code::CA_CERT_NOT_FOR_CRL_ISSUER:
         return "CA certificate not allowed to issue CRLs";
      case Certificate_Status_Code::NO_MATCHING_CRLDP:
         return "No CRL with matching distribution point for certificate";
      case Certificate_Status_Code::OCSP_CERT_NOT_LISTED:
         return "OCSP cert not listed";
      case Certificate_Status_Code::OCSP_BAD_STATUS:
         return "OCSP bad status";
      case Certificate_Status_Code::CERT_NAME_NOMATCH:
         return "Certificate does not match provided name";
      case Certificate_Status_Code::NAME_CONSTRAINT_ERROR:
         return "Certificate does not pass name constraint";
      case Certificate_Status_Code::UNKNOWN_CRITICAL_EXTENSION:
         return "Unknown critical extension encountered";
      case Certificate_Status_Code::DUPLICATE_CERT_EXTENSION:
         return "Duplicate certificate extension encountered";
      case Certificate_Status_Code::EXT_IN_V1_V2_CERT:
         return "Encountered extension in certificate with version that does not allow it";
      case Certificate_Status_Code::V2_IDENTIFIERS_IN_V1_CERT:
         return "Encountered v2 identifiers in v1 certificate";
      case Certificate_Status_Code::OCSP_SIGNATURE_ERROR:
         return "OCSP signature error";
      case Certificate_Status_Code::OCSP_ISSUER_NOT_FOUND:
         return "Unable to find certificate issusing OCSP response";
      case Certificate_Status_Code::OCSP_RESPONSE_MISSING_KEYUSAGE:
         return "OCSP issuer's keyusage prohibits OCSP";
      case Certificate_Status_Code::OCSP_RESPONSE_INVALID:
         return "OCSP parsing valid";
      case Certificate_Status_Code::OCSP_NO_HTTP:
         return "OCSP requests not available, no HTTP support compiled in";
      case Certificate_Status_Code::CERT_IS_REVOKED:
         return "Certificate is revoked";
      case Certificate_Status_Code::CRL_BAD_SIGNATURE:
         return "CRL bad signature";
      case Certificate_Status_Code::SIGNATURE_ERROR:
         return "Signature error";
      case Certificate_Status_Code::CERT_PUBKEY_INVALID:
         return "Certificate public key invalid";
      case Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN:
         return "Certificate signed with unknown/unavailable algorithm";
      case Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS:
         return "Certificate signature has invalid parameters";
 
         // intentionally no default so we are warned if new enum values are added
   }
 
   return nullptr;
}

References CA_CERT_NOT_FOR_CERT_ISSUER, CA_CERT_NOT_FOR_CRL_ISSUER, CANNOT_ESTABLISH_TRUST, CERT_CHAIN_LOOP, CERT_CHAIN_TOO_LONG, CERT_HAS_EXPIRED, CERT_IS_REVOKED, CERT_ISSUER_NOT_FOUND, CERT_NAME_NOMATCH, CERT_NOT_YET_VALID, CERT_PUBKEY_INVALID, CERT_SERIAL_NEGATIVE, CHAIN_LACKS_TRUST_ROOT, CHAIN_NAME_MISMATCH, CRL_BAD_SIGNATURE, CRL_HAS_EXPIRED, CRL_NOT_YET_VALID, DN_TOO_LONG, DUPLICATE_CERT_EXTENSION, DUPLICATE_CERT_POLICY, EXT_IN_V1_V2_CERT, INVALID_USAGE, NAME_CONSTRAINT_ERROR, NO_MATCHING_CRLDP, NO_REVOCATION_DATA, OCSP_BAD_STATUS, OCSP_CERT_NOT_LISTED, OCSP_HAS_EXPIRED, OCSP_IS_TOO_OLD, OCSP_ISSUER_NOT_FOUND, OCSP_ISSUER_NOT_TRUSTED, OCSP_NO_HTTP, OCSP_NO_REVOCATION_URL, OCSP_NOT_YET_VALID, OCSP_RESPONSE_GOOD, OCSP_RESPONSE_INVALID, OCSP_RESPONSE_MISSING_KEYUSAGE, OCSP_SERVER_NOT_AVAILABLE, OCSP_SIGNATURE_ERROR, OCSP_SIGNATURE_OK, POLICY_ERROR, SIGNATURE_ALGO_BAD_PARAMS, SIGNATURE_ALGO_UNKNOWN, SIGNATURE_ERROR, SIGNATURE_METHOD_TOO_WEAK, TRUSTED_CERT_HAS_EXPIRED, TRUSTED_CERT_NOT_YET_VALID, UNKNOWN_CRITICAL_EXTENSION, UNTRUSTED_HASH, V2_IDENTIFIERS_IN_V1_CERT, VALID_CRL_CHECKED, and VERIFIED.

to_string() [2/3]

std::string Botan::to_string

(

ErrorType

type

)

Convert an ErrorType to string.

Definition at line 13 of file exceptn.cpp.

                                    {
   switch(type) {
      case ErrorType::Unknown:
         return "Unknown";
      case ErrorType::SystemError:
         return "SystemError";
      case ErrorType::NotImplemented:
         return "NotImplemented";
      case ErrorType::OutOfMemory:
         return "OutOfMemory";
      case ErrorType::InternalError:
         return "InternalError";
      case ErrorType::IoError:
         return "IoError";
      case ErrorType::InvalidObjectState:
         return "InvalidObjectState";
      case ErrorType::KeyNotSet:
         return "KeyNotSet";
      case ErrorType::InvalidArgument:
         return "InvalidArgument";
      case ErrorType::InvalidKeyLength:
         return "InvalidKeyLength";
      case ErrorType::InvalidNonceLength:
         return "InvalidNonceLength";
      case ErrorType::LookupError:
         return "LookupError";
      case ErrorType::EncodingFailure:
         return "EncodingFailure";
      case ErrorType::DecodingFailure:
         return "DecodingFailure";
      case ErrorType::TLSError:
         return "TLSError";
      case ErrorType::HttpError:
         return "HttpError";
      case ErrorType::InvalidTag:
         return "InvalidTag";
      case ErrorType::RoughtimeError:
         return "RoughtimeError";
      case ErrorType::CommonCryptoError:
         return "CommonCryptoError";
      case ErrorType::Pkcs11Error:
         return "Pkcs11Error";
      case ErrorType::TPMError:
         return "TPMError";
      case ErrorType::DatabaseError:
         return "DatabaseError";
      case ErrorType::ZlibError:
         return "ZlibError";
      case ErrorType::Bzip2Error:
         return "Bzip2Error";
      case ErrorType::LzmaError:
         return "LzmaError";
   }
 
   // No default case in above switch so compiler warns
   return "Unrecognized Botan error";
}

References Bzip2Error, CommonCryptoError, DatabaseError, DecodingFailure, EncodingFailure, HttpError, InternalError, InvalidArgument, InvalidKeyLength, InvalidNonceLength, InvalidObjectState, InvalidTag, IoError, KeyNotSet, LookupError, LzmaError, NotImplemented, OutOfMemory, Pkcs11Error, RoughtimeError, SystemError, TLSError, TPMError, Unknown, and ZlibError.

Referenced by Botan::TLS::Server_Hello_13::basic_validation(), botan_x509_cert_validation_status(), Botan::TLS::PskIdentity::identity_as_string(), Botan::PKCS11::PKCS11_ReturnError::PKCS11_ReturnError(), and Botan::Path_Validation_Result::status_string().

to_string() [3/3]

std::string Botan::to_string ( std::span< const uint8_t > bytes )

inline

Definition at line 34 of file stl_util.h.

                                                         {
   return std::string(bytes.begin(), bytes.end());
}

to_u32bit()

BOTAN_TEST_API uint32_t Botan::to_u32bit

(

std::string_view

str

)

Convert a decimal string to a number

Parameters

str	the string to convert

Returns

number value of the string

Definition at line 32 of file parsing.cpp.

                                            {
   const std::string str(str_view);
 
   // std::stoul is not strict enough. Ensure that str is digit only [0-9]*
   for(const char chr : str) {
      if(chr < '0' || chr > '9') {
         throw Invalid_Argument("to_u32bit invalid decimal string '" + str + "'");
      }
   }
 
   const unsigned long int x = std::stoul(str);
 
   if constexpr(sizeof(unsigned long int) > 4) {
      // x might be uint64
      if(x > std::numeric_limits<uint32_t>::max()) {
         throw Invalid_Argument("Integer value of " + str + " exceeds 32 bit range");
      }
   }
 
   return static_cast<uint32_t>(x);
}

Referenced by Botan::SCAN_Name::arg_as_integer(), Botan::SCAN_Name::arg_as_integer(), argon2_check_pwhash(), create_private_key(), Botan::TLS::Text_Policy::get_len(), Botan::HTTP::http_sync(), and to_uint16().

to_uint16()

uint16_t Botan::to_uint16

(

std::string_view

str

)

Convert a decimal string to a number

Parameters

str	the string to convert

Returns

number value of the string

Definition at line 22 of file parsing.cpp.

                                       {
   const uint32_t x = to_u32bit(str);
 
   if(x >> 16) {
      throw Invalid_Argument("Integer value exceeds 16 bit range");
   }
 
   return static_cast<uint16_t>(x);
}

References to_u32bit().

Referenced by check_bcrypt(), and Botan::TLS::Text_Policy::srtp_profiles().

to_underlying()

template<typename T>
requires std::is_enum_v<T>

auto Botan::to_underlying ( T e )

noexcept

Definition at line 415 of file stl_util.h.

                                 {
   return static_cast<std::underlying_type_t<T>>(e);
}

tolower_string()

std::string Botan::tolower_string

(

std::string_view

in

)

Definition at line 241 of file parsing.cpp.

                                            {
   std::string s(in);
   for(size_t i = 0; i != s.size(); ++i) {
      const int cu = static_cast<unsigned char>(s[i]);
      if(std::isalpha(cu)) {
         s[i] = static_cast<char>(std::tolower(cu));
      }
   }
   return s;
}

Referenced by Botan::AlternativeName::add_dns(), Botan::GeneralName::decode_from(), and host_wildcard_match().

treehash() [1/2]

BOTAN_TEST_API void Botan::treehash	(	StrongSpan< SphincsTreeNode >	out_root,
		StrongSpan< SphincsAuthenticationPath >	out_auth_path,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes,
		std::optional< TreeNodeIndex >	leaf_idx,
		uint32_t	idx_offset,
		uint32_t	tree_height,
		const GenerateLeafFunction &	gen_leaf,
		Sphincs_Address &	tree_address )

Implements a generic Merkle tree hash. Will be used for both FORS and XMSS signatures. gen_leaf is used to create leaf nodes in the respective trees. Additionally XMSS uses the gen_leaf logic to store the WOTS Signature in the main SLH-DSA signature. The leaf_idx is the index of leaf to sign. If only the root node must be computed (without a signature), the leaf_idx is set to std::nullopt.

Definition at line 17 of file sp_treehash.cpp.

                                             {
   BOTAN_ASSERT_NOMSG(out_root.size() == params.n());
   BOTAN_ASSERT_NOMSG(out_auth_path.size() == params.n() * total_tree_height);
 
   const TreeNodeIndex max_idx(uint32_t((1 << total_tree_height) - 1));
 
   std::vector<uint8_t> stack(total_tree_height * params.n());
   SphincsTreeNode current_node(params.n());  // Current logical node
 
   /* Traverse the tree from the left-most leaf, matching siblings and up until
   * the root (Post-order traversal). Collect the adjacent nodes (A) to build
   * the authentication path (X) along the way.
   *
   *         7R
   *        /  \
   *      3X    6A
   *     / \    / \
   *   1X  2A  4   5
   */
   for(TreeNodeIndex idx(0); true; ++idx) {
      tree_address.set_tree_height(TreeLayerIndex(0));
      gen_leaf(current_node, idx + idx_offset);
 
      // Now combine the freshly generated right node with previously generated
      // left ones
      uint32_t internal_idx_offset = idx_offset;
      TreeNodeIndex internal_idx = idx;
      auto internal_leaf = leaf_idx;
 
      for(TreeLayerIndex h(0); true; ++h) {
         // Check if we hit the top of the tree
         if(h.get() == total_tree_height) {
            copy_mem(out_root, current_node);
            return;
         }
 
         // Check if the node we have is a part of the authentication path; if
         // it is, write it out. The XOR sum of both nodes (at internal_idx and internal_leaf)
         // is 1 iff they have the same parent node in the FORS tree
         if(internal_leaf.has_value() && (internal_idx ^ internal_leaf.value()) == 0x01U) {
            auto auth_path_location = out_auth_path.get().subspan(h.get() * params.n(), params.n());
            copy_mem(auth_path_location, current_node);
         }
 
         // At this point we know that we'll need to use the stack. Get a
         // reference to the correct location.
         auto stack_location = std::span(stack).subspan(h.get() * params.n(), params.n());
 
         // Check if we're at a left child; if so, stop going up the stack
         // Exception: if we've reached the end of the tree, keep on going (so
         // we combine the last 4 nodes into the one root node in two more
         // iterations)
         if((internal_idx & 1) == 0U && idx < max_idx) {
            // We've hit a left child; save the current for when we get the
            // corresponding right child.
            copy_mem(stack_location, current_node);
            break;
         }
 
         // Ok, we're at a right node. Now combine the left and right logical
         // nodes together.
 
         // Set the address of the node we're creating.
         internal_idx_offset /= 2;
         tree_address.set_tree_height(h + 1);
         tree_address.set_tree_index(internal_idx / 2 + internal_idx_offset);
 
         hashes.T(current_node, tree_address, stack_location, current_node);
 
         internal_idx /= 2;
         if(internal_leaf.has_value()) {
            internal_leaf.value() /= 2;
         }
      }
   }
}

References BOTAN_ASSERT_NOMSG, copy_mem(), Botan::StrongSpan< T >::get(), Botan::Sphincs_Parameters::n(), Botan::Sphincs_Address::set_tree_height(), Botan::Sphincs_Address::set_tree_index(), Botan::StrongSpan< T >::size(), and Botan::Sphincs_Hash_Functions::T().

Referenced by fors_sign_and_pkgen(), and xmss_sign_and_pkgen().

treehash() [2/2]

template<concepts::contiguous_strong_type TreeNode, concepts::strong_span AuthPathSS, concepts::tree_node_index TreeNodeIndex, concepts::tree_layer_index TreeLayerIndex, typename Address>
requires concepts::tree_address<Address, TreeLayerIndex, TreeNodeIndex>

void Botan::treehash ( StrongSpan< TreeNode > out_root, std::optional< AuthPathSS > out_auth_path, std::optional< TreeNodeIndex > leaf_idx, size_t node_size, TreeLayerIndex total_tree_height, uint32_t idx_offset, concepts::tree_hash_node_pair< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto node_pair_hash, concepts::tree_gen_leaf< TreeNodeIndex, TreeLayerIndex, Address, StrongSpan< TreeNode > > auto gen_leaf, Address & tree_address )

inline

Treehash logic to build up a merkle hash tree.

Computes the root of the merkle tree. Can also output an authentication path necessary for a hash based signature.

Given the following tree: Layer: 2 7R / \ 1 3X 6A / \ / \ 0 1X 2A 4 5

The treehash logic traverses the tree (Post-order traversal), i.e., the nodes are discovered in order 1,2,3,...,7. If we want to create a signature using leaf node 1, the authentication path is (Node 2, Node 6), since we need those to compute the root.

Parameters

out_root	An output buffer to store the root node in (size: node_size ).
out_auth_path	Optional buffer to store the authentication path in (size: node_size * total_tree_height).
leaf_idx	The optional index of the leaf used to sign in the bottom tree layer beginning with index 0. nullopt if no node is signed, so we need no auth path.
node_size	The size of each node in the tree.
total_tree_height	The hight of the merkle tree to construct.
idx_offset	If we compute a subtree this marks the index of the leftmost leaf node in the bottom layer
node_pair_hash	The function to process two child nodes to compute their parent node.
gen_leaf	The logic to create a leaf node given the address in the tree. Probably this function creates a one-time/few-time-signature's public key which is hashed to be the leaf node.
tree_address	The address that is passed to gen_leaf or node_pair hash. This function will update the address accordings to the currently processed node. This object may contain further algorithm specific information, like the position of this merkle tree in a hypertree.

Definition at line 114 of file tree_hash.h.

                          {
   BOTAN_ASSERT_NOMSG(out_root.size() == node_size);
   BOTAN_ASSERT(out_auth_path.has_value() == leaf_idx.has_value(),
                "Both leaf index and auth path buffer is given or neither.");
   const bool is_signing = leaf_idx.has_value();
   BOTAN_ASSERT_NOMSG(!is_signing || out_auth_path.value().size() == node_size * total_tree_height.get());
 
   const TreeNodeIndex max_idx(uint32_t((1 << total_tree_height.get()) - 1));
 
   std::vector<TreeNode> last_visited_left_child_at_layer(total_tree_height.get(), TreeNode(node_size));
 
   TreeNode current_node(node_size);  // Current logical node
 
   // Traverse the tree from the left-most leaf, matching siblings and up until
   // the root (Post-order traversal). Collect the adjacent nodes to build
   // the authentication path along the way.
   for(TreeNodeIndex idx(0); true; ++idx) {
      tree_address.set_address(TreeLayerIndex(0), idx + idx_offset);
      gen_leaf(StrongSpan<TreeNode>(current_node), tree_address);
 
      // Now combine the freshly generated right node with previously generated
      // left ones
      uint32_t internal_idx_offset = idx_offset;
      TreeNodeIndex internal_idx = idx;
      auto internal_leaf = leaf_idx;
 
      for(TreeLayerIndex h(0); true; ++h) {
         // Check if we hit the top of the tree
         if(h == total_tree_height) {
            copy_mem(out_root, current_node);
            return;
         }
 
         // Check if the node we have is a part of the authentication path; if
         // it is, write it out. The XOR sum of both nodes (at internal_idx and internal_leaf)
         // is 1 iff they have the same parent node in the FORS tree
         if(is_signing && (internal_idx ^ internal_leaf.value()) == 0x01U) {
            auto auth_path_location = out_auth_path.value().get().subspan(h.get() * node_size, node_size);
            copy_mem(auth_path_location, current_node);
         }
 
         // Check if we're at a left child; if so, stop going up the tree
         // Exception: if we've reached the end of the tree, keep on going (so
         // we combine the last 4 nodes into the one root node in two more
         // iterations)
         if((internal_idx & 1) == 0U && idx < max_idx) {
            // We've hit a left child; save the current for when we get the
            // corresponding right child.
            copy_mem(last_visited_left_child_at_layer.at(h.get()), current_node);
            break;
         }
 
         // Ok, we're at a right node. Now combine the left and right logical
         // nodes together.
 
         // Set the address of the node we're creating.
         internal_idx_offset /= 2;
         tree_address.set_address(h + 1, internal_idx / 2 + internal_idx_offset);
 
         node_pair_hash(current_node, tree_address, last_visited_left_child_at_layer.at(h.get()), current_node);
 
         internal_idx /= 2;
         if(internal_leaf.has_value()) {
            internal_leaf.value() /= 2;
         }
      }
   }
}

References BOTAN_ASSERT, BOTAN_ASSERT_NOMSG, copy_mem(), Botan::detail::Strong_Base< T >::get(), and Botan::StrongSpan< T >::size().

typecast_copy() [1/9]

template<typename To>
requires std::is_trivial<To>::value

To Botan::typecast_copy ( const uint8_t src[] )

inlineconstexprnoexcept

Definition at line 257 of file mem_ops.h.

                                                                {
   // asserts that *src points to the correct amount of memory
   return typecast_copy<To>(std::span<const uint8_t, sizeof(To)>(src, sizeof(To)));
}

References typecast_copy().

typecast_copy() [2/9]

template<typename ToT, ranges::contiguous_range FromR>
requires std::is_default_constructible_v<ToT> && std::is_trivially_copyable_v<ToT> && std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>>

ToT Botan::typecast_copy ( FromR && src )

inlineconstexprnoexcept

Create a trivial type by bit-casting a range of trivially copyable type with matching length into it.

Definition at line 215 of file mem_ops.h.

                                                         {
   ToT dst;
   typecast_copy(dst, src);
   return dst;
}

References typecast_copy().

typecast_copy() [3/9]

template<typename T>
requires std::is_trivial<typename std::decay<T>::type>::value

void Botan::typecast_copy ( T & out, const uint8_t in[] )

inlineconstexpr

Definition at line 249 of file mem_ops.h.

                                                                {
   // asserts that *in points to the correct amount of memory
   typecast_copy(out, std::span<const uint8_t, sizeof(T)>(in, sizeof(T)));
}

References typecast_copy().

typecast_copy() [4/9]

template<typename T>
requires std::is_trivial<T>::value

void Botan::typecast_copy ( T out[], const uint8_t in[], size_t N )

inlineconstexpr

Definition at line 232 of file mem_ops.h.

{
   // asserts that *in and *out point to the correct amount of memory
   typecast_copy(std::span<T>(out, N), std::span<const uint8_t>(in, N * sizeof(T)));
}

References typecast_copy().

typecast_copy() [5/9]

template<ranges::contiguous_output_range ToR, typename FromT>
requires std::is_trivially_copyable_v<FromT> && (!std::ranges::range<FromT>) && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>

void Botan::typecast_copy ( ToR && out, const FromT & in )

inlineconstexpr

Copy an instance of trivially copyable type into a range of trivially copyable type with matching length.

Definition at line 204 of file mem_ops.h.

                                                                {
   typecast_copy(out, std::span<const FromT, 1>(&in, 1));
}

References typecast_copy().

typecast_copy() [6/9]

template<ranges::contiguous_output_range ToR, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<std::ranges::range_value_t<ToR>>

void Botan::typecast_copy ( ToR && out, FromR && in )

inlineconstexpr

Copy a range of a trivially copyable type into another range of trivially copyable type of matching byte length.

Definition at line 181 of file mem_ops.h.

                                                           {
   ranges::assert_equal_byte_lengths(out, in);
   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
}

References Botan::ranges::assert_equal_byte_lengths(), and Botan::ranges::size_bytes().

Referenced by decode_point(), decode_scalar(), Botan::Roughtime::Response::from_bits(), Botan::bitvector_base< secure_allocator >::from_bytes(), Botan::detail::load_any(), Botan::detail::load_any(), Botan::Roughtime::Nonce::Nonce(), Botan::detail::store_any(), Botan::detail::store_any(), Botan::bitvector_base< secure_allocator >::to_bytes(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), typecast_copy(), xor_buf(), and xor_buf().

typecast_copy() [7/9]

template<typename ToT, ranges::contiguous_range FromR>
requires std::is_trivially_copyable_v<std::ranges::range_value_t<FromR>> && std::is_trivially_copyable_v<ToT> && (!std::ranges::range<ToT>)

void Botan::typecast_copy ( ToT & out, FromR && in )

inlineconstexprnoexcept

Copy a range of trivially copyable type into an instance of trivially copyable type with matching length.

Definition at line 193 of file mem_ops.h.

                                                                   {
   typecast_copy(std::span<ToT, 1>(&out, 1), in);
}

References typecast_copy().

typecast_copy() [8/9]

template<typename T>

void Botan::typecast_copy ( uint8_t out[], const T & in )

inlineconstexpr

Definition at line 241 of file mem_ops.h.

                                                                {
   // asserts that *out points to the correct amount of memory
   typecast_copy(std::span<uint8_t, sizeof(T)>(out, sizeof(T)), in);
}

References typecast_copy().

typecast_copy() [9/9]

template<typename T>
requires std::is_trivially_copyable<T>::value

void Botan::typecast_copy ( uint8_t out[], T in[], size_t N )

inlineconstexpr

Definition at line 223 of file mem_ops.h.

{
   // asserts that *in and *out point to the correct amount of memory
   typecast_copy(std::span<uint8_t>(out, sizeof(T) * N), std::span<const T>(in, N));
}

References typecast_copy().

ucs2_to_utf8()

BOTAN_TEST_API std::string Botan::ucs2_to_utf8	(	const uint8_t	ucs2[],
		size_t	len )

Convert a sequence of UCS-2 (big endian) characters to a UTF-8 string This is used for ASN.1 BMPString type

Parameters

ucs2	the sequence of UCS-2 characters
len	length of ucs2 in bytes, must be a multiple of 2

Definition at line 54 of file charset.cpp.

                                                         {
   if(len % 2 != 0) {
      throw Decoding_Error("Invalid length for UCS-2 string");
   }
 
   const size_t chars = len / 2;
 
   std::string s;
   for(size_t i = 0; i != chars; ++i) {
      const uint32_t c = load_be<uint16_t>(ucs2, i);
      append_utf8_for(s, c);
   }
 
   return s;
}

References load_be().

Referenced by Botan::ASN1_String::decode_from().

ucs4_to_utf8()

BOTAN_TEST_API std::string Botan::ucs4_to_utf8	(	const uint8_t	ucs4[],
		size_t	len )

Convert a sequence of UCS-4 (big endian) characters to a UTF-8 string This is used for ASN.1 UniversalString type

Parameters

ucs4	the sequence of UCS-4 characters
len	length of ucs4 in bytes, must be a multiple of 4

Definition at line 70 of file charset.cpp.

                                                         {
   if(len % 4 != 0) {
      throw Decoding_Error("Invalid length for UCS-4 string");
   }
 
   const size_t chars = len / 4;
 
   std::string s;
   for(size_t i = 0; i != chars; ++i) {
      const uint32_t c = load_be<uint32_t>(ucs4, i);
      append_utf8_for(s, c);
   }
 
   return s;
}

References load_be().

Referenced by Botan::ASN1_String::decode_from().

unlock()

template<typename T>

std::vector< T > Botan::unlock

(

const secure_vector< T > &

in

)

Definition at line 82 of file secmem.h.

                                                {
   return std::vector<T>(in.begin(), in.end());
}

Referenced by Botan::OCSP::CertID::CertID(), Botan::Roughtime::Chain::Chain(), Botan::DL_Group::DL_Group(), Botan::KeyPair::encryption_consistency_check(), Botan::DL_Group::from_PEM(), Botan::OCSP::CertID::is_id_for(), and Botan::Cipher_Mode_Filter::set_iv().

unsafe_for_production_build()

bool Botan::unsafe_for_production_build

(

)

Certain build-time options, used for testing, result in a binary which is not safe for use in a production system. This function can be used to test for such a configuration at runtime.

Currently these unsafe conditions include:

• Unsafe fuzzer mode (–unsafe-fuzzer-mode) which intentionally disables various checks in order to improve the effectiveness of fuzzing.
• Terminate on asserts (–unsafe-terminate-on-asserts) which intentionally aborts if any internal assertion failure occurs, rather than throwing an exception.

Definition at line 67 of file version.cpp.

                                   {
#if defined(BOTAN_UNSAFE_FUZZER_MODE) || defined(BOTAN_TERMINATE_ON_ASSERTS)
   return true;
#else
   return false;
#endif
}

unwrap_strong_type()

template<typename T>

decltype(auto) Botan::unwrap_strong_type ( T && t )

nodiscardconstexpr

Generically unwraps a strong type to its underlying type.

If the provided type is not a strong type, it is returned as is.

Note

This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary get() method if you know that you are dealing with a strong type.

Parameters

t	value to be unwrapped

Returns

the unwrapped value

Definition at line 223 of file strong_type.h.

                                                                 {
   if constexpr(!concepts::strong_type<std::remove_cvref_t<T>>) {
      // If the parameter type isn't a strong type, return it as is.
      return std::forward<T>(t);
   } else {
      // Unwrap the strong type and return the underlying value.
      return std::forward<T>(t).get();
   }
}

Referenced by checked_cast_to_or_throw(), Botan::detail::concatenate(), Botan::bitvector_base< secure_allocator >::ct_conditional_xor(), Botan::bitvector_base< secure_allocator >::equals_vartime(), Botan::bitvector_base< secure_allocator >::operator&=(), Botan::bitvector_base< secure_allocator >::operator^=(), Botan::bitvector_base< secure_allocator >::operator|=(), Botan::bitvector_base< secure_allocator >::subvector(), Botan::bitvector_base< secure_allocator >::subvector_replace(), and Botan::detail::unwrap_strong_type_or_enum().

value_exists()

template<typename T, typename OT>

bool Botan::value_exists	(	const std::vector< T > &	vec,
		const OT &	val )

Existence check for values

Definition at line 61 of file stl_util.h.

                                                          {
   for(size_t i = 0; i != vec.size(); ++i) {
      if(vec[i] == val) {
         return true;
      }
   }
   return false;
}

Referenced by Botan::TLS::Policy::acceptable_ciphersuite(), Botan::TLS::Policy::allowed_signature_hash(), Botan::TLS::Policy::allowed_signature_method(), Botan::TLS::Certificate_Type_Base::Certificate_Type_Base(), Botan::TLS::Policy::choose_key_exchange_group(), Botan::TLS::Policy::ciphersuite_list(), Botan::TLS::Client_Hello_12::Client_Hello_12(), Botan::TLS::Server_Hello_13::create(), Botan::TPM2::Context::find_free_persistent_handle(), Botan::TLS::Hello_Retry_Request::Hello_Retry_Request(), Botan::TLS::Signature_Scheme::is_available(), Botan::TLS::Server_Impl_13::new_session_ticket_supported(), Botan::TPM2::Context::persist(), Botan::TLS::Key_Share::retry_offer(), Botan::TLS::Supported_Groups::Supported_Groups(), and Botan::TLS::Certificate_Type_Base::validate_selection().

var_ctz32()

size_t Botan::var_ctz32 ( uint32_t n )

inlineconstexpr

Definition at line 175 of file bit_ops.h.

                                              {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_ctz)
   if(n == 0) {
      return 32;
   }
   return __builtin_ctz(n);
#else
   return ctz<uint32_t>(n);
#endif
}

References ctz().

varpoint_exec()

template<typename C, size_t WindowBits, typename BlindedScalar>

C::ProjectivePoint Botan::varpoint_exec	(	const AffinePointTable< C > &	table,
		const BlindedScalar &	scalar,
		RandomNumberGenerator &	rng )

Definition at line 236 of file pcurves_mul.h.

                                                                      {
   const size_t windows = (scalar.bits() + WindowBits - 1) / WindowBits;
 
   auto accum = [&]() {
      const size_t w_0 = scalar.get_window((windows - 1) * WindowBits);
      auto pt = C::ProjectivePoint::from_affine(table.ct_select(w_0));
      CT::poison(pt);
      pt.randomize_rep(rng);
      return pt;
   }();
 
   for(size_t i = 1; i != windows; ++i) {
      accum = accum.dbl_n(WindowBits);
      auto w_i = scalar.get_window((windows - i - 1) * WindowBits);
 
      /*
      This point addition cannot be a doubling (except once)
 
      Consider the sequence of points that are operated on, and specifically
      their discrete logarithms. We start out at the point at infinity
      (dlog 0) and then add the initial window which is precisely P*w_0
 
      We then perform WindowBits doublings, so accum's dlog at the point
      of the addition in the first iteration of the loop (when i == 1) is
      at least 2^W * w_0.
 
      Since we know w_0 > 0, then in every iteration of the loop, accums
      dlog will always be greater than the dlog of the table element we
      just looked up (something between 0 and 2^W-1), and thus the
      addition into accum cannot be a doubling.
 
      However due to blinding this argument fails, since we perform
      multiplications using a scalar that is larger than the group
      order. In this case it's possible that the dlog of accum becomes
      `order + x` (or, effectively, `x`) and `x` is smaller than 2^W.
      In this case, a doubling may occur. Future iterations of the loop
      cannot be doublings by the same argument above. Since the blinding
      factor is always less than the group order (substantially so),
      it is not possible for the dlog of accum to overflow a second time.
      */
 
      accum += table.ct_select(w_i);
 
      if(i <= 3) {
         accum.randomize_rep(rng);
      }
   }
 
   CT::unpoison(accum);
   return accum;
}

References Botan::AffinePointTable< C, R >::ct_select(), Botan::CT::poison(), and Botan::CT::unpoison().

varpoint_setup()

template<typename C, size_t TableSize>

AffinePointTable< C > Botan::varpoint_setup

(

const typename C::AffinePoint &

p

)

Definition at line 217 of file pcurves_mul.h.

                                                                   {
   static_assert(TableSize > 2);
 
   std::vector<typename C::ProjectivePoint> table;
   table.reserve(TableSize);
   table.push_back(C::ProjectivePoint::from_affine(p));
 
   for(size_t i = 1; i != TableSize; ++i) {
      if(i % 2 == 1) {
         table.push_back(table[i / 2].dbl());
      } else {
         table.push_back(table[i - 1] + p);
      }
   }
 
   return AffinePointTable<C>(table);
}

vartime_divide()

BOTAN_TEST_API void Botan::vartime_divide	(	const BigInt &	x,
		const BigInt &	y,
		BigInt &	q,
		BigInt &	r )

BigInt Division

Parameters

x	an integer
y	a non-zero integer
q	will be set to x / y
r	will be set to x % y

Definition at line 230 of file divide.cpp.

                                                                                        {
   if(y_arg.is_zero()) {
      throw Invalid_Argument("vartime_divide: cannot divide by zero");
   }
 
   const size_t y_words = y_arg.sig_words();
 
   BOTAN_ASSERT_NOMSG(y_words > 0);
 
   BigInt y = y_arg;
 
   BigInt r = x;
   BigInt q = BigInt::zero();
   secure_vector<word> ws;
 
   r.set_sign(BigInt::Positive);
   y.set_sign(BigInt::Positive);
 
   // Calculate shifts needed to normalize y with high bit set
   const size_t shifts = y.top_bits_free();
 
   if(shifts > 0) {
      y <<= shifts;
      r <<= shifts;
   }
 
   // we know y has not changed size, since we only shifted up to set high bit
   const size_t t = y_words - 1;
   const size_t n = std::max(y_words, r.sig_words()) - 1;  // r may have changed size however
 
   BOTAN_ASSERT_NOMSG(n >= t);
 
   q.grow_to(n - t + 1);
 
   word* q_words = q.mutable_data();
 
   BigInt shifted_y = y << (WordInfo<word>::bits * (n - t));
 
   // Set q_{n-t} to number of times r > shifted_y
   q_words[n - t] = r.reduce_below(shifted_y, ws);
 
   const word y_t0 = y.word_at(t);
   const word y_t1 = y.word_at(t - 1);
   BOTAN_DEBUG_ASSERT((y_t0 >> (WordInfo<word>::bits - 1)) == 1);
 
   for(size_t j = n; j != t; --j) {
      const word x_j0 = r.word_at(j);
      const word x_j1 = r.word_at(j - 1);
      const word x_j2 = r.word_at(j - 2);
 
      word qjt = (x_j0 == y_t0) ? WordInfo<word>::max : bigint_divop_vartime(x_j0, x_j1, y_t0);
 
      // Per HAC 14.23, this operation is required at most twice
      for(size_t k = 0; k != 2; ++k) {
         if(division_check_vartime(qjt, y_t0, y_t1, x_j0, x_j1, x_j2)) {
            qjt--;
         } else {
            break;
         }
      }
 
      shifted_y >>= WordInfo<word>::bits;
      // Now shifted_y == y << (WordInfo<word>::bits * (j-t-1))
 
      // TODO this sequence could be better
      r -= qjt * shifted_y;
      if(r.is_negative()) {
         qjt--;
         r += shifted_y;
         BOTAN_DEBUG_ASSERT(r.is_positive());
      }
 
      q_words[j - t - 1] = qjt;
   }
 
   if(shifts > 0) {
      r >>= shifts;
   }
 
   sign_fixup(x, y_arg, q, r);
 
   r_out = r;
   q_out = q;
}

References bigint_divop_vartime(), BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, Botan::BigInt::grow_to(), Botan::BigInt::is_negative(), Botan::BigInt::is_positive(), Botan::BigInt::is_zero(), Botan::BigInt::mutable_data(), Botan::BigInt::Positive, Botan::BigInt::reduce_below(), Botan::BigInt::set_sign(), Botan::BigInt::sig_words(), Botan::BigInt::top_bits_free(), Botan::BigInt::word_at(), and Botan::BigInt::zero().

Referenced by botan_mp_div(), operator%(), and operator/().

verify_signature()

bool Botan::verify_signature	(	std::span< const uint8_t, ED448_LEN >	pk,
		bool	phflag,
		std::span< const uint8_t >	context,
		std::span< const uint8_t >	sig,
		std::span< const uint8_t >	msg )

Verify a signature(RFC 8032 5.2.7)

Parameters

pk	the public key
phflag	the prehash flag (true iff using Ed448ph)
context	the context string
sig	the signature
msg	the message to verify

Exceptions

Decoding_Error

if the public key or signature is malformed

Returns

true if the signature is valid

Definition at line 283 of file ed448_internal.cpp.

                                                  {
   // RFC 8032 5.2.7. Verify
   // 1. To verify a signature on a message M using context C and public
   //    key A, with F being 0 for Ed448 and 1 for Ed448ph, first split
   //    the signature into two 57-octet halves. Decode the first half as
   //    a point R, and the second half as an integer S, in the range 0 <=
   //    s < L. Decode the public key A as point A’. If any of the
   //    decodings fail (including S being out of range), the signature is
   //    invalid.
   if(sig.size() != 2 * ED448_LEN) {
      // Wrong signature size
      throw Decoding_Error("Ed448 signature has wrong size");
   }
   const auto [big_r_bytes, big_s_bytes] = split(sig.first<2 * ED448_LEN>());
   const auto big_r = Ed448Point::decode(big_r_bytes);
   if(!Scalar448::bytes_are_reduced(big_s_bytes)) {
      // S not in range 0 <= s < L
      throw Decoding_Error("Ed448 signature has invalid S");
   }
   const Scalar448 big_s(big_s_bytes);
   // 2. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114), and
   //    interpret the 114-octet digest as a little-endian integer k.
   const Scalar448 k(shake(phflag, context, big_r_bytes, pk, msg));
   // 3. Check the group equation [4][S]B = [4]R + [4][k]A’. It’s
   //    sufficient, but not required, to instead check [S]B = R + [k]A’.
   return (big_s * Ed448Point::base_point()) == (big_r + k * Ed448Point::decode(pk));
}

References Botan::Ed448Point::base_point(), Botan::Scalar448::bytes_are_reduced(), Botan::Ed448Point::decode(), and ED448_LEN.

Referenced by Botan::Roughtime::Response::from_bits().

version_cstr()

const char * Botan::version_cstr

(

)

Same as version_string() except returning a pointer to a statically allocated string.

Returns

version string

Definition at line 20 of file version.cpp.

                           {
   return BOTAN_FULL_VERSION_STRING;
}

Referenced by botan_version_string(), and version_string().

version_datestamp()

uint32_t Botan::version_datestamp

(

)

Return the date this version of botan was released, in an integer of the form YYYYMMDD. For instance a version released on May 21, 2013 would return the integer 20130521. If the currently running version is not an official release, this function will return 0 instead.

Returns

release date, or zero if unreleased

Definition at line 32 of file version.cpp.

                             {
   return BOTAN_VERSION_DATESTAMP;
}

References BOTAN_VERSION_DATESTAMP.

Referenced by botan_version_datestamp().

version_distribution_info()

std::optional< std::string > Botan::version_distribution_info

(

)

Return any string that is set at build time using the --distribution-info option. It allows a packager of the library to specify any distribution-specific patches. If no value is given at build time, returns nullopt.

Returns

distribution info

Definition at line 44 of file version.cpp.

                                                   {
#if defined(BOTAN_DISTRIBUTION_INFO_STRING)
   return std::string(BOTAN_DISTRIBUTION_INFO_STRING);
#else
   return std::nullopt;
#endif
}

version_major()

uint32_t Botan::version_major

(

)

Get the major version number.

Returns

major version number

Definition at line 55 of file version.cpp.

                         {
   return BOTAN_VERSION_MAJOR;
}

References BOTAN_VERSION_MAJOR.

Referenced by botan_version_major(), and runtime_version_check().

version_minor()

uint32_t Botan::version_minor

(

)

Get the minor version number.

Returns

minor version number

Definition at line 59 of file version.cpp.

                         {
   return BOTAN_VERSION_MINOR;
}

References BOTAN_VERSION_MINOR.

Referenced by botan_version_minor(), and runtime_version_check().

version_patch()

uint32_t Botan::version_patch

(

)

Get the patch number.

Returns

patch number

Definition at line 63 of file version.cpp.

                         {
   return BOTAN_VERSION_PATCH;
}

References BOTAN_VERSION_PATCH.

Referenced by botan_version_patch(), and runtime_version_check().

version_string()

std::string Botan::version_string

(

)

Get a human-readable single-line string identifying the version of Botan. No particular format should be assumed.

Returns

version string

Definition at line 24 of file version.cpp.

                           {
   return std::string(version_cstr());
}

References version_cstr().

version_vc_revision()

std::optional< std::string > Botan::version_vc_revision

(

)

Returns a string that is set to a revision identifier corresponding to the source, or nullopt if this could not be determined. It is set for all official releases, and for builds that originated from within a git checkout.

Returns

VC revision

Definition at line 36 of file version.cpp.

                                             {
#if defined(BOTAN_VC_REVISION)
   return std::string(BOTAN_VC_REVISION);
#else
   return std::nullopt;
#endif
}

word8_add2()

template<WordType W>

auto Botan::word8_add2 ( W x[8], const W y[8], W carry ) -> W

inlineconstexpr

Definition at line 226 of file mp_asmi.h.

                                                                     {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
                   : [carry] "=r"(carry)
                   : [x] "r"(x), [y] "r"(y), "0"(carry)
                   : "cc", "memory");
      return carry;
   }
#endif
 
   x[0] = word_add(x[0], y[0], &carry);
   x[1] = word_add(x[1], y[1], &carry);
   x[2] = word_add(x[2], y[2], &carry);
   x[3] = word_add(x[3], y[3], &carry);
   x[4] = word_add(x[4], y[4], &carry);
   x[5] = word_add(x[5], y[5], &carry);
   x[6] = word_add(x[6], y[6], &carry);
   x[7] = word_add(x[7], y[7], &carry);
   return carry;
}

References carry(), and word_add().

Referenced by bigint_add2_nc().

word8_add3()

template<WordType W>

auto Botan::word8_add3 ( W z[8], const W x[8], const W y[8], W carry ) -> W

inlineconstexpr

Definition at line 252 of file mp_asmi.h.

                                                                                   {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
                   : [carry] "=r"(carry)
                   : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
                   : "cc", "memory");
      return carry;
   }
#endif
 
   z[0] = word_add(x[0], y[0], &carry);
   z[1] = word_add(x[1], y[1], &carry);
   z[2] = word_add(x[2], y[2], &carry);
   z[3] = word_add(x[3], y[3], &carry);
   z[4] = word_add(x[4], y[4], &carry);
   z[5] = word_add(x[5], y[5], &carry);
   z[6] = word_add(x[6], y[6], &carry);
   z[7] = word_add(x[7], y[7], &carry);
   return carry;
}

References carry(), and word_add().

Referenced by bigint_add3_nc(), bigint_cnd_add_or_sub(), and bigint_cnd_addsub().

word8_linmul2()

template<WordType W>

auto Botan::word8_linmul2 ( W x[8], W y, W carry ) -> W

inlineconstexpr

Definition at line 381 of file mp_asmi.h.

                                                               {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(DO_8_TIMES(LINMUL_OP, "x")
          : [carry] "=r"(carry)
          : [x] "r"(x), [y] "rm"(y), "0"(carry)
          : "cc", "%rax", "%rdx");
      return carry;
   }
#endif
 
   x[0] = word_madd2(x[0], y, &carry);
   x[1] = word_madd2(x[1], y, &carry);
   x[2] = word_madd2(x[2], y, &carry);
   x[3] = word_madd2(x[3], y, &carry);
   x[4] = word_madd2(x[4], y, &carry);
   x[5] = word_madd2(x[5], y, &carry);
   x[6] = word_madd2(x[6], y, &carry);
   x[7] = word_madd2(x[7], y, &carry);
   return carry;
}

References carry(), and word_madd2().

Referenced by bigint_linmul2().

word8_linmul3()

template<WordType W>

auto Botan::word8_linmul3 ( W z[8], const W x[8], W y, W carry ) -> W

inlineconstexpr

Definition at line 407 of file mp_asmi.h.

                                                                             {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(DO_8_TIMES(LINMUL_OP, "z")
          : [carry] "=r"(carry)
          : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
          : "cc", "%rax", "%rdx");
      return carry;
   }
#endif
 
   z[0] = word_madd2(x[0], y, &carry);
   z[1] = word_madd2(x[1], y, &carry);
   z[2] = word_madd2(x[2], y, &carry);
   z[3] = word_madd2(x[3], y, &carry);
   z[4] = word_madd2(x[4], y, &carry);
   z[5] = word_madd2(x[5], y, &carry);
   z[6] = word_madd2(x[6], y, &carry);
   z[7] = word_madd2(x[7], y, &carry);
   return carry;
}

References carry(), and word_madd2().

Referenced by bigint_linmul3().

word8_madd3()

template<WordType W>

auto Botan::word8_madd3 ( W z[8], const W x[8], W y, W carry ) -> W

inlineconstexpr

Definition at line 433 of file mp_asmi.h.

                                                                           {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(DO_8_TIMES(MULADD_OP, "")
          : [carry] "=r"(carry)
          : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
          : "cc", "%rax", "%rdx");
      return carry;
   }
#endif
 
   z[0] = word_madd3(x[0], y, z[0], &carry);
   z[1] = word_madd3(x[1], y, z[1], &carry);
   z[2] = word_madd3(x[2], y, z[2], &carry);
   z[3] = word_madd3(x[3], y, z[3], &carry);
   z[4] = word_madd3(x[4], y, z[4], &carry);
   z[5] = word_madd3(x[5], y, z[5], &carry);
   z[6] = word_madd3(x[6], y, z[6], &carry);
   z[7] = word_madd3(x[7], y, z[7], &carry);
   return carry;
}

References carry(), and word_madd3().

Referenced by basecase_mul(), and basecase_sqr().

word8_sub2()

template<WordType W>

auto Botan::word8_sub2 ( W x[8], const W y[8], W carry ) -> W

inlineconstexpr

Definition at line 303 of file mp_asmi.h.

                                                                     {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
          : [carry] "=r"(carry)
          : [x] "r"(x), [y] "r"(y), "0"(carry)
          : "cc", "memory");
      return carry;
   }
#endif
 
   x[0] = word_sub(x[0], y[0], &carry);
   x[1] = word_sub(x[1], y[1], &carry);
   x[2] = word_sub(x[2], y[2], &carry);
   x[3] = word_sub(x[3], y[3], &carry);
   x[4] = word_sub(x[4], y[4], &carry);
   x[5] = word_sub(x[5], y[5], &carry);
   x[6] = word_sub(x[6], y[6], &carry);
   x[7] = word_sub(x[7], y[7], &carry);
   return carry;
}

References carry(), and word_sub().

Referenced by bigint_sub2().

word8_sub2_rev()

template<WordType W>

auto Botan::word8_sub2_rev ( W x[8], const W y[8], W carry ) -> W

inlineconstexpr

Definition at line 329 of file mp_asmi.h.

                                                                         {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
          : [carry] "=r"(carry)
          : [x] "r"(y), [y] "r"(x), [z] "r"(x), "0"(carry)
          : "cc", "memory");
      return carry;
   }
#endif
 
   x[0] = word_sub(y[0], x[0], &carry);
   x[1] = word_sub(y[1], x[1], &carry);
   x[2] = word_sub(y[2], x[2], &carry);
   x[3] = word_sub(y[3], x[3], &carry);
   x[4] = word_sub(y[4], x[4], &carry);
   x[5] = word_sub(y[5], x[5], &carry);
   x[6] = word_sub(y[6], x[6], &carry);
   x[7] = word_sub(y[7], x[7], &carry);
   return carry;
}

References carry(), and word_sub().

Referenced by bigint_sub2_rev().

word8_sub3()

template<WordType W>

auto Botan::word8_sub3 ( W z[8], const W x[8], const W y[8], W carry ) -> W

inlineconstexpr

Definition at line 355 of file mp_asmi.h.

                                                                                   {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
                   : [carry] "=r"(carry)
                   : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
                   : "cc", "memory");
      return carry;
   }
#endif
 
   z[0] = word_sub(x[0], y[0], &carry);
   z[1] = word_sub(x[1], y[1], &carry);
   z[2] = word_sub(x[2], y[2], &carry);
   z[3] = word_sub(x[3], y[3], &carry);
   z[4] = word_sub(x[4], y[4], &carry);
   z[5] = word_sub(x[5], y[5], &carry);
   z[6] = word_sub(x[6], y[6], &carry);
   z[7] = word_sub(x[7], y[7], &carry);
   return carry;
}

References carry(), and word_sub().

Referenced by bigint_cnd_add_or_sub(), bigint_cnd_addsub(), bigint_monty_maybe_sub(), bigint_sub3(), and bigint_sub_abs().

word_add()

template<WordType W>

auto Botan::word_add ( W x, W y, W * carry ) -> W

inlineconstexpr

Definition at line 189 of file mp_asmi.h.

                                                        {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
   if(!std::is_constant_evaluated()) {
      if constexpr(std::same_as<W, unsigned int>) {
         return __builtin_addc(x, y, *carry & 1, carry);
      } else if constexpr(std::same_as<W, unsigned long>) {
         return __builtin_addcl(x, y, *carry & 1, carry);
      } else if constexpr(std::same_as<W, unsigned long long>) {
         return __builtin_addcll(x, y, *carry & 1, carry);
      }
   }
#endif
 
   if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
      /*
      TODO(Botan4) this is largely a performance hack for GCCs that don't
      support __builtin_addc, if we increase the minimum supported version of
      GCC to GCC 14 then we can remove this and not worry about it
      */
      const W cb = *carry & 1;
      const auto s = typename WordInfo<W>::dword(x) + y + cb;
      *carry = static_cast<W>(s >> WordInfo<W>::bits);
      return static_cast<W>(s);
   } else {
      const W cb = *carry & 1;
      W z = x + y;
      W c1 = (z < x);
      z += cb;
      *carry = c1 | (z < cb);
      return z;
   }
}

References carry().

Referenced by Botan::word3< W >::add(), bigint_add2_nc(), bigint_add3_nc(), bigint_cnd_abs(), bigint_cnd_add(), bigint_cnd_add_or_sub(), bigint_cnd_addsub(), Botan::word3< W >::mul_x2(), word8_add2(), and word8_add3().

word_madd2()

template<WordType W>

auto Botan::word_madd2 ( W a, W b, W * c ) -> W

inlineconstexpr

Definition at line 84 of file mp_asmi.h.

                                                      {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(R"(
         mulq %[b]
         addq %[c],%[a]
         adcq $0,%[carry]
         )"
          : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
          : "0"(a), "1"(b), [c] "g"(*c)
          : "cc");
 
      return a;
   }
#endif
 
   typedef typename WordInfo<W>::dword dword;
   const dword s = dword(a) * b + *c;
   *c = static_cast<W>(s >> WordInfo<W>::bits);
   return static_cast<W>(s);
}

References carry().

Referenced by bigint_linmul2(), bigint_linmul3(), bigint_modop_vartime(), Botan::word3< W >::mul_x2(), redc_crandall(), word8_linmul2(), and word8_linmul3().

word_madd3()

template<WordType W>

auto Botan::word_madd3 ( W a, W b, W c, W * d ) -> W

inlineconstexpr

Definition at line 110 of file mp_asmi.h.

                                                           {
#if defined(BOTAN_MP_USE_X86_64_ASM)
   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
      asm(R"(
         mulq %[b]
 
         addq %[c],%[a]
         adcq $0,%[carry]
 
         addq %[d],%[a]
         adcq $0,%[carry]
         )"
          : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
          : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
          : "cc");
 
      return a;
   }
#endif
 
   typedef typename WordInfo<W>::dword dword;
   const dword s = dword(a) * b + c + *d;
   *d = static_cast<W>(s >> WordInfo<W>::bits);
   return static_cast<W>(s);
}

References carry().

Referenced by basecase_mul(), basecase_sqr(), redc_crandall(), and word8_madd3().

word_sub()

template<WordType W>

auto Botan::word_sub ( W x, W y, W * carry ) -> W

inlineconstexpr

Definition at line 278 of file mp_asmi.h.

                                                        {
#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
   if(!std::is_constant_evaluated()) {
      if constexpr(std::same_as<W, unsigned int>) {
         return __builtin_subc(x, y, *carry & 1, carry);
      } else if constexpr(std::same_as<W, unsigned long>) {
         return __builtin_subcl(x, y, *carry & 1, carry);
      } else if constexpr(std::same_as<W, unsigned long long>) {
         return __builtin_subcll(x, y, *carry & 1, carry);
      }
   }
#endif
 
   const W cb = *carry & 1;
   W t0 = x - y;
   W c1 = (t0 > x);
   W z = t0 - cb;
   *carry = c1 | (z > t0);
   return z;
}

References carry().

Referenced by bigint_cnd_add_or_sub(), bigint_cnd_addsub(), bigint_cnd_sub(), bigint_monty_maybe_sub(), bigint_monty_maybe_sub(), bigint_sub2(), bigint_sub2_rev(), bigint_sub3(), bigint_sub_abs(), redc_crandall(), word8_sub2(), word8_sub2_rev(), and word8_sub3().

words_for_bits()

size_t Botan::words_for_bits ( size_t x )

constexpr

Definition at line 18 of file curve448_scalar.h.

                                          {
   constexpr size_t word_bits = sizeof(word) * 8;
   return (x + word_bits - 1) / word_bits;
}

wots_public_key_from_signature()

BOTAN_TEST_API WotsPublicKey Botan::wots_public_key_from_signature	(	const SphincsTreeNode &	hashed_message,
		StrongSpan< const WotsSignature >	signature,
		Sphincs_Address &	address,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 8: wots_pkFromSig.

Reconstructs the WOTS public key from a given WOTS signature and message. This is tailored for the use case in the SLH-DSA implementation and is not meant for general usability in non SLH-DSA algorithms.

Definition at line 103 of file sp_wots.cpp.

                                                                             {
   const std::vector<WotsHashIndex> lengths = chain_lengths(hashed_message, params);
   WotsPublicKey pk_buffer(params.wots_len() * params.n());
   BufferSlicer sig(signature);
   BufferStuffer pk(pk_buffer);
 
   for(WotsChainIndex i(0); i < params.wots_len(); i++) {
      address.set_chain_address(i);
 
      // params.w() can be one of {4, 8, 256}
      const WotsHashIndex start_index = lengths[i.get()];
      const uint8_t steps_to_take = static_cast<uint8_t>(params.w() - 1) - start_index.get();
 
      chain(pk.next<WotsPublicKeyNode>(params.n()),
            sig.take<WotsNode>(params.n()),
            start_index,
            steps_to_take,
            address,
            hashes,
            params);
   }
 
   return pk_buffer;
}

References chain_lengths(), Botan::detail::Strong_Base< T >::get(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Address::set_chain_address(), Botan::BufferSlicer::take(), Botan::Sphincs_Parameters::w(), and Botan::Sphincs_Parameters::wots_len().

Referenced by ht_verify().

wots_sign_and_pkgen()

BOTAN_TEST_API void Botan::wots_sign_and_pkgen	(	StrongSpan< WotsSignature >	sig_out,
		StrongSpan< SphincsTreeNode >	leaf_out,
		const SphincsSecretSeed &	secret_seed,
		TreeNodeIndex	leaf_idx,
		std::optional< TreeNodeIndex >	sign_leaf_idx,
		const std::vector< WotsHashIndex > &	wots_steps,
		Sphincs_Address &	leaf_addr,
		Sphincs_Address &	pk_addr,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 6 and 7: wots_pkGen and wots_sign.

Implements a domain specific wrapper for the one-time signature scheme WOTS+ (Winternitz OTS). It is meant to be used inside SLH-DSA and does not aim to be applicable for other use cases. If this function is not used in a signing operation (i.e. sign_leaf_idx is not set), wots_steps may be empty.

Definition at line 132 of file sp_wots.cpp.

                                                         {
   // `wots_steps` are needed only if `sign_leaf_idx` is set
   BOTAN_ASSERT_NOMSG(!sign_leaf_idx.has_value() || wots_steps.size() == params.wots_len());
   BOTAN_ASSERT_NOMSG(pk_addr.get_type() == Sphincs_Address_Type::WotsPublicKeyCompression);
 
   secure_vector<uint8_t> wots_sig;
   WotsPublicKey wots_pk_buffer(params.wots_bytes());
 
   BufferStuffer wots_pk(wots_pk_buffer);
   BufferStuffer sig(sig_out);
 
   leaf_addr.set_keypair_address(leaf_idx);
   pk_addr.set_keypair_address(leaf_idx);
 
   for(WotsChainIndex i(0); i < params.wots_len(); i++) {
      // If the current leaf is part of the signature wots_k stores the chain index
      //   of the value neccessary for the signature. Otherwise: nullopt (no signature)
      const auto wots_k = [&]() -> std::optional<WotsHashIndex> {
         if(sign_leaf_idx.has_value() && leaf_idx == sign_leaf_idx.value()) {
            return wots_steps[i.get()];
         } else {
            return std::nullopt;
         }
      }();
 
      // Start with the secret seed
      leaf_addr.set_chain_address(i);
      leaf_addr.set_hash_address(WotsHashIndex(0));
      leaf_addr.set_type(Sphincs_Address_Type::WotsKeyGeneration);
 
      auto buffer_s = wots_pk.next<WotsNode>(params.n());
 
      hashes.PRF(buffer_s, secret_seed, leaf_addr);
 
      leaf_addr.set_type(Sphincs_Address_Type::WotsHash);
 
      // Iterates down the WOTS chain
      for(WotsHashIndex k(0);; k++) {
         // Check if this is the value that needs to be saved as a part of the WOTS signature
         if(wots_k.has_value() && k == wots_k.value()) {
            std::copy(buffer_s.begin(), buffer_s.end(), sig.next<WotsNode>(params.n()).begin());
         }
 
         // Check if the top of the chain was hit
         if(k == params.w() - 1) {
            break;
         }
 
         // Iterate one step on the chain
         leaf_addr.set_hash_address(k);
 
         hashes.T(buffer_s, leaf_addr, buffer_s);
      }
   }
 
   // Do the final thash to generate the public keys
   hashes.T(leaf_out, pk_addr, wots_pk_buffer);
}

References BOTAN_ASSERT_NOMSG, Botan::Sphincs_Address::get_type(), Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::Sphincs_Hash_Functions::PRF(), Botan::Sphincs_Address::set_chain_address(), Botan::Sphincs_Address::set_hash_address(), Botan::Sphincs_Address::set_keypair_address(), Botan::Sphincs_Address::set_type(), Botan::Sphincs_Hash_Functions::T(), Botan::Sphincs_Parameters::w(), Botan::Sphincs_Parameters::wots_bytes(), Botan::Sphincs_Parameters::wots_len(), WotsHash, WotsKeyGeneration, and WotsPublicKeyCompression.

Referenced by xmss_sign_and_pkgen().

wrap_strong_type()

template<typename T, typename ParamT>
requires std::constructible_from<T, ParamT> || (concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>)

decltype(auto) Botan::wrap_strong_type ( ParamT && t )

nodiscardconstexpr

Wraps a value into a caller-defined (strong) type.

If the provided object t is already of type T, it is returned as is.

Note

This is meant as a helper for generic code that needs to deal with both wrapped strong types and bare objects. Use the ordinary constructor if you know that you are dealing with a bare value type.

Parameters

t	value to be wrapped

Returns

the wrapped value

Definition at line 248 of file strong_type.h.

                                                                    {
   if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
      // Noop, if the parameter type already is the desired return type.
      return std::forward<ParamT>(t);
   } else if constexpr(std::constructible_from<T, ParamT>) {
      // Implicit conversion from the parameter type to the return type.
      return T{std::forward<ParamT>(t)};
   } else {
      // Explicitly calling the wrapped type's constructor to support
      // implicit conversions on types that mark their constructors as explicit.
      static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
      return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
   }
}

Referenced by checked_cast_to_or_throw(), Botan::detail::load_any(), Botan::bitvector_base< secure_allocator >::subvector(), and Botan::detail::wrap_strong_type_or_enum().

x448()

Point448 Botan::x448	(	const ScalarX448 &	k,
		const Point448 &	u )

Multiply a scalar k with a point u.

Parameters

k	scalar
u	point on curve

Returns

k * u

Definition at line 48 of file x448_internal.cpp.

                                                      {
   const Gf448Elem a24 = 39081;
 
   Gf448Elem x_1 = Gf448Elem(u.get());
   Gf448Elem x_2 = 1;
   Gf448Elem z_2 = 0;
   Gf448Elem x_3 = Gf448Elem(u.get());
   Gf448Elem z_3 = 1;
   auto swap = CT::Mask<uint64_t>::cleared();
 
   for(int16_t t = 448 - 1; t >= 0; --t) {
      auto k_t = CT::Mask<uint64_t>::expand(get_bit(k, t));
      swap ^= k_t;
 
      x_2.ct_cond_swap(swap.as_bool(), x_3);
      z_2.ct_cond_swap(swap.as_bool(), z_3);
      swap = k_t;
 
      const auto A = x_2 + z_2;
      const auto AA = square(A);
      const auto B = x_2 - z_2;
      const auto BB = square(B);
      const auto E = AA - BB;
      const auto C = x_3 + z_3;
      const auto D = x_3 - z_3;
      const auto DA = D * A;
      const auto CB = C * B;
      x_3 = square(DA + CB);
      z_3 = x_1 * square(DA - CB);
      x_2 = AA * BB;
      z_2 = E * (AA + a24 * E);
   }
 
   x_2.ct_cond_swap(swap.as_bool(), x_3);
   z_2.ct_cond_swap(swap.as_bool(), z_3);
 
   const auto res = x_2 / z_2;
 
   return Point448(res.to_bytes());
}

References Botan::CT::Mask< T >::cleared(), Botan::Gf448Elem::ct_cond_swap(), Botan::CT::Mask< T >::expand(), Botan::detail::Strong_Base< T >::get(), and square().

Referenced by x448_basepoint().

x448_basepoint()

Point448 Botan::x448_basepoint

(

const ScalarX448 &

k

)

Multiply a scalar with the base group element (5)

Multiply a scalar with the standard group element (5)

Parameters

k

scalar

Returns

encoded point

Definition at line 41 of file x448_internal.cpp.

                                             {
   const Point448 u({5});
   return x448(k, u);
}

References x448().

x509_path_validate() [1/4]

Path_Validation_Result Botan::x509_path_validate	(	const std::vector< X509_Certificate > &	end_certs,
		const Path_Validation_Restrictions &	restrictions,
		const Certificate_Store &	store,
		std::string_view	hostname = "",
		Usage_Type	usage = Usage_Type::UNSPECIFIED,
		std::chrono::system_clock::time_point	validation_time = std::chrono::system_clock::now(),
		std::chrono::milliseconds	ocsp_timeout = std::chrono::milliseconds(0),
		const std::vector< std::optional< OCSP::Response > > &	ocsp_resp = {} )

PKIX Path Validation

Parameters

end_certs	certificate chain to validate
restrictions	path validation restrictions
store	store that contains trusted certificates
hostname	if not empty, compared against the DNS name in end_certs[0]
usage	if not set to UNSPECIFIED, compared against the key usage in end_certs[0]
validation_time	what reference time to use for validation
ocsp_timeout	timeout for OCSP operations, 0 disables OCSP check
ocsp_resp	additional OCSP responses to consider (eg from peer)

Returns

result of the path validation

Definition at line 956 of file x509path.cpp.

                                                                                                 {
   std::vector<Certificate_Store*> trusted_roots;
   trusted_roots.push_back(const_cast<Certificate_Store*>(&store));
 
   return x509_path_validate(end_certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
}

References x509_path_validate().

x509_path_validate() [2/4]

Path_Validation_Result Botan::x509_path_validate	(	const std::vector< X509_Certificate > &	end_certs,
		const Path_Validation_Restrictions &	restrictions,
		const std::vector< Certificate_Store * > &	trusted_roots,
		std::string_view	hostname = "",
		Usage_Type	usage = Usage_Type::UNSPECIFIED,
		std::chrono::system_clock::time_point	validation_time = std::chrono::system_clock::now(),
		std::chrono::milliseconds	ocsp_timeout = std::chrono::milliseconds(0),
		const std::vector< std::optional< OCSP::Response > > &	ocsp_resp = {} )

PKIX Path Validation

Parameters

end_certs	certificate chain to validate (with end entity certificate in end_certs[0])
restrictions	path validation restrictions
trusted_roots	list of certificate stores that contain trusted certificates
hostname	if not empty, compared against the DNS name in end_certs[0]
usage	if not set to UNSPECIFIED, compared against the key usage in end_certs[0]
validation_time	what reference time to use for validation
ocsp_timeout	timeout for OCSP operations, 0 disables OCSP check
ocsp_resp	additional OCSP responses to consider (eg from peer)

Returns

result of the path validation note: when enabled, OCSP check is softfail by default: if the OCSP server is not reachable, Path_Validation_Result::successful_validation() will return true. Hardfail OCSP check can be achieve by also calling Path_Validation_Result::no_warnings().

Definition at line 882 of file x509path.cpp.

                                                                                                 {
   if(end_certs.empty()) {
      throw Invalid_Argument("x509_path_validate called with no subjects");
   }
 
   X509_Certificate end_entity = end_certs[0];
   std::vector<X509_Certificate> end_entity_extra;
   for(size_t i = 1; i < end_certs.size(); ++i) {
      end_entity_extra.push_back(end_certs[i]);
   }
 
   std::vector<std::vector<X509_Certificate>> cert_paths;
   Certificate_Status_Code path_building_result =
      PKIX::build_all_certificate_paths(cert_paths, trusted_roots, end_entity, end_entity_extra);
 
   // If we cannot successfully build a chain to a trusted self-signed root, stop now
   if(path_building_result != Certificate_Status_Code::OK) {
      return Path_Validation_Result(path_building_result);
   }
 
   std::vector<Path_Validation_Result> error_results;
   // Try validating all the potentially valid paths and return the first one to validate properly
   for(auto cert_path : cert_paths) {
      CertificatePathStatusCodes status = PKIX::check_chain(cert_path, ref_time, hostname, usage, restrictions);
 
      CertificatePathStatusCodes crl_status = PKIX::check_crl(cert_path, trusted_roots, ref_time);
 
      CertificatePathStatusCodes ocsp_status;
 
      if(!ocsp_resp.empty()) {
         ocsp_status = PKIX::check_ocsp(cert_path, ocsp_resp, trusted_roots, ref_time, restrictions);
      }
 
      if(ocsp_status.empty() && ocsp_timeout != std::chrono::milliseconds(0)) {
#if defined(BOTAN_TARGET_OS_HAS_THREADS) && defined(BOTAN_HAS_HTTP_UTIL)
         ocsp_status = PKIX::check_ocsp_online(cert_path, trusted_roots, ref_time, ocsp_timeout, restrictions);
#else
         ocsp_status.resize(1);
         ocsp_status[0].insert(Certificate_Status_Code::OCSP_NO_HTTP);
#endif
      }
 
      PKIX::merge_revocation_status(status, crl_status, ocsp_status, restrictions);
 
      Path_Validation_Result pvd(status, std::move(cert_path));
      if(pvd.successful_validation()) {
         return pvd;
      } else {
         error_results.push_back(std::move(pvd));
      }
   }
   return error_results[0];
}

References Botan::PKIX::build_all_certificate_paths(), Botan::PKIX::check_chain(), Botan::PKIX::check_crl(), Botan::PKIX::check_ocsp(), Botan::PKIX::merge_revocation_status(), OCSP_NO_HTTP, OK, and Botan::Path_Validation_Result::successful_validation().

Referenced by botan_x509_cert_verify(), botan_x509_cert_verify_with_crl(), Botan::TLS::Callbacks::tls_verify_cert_chain(), x509_path_validate(), x509_path_validate(), and x509_path_validate().

x509_path_validate() [3/4]

Path_Validation_Result Botan::x509_path_validate	(	const X509_Certificate &	end_cert,
		const Path_Validation_Restrictions &	restrictions,
		const Certificate_Store &	store,
		std::string_view	hostname = "",
		Usage_Type	usage = Usage_Type::UNSPECIFIED,
		std::chrono::system_clock::time_point	validation_time = std::chrono::system_clock::now(),
		std::chrono::milliseconds	ocsp_timeout = std::chrono::milliseconds(0),
		const std::vector< std::optional< OCSP::Response > > &	ocsp_resp = {} )

PKIX Path Validation

Parameters

end_cert	certificate to validate
restrictions	path validation restrictions
store	store that contains trusted certificates
hostname	if not empty, compared against the DNS name in end_cert
usage	if not set to UNSPECIFIED, compared against the key usage in end_cert
validation_time	what reference time to use for validation
ocsp_timeout	timeout for OCSP operations, 0 disables OCSP check
ocsp_resp	additional OCSP responses to consider (eg from peer)

Returns

result of the path validation

Definition at line 970 of file x509path.cpp.

                                                                                                 {
   std::vector<X509_Certificate> certs;
   certs.push_back(end_cert);
 
   std::vector<Certificate_Store*> trusted_roots;
   trusted_roots.push_back(const_cast<Certificate_Store*>(&store));
 
   return x509_path_validate(certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
}

References x509_path_validate().

x509_path_validate() [4/4]

Path_Validation_Result Botan::x509_path_validate	(	const X509_Certificate &	end_cert,
		const Path_Validation_Restrictions &	restrictions,
		const std::vector< Certificate_Store * > &	trusted_roots,
		std::string_view	hostname = "",
		Usage_Type	usage = Usage_Type::UNSPECIFIED,
		std::chrono::system_clock::time_point	validation_time = std::chrono::system_clock::now(),
		std::chrono::milliseconds	ocsp_timeout = std::chrono::milliseconds(0),
		const std::vector< std::optional< OCSP::Response > > &	ocsp_resp = {} )

PKIX Path Validation

Parameters

end_cert	certificate to validate
restrictions	path validation restrictions
trusted_roots	list of stores that contain trusted certificates
hostname	if not empty, compared against the DNS name in end_cert
usage	if not set to UNSPECIFIED, compared against the key usage in end_cert
validation_time	what reference time to use for validation
ocsp_timeout	timeout for OCSP operations, 0 disables OCSP check
ocsp_resp	additional OCSP responses to consider (eg from peer)

Returns

result of the path validation

Definition at line 943 of file x509path.cpp.

                                                                                                 {
   std::vector<X509_Certificate> certs;
   certs.push_back(end_cert);
   return x509_path_validate(certs, restrictions, trusted_roots, hostname, usage, when, ocsp_timeout, ocsp_resp);
}

References x509_path_validate().

xmss_gen_root()

SphincsTreeNode Botan::xmss_gen_root	(	const Sphincs_Parameters &	params,
		const SphincsSecretSeed &	secret_seed,
		Sphincs_Hash_Functions &	hashes )

Compute the XMSS public key (root node) of the top-most subtree. Contains logic of FIPS 205, Algorithm 18: slh_keygen_internal

Definition at line 58 of file sp_xmss.cpp.

                                                              {
   // We do not need the a sig/auth path in key generation, but it simplifies the
   // code to have just one treehash routine that computes both root and path
   // in one function.
   SphincsXmssSignature dummy_sig(params.xmss_tree_height() * params.n() + params.wots_bytes());
   SphincsTreeNode dummy_root(params.n());
 
   Sphincs_Address top_tree_addr(Sphincs_Address_Type::HashTree);
   Sphincs_Address wots_addr(Sphincs_Address_Type::WotsPublicKeyCompression);
 
   top_tree_addr.set_layer_address(HypertreeLayerIndex(params.d() - 1));
   wots_addr.set_layer_address(HypertreeLayerIndex(params.d() - 1));
 
   SphincsTreeNode root =
      xmss_sign_and_pkgen(dummy_sig, dummy_root, secret_seed, wots_addr, top_tree_addr, std::nullopt, params, hashes);
 
   return root;
}

References Botan::Sphincs_Parameters::d(), HashTree, Botan::Sphincs_Parameters::n(), root(), Botan::Sphincs_Address::set_layer_address(), Botan::Sphincs_Parameters::wots_bytes(), WotsPublicKeyCompression, xmss_sign_and_pkgen(), and Botan::Sphincs_Parameters::xmss_tree_height().

Referenced by Botan::SphincsPlus_PrivateKey::SphincsPlus_PrivateKey().

xmss_sign_and_pkgen()

SphincsTreeNode Botan::xmss_sign_and_pkgen	(	StrongSpan< SphincsXmssSignature >	out_sig,
		const SphincsTreeNode &	message,
		const SphincsSecretSeed &	secret_seed,
		Sphincs_Address &	wots_addr,
		Sphincs_Address &	tree_addr,
		std::optional< TreeNodeIndex >	idx_leaf,
		const Sphincs_Parameters &	params,
		Sphincs_Hash_Functions &	hashes )

FIPS 205, Algorithm 10: xmss_sign.

This generates a Merkle signature of message (i.e. a FORS public key (bottom layer) or an XMSS root node). The Merkle authentication path logic is mostly hidden in treehash_spec. The WOTS signature followed by the Merkle authentication path are stored in out_sig. Set idx_leaf to std::nullopt if no signature is desired.

Returns

the XMSS public key (i.e. the root of the XMSS merkle tree)

Definition at line 19 of file sp_xmss.cpp.

                                                                    {
   BufferStuffer sig(out_sig);
   auto wots_bytes_s = sig.next<WotsSignature>(params.wots_bytes());
   auto auth_path_s = sig.next<SphincsAuthenticationPath>(sig.remaining_capacity());
 
   const auto steps = [&]() -> std::vector<WotsHashIndex> {
      // if `idx_leaf` is not set, we don't want to calculate a signature and
      // therefore won't need to bother preparing the chain lengths either.
      if(idx_leaf.has_value()) {
         return chain_lengths(message, params);
      } else {
         return {};
      };
   }();
 
   Sphincs_Address leaf_addr = Sphincs_Address::as_subtree_from(wots_addr);
   Sphincs_Address pk_addr = Sphincs_Address::as_subtree_from(wots_addr);
 
   pk_addr.set_type(Sphincs_Address_Type::WotsPublicKeyCompression);
 
   GenerateLeafFunction xmss_gen_leaf = [&](StrongSpan<SphincsTreeNode> out_root, TreeNodeIndex address_index) {
      wots_sign_and_pkgen(
         wots_bytes_s, out_root, secret_seed, address_index, idx_leaf, steps, leaf_addr, pk_addr, params, hashes);
   };
 
   SphincsTreeNode next_root(params.n());
   BOTAN_ASSERT_NOMSG(tree_addr.get_type() == Sphincs_Address_Type::HashTree);
   treehash(next_root, auth_path_s, params, hashes, idx_leaf, 0, params.xmss_tree_height(), xmss_gen_leaf, tree_addr);
 
   return next_root;
}

References Botan::Sphincs_Address::as_subtree_from(), BOTAN_ASSERT_NOMSG, chain_lengths(), Botan::Sphincs_Address::get_type(), HashTree, Botan::Sphincs_Parameters::n(), Botan::BufferStuffer::next(), Botan::BufferStuffer::remaining_capacity(), Botan::Sphincs_Address::set_type(), treehash(), Botan::Sphincs_Parameters::wots_bytes(), wots_sign_and_pkgen(), WotsPublicKeyCompression, and Botan::Sphincs_Parameters::xmss_tree_height().

Referenced by ht_sign(), and xmss_gen_root().

xor_buf() [1/7]

void Botan::xor_buf ( ranges::contiguous_output_range< uint8_t > auto && out, ranges::contiguous_range< uint8_t > auto && in )

inlineconstexpr

XOR arrays. Postcondition out[i] = in[i] ^ out[i] forall i = 0...length

Parameters

out	the input/output range
in	the read-only input range

Definition at line 344 of file mem_ops.h.

                                                                         {
   ranges::assert_equal_byte_lengths(out, in);
 
   std::span<uint8_t> o(out);
   std::span<const uint8_t> i(in);
 
   for(; o.size_bytes() >= 32; o = o.subspan(32), i = i.subspan(32)) {
      auto x = typecast_copy<std::array<uint64_t, 4>>(o.template first<32>());
      const auto y = typecast_copy<std::array<uint64_t, 4>>(i.template first<32>());
 
      x[0] ^= y[0];
      x[1] ^= y[1];
      x[2] ^= y[2];
      x[3] ^= y[3];
 
      typecast_copy(o.template first<32>(), x);
   }
 
   for(size_t off = 0; off != o.size_bytes(); ++off) {
      o[off] ^= i[off];
   }
}

References Botan::ranges::assert_equal_byte_lengths(), and typecast_copy().

Referenced by Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::TLS::Connection_Cipher_State::aead_nonce(), Botan::Salsa20::cipher_bytes(), Botan::Lion::decrypt_n(), Botan::Lion::encrypt_n(), Botan::GHASH::final(), mgf1_mask(), operator^(), Botan::OctetString::operator^=(), operator^=(), pbkdf2(), Botan::SIV_Mode::S2V(), xor_buf(), xor_buf(), xor_buf(), xor_buf(), and xor_buf().

xor_buf() [2/7]

void Botan::xor_buf ( ranges::contiguous_output_range< uint8_t > auto && out, ranges::contiguous_range< uint8_t > auto && in1, ranges::contiguous_range< uint8_t > auto && in2 )

inlineconstexpr

XOR arrays. Postcondition out[i] = in1[i] ^ in2[i] forall i = 0...length

Parameters

out	the output range
in1	the first input range
in2	the second input range

Definition at line 374 of file mem_ops.h.

                                                                          {
   ranges::assert_equal_byte_lengths(out, in1, in2);
 
   std::span o{out};
   std::span i1{in1};
   std::span i2{in2};
 
   for(; o.size_bytes() >= 32; o = o.subspan(32), i1 = i1.subspan(32), i2 = i2.subspan(32)) {
      auto x = typecast_copy<std::array<uint64_t, 4>>(i1.template first<32>());
      const auto y = typecast_copy<std::array<uint64_t, 4>>(i2.template first<32>());
 
      x[0] ^= y[0];
      x[1] ^= y[1];
      x[2] ^= y[2];
      x[3] ^= y[3];
 
      typecast_copy(o.template first<32>(), x);
   }
 
   for(size_t off = 0; off != o.size_bytes(); ++off) {
      o[off] = i1[off] ^ i2[off];
   }
}

References Botan::ranges::assert_equal_byte_lengths(), and typecast_copy().

xor_buf() [3/7]

void Botan::xor_buf ( std::span< uint8_t > out, std::span< const uint8_t > in, size_t n )

inline

Definition at line 424 of file mem_ops.h.

                                                                               {
   BOTAN_ARG_CHECK(out.size() >= n, "output span is too small");
   BOTAN_ARG_CHECK(in.size() >= n, "input span is too small");
   xor_buf(out.first(n), in.first(n));
}

References BOTAN_ARG_CHECK, and xor_buf().

xor_buf() [4/7]

template<typename Alloc, typename Alloc2>

void Botan::xor_buf	(	std::vector< uint8_t, Alloc > &	out,
		const uint8_t *	in,
		const std::vector< uint8_t, Alloc2 > &	in2,
		size_t	n )

Definition at line 440 of file mem_ops.h.

                                                                                                                 {
   BOTAN_ARG_CHECK(out.size() >= n, "output vector is too small");
   BOTAN_ARG_CHECK(in2.size() >= n, "input vector is too small");
   // simply assumes that *in points to "n" allocated bytes at least
   xor_buf(std::span{out}.first(n), std::span{in, n}, std::span{in2}.first(n));
}

References BOTAN_ARG_CHECK, and xor_buf().

xor_buf() [5/7]

template<typename Alloc>

void Botan::xor_buf	(	std::vector< uint8_t, Alloc > &	out,
		const uint8_t *	in,
		size_t	n )

Definition at line 432 of file mem_ops.h.

                                                                          {
   BOTAN_ARG_CHECK(out.size() >= n, "output vector is too small");
   // simply assumes that *in points to "n" allocated bytes at least
   xor_buf(std::span{out}.first(n), std::span{in, n});
}

References BOTAN_ARG_CHECK, and xor_buf().

xor_buf() [6/7]

void Botan::xor_buf ( uint8_t out[], const uint8_t in[], const uint8_t in2[], size_t length )

inline

XOR arrays. Postcondition out[i] = in[i] ^ in2[i] forall i = 0...length

Parameters

out	the output buffer
in	the first input buffer
in2	the second input buffer
length	the length of the three buffers

Definition at line 418 of file mem_ops.h.

                                                                                           {
   // simply assumes that *out, *in, and *in2 point to "length" allocated bytes at least
   xor_buf(std::span{out, length}, std::span{in, length}, std::span{in2, length});
}

References xor_buf().

xor_buf() [7/7]

void Botan::xor_buf ( uint8_t out[], const uint8_t in[], size_t length )

inline

XOR arrays. Postcondition out[i] = in[i] ^ out[i] forall i = 0...length

Parameters

out	the input/output buffer
in	the read-only input buffer
length	the length of the buffers

Definition at line 406 of file mem_ops.h.

                                                                      {
   // simply assumes that *out and *in point to "length" allocated bytes at least
   xor_buf(std::span{out, length}, std::span{in, length});
}

References xor_buf().

xts_update_tweak_block()

void Botan::xts_update_tweak_block	(	uint8_t	tweak[],
		size_t	BS,
		size_t	blocks_in_tweak )

Definition at line 119 of file poly_dbl.cpp.

                                                                                {
   if(BS == 16) {
      constexpr size_t LIMBS = 2;
 
      uint64_t W[LIMBS];
      load_le(W, &tweak[0], LIMBS);
 
      for(size_t i = 1; i < blocks_in_tweak; ++i) {
         const uint64_t carry = return_carry<MinWeightPolynomial::P128>(W[1]);
         W[1] = (W[1] << 1) ^ (W[0] >> 63);
         W[0] = (W[0] << 1) ^ carry;
         copy_out_le(std::span(&tweak[i * BS], 2 * 8), W);
      }
   } else {
      for(size_t i = 1; i < blocks_in_tweak; ++i) {
         const uint8_t* prev = &tweak[(i - 1) * BS];
         uint8_t* cur = &tweak[i * BS];
         poly_double_n_le(cur, prev, BS);
      }
   }
}

References carry(), copy_out_le(), load_le(), and poly_double_n_le().

Referenced by Botan::XTS_Mode::update_tweak().

zap()

template<typename T, typename Alloc>

void Botan::zap

(

std::vector< T, Alloc > &

vec

)

Zeroise the values then free the memory

Parameters

vec	the vector to zeroise and free

Definition at line 124 of file secmem.h.

                                   {
   zeroise(vec);
   vec.clear();
   vec.shrink_to_fit();
}

References zeroise().

Referenced by Botan::TLS::Cipher_State::advance_with_client_finished(), Botan::TLS::Cipher_State::advance_with_client_hello(), Botan::AES_128::clear(), Botan::AES_192::clear(), Botan::AES_256::clear(), Botan::ANSI_X919_MAC::clear(), Botan::ARIA_128::clear(), Botan::ARIA_192::clear(), Botan::ARIA_256::clear(), Botan::Blowfish::clear(), Botan::Camellia_128::clear(), Botan::Camellia_192::clear(), Botan::Camellia_256::clear(), Botan::CAST_128::clear(), Botan::ChaCha::clear(), Botan::CTR_BE::clear(), Botan::DES::clear(), Botan::GHASH::clear(), Botan::GOST_28147_89::clear(), Botan::HMAC::clear(), Botan::IDEA::clear(), Botan::KMAC::clear(), Botan::Lion::clear(), Botan::Noekeon::clear(), Botan::Poly1305::clear(), Botan::RC4::clear(), Botan::Salsa20::clear(), Botan::SEED::clear(), Botan::Serpent::clear(), Botan::SHACAL2::clear(), Botan::SipHash::clear(), Botan::SM4::clear(), Botan::Threefish_512::clear(), Botan::TripleDES::clear(), Botan::Twofish::clear(), Botan::TLS::Record_Layer::clear_read_buffer(), Botan::TLS::Cipher_State::clear_read_keys(), and Botan::TLS::Cipher_State::clear_write_keys().

zeroise()

template<typename T, typename Alloc>

void Botan::zeroise

(

std::vector< T, Alloc > &

vec

)

Zeroise the values; length remains unchanged

Parameters

vec	the vector to zeroise

Definition at line 115 of file secmem.h.

                                       {
   std::fill(vec.begin(), vec.end(), static_cast<T>(0));
}

Referenced by Botan::BLAKE2b::clear(), Botan::CMAC::clear(), Botan::CTR_BE::clear(), Botan::GMAC::clear(), Botan::GOST_34_11::clear(), Botan::Keccak_Permutation::clear(), Botan::OFB::clear(), Botan::SHAKE_Cipher::clear(), Botan::Streebog::clear(), Botan::Whirlpool::init(), Botan::OctetString::operator^=(), Botan::CBC_Decryption::reset(), Botan::CFB_Mode::reset(), Botan::OCB_Mode::reset(), Botan::CTR_BE::seek(), and zap().

Variable Documentation

BLAKE2B_BLOCKBYTES

size_t Botan::BLAKE2B_BLOCKBYTES = 128

constexpr

Definition at line 21 of file blake2b.h.

Referenced by Botan::BLAKE2b::add_data().

BYTES_448

size_t Botan::BYTES_448 = ceil_tobytes(448)

constexpr

Definition at line 20 of file curve448_gf.h.

DefaultBufferSize

size_t Botan::DefaultBufferSize = 4096

constexpr

How much to allocate for a buffer of no particular size

Definition at line 137 of file types.h.

Referenced by operator<<(), operator<<(), operator>>(), operator>>(), Botan::Pipe::read_all_as_string(), and Botan::Pipe::write().

ED448_LEN

size_t Botan::ED448_LEN = 57

constexpr

Definition at line 17 of file ed448_internal.h.

Referenced by Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PrivateKey::Ed448_PrivateKey(), Botan::Ed448_PublicKey::Ed448_PublicKey(), Botan::Ed448_PrivateKey::private_key_bits(), sign_message(), and verify_signature().

HEX_CODEC_BUFFER_SIZE

const size_t Botan::HEX_CODEC_BUFFER_SIZE = 256

Size used for internal buffer in hex encoder/decoder

Definition at line 20 of file hex_filt.cpp.

Referenced by Botan::Hex_Decoder::Hex_Decoder(), Botan::Hex_Encoder::Hex_Encoder(), and Botan::Hex_Encoder::Hex_Encoder().

is_strong_span_v

template<typename T>

bool Botan::is_strong_span_v = is_strong_span<T>::value

constexpr

Definition at line 713 of file strong_type.h.

is_strong_type_v

template<typename... Ts>

bool Botan::is_strong_type_v = is_strong_type<std::remove_const_t<Ts>...>::value

constexpr

Definition at line 33 of file concepts.h.

LMS_IDENTIFIER_LEN

size_t Botan::LMS_IDENTIFIER_LEN = 16

constexpr

The length in bytes of the LMS identifier (I).

Definition at line 67 of file lms.h.

Referenced by Botan::HSS_LMS_PrivateKeyInternal::from_bytes_or_throw(), Botan::LMS_PublicKey::from_bytes_or_throw(), Botan::HSS_LMS_PrivateKeyInternal::HSS_LMS_PrivateKeyInternal(), Botan::LMS_PublicKey::LMS_PublicKey(), and Botan::LMS_PublicKey::size().

MAX_EXT_DEG

const size_t Botan::MAX_EXT_DEG = 16

Definition at line 18 of file gf2m_small_m.cpp.

PRIME_TABLE_SIZE

const size_t Botan::PRIME_TABLE_SIZE = 6541

The size of the PRIMES[] array

Definition at line 174 of file numthry.h.

Referenced by is_prime(), and random_prime().

PRIMES

const uint16_t Botan::PRIMES

A const array of all odd primes less than 65535

Definition at line 12 of file primes.cpp.

                                              {
   3,     5,     7,     11,    13,    17,    19,    23,    29,    31,    37,    41,    43,    47,    53,    59,
   61,    67,    71,    73,    79,    83,    89,    97,    101,   103,   107,   109,   113,   127,   131,   137,
   139,   149,   151,   157,   163,   167,   173,   179,   181,   191,   193,   197,   199,   211,   223,   227,
   229,   233,   239,   241,   251,   257,   263,   269,   271,   277,   281,   283,   293,   307,   311,   313,
   317,   331,   337,   347,   349,   353,   359,   367,   373,   379,   383,   389,   397,   401,   409,   419,
   421,   431,   433,   439,   443,   449,   457,   461,   463,   467,   479,   487,   491,   499,   503,   509,
   521,   523,   541,   547,   557,   563,   569,   571,   577,   587,   593,   599,   601,   607,   613,   617,
   619,   631,   641,   643,   647,   653,   659,   661,   673,   677,   683,   691,   701,   709,   719,   727,
   733,   739,   743,   751,   757,   761,   769,   773,   787,   797,   809,   811,   821,   823,   827,   829,
   839,   853,   857,   859,   863,   877,   881,   883,   887,   907,   911,   919,   929,   937,   941,   947,
   953,   967,   971,   977,   983,   991,   997,   1009,  1013,  1019,  1021,  1031,  1033,  1039,  1049,  1051,
   1061,  1063,  1069,  1087,  1091,  1093,  1097,  1103,  1109,  1117,  1123,  1129,  1151,  1153,  1163,  1171,
   1181,  1187,  1193,  1201,  1213,  1217,  1223,  1229,  1231,  1237,  1249,  1259,  1277,  1279,  1283,  1289,
   1291,  1297,  1301,  1303,  1307,  1319,  1321,  1327,  1361,  1367,  1373,  1381,  1399,  1409,  1423,  1427,
   1429,  1433,  1439,  1447,  1451,  1453,  1459,  1471,  1481,  1483,  1487,  1489,  1493,  1499,  1511,  1523,
   1531,  1543,  1549,  1553,  1559,  1567,  1571,  1579,  1583,  1597,  1601,  1607,  1609,  1613,  1619,  1621,
   1627,  1637,  1657,  1663,  1667,  1669,  1693,  1697,  1699,  1709,  1721,  1723,  1733,  1741,  1747,  1753,
   1759,  1777,  1783,  1787,  1789,  1801,  1811,  1823,  1831,  1847,  1861,  1867,  1871,  1873,  1877,  1879,
   1889,  1901,  1907,  1913,  1931,  1933,  1949,  1951,  1973,  1979,  1987,  1993,  1997,  1999,  2003,  2011,
   2017,  2027,  2029,  2039,  2053,  2063,  2069,  2081,  2083,  2087,  2089,  2099,  2111,  2113,  2129,  2131,
   2137,  2141,  2143,  2153,  2161,  2179,  2203,  2207,  2213,  2221,  2237,  2239,  2243,  2251,  2267,  2269,
   2273,  2281,  2287,  2293,  2297,  2309,  2311,  2333,  2339,  2341,  2347,  2351,  2357,  2371,  2377,  2381,
   2383,  2389,  2393,  2399,  2411,  2417,  2423,  2437,  2441,  2447,  2459,  2467,  2473,  2477,  2503,  2521,
   2531,  2539,  2543,  2549,  2551,  2557,  2579,  2591,  2593,  2609,  2617,  2621,  2633,  2647,  2657,  2659,
   2663,  2671,  2677,  2683,  2687,  2689,  2693,  2699,  2707,  2711,  2713,  2719,  2729,  2731,  2741,  2749,
   2753,  2767,  2777,  2789,  2791,  2797,  2801,  2803,  2819,  2833,  2837,  2843,  2851,  2857,  2861,  2879,
   2887,  2897,  2903,  2909,  2917,  2927,  2939,  2953,  2957,  2963,  2969,  2971,  2999,  3001,  3011,  3019,
   3023,  3037,  3041,  3049,  3061,  3067,  3079,  3083,  3089,  3109,  3119,  3121,  3137,  3163,  3167,  3169,
   3181,  3187,  3191,  3203,  3209,  3217,  3221,  3229,  3251,  3253,  3257,  3259,  3271,  3299,  3301,  3307,
   3313,  3319,  3323,  3329,  3331,  3343,  3347,  3359,  3361,  3371,  3373,  3389,  3391,  3407,  3413,  3433,
   3449,  3457,  3461,  3463,  3467,  3469,  3491,  3499,  3511,  3517,  3527,  3529,  3533,  3539,  3541,  3547,
   3557,  3559,  3571,  3581,  3583,  3593,  3607,  3613,  3617,  3623,  3631,  3637,  3643,  3659,  3671,  3673,
   3677,  3691,  3697,  3701,  3709,  3719,  3727,  3733,  3739,  3761,  3767,  3769,  3779,  3793,  3797,  3803,
   3821,  3823,  3833,  3847,  3851,  3853,  3863,  3877,  3881,  3889,  3907,  3911,  3917,  3919,  3923,  3929,
   3931,  3943,  3947,  3967,  3989,  4001,  4003,  4007,  4013,  4019,  4021,  4027,  4049,  4051,  4057,  4073,
   4079,  4091,  4093,  4099,  4111,  4127,  4129,  4133,  4139,  4153,  4157,  4159,  4177,  4201,  4211,  4217,
   4219,  4229,  4231,  4241,  4243,  4253,  4259,  4261,  4271,  4273,  4283,  4289,  4297,  4327,  4337,  4339,
   4349,  4357,  4363,  4373,  4391,  4397,  4409,  4421,  4423,  4441,  4447,  4451,  4457,  4463,  4481,  4483,
   4493,  4507,  4513,  4517,  4519,  4523,  4547,  4549,  4561,  4567,  4583,  4591,  4597,  4603,  4621,  4637,
   4639,  4643,  4649,  4651,  4657,  4663,  4673,  4679,  4691,  4703,  4721,  4723,  4729,  4733,  4751,  4759,
   4783,  4787,  4789,  4793,  4799,  4801,  4813,  4817,  4831,  4861,  4871,  4877,  4889,  4903,  4909,  4919,
   4931,  4933,  4937,  4943,  4951,  4957,  4967,  4969,  4973,  4987,  4993,  4999,  5003,  5009,  5011,  5021,
   5023,  5039,  5051,  5059,  5077,  5081,  5087,  5099,  5101,  5107,  5113,  5119,  5147,  5153,  5167,  5171,
   5179,  5189,  5197,  5209,  5227,  5231,  5233,  5237,  5261,  5273,  5279,  5281,  5297,  5303,  5309,  5323,
   5333,  5347,  5351,  5381,  5387,  5393,  5399,  5407,  5413,  5417,  5419,  5431,  5437,  5441,  5443,  5449,
   5471,  5477,  5479,  5483,  5501,  5503,  5507,  5519,  5521,  5527,  5531,  5557,  5563,  5569,  5573,  5581,
   5591,  5623,  5639,  5641,  5647,  5651,  5653,  5657,  5659,  5669,  5683,  5689,  5693,  5701,  5711,  5717,
   5737,  5741,  5743,  5749,  5779,  5783,  5791,  5801,  5807,  5813,  5821,  5827,  5839,  5843,  5849,  5851,
   5857,  5861,  5867,  5869,  5879,  5881,  5897,  5903,  5923,  5927,  5939,  5953,  5981,  5987,  6007,  6011,
   6029,  6037,  6043,  6047,  6053,  6067,  6073,  6079,  6089,  6091,  6101,  6113,  6121,  6131,  6133,  6143,
   6151,  6163,  6173,  6197,  6199,  6203,  6211,  6217,  6221,  6229,  6247,  6257,  6263,  6269,  6271,  6277,
   6287,  6299,  6301,  6311,  6317,  6323,  6329,  6337,  6343,  6353,  6359,  6361,  6367,  6373,  6379,  6389,
   6397,  6421,  6427,  6449,  6451,  6469,  6473,  6481,  6491,  6521,  6529,  6547,  6551,  6553,  6563,  6569,
   6571,  6577,  6581,  6599,  6607,  6619,  6637,  6653,  6659,  6661,  6673,  6679,  6689,  6691,  6701,  6703,
   6709,  6719,  6733,  6737,  6761,  6763,  6779,  6781,  6791,  6793,  6803,  6823,  6827,  6829,  6833,  6841,
   6857,  6863,  6869,  6871,  6883,  6899,  6907,  6911,  6917,  6947,  6949,  6959,  6961,  6967,  6971,  6977,
   6983,  6991,  6997,  7001,  7013,  7019,  7027,  7039,  7043,  7057,  7069,  7079,  7103,  7109,  7121,  7127,
   7129,  7151,  7159,  7177,  7187,  7193,  7207,  7211,  7213,  7219,  7229,  7237,  7243,  7247,  7253,  7283,
   7297,  7307,  7309,  7321,  7331,  7333,  7349,  7351,  7369,  7393,  7411,  7417,  7433,  7451,  7457,  7459,
   7477,  7481,  7487,  7489,  7499,  7507,  7517,  7523,  7529,  7537,  7541,  7547,  7549,  7559,  7561,  7573,
   7577,  7583,  7589,  7591,  7603,  7607,  7621,  7639,  7643,  7649,  7669,  7673,  7681,  7687,  7691,  7699,
   7703,  7717,  7723,  7727,  7741,  7753,  7757,  7759,  7789,  7793,  7817,  7823,  7829,  7841,  7853,  7867,
   7873,  7877,  7879,  7883,  7901,  7907,  7919,  7927,  7933,  7937,  7949,  7951,  7963,  7993,  8009,  8011,
   8017,  8039,  8053,  8059,  8069,  8081,  8087,  8089,  8093,  8101,  8111,  8117,  8123,  8147,  8161,  8167,
   8171,  8179,  8191,  8209,  8219,  8221,  8231,  8233,  8237,  8243,  8263,  8269,  8273,  8287,  8291,  8293,
   8297,  8311,  8317,  8329,  8353,  8363,  8369,  8377,  8387,  8389,  8419,  8423,  8429,  8431,  8443,  8447,
   8461,  8467,  8501,  8513,  8521,  8527,  8537,  8539,  8543,  8563,  8573,  8581,  8597,  8599,  8609,  8623,
   8627,  8629,  8641,  8647,  8663,  8669,  8677,  8681,  8689,  8693,  8699,  8707,  8713,  8719,  8731,  8737,
   8741,  8747,  8753,  8761,  8779,  8783,  8803,  8807,  8819,  8821,  8831,  8837,  8839,  8849,  8861,  8863,
   8867,  8887,  8893,  8923,  8929,  8933,  8941,  8951,  8963,  8969,  8971,  8999,  9001,  9007,  9011,  9013,
   9029,  9041,  9043,  9049,  9059,  9067,  9091,  9103,  9109,  9127,  9133,  9137,  9151,  9157,  9161,  9173,
   9181,  9187,  9199,  9203,  9209,  9221,  9227,  9239,  9241,  9257,  9277,  9281,  9283,  9293,  9311,  9319,
   9323,  9337,  9341,  9343,  9349,  9371,  9377,  9391,  9397,  9403,  9413,  9419,  9421,  9431,  9433,  9437,
   9439,  9461,  9463,  9467,  9473,  9479,  9491,  9497,  9511,  9521,  9533,  9539,  9547,  9551,  9587,  9601,
   9613,  9619,  9623,  9629,  9631,  9643,  9649,  9661,  9677,  9679,  9689,  9697,  9719,  9721,  9733,  9739,
   9743,  9749,  9767,  9769,  9781,  9787,  9791,  9803,  9811,  9817,  9829,  9833,  9839,  9851,  9857,  9859,
   9871,  9883,  9887,  9901,  9907,  9923,  9929,  9931,  9941,  9949,  9967,  9973,  10007, 10009, 10037, 10039,
   10061, 10067, 10069, 10079, 10091, 10093, 10099, 10103, 10111, 10133, 10139, 10141, 10151, 10159, 10163, 10169,
   10177, 10181, 10193, 10211, 10223, 10243, 10247, 10253, 10259, 10267, 10271, 10273, 10289, 10301, 10303, 10313,
   10321, 10331, 10333, 10337, 10343, 10357, 10369, 10391, 10399, 10427, 10429, 10433, 10453, 10457, 10459, 10463,
   10477, 10487, 10499, 10501, 10513, 10529, 10531, 10559, 10567, 10589, 10597, 10601, 10607, 10613, 10627, 10631,
   10639, 10651, 10657, 10663, 10667, 10687, 10691, 10709, 10711, 10723, 10729, 10733, 10739, 10753, 10771, 10781,
   10789, 10799, 10831, 10837, 10847, 10853, 10859, 10861, 10867, 10883, 10889, 10891, 10903, 10909, 10937, 10939,
   10949, 10957, 10973, 10979, 10987, 10993, 11003, 11027, 11047, 11057, 11059, 11069, 11071, 11083, 11087, 11093,
   11113, 11117, 11119, 11131, 11149, 11159, 11161, 11171, 11173, 11177, 11197, 11213, 11239, 11243, 11251, 11257,
   11261, 11273, 11279, 11287, 11299, 11311, 11317, 11321, 11329, 11351, 11353, 11369, 11383, 11393, 11399, 11411,
   11423, 11437, 11443, 11447, 11467, 11471, 11483, 11489, 11491, 11497, 11503, 11519, 11527, 11549, 11551, 11579,
   11587, 11593, 11597, 11617, 11621, 11633, 11657, 11677, 11681, 11689, 11699, 11701, 11717, 11719, 11731, 11743,
   11777, 11779, 11783, 11789, 11801, 11807, 11813, 11821, 11827, 11831, 11833, 11839, 11863, 11867, 11887, 11897,
   11903, 11909, 11923, 11927, 11933, 11939, 11941, 11953, 11959, 11969, 11971, 11981, 11987, 12007, 12011, 12037,
   12041, 12043, 12049, 12071, 12073, 12097, 12101, 12107, 12109, 12113, 12119, 12143, 12149, 12157, 12161, 12163,
   12197, 12203, 12211, 12227, 12239, 12241, 12251, 12253, 12263, 12269, 12277, 12281, 12289, 12301, 12323, 12329,
   12343, 12347, 12373, 12377, 12379, 12391, 12401, 12409, 12413, 12421, 12433, 12437, 12451, 12457, 12473, 12479,
   12487, 12491, 12497, 12503, 12511, 12517, 12527, 12539, 12541, 12547, 12553, 12569, 12577, 12583, 12589, 12601,
   12611, 12613, 12619, 12637, 12641, 12647, 12653, 12659, 12671, 12689, 12697, 12703, 12713, 12721, 12739, 12743,
   12757, 12763, 12781, 12791, 12799, 12809, 12821, 12823, 12829, 12841, 12853, 12889, 12893, 12899, 12907, 12911,
   12917, 12919, 12923, 12941, 12953, 12959, 12967, 12973, 12979, 12983, 13001, 13003, 13007, 13009, 13033, 13037,
   13043, 13049, 13063, 13093, 13099, 13103, 13109, 13121, 13127, 13147, 13151, 13159, 13163, 13171, 13177, 13183,
   13187, 13217, 13219, 13229, 13241, 13249, 13259, 13267, 13291, 13297, 13309, 13313, 13327, 13331, 13337, 13339,
   13367, 13381, 13397, 13399, 13411, 13417, 13421, 13441, 13451, 13457, 13463, 13469, 13477, 13487, 13499, 13513,
   13523, 13537, 13553, 13567, 13577, 13591, 13597, 13613, 13619, 13627, 13633, 13649, 13669, 13679, 13681, 13687,
   13691, 13693, 13697, 13709, 13711, 13721, 13723, 13729, 13751, 13757, 13759, 13763, 13781, 13789, 13799, 13807,
   13829, 13831, 13841, 13859, 13873, 13877, 13879, 13883, 13901, 13903, 13907, 13913, 13921, 13931, 13933, 13963,
   13967, 13997, 13999, 14009, 14011, 14029, 14033, 14051, 14057, 14071, 14081, 14083, 14087, 14107, 14143, 14149,
   14153, 14159, 14173, 14177, 14197, 14207, 14221, 14243, 14249, 14251, 14281, 14293, 14303, 14321, 14323, 14327,
   14341, 14347, 14369, 14387, 14389, 14401, 14407, 14411, 14419, 14423, 14431, 14437, 14447, 14449, 14461, 14479,
   14489, 14503, 14519, 14533, 14537, 14543, 14549, 14551, 14557, 14561, 14563, 14591, 14593, 14621, 14627, 14629,
   14633, 14639, 14653, 14657, 14669, 14683, 14699, 14713, 14717, 14723, 14731, 14737, 14741, 14747, 14753, 14759,
   14767, 14771, 14779, 14783, 14797, 14813, 14821, 14827, 14831, 14843, 14851, 14867, 14869, 14879, 14887, 14891,
   14897, 14923, 14929, 14939, 14947, 14951, 14957, 14969, 14983, 15013, 15017, 15031, 15053, 15061, 15073, 15077,
   15083, 15091, 15101, 15107, 15121, 15131, 15137, 15139, 15149, 15161, 15173, 15187, 15193, 15199, 15217, 15227,
   15233, 15241, 15259, 15263, 15269, 15271, 15277, 15287, 15289, 15299, 15307, 15313, 15319, 15329, 15331, 15349,
   15359, 15361, 15373, 15377, 15383, 15391, 15401, 15413, 15427, 15439, 15443, 15451, 15461, 15467, 15473, 15493,
   15497, 15511, 15527, 15541, 15551, 15559, 15569, 15581, 15583, 15601, 15607, 15619, 15629, 15641, 15643, 15647,
   15649, 15661, 15667, 15671, 15679, 15683, 15727, 15731, 15733, 15737, 15739, 15749, 15761, 15767, 15773, 15787,
   15791, 15797, 15803, 15809, 15817, 15823, 15859, 15877, 15881, 15887, 15889, 15901, 15907, 15913, 15919, 15923,
   15937, 15959, 15971, 15973, 15991, 16001, 16007, 16033, 16057, 16061, 16063, 16067, 16069, 16073, 16087, 16091,
   16097, 16103, 16111, 16127, 16139, 16141, 16183, 16187, 16189, 16193, 16217, 16223, 16229, 16231, 16249, 16253,
   16267, 16273, 16301, 16319, 16333, 16339, 16349, 16361, 16363, 16369, 16381, 16411, 16417, 16421, 16427, 16433,
   16447, 16451, 16453, 16477, 16481, 16487, 16493, 16519, 16529, 16547, 16553, 16561, 16567, 16573, 16603, 16607,
   16619, 16631, 16633, 16649, 16651, 16657, 16661, 16673, 16691, 16693, 16699, 16703, 16729, 16741, 16747, 16759,
   16763, 16787, 16811, 16823, 16829, 16831, 16843, 16871, 16879, 16883, 16889, 16901, 16903, 16921, 16927, 16931,
   16937, 16943, 16963, 16979, 16981, 16987, 16993, 17011, 17021, 17027, 17029, 17033, 17041, 17047, 17053, 17077,
   17093, 17099, 17107, 17117, 17123, 17137, 17159, 17167, 17183, 17189, 17191, 17203, 17207, 17209, 17231, 17239,
   17257, 17291, 17293, 17299, 17317, 17321, 17327, 17333, 17341, 17351, 17359, 17377, 17383, 17387, 17389, 17393,
   17401, 17417, 17419, 17431, 17443, 17449, 17467, 17471, 17477, 17483, 17489, 17491, 17497, 17509, 17519, 17539,
   17551, 17569, 17573, 17579, 17581, 17597, 17599, 17609, 17623, 17627, 17657, 17659, 17669, 17681, 17683, 17707,
   17713, 17729, 17737, 17747, 17749, 17761, 17783, 17789, 17791, 17807, 17827, 17837, 17839, 17851, 17863, 17881,
   17891, 17903, 17909, 17911, 17921, 17923, 17929, 17939, 17957, 17959, 17971, 17977, 17981, 17987, 17989, 18013,
   18041, 18043, 18047, 18049, 18059, 18061, 18077, 18089, 18097, 18119, 18121, 18127, 18131, 18133, 18143, 18149,
   18169, 18181, 18191, 18199, 18211, 18217, 18223, 18229, 18233, 18251, 18253, 18257, 18269, 18287, 18289, 18301,
   18307, 18311, 18313, 18329, 18341, 18353, 18367, 18371, 18379, 18397, 18401, 18413, 18427, 18433, 18439, 18443,
   18451, 18457, 18461, 18481, 18493, 18503, 18517, 18521, 18523, 18539, 18541, 18553, 18583, 18587, 18593, 18617,
   18637, 18661, 18671, 18679, 18691, 18701, 18713, 18719, 18731, 18743, 18749, 18757, 18773, 18787, 18793, 18797,
   18803, 18839, 18859, 18869, 18899, 18911, 18913, 18917, 18919, 18947, 18959, 18973, 18979, 19001, 19009, 19013,
   19031, 19037, 19051, 19069, 19073, 19079, 19081, 19087, 19121, 19139, 19141, 19157, 19163, 19181, 19183, 19207,
   19211, 19213, 19219, 19231, 19237, 19249, 19259, 19267, 19273, 19289, 19301, 19309, 19319, 19333, 19373, 19379,
   19381, 19387, 19391, 19403, 19417, 19421, 19423, 19427, 19429, 19433, 19441, 19447, 19457, 19463, 19469, 19471,
   19477, 19483, 19489, 19501, 19507, 19531, 19541, 19543, 19553, 19559, 19571, 19577, 19583, 19597, 19603, 19609,
   19661, 19681, 19687, 19697, 19699, 19709, 19717, 19727, 19739, 19751, 19753, 19759, 19763, 19777, 19793, 19801,
   19813, 19819, 19841, 19843, 19853, 19861, 19867, 19889, 19891, 19913, 19919, 19927, 19937, 19949, 19961, 19963,
   19973, 19979, 19991, 19993, 19997, 20011, 20021, 20023, 20029, 20047, 20051, 20063, 20071, 20089, 20101, 20107,
   20113, 20117, 20123, 20129, 20143, 20147, 20149, 20161, 20173, 20177, 20183, 20201, 20219, 20231, 20233, 20249,
   20261, 20269, 20287, 20297, 20323, 20327, 20333, 20341, 20347, 20353, 20357, 20359, 20369, 20389, 20393, 20399,
   20407, 20411, 20431, 20441, 20443, 20477, 20479, 20483, 20507, 20509, 20521, 20533, 20543, 20549, 20551, 20563,
   20593, 20599, 20611, 20627, 20639, 20641, 20663, 20681, 20693, 20707, 20717, 20719, 20731, 20743, 20747, 20749,
   20753, 20759, 20771, 20773, 20789, 20807, 20809, 20849, 20857, 20873, 20879, 20887, 20897, 20899, 20903, 20921,
   20929, 20939, 20947, 20959, 20963, 20981, 20983, 21001, 21011, 21013, 21017, 21019, 21023, 21031, 21059, 21061,
   21067, 21089, 21101, 21107, 21121, 21139, 21143, 21149, 21157, 21163, 21169, 21179, 21187, 21191, 21193, 21211,
   21221, 21227, 21247, 21269, 21277, 21283, 21313, 21317, 21319, 21323, 21341, 21347, 21377, 21379, 21383, 21391,
   21397, 21401, 21407, 21419, 21433, 21467, 21481, 21487, 21491, 21493, 21499, 21503, 21517, 21521, 21523, 21529,
   21557, 21559, 21563, 21569, 21577, 21587, 21589, 21599, 21601, 21611, 21613, 21617, 21647, 21649, 21661, 21673,
   21683, 21701, 21713, 21727, 21737, 21739, 21751, 21757, 21767, 21773, 21787, 21799, 21803, 21817, 21821, 21839,
   21841, 21851, 21859, 21863, 21871, 21881, 21893, 21911, 21929, 21937, 21943, 21961, 21977, 21991, 21997, 22003,
   22013, 22027, 22031, 22037, 22039, 22051, 22063, 22067, 22073, 22079, 22091, 22093, 22109, 22111, 22123, 22129,
   22133, 22147, 22153, 22157, 22159, 22171, 22189, 22193, 22229, 22247, 22259, 22271, 22273, 22277, 22279, 22283,
   22291, 22303, 22307, 22343, 22349, 22367, 22369, 22381, 22391, 22397, 22409, 22433, 22441, 22447, 22453, 22469,
   22481, 22483, 22501, 22511, 22531, 22541, 22543, 22549, 22567, 22571, 22573, 22613, 22619, 22621, 22637, 22639,
   22643, 22651, 22669, 22679, 22691, 22697, 22699, 22709, 22717, 22721, 22727, 22739, 22741, 22751, 22769, 22777,
   22783, 22787, 22807, 22811, 22817, 22853, 22859, 22861, 22871, 22877, 22901, 22907, 22921, 22937, 22943, 22961,
   22963, 22973, 22993, 23003, 23011, 23017, 23021, 23027, 23029, 23039, 23041, 23053, 23057, 23059, 23063, 23071,
   23081, 23087, 23099, 23117, 23131, 23143, 23159, 23167, 23173, 23189, 23197, 23201, 23203, 23209, 23227, 23251,
   23269, 23279, 23291, 23293, 23297, 23311, 23321, 23327, 23333, 23339, 23357, 23369, 23371, 23399, 23417, 23431,
   23447, 23459, 23473, 23497, 23509, 23531, 23537, 23539, 23549, 23557, 23561, 23563, 23567, 23581, 23593, 23599,
   23603, 23609, 23623, 23627, 23629, 23633, 23663, 23669, 23671, 23677, 23687, 23689, 23719, 23741, 23743, 23747,
   23753, 23761, 23767, 23773, 23789, 23801, 23813, 23819, 23827, 23831, 23833, 23857, 23869, 23873, 23879, 23887,
   23893, 23899, 23909, 23911, 23917, 23929, 23957, 23971, 23977, 23981, 23993, 24001, 24007, 24019, 24023, 24029,
   24043, 24049, 24061, 24071, 24077, 24083, 24091, 24097, 24103, 24107, 24109, 24113, 24121, 24133, 24137, 24151,
   24169, 24179, 24181, 24197, 24203, 24223, 24229, 24239, 24247, 24251, 24281, 24317, 24329, 24337, 24359, 24371,
   24373, 24379, 24391, 24407, 24413, 24419, 24421, 24439, 24443, 24469, 24473, 24481, 24499, 24509, 24517, 24527,
   24533, 24547, 24551, 24571, 24593, 24611, 24623, 24631, 24659, 24671, 24677, 24683, 24691, 24697, 24709, 24733,
   24749, 24763, 24767, 24781, 24793, 24799, 24809, 24821, 24841, 24847, 24851, 24859, 24877, 24889, 24907, 24917,
   24919, 24923, 24943, 24953, 24967, 24971, 24977, 24979, 24989, 25013, 25031, 25033, 25037, 25057, 25073, 25087,
   25097, 25111, 25117, 25121, 25127, 25147, 25153, 25163, 25169, 25171, 25183, 25189, 25219, 25229, 25237, 25243,
   25247, 25253, 25261, 25301, 25303, 25307, 25309, 25321, 25339, 25343, 25349, 25357, 25367, 25373, 25391, 25409,
   25411, 25423, 25439, 25447, 25453, 25457, 25463, 25469, 25471, 25523, 25537, 25541, 25561, 25577, 25579, 25583,
   25589, 25601, 25603, 25609, 25621, 25633, 25639, 25643, 25657, 25667, 25673, 25679, 25693, 25703, 25717, 25733,
   25741, 25747, 25759, 25763, 25771, 25793, 25799, 25801, 25819, 25841, 25847, 25849, 25867, 25873, 25889, 25903,
   25913, 25919, 25931, 25933, 25939, 25943, 25951, 25969, 25981, 25997, 25999, 26003, 26017, 26021, 26029, 26041,
   26053, 26083, 26099, 26107, 26111, 26113, 26119, 26141, 26153, 26161, 26171, 26177, 26183, 26189, 26203, 26209,
   26227, 26237, 26249, 26251, 26261, 26263, 26267, 26293, 26297, 26309, 26317, 26321, 26339, 26347, 26357, 26371,
   26387, 26393, 26399, 26407, 26417, 26423, 26431, 26437, 26449, 26459, 26479, 26489, 26497, 26501, 26513, 26539,
   26557, 26561, 26573, 26591, 26597, 26627, 26633, 26641, 26647, 26669, 26681, 26683, 26687, 26693, 26699, 26701,
   26711, 26713, 26717, 26723, 26729, 26731, 26737, 26759, 26777, 26783, 26801, 26813, 26821, 26833, 26839, 26849,
   26861, 26863, 26879, 26881, 26891, 26893, 26903, 26921, 26927, 26947, 26951, 26953, 26959, 26981, 26987, 26993,
   27011, 27017, 27031, 27043, 27059, 27061, 27067, 27073, 27077, 27091, 27103, 27107, 27109, 27127, 27143, 27179,
   27191, 27197, 27211, 27239, 27241, 27253, 27259, 27271, 27277, 27281, 27283, 27299, 27329, 27337, 27361, 27367,
   27397, 27407, 27409, 27427, 27431, 27437, 27449, 27457, 27479, 27481, 27487, 27509, 27527, 27529, 27539, 27541,
   27551, 27581, 27583, 27611, 27617, 27631, 27647, 27653, 27673, 27689, 27691, 27697, 27701, 27733, 27737, 27739,
   27743, 27749, 27751, 27763, 27767, 27773, 27779, 27791, 27793, 27799, 27803, 27809, 27817, 27823, 27827, 27847,
   27851, 27883, 27893, 27901, 27917, 27919, 27941, 27943, 27947, 27953, 27961, 27967, 27983, 27997, 28001, 28019,
   28027, 28031, 28051, 28057, 28069, 28081, 28087, 28097, 28099, 28109, 28111, 28123, 28151, 28163, 28181, 28183,
   28201, 28211, 28219, 28229, 28277, 28279, 28283, 28289, 28297, 28307, 28309, 28319, 28349, 28351, 28387, 28393,
   28403, 28409, 28411, 28429, 28433, 28439, 28447, 28463, 28477, 28493, 28499, 28513, 28517, 28537, 28541, 28547,
   28549, 28559, 28571, 28573, 28579, 28591, 28597, 28603, 28607, 28619, 28621, 28627, 28631, 28643, 28649, 28657,
   28661, 28663, 28669, 28687, 28697, 28703, 28711, 28723, 28729, 28751, 28753, 28759, 28771, 28789, 28793, 28807,
   28813, 28817, 28837, 28843, 28859, 28867, 28871, 28879, 28901, 28909, 28921, 28927, 28933, 28949, 28961, 28979,
   29009, 29017, 29021, 29023, 29027, 29033, 29059, 29063, 29077, 29101, 29123, 29129, 29131, 29137, 29147, 29153,
   29167, 29173, 29179, 29191, 29201, 29207, 29209, 29221, 29231, 29243, 29251, 29269, 29287, 29297, 29303, 29311,
   29327, 29333, 29339, 29347, 29363, 29383, 29387, 29389, 29399, 29401, 29411, 29423, 29429, 29437, 29443, 29453,
   29473, 29483, 29501, 29527, 29531, 29537, 29567, 29569, 29573, 29581, 29587, 29599, 29611, 29629, 29633, 29641,
   29663, 29669, 29671, 29683, 29717, 29723, 29741, 29753, 29759, 29761, 29789, 29803, 29819, 29833, 29837, 29851,
   29863, 29867, 29873, 29879, 29881, 29917, 29921, 29927, 29947, 29959, 29983, 29989, 30011, 30013, 30029, 30047,
   30059, 30071, 30089, 30091, 30097, 30103, 30109, 30113, 30119, 30133, 30137, 30139, 30161, 30169, 30181, 30187,
   30197, 30203, 30211, 30223, 30241, 30253, 30259, 30269, 30271, 30293, 30307, 30313, 30319, 30323, 30341, 30347,
   30367, 30389, 30391, 30403, 30427, 30431, 30449, 30467, 30469, 30491, 30493, 30497, 30509, 30517, 30529, 30539,
   30553, 30557, 30559, 30577, 30593, 30631, 30637, 30643, 30649, 30661, 30671, 30677, 30689, 30697, 30703, 30707,
   30713, 30727, 30757, 30763, 30773, 30781, 30803, 30809, 30817, 30829, 30839, 30841, 30851, 30853, 30859, 30869,
   30871, 30881, 30893, 30911, 30931, 30937, 30941, 30949, 30971, 30977, 30983, 31013, 31019, 31033, 31039, 31051,
   31063, 31069, 31079, 31081, 31091, 31121, 31123, 31139, 31147, 31151, 31153, 31159, 31177, 31181, 31183, 31189,
   31193, 31219, 31223, 31231, 31237, 31247, 31249, 31253, 31259, 31267, 31271, 31277, 31307, 31319, 31321, 31327,
   31333, 31337, 31357, 31379, 31387, 31391, 31393, 31397, 31469, 31477, 31481, 31489, 31511, 31513, 31517, 31531,
   31541, 31543, 31547, 31567, 31573, 31583, 31601, 31607, 31627, 31643, 31649, 31657, 31663, 31667, 31687, 31699,
   31721, 31723, 31727, 31729, 31741, 31751, 31769, 31771, 31793, 31799, 31817, 31847, 31849, 31859, 31873, 31883,
   31891, 31907, 31957, 31963, 31973, 31981, 31991, 32003, 32009, 32027, 32029, 32051, 32057, 32059, 32063, 32069,
   32077, 32083, 32089, 32099, 32117, 32119, 32141, 32143, 32159, 32173, 32183, 32189, 32191, 32203, 32213, 32233,
   32237, 32251, 32257, 32261, 32297, 32299, 32303, 32309, 32321, 32323, 32327, 32341, 32353, 32359, 32363, 32369,
   32371, 32377, 32381, 32401, 32411, 32413, 32423, 32429, 32441, 32443, 32467, 32479, 32491, 32497, 32503, 32507,
   32531, 32533, 32537, 32561, 32563, 32569, 32573, 32579, 32587, 32603, 32609, 32611, 32621, 32633, 32647, 32653,
   32687, 32693, 32707, 32713, 32717, 32719, 32749, 32771, 32779, 32783, 32789, 32797, 32801, 32803, 32831, 32833,
   32839, 32843, 32869, 32887, 32909, 32911, 32917, 32933, 32939, 32941, 32957, 32969, 32971, 32983, 32987, 32993,
   32999, 33013, 33023, 33029, 33037, 33049, 33053, 33071, 33073, 33083, 33091, 33107, 33113, 33119, 33149, 33151,
   33161, 33179, 33181, 33191, 33199, 33203, 33211, 33223, 33247, 33287, 33289, 33301, 33311, 33317, 33329, 33331,
   33343, 33347, 33349, 33353, 33359, 33377, 33391, 33403, 33409, 33413, 33427, 33457, 33461, 33469, 33479, 33487,
   33493, 33503, 33521, 33529, 33533, 33547, 33563, 33569, 33577, 33581, 33587, 33589, 33599, 33601, 33613, 33617,
   33619, 33623, 33629, 33637, 33641, 33647, 33679, 33703, 33713, 33721, 33739, 33749, 33751, 33757, 33767, 33769,
   33773, 33791, 33797, 33809, 33811, 33827, 33829, 33851, 33857, 33863, 33871, 33889, 33893, 33911, 33923, 33931,
   33937, 33941, 33961, 33967, 33997, 34019, 34031, 34033, 34039, 34057, 34061, 34123, 34127, 34129, 34141, 34147,
   34157, 34159, 34171, 34183, 34211, 34213, 34217, 34231, 34253, 34259, 34261, 34267, 34273, 34283, 34297, 34301,
   34303, 34313, 34319, 34327, 34337, 34351, 34361, 34367, 34369, 34381, 34403, 34421, 34429, 34439, 34457, 34469,
   34471, 34483, 34487, 34499, 34501, 34511, 34513, 34519, 34537, 34543, 34549, 34583, 34589, 34591, 34603, 34607,
   34613, 34631, 34649, 34651, 34667, 34673, 34679, 34687, 34693, 34703, 34721, 34729, 34739, 34747, 34757, 34759,
   34763, 34781, 34807, 34819, 34841, 34843, 34847, 34849, 34871, 34877, 34883, 34897, 34913, 34919, 34939, 34949,
   34961, 34963, 34981, 35023, 35027, 35051, 35053, 35059, 35069, 35081, 35083, 35089, 35099, 35107, 35111, 35117,
   35129, 35141, 35149, 35153, 35159, 35171, 35201, 35221, 35227, 35251, 35257, 35267, 35279, 35281, 35291, 35311,
   35317, 35323, 35327, 35339, 35353, 35363, 35381, 35393, 35401, 35407, 35419, 35423, 35437, 35447, 35449, 35461,
   35491, 35507, 35509, 35521, 35527, 35531, 35533, 35537, 35543, 35569, 35573, 35591, 35593, 35597, 35603, 35617,
   35671, 35677, 35729, 35731, 35747, 35753, 35759, 35771, 35797, 35801, 35803, 35809, 35831, 35837, 35839, 35851,
   35863, 35869, 35879, 35897, 35899, 35911, 35923, 35933, 35951, 35963, 35969, 35977, 35983, 35993, 35999, 36007,
   36011, 36013, 36017, 36037, 36061, 36067, 36073, 36083, 36097, 36107, 36109, 36131, 36137, 36151, 36161, 36187,
   36191, 36209, 36217, 36229, 36241, 36251, 36263, 36269, 36277, 36293, 36299, 36307, 36313, 36319, 36341, 36343,
   36353, 36373, 36383, 36389, 36433, 36451, 36457, 36467, 36469, 36473, 36479, 36493, 36497, 36523, 36527, 36529,
   36541, 36551, 36559, 36563, 36571, 36583, 36587, 36599, 36607, 36629, 36637, 36643, 36653, 36671, 36677, 36683,
   36691, 36697, 36709, 36713, 36721, 36739, 36749, 36761, 36767, 36779, 36781, 36787, 36791, 36793, 36809, 36821,
   36833, 36847, 36857, 36871, 36877, 36887, 36899, 36901, 36913, 36919, 36923, 36929, 36931, 36943, 36947, 36973,
   36979, 36997, 37003, 37013, 37019, 37021, 37039, 37049, 37057, 37061, 37087, 37097, 37117, 37123, 37139, 37159,
   37171, 37181, 37189, 37199, 37201, 37217, 37223, 37243, 37253, 37273, 37277, 37307, 37309, 37313, 37321, 37337,
   37339, 37357, 37361, 37363, 37369, 37379, 37397, 37409, 37423, 37441, 37447, 37463, 37483, 37489, 37493, 37501,
   37507, 37511, 37517, 37529, 37537, 37547, 37549, 37561, 37567, 37571, 37573, 37579, 37589, 37591, 37607, 37619,
   37633, 37643, 37649, 37657, 37663, 37691, 37693, 37699, 37717, 37747, 37781, 37783, 37799, 37811, 37813, 37831,
   37847, 37853, 37861, 37871, 37879, 37889, 37897, 37907, 37951, 37957, 37963, 37967, 37987, 37991, 37993, 37997,
   38011, 38039, 38047, 38053, 38069, 38083, 38113, 38119, 38149, 38153, 38167, 38177, 38183, 38189, 38197, 38201,
   38219, 38231, 38237, 38239, 38261, 38273, 38281, 38287, 38299, 38303, 38317, 38321, 38327, 38329, 38333, 38351,
   38371, 38377, 38393, 38431, 38447, 38449, 38453, 38459, 38461, 38501, 38543, 38557, 38561, 38567, 38569, 38593,
   38603, 38609, 38611, 38629, 38639, 38651, 38653, 38669, 38671, 38677, 38693, 38699, 38707, 38711, 38713, 38723,
   38729, 38737, 38747, 38749, 38767, 38783, 38791, 38803, 38821, 38833, 38839, 38851, 38861, 38867, 38873, 38891,
   38903, 38917, 38921, 38923, 38933, 38953, 38959, 38971, 38977, 38993, 39019, 39023, 39041, 39043, 39047, 39079,
   39089, 39097, 39103, 39107, 39113, 39119, 39133, 39139, 39157, 39161, 39163, 39181, 39191, 39199, 39209, 39217,
   39227, 39229, 39233, 39239, 39241, 39251, 39293, 39301, 39313, 39317, 39323, 39341, 39343, 39359, 39367, 39371,
   39373, 39383, 39397, 39409, 39419, 39439, 39443, 39451, 39461, 39499, 39503, 39509, 39511, 39521, 39541, 39551,
   39563, 39569, 39581, 39607, 39619, 39623, 39631, 39659, 39667, 39671, 39679, 39703, 39709, 39719, 39727, 39733,
   39749, 39761, 39769, 39779, 39791, 39799, 39821, 39827, 39829, 39839, 39841, 39847, 39857, 39863, 39869, 39877,
   39883, 39887, 39901, 39929, 39937, 39953, 39971, 39979, 39983, 39989, 40009, 40013, 40031, 40037, 40039, 40063,
   40087, 40093, 40099, 40111, 40123, 40127, 40129, 40151, 40153, 40163, 40169, 40177, 40189, 40193, 40213, 40231,
   40237, 40241, 40253, 40277, 40283, 40289, 40343, 40351, 40357, 40361, 40387, 40423, 40427, 40429, 40433, 40459,
   40471, 40483, 40487, 40493, 40499, 40507, 40519, 40529, 40531, 40543, 40559, 40577, 40583, 40591, 40597, 40609,
   40627, 40637, 40639, 40693, 40697, 40699, 40709, 40739, 40751, 40759, 40763, 40771, 40787, 40801, 40813, 40819,
   40823, 40829, 40841, 40847, 40849, 40853, 40867, 40879, 40883, 40897, 40903, 40927, 40933, 40939, 40949, 40961,
   40973, 40993, 41011, 41017, 41023, 41039, 41047, 41051, 41057, 41077, 41081, 41113, 41117, 41131, 41141, 41143,
   41149, 41161, 41177, 41179, 41183, 41189, 41201, 41203, 41213, 41221, 41227, 41231, 41233, 41243, 41257, 41263,
   41269, 41281, 41299, 41333, 41341, 41351, 41357, 41381, 41387, 41389, 41399, 41411, 41413, 41443, 41453, 41467,
   41479, 41491, 41507, 41513, 41519, 41521, 41539, 41543, 41549, 41579, 41593, 41597, 41603, 41609, 41611, 41617,
   41621, 41627, 41641, 41647, 41651, 41659, 41669, 41681, 41687, 41719, 41729, 41737, 41759, 41761, 41771, 41777,
   41801, 41809, 41813, 41843, 41849, 41851, 41863, 41879, 41887, 41893, 41897, 41903, 41911, 41927, 41941, 41947,
   41953, 41957, 41959, 41969, 41981, 41983, 41999, 42013, 42017, 42019, 42023, 42043, 42061, 42071, 42073, 42083,
   42089, 42101, 42131, 42139, 42157, 42169, 42179, 42181, 42187, 42193, 42197, 42209, 42221, 42223, 42227, 42239,
   42257, 42281, 42283, 42293, 42299, 42307, 42323, 42331, 42337, 42349, 42359, 42373, 42379, 42391, 42397, 42403,
   42407, 42409, 42433, 42437, 42443, 42451, 42457, 42461, 42463, 42467, 42473, 42487, 42491, 42499, 42509, 42533,
   42557, 42569, 42571, 42577, 42589, 42611, 42641, 42643, 42649, 42667, 42677, 42683, 42689, 42697, 42701, 42703,
   42709, 42719, 42727, 42737, 42743, 42751, 42767, 42773, 42787, 42793, 42797, 42821, 42829, 42839, 42841, 42853,
   42859, 42863, 42899, 42901, 42923, 42929, 42937, 42943, 42953, 42961, 42967, 42979, 42989, 43003, 43013, 43019,
   43037, 43049, 43051, 43063, 43067, 43093, 43103, 43117, 43133, 43151, 43159, 43177, 43189, 43201, 43207, 43223,
   43237, 43261, 43271, 43283, 43291, 43313, 43319, 43321, 43331, 43391, 43397, 43399, 43403, 43411, 43427, 43441,
   43451, 43457, 43481, 43487, 43499, 43517, 43541, 43543, 43573, 43577, 43579, 43591, 43597, 43607, 43609, 43613,
   43627, 43633, 43649, 43651, 43661, 43669, 43691, 43711, 43717, 43721, 43753, 43759, 43777, 43781, 43783, 43787,
   43789, 43793, 43801, 43853, 43867, 43889, 43891, 43913, 43933, 43943, 43951, 43961, 43963, 43969, 43973, 43987,
   43991, 43997, 44017, 44021, 44027, 44029, 44041, 44053, 44059, 44071, 44087, 44089, 44101, 44111, 44119, 44123,
   44129, 44131, 44159, 44171, 44179, 44189, 44201, 44203, 44207, 44221, 44249, 44257, 44263, 44267, 44269, 44273,
   44279, 44281, 44293, 44351, 44357, 44371, 44381, 44383, 44389, 44417, 44449, 44453, 44483, 44491, 44497, 44501,
   44507, 44519, 44531, 44533, 44537, 44543, 44549, 44563, 44579, 44587, 44617, 44621, 44623, 44633, 44641, 44647,
   44651, 44657, 44683, 44687, 44699, 44701, 44711, 44729, 44741, 44753, 44771, 44773, 44777, 44789, 44797, 44809,
   44819, 44839, 44843, 44851, 44867, 44879, 44887, 44893, 44909, 44917, 44927, 44939, 44953, 44959, 44963, 44971,
   44983, 44987, 45007, 45013, 45053, 45061, 45077, 45083, 45119, 45121, 45127, 45131, 45137, 45139, 45161, 45179,
   45181, 45191, 45197, 45233, 45247, 45259, 45263, 45281, 45289, 45293, 45307, 45317, 45319, 45329, 45337, 45341,
   45343, 45361, 45377, 45389, 45403, 45413, 45427, 45433, 45439, 45481, 45491, 45497, 45503, 45523, 45533, 45541,
   45553, 45557, 45569, 45587, 45589, 45599, 45613, 45631, 45641, 45659, 45667, 45673, 45677, 45691, 45697, 45707,
   45737, 45751, 45757, 45763, 45767, 45779, 45817, 45821, 45823, 45827, 45833, 45841, 45853, 45863, 45869, 45887,
   45893, 45943, 45949, 45953, 45959, 45971, 45979, 45989, 46021, 46027, 46049, 46051, 46061, 46073, 46091, 46093,
   46099, 46103, 46133, 46141, 46147, 46153, 46171, 46181, 46183, 46187, 46199, 46219, 46229, 46237, 46261, 46271,
   46273, 46279, 46301, 46307, 46309, 46327, 46337, 46349, 46351, 46381, 46399, 46411, 46439, 46441, 46447, 46451,
   46457, 46471, 46477, 46489, 46499, 46507, 46511, 46523, 46549, 46559, 46567, 46573, 46589, 46591, 46601, 46619,
   46633, 46639, 46643, 46649, 46663, 46679, 46681, 46687, 46691, 46703, 46723, 46727, 46747, 46751, 46757, 46769,
   46771, 46807, 46811, 46817, 46819, 46829, 46831, 46853, 46861, 46867, 46877, 46889, 46901, 46919, 46933, 46957,
   46993, 46997, 47017, 47041, 47051, 47057, 47059, 47087, 47093, 47111, 47119, 47123, 47129, 47137, 47143, 47147,
   47149, 47161, 47189, 47207, 47221, 47237, 47251, 47269, 47279, 47287, 47293, 47297, 47303, 47309, 47317, 47339,
   47351, 47353, 47363, 47381, 47387, 47389, 47407, 47417, 47419, 47431, 47441, 47459, 47491, 47497, 47501, 47507,
   47513, 47521, 47527, 47533, 47543, 47563, 47569, 47581, 47591, 47599, 47609, 47623, 47629, 47639, 47653, 47657,
   47659, 47681, 47699, 47701, 47711, 47713, 47717, 47737, 47741, 47743, 47777, 47779, 47791, 47797, 47807, 47809,
   47819, 47837, 47843, 47857, 47869, 47881, 47903, 47911, 47917, 47933, 47939, 47947, 47951, 47963, 47969, 47977,
   47981, 48017, 48023, 48029, 48049, 48073, 48079, 48091, 48109, 48119, 48121, 48131, 48157, 48163, 48179, 48187,
   48193, 48197, 48221, 48239, 48247, 48259, 48271, 48281, 48299, 48311, 48313, 48337, 48341, 48353, 48371, 48383,
   48397, 48407, 48409, 48413, 48437, 48449, 48463, 48473, 48479, 48481, 48487, 48491, 48497, 48523, 48527, 48533,
   48539, 48541, 48563, 48571, 48589, 48593, 48611, 48619, 48623, 48647, 48649, 48661, 48673, 48677, 48679, 48731,
   48733, 48751, 48757, 48761, 48767, 48779, 48781, 48787, 48799, 48809, 48817, 48821, 48823, 48847, 48857, 48859,
   48869, 48871, 48883, 48889, 48907, 48947, 48953, 48973, 48989, 48991, 49003, 49009, 49019, 49031, 49033, 49037,
   49043, 49057, 49069, 49081, 49103, 49109, 49117, 49121, 49123, 49139, 49157, 49169, 49171, 49177, 49193, 49199,
   49201, 49207, 49211, 49223, 49253, 49261, 49277, 49279, 49297, 49307, 49331, 49333, 49339, 49363, 49367, 49369,
   49391, 49393, 49409, 49411, 49417, 49429, 49433, 49451, 49459, 49463, 49477, 49481, 49499, 49523, 49529, 49531,
   49537, 49547, 49549, 49559, 49597, 49603, 49613, 49627, 49633, 49639, 49663, 49667, 49669, 49681, 49697, 49711,
   49727, 49739, 49741, 49747, 49757, 49783, 49787, 49789, 49801, 49807, 49811, 49823, 49831, 49843, 49853, 49871,
   49877, 49891, 49919, 49921, 49927, 49937, 49939, 49943, 49957, 49991, 49993, 49999, 50021, 50023, 50033, 50047,
   50051, 50053, 50069, 50077, 50087, 50093, 50101, 50111, 50119, 50123, 50129, 50131, 50147, 50153, 50159, 50177,
   50207, 50221, 50227, 50231, 50261, 50263, 50273, 50287, 50291, 50311, 50321, 50329, 50333, 50341, 50359, 50363,
   50377, 50383, 50387, 50411, 50417, 50423, 50441, 50459, 50461, 50497, 50503, 50513, 50527, 50539, 50543, 50549,
   50551, 50581, 50587, 50591, 50593, 50599, 50627, 50647, 50651, 50671, 50683, 50707, 50723, 50741, 50753, 50767,
   50773, 50777, 50789, 50821, 50833, 50839, 50849, 50857, 50867, 50873, 50891, 50893, 50909, 50923, 50929, 50951,
   50957, 50969, 50971, 50989, 50993, 51001, 51031, 51043, 51047, 51059, 51061, 51071, 51109, 51131, 51133, 51137,
   51151, 51157, 51169, 51193, 51197, 51199, 51203, 51217, 51229, 51239, 51241, 51257, 51263, 51283, 51287, 51307,
   51329, 51341, 51343, 51347, 51349, 51361, 51383, 51407, 51413, 51419, 51421, 51427, 51431, 51437, 51439, 51449,
   51461, 51473, 51479, 51481, 51487, 51503, 51511, 51517, 51521, 51539, 51551, 51563, 51577, 51581, 51593, 51599,
   51607, 51613, 51631, 51637, 51647, 51659, 51673, 51679, 51683, 51691, 51713, 51719, 51721, 51749, 51767, 51769,
   51787, 51797, 51803, 51817, 51827, 51829, 51839, 51853, 51859, 51869, 51871, 51893, 51899, 51907, 51913, 51929,
   51941, 51949, 51971, 51973, 51977, 51991, 52009, 52021, 52027, 52051, 52057, 52067, 52069, 52081, 52103, 52121,
   52127, 52147, 52153, 52163, 52177, 52181, 52183, 52189, 52201, 52223, 52237, 52249, 52253, 52259, 52267, 52289,
   52291, 52301, 52313, 52321, 52361, 52363, 52369, 52379, 52387, 52391, 52433, 52453, 52457, 52489, 52501, 52511,
   52517, 52529, 52541, 52543, 52553, 52561, 52567, 52571, 52579, 52583, 52609, 52627, 52631, 52639, 52667, 52673,
   52691, 52697, 52709, 52711, 52721, 52727, 52733, 52747, 52757, 52769, 52783, 52807, 52813, 52817, 52837, 52859,
   52861, 52879, 52883, 52889, 52901, 52903, 52919, 52937, 52951, 52957, 52963, 52967, 52973, 52981, 52999, 53003,
   53017, 53047, 53051, 53069, 53077, 53087, 53089, 53093, 53101, 53113, 53117, 53129, 53147, 53149, 53161, 53171,
   53173, 53189, 53197, 53201, 53231, 53233, 53239, 53267, 53269, 53279, 53281, 53299, 53309, 53323, 53327, 53353,
   53359, 53377, 53381, 53401, 53407, 53411, 53419, 53437, 53441, 53453, 53479, 53503, 53507, 53527, 53549, 53551,
   53569, 53591, 53593, 53597, 53609, 53611, 53617, 53623, 53629, 53633, 53639, 53653, 53657, 53681, 53693, 53699,
   53717, 53719, 53731, 53759, 53773, 53777, 53783, 53791, 53813, 53819, 53831, 53849, 53857, 53861, 53881, 53887,
   53891, 53897, 53899, 53917, 53923, 53927, 53939, 53951, 53959, 53987, 53993, 54001, 54011, 54013, 54037, 54049,
   54059, 54083, 54091, 54101, 54121, 54133, 54139, 54151, 54163, 54167, 54181, 54193, 54217, 54251, 54269, 54277,
   54287, 54293, 54311, 54319, 54323, 54331, 54347, 54361, 54367, 54371, 54377, 54401, 54403, 54409, 54413, 54419,
   54421, 54437, 54443, 54449, 54469, 54493, 54497, 54499, 54503, 54517, 54521, 54539, 54541, 54547, 54559, 54563,
   54577, 54581, 54583, 54601, 54617, 54623, 54629, 54631, 54647, 54667, 54673, 54679, 54709, 54713, 54721, 54727,
   54751, 54767, 54773, 54779, 54787, 54799, 54829, 54833, 54851, 54869, 54877, 54881, 54907, 54917, 54919, 54941,
   54949, 54959, 54973, 54979, 54983, 55001, 55009, 55021, 55049, 55051, 55057, 55061, 55073, 55079, 55103, 55109,
   55117, 55127, 55147, 55163, 55171, 55201, 55207, 55213, 55217, 55219, 55229, 55243, 55249, 55259, 55291, 55313,
   55331, 55333, 55337, 55339, 55343, 55351, 55373, 55381, 55399, 55411, 55439, 55441, 55457, 55469, 55487, 55501,
   55511, 55529, 55541, 55547, 55579, 55589, 55603, 55609, 55619, 55621, 55631, 55633, 55639, 55661, 55663, 55667,
   55673, 55681, 55691, 55697, 55711, 55717, 55721, 55733, 55763, 55787, 55793, 55799, 55807, 55813, 55817, 55819,
   55823, 55829, 55837, 55843, 55849, 55871, 55889, 55897, 55901, 55903, 55921, 55927, 55931, 55933, 55949, 55967,
   55987, 55997, 56003, 56009, 56039, 56041, 56053, 56081, 56087, 56093, 56099, 56101, 56113, 56123, 56131, 56149,
   56167, 56171, 56179, 56197, 56207, 56209, 56237, 56239, 56249, 56263, 56267, 56269, 56299, 56311, 56333, 56359,
   56369, 56377, 56383, 56393, 56401, 56417, 56431, 56437, 56443, 56453, 56467, 56473, 56477, 56479, 56489, 56501,
   56503, 56509, 56519, 56527, 56531, 56533, 56543, 56569, 56591, 56597, 56599, 56611, 56629, 56633, 56659, 56663,
   56671, 56681, 56687, 56701, 56711, 56713, 56731, 56737, 56747, 56767, 56773, 56779, 56783, 56807, 56809, 56813,
   56821, 56827, 56843, 56857, 56873, 56891, 56893, 56897, 56909, 56911, 56921, 56923, 56929, 56941, 56951, 56957,
   56963, 56983, 56989, 56993, 56999, 57037, 57041, 57047, 57059, 57073, 57077, 57089, 57097, 57107, 57119, 57131,
   57139, 57143, 57149, 57163, 57173, 57179, 57191, 57193, 57203, 57221, 57223, 57241, 57251, 57259, 57269, 57271,
   57283, 57287, 57301, 57329, 57331, 57347, 57349, 57367, 57373, 57383, 57389, 57397, 57413, 57427, 57457, 57467,
   57487, 57493, 57503, 57527, 57529, 57557, 57559, 57571, 57587, 57593, 57601, 57637, 57641, 57649, 57653, 57667,
   57679, 57689, 57697, 57709, 57713, 57719, 57727, 57731, 57737, 57751, 57773, 57781, 57787, 57791, 57793, 57803,
   57809, 57829, 57839, 57847, 57853, 57859, 57881, 57899, 57901, 57917, 57923, 57943, 57947, 57973, 57977, 57991,
   58013, 58027, 58031, 58043, 58049, 58057, 58061, 58067, 58073, 58099, 58109, 58111, 58129, 58147, 58151, 58153,
   58169, 58171, 58189, 58193, 58199, 58207, 58211, 58217, 58229, 58231, 58237, 58243, 58271, 58309, 58313, 58321,
   58337, 58363, 58367, 58369, 58379, 58391, 58393, 58403, 58411, 58417, 58427, 58439, 58441, 58451, 58453, 58477,
   58481, 58511, 58537, 58543, 58549, 58567, 58573, 58579, 58601, 58603, 58613, 58631, 58657, 58661, 58679, 58687,
   58693, 58699, 58711, 58727, 58733, 58741, 58757, 58763, 58771, 58787, 58789, 58831, 58889, 58897, 58901, 58907,
   58909, 58913, 58921, 58937, 58943, 58963, 58967, 58979, 58991, 58997, 59009, 59011, 59021, 59023, 59029, 59051,
   59053, 59063, 59069, 59077, 59083, 59093, 59107, 59113, 59119, 59123, 59141, 59149, 59159, 59167, 59183, 59197,
   59207, 59209, 59219, 59221, 59233, 59239, 59243, 59263, 59273, 59281, 59333, 59341, 59351, 59357, 59359, 59369,
   59377, 59387, 59393, 59399, 59407, 59417, 59419, 59441, 59443, 59447, 59453, 59467, 59471, 59473, 59497, 59509,
   59513, 59539, 59557, 59561, 59567, 59581, 59611, 59617, 59621, 59627, 59629, 59651, 59659, 59663, 59669, 59671,
   59693, 59699, 59707, 59723, 59729, 59743, 59747, 59753, 59771, 59779, 59791, 59797, 59809, 59833, 59863, 59879,
   59887, 59921, 59929, 59951, 59957, 59971, 59981, 59999, 60013, 60017, 60029, 60037, 60041, 60077, 60083, 60089,
   60091, 60101, 60103, 60107, 60127, 60133, 60139, 60149, 60161, 60167, 60169, 60209, 60217, 60223, 60251, 60257,
   60259, 60271, 60289, 60293, 60317, 60331, 60337, 60343, 60353, 60373, 60383, 60397, 60413, 60427, 60443, 60449,
   60457, 60493, 60497, 60509, 60521, 60527, 60539, 60589, 60601, 60607, 60611, 60617, 60623, 60631, 60637, 60647,
   60649, 60659, 60661, 60679, 60689, 60703, 60719, 60727, 60733, 60737, 60757, 60761, 60763, 60773, 60779, 60793,
   60811, 60821, 60859, 60869, 60887, 60889, 60899, 60901, 60913, 60917, 60919, 60923, 60937, 60943, 60953, 60961,
   61001, 61007, 61027, 61031, 61043, 61051, 61057, 61091, 61099, 61121, 61129, 61141, 61151, 61153, 61169, 61211,
   61223, 61231, 61253, 61261, 61283, 61291, 61297, 61331, 61333, 61339, 61343, 61357, 61363, 61379, 61381, 61403,
   61409, 61417, 61441, 61463, 61469, 61471, 61483, 61487, 61493, 61507, 61511, 61519, 61543, 61547, 61553, 61559,
   61561, 61583, 61603, 61609, 61613, 61627, 61631, 61637, 61643, 61651, 61657, 61667, 61673, 61681, 61687, 61703,
   61717, 61723, 61729, 61751, 61757, 61781, 61813, 61819, 61837, 61843, 61861, 61871, 61879, 61909, 61927, 61933,
   61949, 61961, 61967, 61979, 61981, 61987, 61991, 62003, 62011, 62017, 62039, 62047, 62053, 62057, 62071, 62081,
   62099, 62119, 62129, 62131, 62137, 62141, 62143, 62171, 62189, 62191, 62201, 62207, 62213, 62219, 62233, 62273,
   62297, 62299, 62303, 62311, 62323, 62327, 62347, 62351, 62383, 62401, 62417, 62423, 62459, 62467, 62473, 62477,
   62483, 62497, 62501, 62507, 62533, 62539, 62549, 62563, 62581, 62591, 62597, 62603, 62617, 62627, 62633, 62639,
   62653, 62659, 62683, 62687, 62701, 62723, 62731, 62743, 62753, 62761, 62773, 62791, 62801, 62819, 62827, 62851,
   62861, 62869, 62873, 62897, 62903, 62921, 62927, 62929, 62939, 62969, 62971, 62981, 62983, 62987, 62989, 63029,
   63031, 63059, 63067, 63073, 63079, 63097, 63103, 63113, 63127, 63131, 63149, 63179, 63197, 63199, 63211, 63241,
   63247, 63277, 63281, 63299, 63311, 63313, 63317, 63331, 63337, 63347, 63353, 63361, 63367, 63377, 63389, 63391,
   63397, 63409, 63419, 63421, 63439, 63443, 63463, 63467, 63473, 63487, 63493, 63499, 63521, 63527, 63533, 63541,
   63559, 63577, 63587, 63589, 63599, 63601, 63607, 63611, 63617, 63629, 63647, 63649, 63659, 63667, 63671, 63689,
   63691, 63697, 63703, 63709, 63719, 63727, 63737, 63743, 63761, 63773, 63781, 63793, 63799, 63803, 63809, 63823,
   63839, 63841, 63853, 63857, 63863, 63901, 63907, 63913, 63929, 63949, 63977, 63997, 64007, 64013, 64019, 64033,
   64037, 64063, 64067, 64081, 64091, 64109, 64123, 64151, 64153, 64157, 64171, 64187, 64189, 64217, 64223, 64231,
   64237, 64271, 64279, 64283, 64301, 64303, 64319, 64327, 64333, 64373, 64381, 64399, 64403, 64433, 64439, 64451,
   64453, 64483, 64489, 64499, 64513, 64553, 64567, 64577, 64579, 64591, 64601, 64609, 64613, 64621, 64627, 64633,
   64661, 64663, 64667, 64679, 64693, 64709, 64717, 64747, 64763, 64781, 64783, 64793, 64811, 64817, 64849, 64853,
   64871, 64877, 64879, 64891, 64901, 64919, 64921, 64927, 64937, 64951, 64969, 64997, 65003, 65011, 65027, 65029,
   65033, 65053, 65063, 65071, 65089, 65099, 65101, 65111, 65119, 65123, 65129, 65141, 65147, 65167, 65171, 65173,
   65179, 65183, 65203, 65213, 65239, 65257, 65267, 65269, 65287, 65293, 65309, 65323, 65327, 65353, 65357, 65371,
   65381, 65393, 65407, 65413, 65419, 65423, 65437, 65447, 65449, 65479, 65497, 65519, 65521, 0};

Referenced by is_prime(), and random_prime().

STREEBOG_Ax

const uint64_t Botan::STREEBOG_Ax

extern

Definition at line 34 of file streebog_precalc.cpp.

                                            {
   {0xd01f715b5c7ef8e6, 0x16fa240980778325, 0xa8a42e857ee049c8, 0x6ac1068fa186465b, 0x6e417bd7a2e9320b,
    0x665c8167a437daab, 0x7666681aa89617f6, 0x4b959163700bdcf5, 0xf14be6b78df36248, 0xc585bd689a625cff,
    0x9557d7fca67d82cb, 0x89f0b969af6dd366, 0xb0833d48749f6c35, 0xa1998c23b1ecbc7c, 0x8d70c431ac02a736,
    0xd6dfbc2fd0a8b69e, 0x37aeb3e551fa198b, 0x0b7d128a40b5cf9c, 0x5a8f2008b5780cbc, 0xedec882284e333e5,
    0xd25fc177d3c7c2ce, 0x5e0f5d50b61778ec, 0x1d873683c0c24cb9, 0xad040bcbb45d208c, 0x2f89a0285b853c76,
    0x5732fff6791b8d58, 0x3e9311439ef6ec3f, 0xc9183a809fd3c00f, 0x83adf3f5260a01ee, 0xa6791941f4e8ef10,
    0x103ae97d0ca1cd5d, 0x2ce948121dee1b4a, 0x39738421dbf2bf53, 0x093da2a6cf0cf5b4, 0xcd9847d89cbcb45f,
    0xf9561c078b2d8ae8, 0x9c6a755a6971777f, 0xbc1ebaa0712ef0c5, 0x72e61542abf963a6, 0x78bb5fde229eb12e,
    0x14ba94250fceb90d, 0x844d6697630e5282, 0x98ea08026a1e032f, 0xf06bbea144217f5c, 0xdb6263d11ccb377a,
    0x641c314b2b8ee083, 0x320e96ab9b4770cf, 0x1ee7deb986a96b85, 0xe96cf57a878c47b5, 0xfdd6615f8842feb8,
    0xc83862965601dd1b, 0x2ea9f83e92572162, 0xf876441142ff97fc, 0xeb2c455608357d9d, 0x5612a7e0b0c9904c,
    0x6c01cbfb2d500823, 0x4548a6a7fa037a2d, 0xabc4c6bf388b6ef4, 0xbade77d4fdf8bebd, 0x799b07c8eb4cac3a,
    0x0c9d87e805b19cf0, 0xcb588aac106afa27, 0xea0c1d40c1e76089, 0x2869354a1e816f1a, 0xff96d17307fbc490,
    0x9f0a9d602f1a5043, 0x96373fc6e016a5f7, 0x5292dab8b3a6e41c, 0x9b8ae0382c752413, 0x4f15ec3b7364a8a5,
    0x3fb349555724f12b, 0xc7c50d4415db66d7, 0x92b7429ee379d1a7, 0xd37f99611a15dfda, 0x231427c05e34a086,
    0xa439a96d7b51d538, 0xb403401077f01865, 0xdda2aea5901d7902, 0x0a5d4a9c8967d288, 0xc265280adf660f93,
    0x8bb0094520d4e94e, 0x2a29856691385532, 0x42a833c5bf072941, 0x73c64d54622b7eb2, 0x07e095624504536c,
    0x8a905153e906f45a, 0x6f6123c16b3b2f1f, 0xc6e55552dc097bc3, 0x4468feb133d16739, 0xe211e7f0c7398829,
    0xa2f96419f7879b40, 0x19074bdbc3ad38e9, 0xf4ebc3f9474e0b0c, 0x43886bd376d53455, 0xd8028beb5aa01046,
    0x51f23282f5cdc320, 0xe7b1c2be0d84e16d, 0x081dfab006dee8a0, 0x3b33340d544b857b, 0x7f5bcabc679ae242,
    0x0edd37c48a08a6d8, 0x81ed43d9a9b33bc6, 0xb1a3655ebd4d7121, 0x69a1eeb5e7ed6167, 0xf6ab73d5c8f73124,
    0x1a67a3e185c61fd5, 0x2dc91004d43c065e, 0x0240b02c8fb93a28, 0x90f7f2b26cc0eb8f, 0x3cd3a16f114fd617,
    0xaae49ea9f15973e0, 0x06c0cd748cd64e78, 0xda423bc7d5192a6e, 0xc345701c16b41287, 0x6d2193ede4821537,
    0xfcf639494190e3ac, 0x7c3b228621f1c57e, 0xfb16ac2b0494b0c0, 0xbf7e529a3745d7f9, 0x6881b6a32e3f7c73,
    0xca78d2bad9b8e733, 0xbbfe2fc2342aa3a9, 0x0dbddffecc6381e4, 0x70a6a56e2440598e, 0xe4d12a844befc651,
    0x8c509c2765d0ba22, 0xee8c6018c28814d9, 0x17da7c1f49a59e31, 0x609c4c1328e194d3, 0xb3e3d57232f44b09,
    0x91d7aaa4a512f69b, 0x0ffd6fd243dabbcc, 0x50d26a943c1fde34, 0x6be15e9968545b4f, 0x94778fea6faf9fdf,
    0x2b09dd7058ea4826, 0x677cd9716de5c7bf, 0x49d5214fffb2e6dd, 0x0360e83a466b273c, 0x1fc786af4f7b7691,
    0xa0b9d435783ea168, 0xd49f0c035f118cb6, 0x01205816c9d21d14, 0xac2453dd7d8f3d98, 0x545217cc3f70aa64,
    0x26b4028e9489c9c2, 0xdec2469fd6765e3e, 0x04807d58036f7450, 0xe5f17292823ddb45, 0xf30b569b024a5860,
    0x62dcfc3fa758aefb, 0xe84cad6c4e5e5aa1, 0xccb81fce556ea94b, 0x53b282ae7a74f908, 0x1b47fbf74c1402c1,
    0x368eebf39828049f, 0x7afbeff2ad278b06, 0xbe5e0a8cfe97caed, 0xcfd8f7f413058e77, 0xf78b2bc301252c30,
    0x4d555c17fcdd928d, 0x5f2f05467fc565f8, 0x24f4b2a21b30f3ea, 0x860dd6bbecb768aa, 0x4c750401350f8f99,
    0x0000000000000000, 0xecccd0344d312ef1, 0xb5231806be220571, 0xc105c030990d28af, 0x653c695de25cfd97,
    0x159acc33c61ca419, 0xb89ec7f872418495, 0xa9847693b73254dc, 0x58cf90243ac13694, 0x59efc832f3132b80,
    0x5c4fed7c39ae42c4, 0x828dabe3efd81cfa, 0xd13f294d95ace5f2, 0x7d1b7a90e823d86a, 0xb643f03cf849224d,
    0x3df3f979d89dcb03, 0x7426d836272f2dde, 0xdfe21e891fa4432a, 0x3a136c1b9d99986f, 0xfa36f43dcd46add4,
    0xc025982650df35bb, 0x856d3e81aadc4f96, 0xc4a5e57e53b041eb, 0x4708168b75ba4005, 0xaf44bbe73be41aa4,
    0x971767d029c4b8e3, 0xb9be9feebb939981, 0x215497ecd18d9aae, 0x316e7e91dd2c57f3, 0xcef8afe2dad79363,
    0x3853dc371220a247, 0x35ee03c9de4323a3, 0xe6919aa8c456fc79, 0xe05157dc4880b201, 0x7bdbb7e464f59612,
    0x127a59518318f775, 0x332ecebd52956ddb, 0x8f30741d23bb9d1e, 0xd922d3fd93720d52, 0x7746300c61440ae2,
    0x25d4eab4d2e2eefe, 0x75068020eefd30ca, 0x135a01474acaea61, 0x304e268714fe4ae7, 0xa519f17bb283c82c,
    0xdc82f6b359cf6416, 0x5baf781e7caa11a8, 0xb2c38d64fb26561d, 0x34ce5bdf17913eb7, 0x5d6fb56af07c5fd0,
    0x182713cd0a7f25fd, 0x9e2ac576e6c84d57, 0x9aaab82ee5a73907, 0xa3d93c0f3e558654, 0x7e7b92aaae48ff56,
    0x872d8ead256575be, 0x41c8dbfff96c0e7d, 0x99ca5014a3cc1e3b, 0x40e883e930be1369, 0x1ca76e95091051ad,
    0x4e35b42dbab6b5b1, 0x05a0254ecabd6944, 0xe1710fca8152af15, 0xf22b0e8dcb984574, 0xb763a82a319b3f59,
    0x63fca4296e8ab3ef, 0x9d4a2d4ca0a36a6b, 0xe331bfe60eeb953d, 0xd5bf541596c391a2, 0xf5cb9bef8e9c1618,
    0x46284e9dbc685d11, 0x2074cffa185f87ba, 0xbd3ee2b6b8fcedd1, 0xae64e3f1f23607b0, 0xfeb68965ce29d984,
    0x55724fdaf6a2b770, 0x29496d5cd753720e, 0xa75941573d3af204, 0x8e102c0bea69800a, 0x111ab16bc573d049,
    0xd7ffe439197aab8a, 0xefac380e0b5a09cd, 0x48f579593660fbc9, 0x22347fd697e6bd92, 0x61bc1405e13389c7,
    0x4ab5c975b9d9c1e1, 0x80cd1bcf606126d2, 0x7186fd78ed92449a, 0x93971a882aabccb3, 0x88d0e17f66bfce72,
    0x27945a985d5bd4d6},
   {0xde553f8c05a811c8, 0x1906b59631b4f565, 0x436e70d6b1964ff7, 0x36d343cb8b1e9d85, 0x843dfacc858aab5a,
    0xfdfc95c299bfc7f9, 0x0f634bdea1d51fa2, 0x6d458b3b76efb3cd, 0x85c3f77cf8593f80, 0x3c91315fbe737cb2,
    0x2148b03366ace398, 0x18f8b8264c6761bf, 0xc830c1c495c9fb0f, 0x981a76102086a0aa, 0xaa16012142f35760,
    0x35cc54060c763cf6, 0x42907d66cc45db2d, 0x8203d44b965af4bc, 0x3d6f3cefc3a0e868, 0xbc73ff69d292bda7,
    0x8722ed0102e20a29, 0x8f8185e8cd34deb7, 0x9b0561dda7ee01d9, 0x5335a0193227fad6, 0xc9cecc74e81a6fd5,
    0x54f5832e5c2431ea, 0x99e47ba05d553470, 0xf7bee756acd226ce, 0x384e05a5571816fd, 0xd1367452a47d0e6a,
    0xf29fde1c386ad85b, 0x320c77316275f7ca, 0xd0c879e2d9ae9ab0, 0xdb7406c69110ef5d, 0x45505e51a2461011,
    0xfc029872e46c5323, 0xfa3cb6f5f7bc0cc5, 0x031f17cd8768a173, 0xbd8df2d9af41297d, 0x9d3b4f5ab43e5e3f,
    0x4071671b36feee84, 0x716207e7d3e3b83d, 0x48d20ff2f9283a1a, 0x27769eb4757cbc7e, 0x5c56ebc793f2e574,
    0xa48b474f9ef5dc18, 0x52cbada94ff46e0c, 0x60c7da982d8199c6, 0x0e9d466edc068b78, 0x4eec2175eaf865fc,
    0x550b8e9e21f7a530, 0x6b7ba5bc653fec2b, 0x5eb7f1ba6949d0dd, 0x57ea94e3db4c9099, 0xf640eae6d101b214,
    0xdd4a284182c0b0bb, 0xff1d8fbf6304f250, 0xb8accb933bf9d7e8, 0xe8867c478eb68c4d, 0x3f8e2692391bddc1,
    0xcb2fd60912a15a7c, 0xaec935dbab983d2f, 0xf55ffd2b56691367, 0x80e2ce366ce1c115, 0x179bf3f8edb27e1d,
    0x01fe0db07dd394da, 0xda8a0b76ecc37b87, 0x44ae53e1df9584cb, 0xb310b4b77347a205, 0xdfab323c787b8512,
    0x3b511268d070b78e, 0x65e6e3d2b9396753, 0x6864b271e2574d58, 0x259784c98fc789d7, 0x02e11a7dfabb35a9,
    0x8841a6dfa337158b, 0x7ade78c39b5dcdd0, 0xb7cf804d9a2cc84a, 0x20b6bd831b7f7742, 0x75bd331d3a88d272,
    0x418f6aab4b2d7a5e, 0xd9951cbb6babdaf4, 0xb6318dfde7ff5c90, 0x1f389b112264aa83, 0x492c024284fbaec0,
    0xe33a0363c608f9a0, 0x2688930408af28a4, 0xc7538a1a341ce4ad, 0x5da8e677ee2171ae, 0x8c9e92254a5c7fc4,
    0x63d8cd55aae938b5, 0x29ebd8daa97a3706, 0x959827b37be88aa1, 0x1484e4356adadf6e, 0xa7945082199d7d6b,
    0xbf6ce8a455fa1cd4, 0x9cc542eac9edcae5, 0x79c16f0e1c356ca3, 0x89bfab6fdee48151, 0xd4174d1830c5f0ff,
    0x9258048415eb419d, 0x6139d72850520d1c, 0x6a85a80c18ec78f1, 0xcd11f88e0171059a, 0xcceff53e7ca29140,
    0xd229639f2315af19, 0x90b91ef9ef507434, 0x5977d28d074a1be1, 0x311360fce51d56b9, 0xc093a92d5a1f2f91,
    0x1a19a25bb6dc5416, 0xeb996b8a09de2d3e, 0xfee3820f1ed7668a, 0xd7085ad5b7ad518c, 0x7fff41890fe53345,
    0xec5948bd67dde602, 0x2fd5f65dbaaa68e0, 0xa5754affe32648c2, 0xf8ddac880d07396c, 0x6fa491468c548664,
    0x0c7c5c1326bdbed1, 0x4a33158f03930fb3, 0x699abfc19f84d982, 0xe4fa2054a80b329c, 0x6707f9af438252fa,
    0x08a368e9cfd6d49e, 0x47b1442c58fd25b8, 0xbbb3dc5ebc91769b, 0x1665fe489061eac7, 0x33f27a811fa66310,
    0x93a609346838d547, 0x30ed6d4c98cec263, 0x1dd9816cd8df9f2a, 0x94662a03063b1e7b, 0x83fdd9fbeb896066,
    0x7b207573e68e590a, 0x5f49fc0a149a4407, 0x343259b671a5a82c, 0xfbc2bb458a6f981f, 0xc272b350a0a41a38,
    0x3aaf1fd8ada32354, 0x6cbb868b0b3c2717, 0xa2b569c88d2583fe, 0xf180c9d1bf027928, 0xaf37386bd64ba9f5,
    0x12bacab2790a8088, 0x4c0d3b0810435055, 0xb2eeb9070e9436df, 0xc5b29067cea7d104, 0xdcb425f1ff132461,
    0x4f122cc5972bf126, 0xac282fa651230886, 0xe7e537992f6393ef, 0xe61b3a2952b00735, 0x709c0a57ae302ce7,
    0xe02514ae416058d3, 0xc44c9dd7b37445de, 0x5a68c5408022ba92, 0x1c278cdca50c0bf0, 0x6e5a9cf6f18712be,
    0x86dce0b17f319ef3, 0x2d34ec2040115d49, 0x4bcd183f7e409b69, 0x2815d56ad4a9a3dc, 0x24698979f2141d0d,
    0x0000000000000000, 0x1ec696a15fb73e59, 0xd86b110b16784e2e, 0x8e7f8858b0e74a6d, 0x063e2e8713d05fe6,
    0xe2c40ed3bbdb6d7a, 0xb1f1aeca89fc97ac, 0xe1db191e3cb3cc09, 0x6418ee62c4eaf389, 0xc6ad87aa49cf7077,
    0xd6f65765ca7ec556, 0x9afb6c6dda3d9503, 0x7ce05644888d9236, 0x8d609f95378feb1e, 0x23a9aa4e9c17d631,
    0x6226c0e5d73aac6f, 0x56149953a69f0443, 0xeeb852c09d66d3ab, 0x2b0ac2a753c102af, 0x07c023376e03cb3c,
    0x2ccae1903dc2c993, 0xd3d76e2f5ec63bc3, 0x9e2458973356ff4c, 0xa66a5d32644ee9b1, 0x0a427294356de137,
    0x783f62be61e6f879, 0x1344c70204d91452, 0x5b96c8f0fdf12e48, 0xa90916ecc59bf613, 0xbe92e5142829880e,
    0x727d102a548b194e, 0x1be7afebcb0fc0cc, 0x3e702b2244c8491b, 0xd5e940a84d166425, 0x66f9f41f3e51c620,
    0xabe80c913f20c3ba, 0xf07ec461c2d1edf2, 0xf361d3ac45b94c81, 0x0521394a94b8fe95, 0xadd622162cf09c5c,
    0xe97871f7f3651897, 0xf4a1f09b2bba87bd, 0x095d6559b2054044, 0x0bbc7f2448be75ed, 0x2af4cf172e129675,
    0x157ae98517094bb4, 0x9fda55274e856b96, 0x914713499283e0ee, 0xb952c623462a4332, 0x74433ead475b46a8,
    0x8b5eb112245fb4f8, 0xa34b6478f0f61724, 0x11a5dd7ffe6221fb, 0xc16da49d27ccbb4b, 0x76a224d0bde07301,
    0x8aa0bca2598c2022, 0x4df336b86d90c48f, 0xea67663a740db9e4, 0xef465f70e0b54771, 0x39b008152acb8227,
    0x7d1e5bf4f55e06ec, 0x105bd0cf83b1b521, 0x775c2960c033e7db, 0x7e014c397236a79f, 0x811cc386113255cf,
    0xeda7450d1a0e72d8, 0x5889df3d7a998f3b, 0x2e2bfbedc779fc3a, 0xce0eef438619a4e9, 0x372d4e7bf6cd095f,
    0x04df34fae96b6a4f, 0xf923a13870d4adb6, 0xa1aa7e050a4d228d, 0xa8f71b5cb84862c9, 0xb52e9a306097fde3,
    0x0d8251a35b6e2a0b, 0x2257a7fee1c442eb, 0x73831d9a29588d94, 0x51d4ba64c89ccf7f, 0x502ab7d4b54f5ba5,
    0x97793dce8153bf08, 0xe5042de4d5d8a646, 0x9687307efc802bd2, 0xa05473b5779eb657, 0xb4d097801d446939,
    0xcff0e2f3fbca3033, 0xc38cbee0dd778ee2, 0x464f499c252eb162, 0xcad1dbb96f72cea6, 0xba4dd1eec142e241,
    0xb00fa37af42f0376},
   {0xcce4cd3aa968b245, 0x089d5484e80b7faf, 0x638246c1b3548304, 0xd2fe0ec8c2355492, 0xa7fbdf7ff2374eee,
    0x4df1600c92337a16, 0x84e503ea523b12fb, 0x0790bbfd53ab0c4a, 0x198a780f38f6ea9d, 0x2ab30c8f55ec48cb,
    0xe0f7fed6b2c49db5, 0xb6ecf3f422cadbdc, 0x409c9a541358df11, 0xd3ce8a56dfde3fe3, 0xc3e9224312c8c1a0,
    0x0d6dfa58816ba507, 0xddf3e1b179952777, 0x04c02a42748bb1d9, 0x94c2abff9f2decb8, 0x4f91752da8f8acf4,
    0x78682befb169bf7b, 0xe1c77a48af2ff6c4, 0x0c5d7ec69c80ce76, 0x4cc1e4928fd81167, 0xfeed3d24d9997b62,
    0x518bb6dfc3a54a23, 0x6dbf2d26151f9b90, 0xb5bc624b05ea664f, 0xe86aaa525acfe21a, 0x4801ced0fb53a0be,
    0xc91463e6c00868ed, 0x1027a815cd16fe43, 0xf67069a0319204cd, 0xb04ccc976c8abce7, 0xc0b9b3fc35e87c33,
    0xf380c77c58f2de65, 0x50bb3241de4e2152, 0xdf93f490435ef195, 0xf1e0d25d62390887, 0xaf668bfb1a3c3141,
    0xbc11b251f00a7291, 0x73a5eed47e427d47, 0x25bee3f6ee4c3b2e, 0x43cc0beb34786282, 0xc824e778dde3039c,
    0xf97d86d98a327728, 0xf2b043e24519b514, 0xe297ebf7880f4b57, 0x3a94a49a98fab688, 0x868516cb68f0c419,
    0xeffa11af0964ee50, 0xa4ab4ec0d517f37d, 0xa9c6b498547c567a, 0x8e18424f80fbbbb6, 0x0bcdc53bcf2bc23c,
    0x137739aaea3643d0, 0x2c1333ec1bac2ff0, 0x8d48d3f0a7db0625, 0x1e1ac3f26b5de6d7, 0xf520f81f16b2b95e,
    0x9f0f6ec450062e84, 0x0130849e1deb6b71, 0xd45e31ab8c7533a9, 0x652279a2fd14e43f, 0x3209f01e70f1c927,
    0xbe71a770cac1a473, 0x0e3d6be7a64b1894, 0x7ec8148cff29d840, 0xcb7476c7fac3be0f, 0x72956a4a63a91636,
    0x37f95ec21991138f, 0x9e3fea5a4ded45f5, 0x7b38ba50964902e8, 0x222e580bbde73764, 0x61e253e0899f55e6,
    0xfc8d2805e352ad80, 0x35994be3235ac56d, 0x09add01af5e014de, 0x5e8659a6780539c6, 0xb17c48097161d796,
    0x026015213acbd6e2, 0xd1ae9f77e515e901, 0xb7dc776a3f21b0ad, 0xaba6a1b96eb78098, 0x9bcf4486248d9f5d,
    0x582666c536455efd, 0xfdbdac9bfeb9c6f1, 0xc47999be4163cdea, 0x765540081722a7ef, 0x3e548ed8ec710751,
    0x3d041f67cb51bac2, 0x7958af71ac82d40a, 0x36c9da5c047a78fe, 0xed9a048e33af38b2, 0x26ee7249c96c86bd,
    0x900281bdeba65d61, 0x11172c8bd0fd9532, 0xea0abf73600434f8, 0x42fc8f75299309f3, 0x34a9cf7d3eb1ae1c,
    0x2b838811480723ba, 0x5ce64c8742ceef24, 0x1adae9b01fd6570e, 0x3c349bf9d6bad1b3, 0x82453c891c7b75c0,
    0x97923a40b80d512b, 0x4a61dbf1c198765c, 0xb48ce6d518010d3e, 0xcfb45c858e480fd6, 0xd933cbf30d1e96ae,
    0xd70ea014ab558e3a, 0xc189376228031742, 0x9262949cd16d8b83, 0xeb3a3bed7def5f89, 0x49314a4ee6b8cbcf,
    0xdcc3652f647e4c06, 0xda635a4c2a3e2b3d, 0x470c21a940f3d35b, 0x315961a157d174b4, 0x6672e81dda3459ac,
    0x5b76f77a1165e36e, 0x445cb01667d36ec8, 0xc5491d205c88a69b, 0x456c34887a3805b9, 0xffddb9bac4721013,
    0x99af51a71e4649bf, 0xa15be01cbc7729d5, 0x52db2760e485f7b0, 0x8c78576eba306d54, 0xae560f6507d75a30,
    0x95f22f6182c687c9, 0x71c5fbf54489aba5, 0xca44f259e728d57e, 0x88b87d2ccebbdc8d, 0xbab18d32be4a15aa,
    0x8be8ec93e99b611e, 0x17b713e89ebdf209, 0xb31c5d284baa0174, 0xeeca9531148f8521, 0xb8d198138481c348,
    0x8988f9b2d350b7fc, 0xb9e11c8d996aa839, 0x5a4673e40c8e881f, 0x1687977683569978, 0xbf4123eed72acf02,
    0x4ea1f1b3b513c785, 0xe767452be16f91ff, 0x7505d1b730021a7c, 0xa59bca5ec8fc980c, 0xad069eda20f7e7a3,
    0x38f4b1bba231606a, 0x60d2d77e94743e97, 0x9affc0183966f42c, 0x248e6768f3a7505f, 0xcdd449a4b483d934,
    0x87b59255751baf68, 0x1bea6d2e023d3c7f, 0x6b1f12455b5ffcab, 0x743555292de9710d, 0xd8034f6d10f5fddf,
    0xc6198c9f7ba81b08, 0xbb8109aca3a17edb, 0xfa2d1766ad12cabb, 0xc729080166437079, 0x9c5fff7b77269317,
    0x0000000000000000, 0x15d706c9a47624eb, 0x6fdf38072fd44d72, 0x5fb6dd3865ee52b7, 0xa33bf53d86bcff37,
    0xe657c1b5fc84fa8e, 0xaa962527735cebe9, 0x39c43525bfda0b1b, 0x204e4d2a872ce186, 0x7a083ece8ba26999,
    0x554b9c9db72efbfa, 0xb22cd9b656416a05, 0x96a2bedea5e63a5a, 0x802529a826b0a322, 0x8115ad363b5bc853,
    0x8375b81701901eb1, 0x3069e53f4a3a1fc5, 0xbd2136cfede119e0, 0x18bafc91251d81ec, 0x1d4a524d4c7d5b44,
    0x05f0aedc6960daa8, 0x29e39d3072ccf558, 0x70f57f6b5962c0d4, 0x989fd53903ad22ce, 0xf84d024797d91c59,
    0x547b1803aac5908b, 0xf0d056c37fd263f6, 0xd56eb535919e58d8, 0x1c7ad6d351963035, 0x2e7326cd2167f912,
    0xac361a443d1c8cd2, 0x697f076461942a49, 0x4b515f6fdc731d2d, 0x8ad8680df4700a6f, 0x41ac1eca0eb3b460,
    0x7d988533d80965d3, 0xa8f6300649973d0b, 0x7765c4960ac9cc9e, 0x7ca801adc5e20ea2, 0xdea3700e5eb59ae4,
    0xa06b6482a19c42a4, 0x6a2f96db46b497da, 0x27def6d7d487edcc, 0x463ca5375d18b82a, 0xa6cb5be1efdc259f,
    0x53eba3fef96e9cc1, 0xce84d81b93a364a7, 0xf4107c810b59d22f, 0x333974806d1aa256, 0x0f0def79bba073e5,
    0x231edc95a00c5c15, 0xe437d494c64f2c6c, 0x91320523f64d3610, 0x67426c83c7df32dd, 0x6eefbc99323f2603,
    0x9d6f7be56acdf866, 0x5916e25b2bae358c, 0x7ff89012e2c2b331, 0x035091bf2720bd93, 0x561b0d22900e4669,
    0x28d319ae6f279e29, 0x2f43a2533c8c9263, 0xd09e1be9f8fe8270, 0xf740ed3e2c796fbc, 0xdb53ded237d5404c,
    0x62b2c25faebfe875, 0x0afd41a5d2c0a94d, 0x6412fd3ce0ff8f4e, 0xe3a76f6995e42026, 0x6c8fa9b808f4f0e1,
    0xc2d9a6dd0f23aad1, 0x8f28c6d19d10d0c7, 0x85d587744fd0798a, 0xa20b71a39b579446, 0x684f83fa7c7f4138,
    0xe507500adba4471d, 0x3f640a46f19a6c20, 0x1247bd34f7dd28a1, 0x2d23b77206474481, 0x93521002cc86e0f2,
    0x572b89bc8de52d18, 0xfb1d93f8b0f9a1ca, 0xe95a2ecc4724896b, 0x3ba420048511ddf9, 0xd63e248ab6bee54b,
    0x5dd6c8195f258455, 0x06a03f634e40673b, 0x1f2a476c76b68da6, 0x217ec9b49ac78af7, 0xecaa80102e4453c3,
    0x14e78257b99d4f9a},
   {0x20329b2cc87bba05, 0x4f5eb6f86546a531, 0xd4f44775f751b6b1, 0x8266a47b850dfa8b, 0xbb986aa15a6ca985,
    0xc979eb08f9ae0f99, 0x2da6f447a2375ea1, 0x1e74275dcd7d8576, 0xbc20180a800bc5f8, 0xb4a2f701b2dc65be,
    0xe726946f981b6d66, 0x48e6c453bf21c94c, 0x42cad9930f0a4195, 0xefa47b64aacccd20, 0x71180a8960409a42,
    0x8bb3329bf6a44e0c, 0xd34c35de2d36dacc, 0xa92f5b7cbc23dc96, 0xb31a85aa68bb09c3, 0x13e04836a73161d2,
    0xb24dfc4129c51d02, 0x8ae44b70b7da5acd, 0xe671ed84d96579a7, 0xa4bb3417d66f3832, 0x4572ab38d56d2de8,
    0xb1b47761ea47215c, 0xe81c09cf70aba15d, 0xffbdb872ce7f90ac, 0xa8782297fd5dc857, 0x0d946f6b6a4ce4a4,
    0xe4df1f4f5b995138, 0x9ebc71edca8c5762, 0x0a2c1dc0b02b88d9, 0x3b503c115d9d7b91, 0xc64376a8111ec3a2,
    0xcec199a323c963e4, 0xdc76a87ec58616f7, 0x09d596e073a9b487, 0x14583a9d7d560daf, 0xf4c6dc593f2a0cb4,
    0xdd21d19584f80236, 0x4a4836983ddde1d3, 0xe58866a41ae745f9, 0xf591a5b27e541875, 0x891dc05074586693,
    0x5b068c651810a89e, 0xa30346bc0c08544f, 0x3dbf3751c684032d, 0x2a1e86ec785032dc, 0xf73f5779fca830ea,
    0xb60c05ca30204d21, 0x0cc316802b32f065, 0x8770241bdd96be69, 0xb861e18199ee95db, 0xf805cad91418fcd1,
    0x29e70dccbbd20e82, 0xc7140f435060d763, 0x0f3a9da0e8b0cc3b, 0xa2543f574d76408e, 0xbd7761e1c175d139,
    0x4b1f4f737ca3f512, 0x6dc2df1f2fc137ab, 0xf1d05c3967b14856, 0xa742bf3715ed046c, 0x654030141d1697ed,
    0x07b872abda676c7d, 0x3ce84eba87fa17ec, 0xc1fb0403cb79afdf, 0x3e46bc7105063f73, 0x278ae987121cd678,
    0xa1adb4778ef47cd0, 0x26dd906c5362c2b9, 0x05168060589b44e2, 0xfbfc41f9d79ac08f, 0x0e6de44ba9ced8fa,
    0x9feb08068bf243a3, 0x7b341749d06b129b, 0x229c69e74a87929a, 0xe09ee6c4427c011b, 0x5692e30e725c4c3a,
    0xda99a33e5e9f6e4b, 0x353dd85af453a36b, 0x25241b4c90e0fee7, 0x5de987258309d022, 0xe230140fc0802984,
    0x93281e86a0c0b3c6, 0xf229d719a4337408, 0x6f6c2dd4ad3d1f34, 0x8ea5b2fbae3f0aee, 0x8331dd90c473ee4a,
    0x346aa1b1b52db7aa, 0xdf8f235e06042aa9, 0xcc6f6b68a1354b7b, 0x6c95a6f46ebf236a, 0x52d31a856bb91c19,
    0x1a35ded6d498d555, 0xf37eaef2e54d60c9, 0x72e181a9a3c2a61c, 0x98537aad51952fde, 0x16f6c856ffaa2530,
    0xd960281e9d1d5215, 0x3a0745fa1ce36f50, 0x0b7b642bf1559c18, 0x59a87eae9aec8001, 0x5e100c05408bec7c,
    0x0441f98b19e55023, 0xd70dcc5534d38aef, 0x927f676de1bea707, 0x9769e70db925e3e5, 0x7a636ea29115065a,
    0x468b201816ef11b6, 0xab81a9b73edff409, 0xc0ac7de88a07bb1e, 0x1f235eb68c0391b7, 0x6056b074458dd30f,
    0xbe8eeac102f7ed67, 0xcd381283e04b5fba, 0x5cbefecec277c4e3, 0xd21b4c356c48ce0d, 0x1019c31664b35d8c,
    0x247362a7d19eea26, 0xebe582efb3299d03, 0x02aef2cb82fc289f, 0x86275df09ce8aaa8, 0x28b07427faac1a43,
    0x38a9b7319e1f47cf, 0xc82e92e3b8d01b58, 0x06ef0b409b1978bc, 0x62f842bfc771fb90, 0x9904034610eb3b1f,
    0xded85ab5477a3e68, 0x90d195a663428f98, 0x5384636e2ac708d8, 0xcbd719c37b522706, 0xae9729d76644b0eb,
    0x7c8c65e20a0c7ee6, 0x80c856b007f1d214, 0x8c0b40302cc32271, 0xdbcedad51fe17a8a, 0x740e8ae938dbdea0,
    0xa615c6dc549310ad, 0x19cc55f6171ae90b, 0x49b1bdb8fe5fdd8d, 0xed0a89af2830e5bf, 0x6a7aadb4f5a65bd6,
    0x7e22972988f05679, 0xf952b3325566e810, 0x39fecedadf61530e, 0x6101c99f04f3c7ce, 0x2e5f7f6761b562ff,
    0xf08725d226cf5c97, 0x63af3b54860fef51, 0x8ff2cb10ef411e2f, 0x884ab9bb35267252, 0x4df04433e7ba8dae,
    0x9afd8866d3690741, 0x66b9bb34de94abb3, 0x9baaf18d92171380, 0x543c11c5f0a064a5, 0x17a1b1bdbed431f1,
    0xb5f58eeaf3a2717f, 0xc355f6c849858740, 0xec5df044694ef17e, 0xd83751f5dc6346d4, 0xfc4433520dfdacf2,
    0x0000000000000000, 0x5a51f58e596ebc5f, 0x3285aaf12e34cf16, 0x8d5c39db6dbd36b0, 0x12b731dde64f7513,
    0x94906c2d7aa7dfbb, 0x302b583aacc8e789, 0x9d45facd090e6b3c, 0x2165e2c78905aec4, 0x68d45f7f775a7349,
    0x189b2c1d5664fdca, 0xe1c99f2f030215da, 0x6983269436246788, 0x8489af3b1e148237, 0xe94b702431d5b59c,
    0x33d2d31a6f4adbd7, 0xbfd9932a4389f9a6, 0xb0e30e8aab39359d, 0xd1e2c715afcaf253, 0x150f43763c28196e,
    0xc4ed846393e2eb3d, 0x03f98b20c3823c5e, 0xfd134ab94c83b833, 0x556b682eb1de7064, 0x36c4537a37d19f35,
    0x7559f30279a5ca61, 0x799ae58252973a04, 0x9c12832648707ffd, 0x78cd9c6913e92ec5, 0x1d8dac7d0effb928,
    0x439da0784e745554, 0x413352b3cc887dcb, 0xbacf134a1b12bd44, 0x114ebafd25cd494d, 0x2f08068c20cb763e,
    0x76a07822ba27f63f, 0xeab2fb04f25789c2, 0xe3676de481fe3d45, 0x1b62a73d95e6c194, 0x641749ff5c68832c,
    0xa5ec4dfc97112cf3, 0xf6682e92bdd6242b, 0x3f11c59a44782bb2, 0x317c21d1edb6f348, 0xd65ab5be75ad9e2e,
    0x6b2dd45fb4d84f17, 0xfaab381296e4d44e, 0xd0b5befeeeb4e692, 0x0882ef0b32d7a046, 0x512a91a5a83b2047,
    0x963e9ee6f85bf724, 0x4e09cf132438b1f0, 0x77f701c9fb59e2fe, 0x7ddb1c094b726a27, 0x5f4775ee01f5f8bd,
    0x9186ec4d223c9b59, 0xfeeac1998f01846d, 0xac39db1ce4b89874, 0xb75b7c21715e59e0, 0xafc0503c273aa42a,
    0x6e3b543fec430bf5, 0x704f7362213e8e83, 0x58ff0745db9294c0, 0x67eec2df9feabf72, 0xa0facd9ccf8a6811,
    0xb936986ad890811a, 0x95c715c63bd9cb7a, 0xca8060283a2c33c7, 0x507de84ee9453486, 0x85ded6d05f6a96f6,
    0x1cdad5964f81ade9, 0xd5a33e9eb62fa270, 0x40642b588df6690a, 0x7f75eec2c98e42b8, 0x2cf18dace3494a60,
    0x23cb100c0bf9865b, 0xeef3028febb2d9e1, 0x4425d2d394133929, 0xaad6d05c7fa1e0c8, 0xad6ea2f7a5c68cb5,
    0xc2028f2308fb9381, 0x819f2f5b468fc6d5, 0xc5bafd88d29cfffc, 0x47dc59f357910577, 0x2b49ff07392e261d,
    0x57c59ae5332258fb, 0x73b6f842e2bcb2dd, 0xcf96e04862b77725, 0x4ca73dd8a6c4996f, 0x015779eb417e14c1,
    0x37932a9176af8bf4},
   {0x190a2c9b249df23e, 0x2f62f8b62263e1e9, 0x7a7f754740993655, 0x330b7ba4d5564d9f, 0x4c17a16a46672582,
    0xb22f08eb7d05f5b8, 0x535f47f40bc148cc, 0x3aec5d27d4883037, 0x10ed0a1825438f96, 0x516101f72c233d17,
    0x13cc6f949fd04eae, 0x739853c441474bfd, 0x653793d90d3f5b1b, 0x5240647b96b0fc2f, 0x0c84890ad27623e0,
    0xd7189b32703aaea3, 0x2685de3523bd9c41, 0x99317c5b11bffefa, 0x0d9baa854f079703, 0x70b93648fbd48ac5,
    0xa80441fce30bc6be, 0x7287704bdc36ff1e, 0xb65384ed33dc1f13, 0xd36417343ee34408, 0x39cd38ab6e1bf10f,
    0x5ab861770a1f3564, 0x0ebacf09f594563b, 0xd04572b884708530, 0x3cae9722bdb3af47, 0x4a556b6f2f5cbaf2,
    0xe1704f1f76c4bd74, 0x5ec4ed7144c6dfcf, 0x16afc01d4c7810e6, 0x283f113cd629ca7a, 0xaf59a8761741ed2d,
    0xeed5a3991e215fac, 0x3bf37ea849f984d4, 0xe413e096a56ce33c, 0x2c439d3a98f020d1, 0x637559dc6404c46b,
    0x9e6c95d1e5f5d569, 0x24bb9836045fe99a, 0x44efa466dac8ecc9, 0xc6eab2a5c80895d6, 0x803b50c035220cc4,
    0x0321658cba93c138, 0x8f9ebc465dc7ee1c, 0xd15a5137190131d3, 0x0fa5ec8668e5e2d8, 0x91c979578d1037b1,
    0x0642ca05693b9f70, 0xefca80168350eb4f, 0x38d21b24f36a45ec, 0xbeab81e1af73d658, 0x8cbfd9cae7542f24,
    0xfd19cc0d81f11102, 0x0ac6430fbb4dbc90, 0x1d76a09d6a441895, 0x2a01573ff1cbbfa1, 0xb572e161894fde2b,
    0x8124734fa853b827, 0x614b1fdf43e6b1b0, 0x68ac395c4238cc18, 0x21d837bfd7f7b7d2, 0x20c714304a860331,
    0x5cfaab726324aa14, 0x74c5ba4eb50d606e, 0xf3a3030474654739, 0x23e671bcf015c209, 0x45f087e947b9582a,
    0xd8bd77b418df4c7b, 0xe06f6c90ebb50997, 0x0bd96080263c0873, 0x7e03f9410e40dcfe, 0xb8e94be4c6484928,
    0xfb5b0608e8ca8e72, 0x1a2b49179e0e3306, 0x4e29e76961855059, 0x4f36c4e6fcf4e4ba, 0x49740ee395cf7bca,
    0xc2963ea386d17f7d, 0x90d65ad810618352, 0x12d34c1b02a1fa4d, 0xfa44258775bb3a91, 0x18150f14b9ec46dd,
    0x1491861e6b9a653d, 0x9a1019d7ab2c3fc2, 0x3668d42d06fe13d7, 0xdcc1fbb25606a6d0, 0x969490dd795a1c22,
    0x3549b1a1bc6dd2ef, 0xc94f5e23a0ed770e, 0xb9f6686b5b39fdcb, 0xc4d4f4a6efeae00d, 0xe732851a1fff2204,
    0x94aad6de5eb869f9, 0x3f8ff2ae07206e7f, 0xfe38a9813b62d03a, 0xa7a1ad7a8bee2466, 0x7b6056c8dde882b6,
    0x302a1e286fc58ca7, 0x8da0fa457a259bc7, 0xb3302b64e074415b, 0x5402ae7eff8b635f, 0x08f8050c9cafc94b,
    0xae468bf98a3059ce, 0x88c355cca98dc58f, 0xb10e6d67c7963480, 0xbad70de7e1aa3cf3, 0xbfb4a26e320262bb,
    0xcb711820870f02d5, 0xce12b7a954a75c9d, 0x563ce87dd8691684, 0x9f73b65e7884618a, 0x2b1e74b06cba0b42,
    0x47cec1ea605b2df1, 0x1c698312f735ac76, 0x5fdbcefed9b76b2c, 0x831a354c8fb1cdfc, 0x820516c312c0791f,
    0xb74ca762aeadabf0, 0xfc06ef821c80a5e1, 0x5723cbf24518a267, 0x9d4df05d5f661451, 0x588627742dfd40bf,
    0xda8331b73f3d39a0, 0x17b0e392d109a405, 0xf965400bcf28fba9, 0x7c3dbf4229a2a925, 0x023e460327e275db,
    0x6cd0b55a0ce126b3, 0xe62da695828e96e7, 0x42ad6e63b3f373b9, 0xe50cc319381d57df, 0xc5cbd729729b54ee,
    0x46d1e265fd2a9912, 0x6428b056904eeff8, 0x8be23040131e04b7, 0x6709d5da2add2ec0, 0x075de98af44a2b93,
    0x8447dcc67bfbe66f, 0x6616f655b7ac9a23, 0xd607b8bded4b1a40, 0x0563af89d3a85e48, 0x3db1b4ad20c21ba4,
    0x11f22997b8323b75, 0x292032b34b587e99, 0x7f1cdace9331681d, 0x8e819fc9c0b65aff, 0xa1e3677fe2d5bb16,
    0xcd33d225ee349da5, 0xd9a2543b85aef898, 0x795e10cbfa0af76d, 0x25a4bbb9992e5d79, 0x78413344677b438e,
    0xf0826688cef68601, 0xd27b34bba392f0eb, 0x551d8df162fad7bc, 0x1e57c511d0d7d9ad, 0xdeffbdb171e4d30b,
    0xf4feea8e802f6caa, 0xa480c8f6317de55e, 0xa0fc44f07fa40ff5, 0x95b5f551c3c9dd1a, 0x22f952336d6476ea,
    0x0000000000000000, 0xa6be8ef5169f9085, 0xcc2cf1aa73452946, 0x2e7ddb39bf12550a, 0xd526dd3157d8db78,
    0x486b2d6c08becf29, 0x9b0f3a58365d8b21, 0xac78cdfaadd22c15, 0xbc95c7e28891a383, 0x6a927f5f65dab9c3,
    0xc3891d2c1ba0cb9e, 0xeaa92f9f50f8b507, 0xcf0d9426c9d6e87e, 0xca6e3baf1a7eb636, 0xab25247059980786,
    0x69b31ad3df4978fb, 0xe2512a93cc577c4c, 0xff278a0ea61364d9, 0x71a615c766a53e26, 0x89dc764334fc716c,
    0xf87a638452594f4a, 0xf2bc208be914f3da, 0x8766b94ac1682757, 0xbbc82e687cdb8810, 0x626a7a53f9757088,
    0xa2c202f358467a2e, 0x4d0882e5db169161, 0x09e7268301de7da8, 0xe897699c771ac0dc, 0xc8507dac3d9cc3ed,
    0xc0a878a0a1330aa6, 0x978bb352e42ba8c1, 0xe9884a13ea6b743f, 0x279afdbabecc28a2, 0x047c8c064ed9eaab,
    0x507e2278b15289f4, 0x599904fbb08cf45c, 0xbd8ae46d15e01760, 0x31353da7f2b43844, 0x8558ff49e68a528c,
    0x76fbfc4d92ef15b5, 0x3456922e211c660c, 0x86799ac55c1993b4, 0x3e90d1219a51da9c, 0x2d5cbeb505819432,
    0x982e5fd48cce4a19, 0xdb9c1238a24c8d43, 0xd439febecaa96f9b, 0x418c0bef0960b281, 0x158ea591f6ebd1de,
    0x1f48e69e4da66d4e, 0x8afd13cf8e6fb054, 0xf5e1c9011d5ed849, 0xe34e091c5126c8af, 0xad67ee7530a398f6,
    0x43b24dec2e82c75a, 0x75da99c1287cd48d, 0x92e81cdb3783f689, 0xa3dd217cc537cecd, 0x60543c50de970553,
    0x93f73f54aaf2426a, 0xa91b62737e7a725d, 0xf19d4507538732e2, 0x77e4dfc20f9ea156, 0x7d229ccdb4d31dc6,
    0x1b346a98037f87e5, 0xedf4c615a4b29e94, 0x4093286094110662, 0xb0114ee85ae78063, 0x6ff1d0d6b672e78b,
    0x6dcf96d591909250, 0xdfe09e3eec9567e8, 0x3214582b4827f97c, 0xb46dc2ee143e6ac8, 0xf6c0ac8da7cd1971,
    0xebb60c10cd8901e4, 0xf7df8f023abcad92, 0x9c52d3d2c217a0b2, 0x6b8d5cd0f8ab0d20, 0x3777f7a29b8fa734,
    0x011f238f9d71b4e3, 0xc1b75b2f3c42be45, 0x5de588fdfe551ef7, 0x6eeef3592b035368, 0xaa3a07ffc4e9b365,
    0xecebe59a39c32a77, 0x5ba742f8976e8187, 0x4b4a48e0b22d0e11, 0xddded83dcb771233, 0xa59feb79ac0c51bd,
    0xc7f5912a55792135},
   {0x6d6ae04668a9b08a, 0x3ab3f04b0be8c743, 0xe51e166b54b3c908, 0xbe90a9eb35c2f139, 0xb2c7066637f2bec1,
    0xaa6945613392202c, 0x9a28c36f3b5201eb, 0xddce5a93ab536994, 0x0e34133ef6382827, 0x52a02ba1ec55048b,
    0xa2f88f97c4b2a177, 0x8640e513ca2251a5, 0xcdf1d36258137622, 0xfe6cb708dedf8ddb, 0x8a174a9ec8121e5d,
    0x679896036b81560e, 0x59ed033395795fee, 0x1dd778ab8b74edaf, 0xee533ef92d9f926d, 0x2a8c79baf8a8d8f5,
    0x6bcf398e69b119f6, 0xe20491742fafdd95, 0x276488e0809c2aec, 0xea955b82d88f5cce, 0x7102c63a99d9e0c4,
    0xf9763017a5c39946, 0x429fa2501f151b3d, 0x4659c72bea05d59e, 0x984b7fdccf5a6634, 0xf742232953fbb161,
    0x3041860e08c021c7, 0x747bfd9616cd9386, 0x4bb1367192312787, 0x1b72a1638a6c44d3, 0x4a0e68a6e8359a66,
    0x169a5039f258b6ca, 0xb98a2ef44edee5a4, 0xd9083fe85e43a737, 0x967f6ce239624e13, 0x8874f62d3c1a7982,
    0x3c1629830af06e3f, 0x9165ebfd427e5a8e, 0xb5dd81794ceeaa5c, 0x0de8f15a7834f219, 0x70bd98ede3dd5d25,
    0xaccc9ca9328a8950, 0x56664eda1945ca28, 0x221db34c0f8859ae, 0x26dbd637fa98970d, 0x1acdffb4f068f932,
    0x4585254f64090fa0, 0x72de245e17d53afa, 0x1546b25d7c546cf4, 0x207e0ffffb803e71, 0xfaaad2732bcf4378,
    0xb462dfae36ea17bd, 0xcf926fd1ac1b11fd, 0xe0672dc7dba7ba4a, 0xd3fa49ad5d6b41b3, 0x8ba81449b216a3bc,
    0x14f9ec8a0650d115, 0x40fc1ee3eb1d7ce2, 0x23a2ed9b758ce44f, 0x782c521b14fddc7e, 0x1c68267cf170504e,
    0xbcf31558c1ca96e6, 0xa781b43b4ba6d235, 0xf6fd7dfe29ff0c80, 0xb0a4bad5c3fad91e, 0xd199f51ea963266c,
    0x414340349119c103, 0x5405f269ed4dadf7, 0xabd61bb649969dcd, 0x6813dbeae7bdc3c8, 0x65fb2ab09f8931d1,
    0xf1e7fae152e3181d, 0xc1a67cef5a2339da, 0x7a4feea8e0f5bba1, 0x1e0b9acf05783791, 0x5b8ebf8061713831,
    0x80e53cdbcb3af8d9, 0x7e898bd315e57502, 0xc6bcfbf0213f2d47, 0x95a38e86b76e942d, 0x092e94218d243cba,
    0x8339debf453622e7, 0xb11be402b9fe64ff, 0x57d9100d634177c9, 0xcc4e8db52217cbc3, 0x3b0cae9c71ec7aa2,
    0xfb158ca451cbfe99, 0x2b33276d82ac6514, 0x01bf5ed77a04bde1, 0xc5601994af33f779, 0x75c4a3416cc92e67,
    0xf3844652a6eb7fc2, 0x3487e375fdd0ef64, 0x18ae430704609eed, 0x4d14efb993298efb, 0x815a620cb13e4538,
    0x125c354207487869, 0x9eeea614ce42cf48, 0xce2d3106d61fac1c, 0xbbe99247bad6827b, 0x071a871f7b1c149d,
    0x2e4a1cc10db81656, 0x77a71ff298c149b8, 0x06a5d9c80118a97c, 0xad73c27e488e34b1, 0x443a7b981e0db241,
    0xe3bbcfa355ab6074, 0x0af276450328e684, 0x73617a896dd1871b, 0x58525de4ef7de20f, 0xb7be3dcab8e6cd83,
    0x19111dd07e64230c, 0x842359a03e2a367a, 0x103f89f1f3401fb6, 0xdc710444d157d475, 0xb835702334da5845,
    0x4320fc876511a6dc, 0xd026abc9d3679b8d, 0x17250eee885c0b2b, 0x90dab52a387ae76f, 0x31fed8d972c49c26,
    0x89cba8fa461ec463, 0x2ff5421677bcabb7, 0x396f122f85e41d7d, 0xa09b332430bac6a8, 0xc888e8ced7070560,
    0xaeaf201ac682ee8f, 0x1180d7268944a257, 0xf058a43628e7a5fc, 0xbd4c4b8fbbce2b07, 0xa1246df34abe7b49,
    0x7d5569b79be9af3c, 0xa9b5a705bd9efa12, 0xdb6b835baa4bc0e8, 0x05793bac8f147342, 0x21c1512881848390,
    0xfdb0556c50d357e5, 0x613d4fcb6a99ff72, 0x03dce2648e0cda3e, 0xe949b9e6568386f0, 0xfc0f0bbb2ad7ea04,
    0x6a70675913b5a417, 0x7f36d5046fe1c8e3, 0x0c57af8d02304ff8, 0x32223abdfcc84618, 0x0891caf6f720815b,
    0xa63eeaec31a26fd4, 0x2507345374944d33, 0x49d28ac266394058, 0xf5219f9aa7f3d6be, 0x2d96fea583b4cc68,
    0x5a31e1571b7585d0, 0x8ed12fe53d02d0fe, 0xdfade6205f5b0e4b, 0x4cabb16ee92d331a, 0x04c6657bf510cea3,
    0xd73c2cd6a87b8f10, 0xe1d87310a1a307ab, 0x6cd5be9112ad0d6b, 0x97c032354366f3f2, 0xd4e0ceb22677552e,
    0x0000000000000000, 0x29509bde76a402cb, 0xc27a9e8bd42fe3e4, 0x5ef7842cee654b73, 0xaf107ecdbc86536e,
    0x3fcacbe784fcb401, 0xd55f90655c73e8cf, 0xe6c2f40fdabf1336, 0xe8f6e7312c873b11, 0xeb2a0555a28be12f,
    0xe4a148bc2eb774e9, 0x9b979db84156bc0a, 0x6eb60222e6a56ab4, 0x87ffbbc4b026ec44, 0xc703a5275b3b90a6,
    0x47e699fc9001687f, 0x9c8d1aa73a4aa897, 0x7cea3760e1ed12dd, 0x4ec80ddd1d2554c5, 0x13e36b957d4cc588,
    0x5d2b66486069914d, 0x92b90999cc7280b0, 0x517cc9c56259deb5, 0xc937b619ad03b881, 0xec30824ad997f5b2,
    0xa45d565fc5aa080b, 0xd6837201d27f32f1, 0x635ef3789e9198ad, 0x531f75769651b96a, 0x4f77530a6721e924,
    0x486dd4151c3dfdb9, 0x5f48dafb9461f692, 0x375b011173dc355a, 0x3da9775470f4d3de, 0x8d0dcd81b30e0ac0,
    0x36e45fc609d888bb, 0x55baacbe97491016, 0x8cb29356c90ab721, 0x76184125e2c5f459, 0x99f4210bb55edbd5,
    0x6f095cf59ca1d755, 0x9f51f8c3b44672a9, 0x3538bda287d45285, 0x50c39712185d6354, 0xf23b1885dcefc223,
    0x79930ccc6ef9619f, 0xed8fdc9da3934853, 0xcb540aaa590bdf5e, 0x5c94389f1a6d2cac, 0xe77daad8a0bbaed7,
    0x28efc5090ca0bf2a, 0xbf2ff73c4fc64cd8, 0xb37858b14df60320, 0xf8c96ec0dfc724a7, 0x828680683f329f06,
    0x941cd051cd6a29cc, 0xc3c5c05cae2b5e05, 0xb601631dc2e27062, 0xc01922382027843b, 0x24b86a840e90f0d2,
    0xd245177a276ffc52, 0x0f8b4de98c3c95c6, 0x3e759530fef809e0, 0x0b4d2892792c5b65, 0xc4df4743d5374a98,
    0xa5e20888bfaeb5ea, 0xba56cc90c0d23f9a, 0x38d04cf8ffe0a09c, 0x62e1adafe495254c, 0x0263bcb3f40867df,
    0xcaeb547d230f62bf, 0x6082111c109d4293, 0xdad4dd8cd04f7d09, 0xefec602e579b2f8c, 0x1fb4c4187f7c8a70,
    0xffd3e9dfa4db303a, 0x7bf0b07f9af10640, 0xf49ec14dddf76b5f, 0x8f6e713247066d1f, 0x339d646a86ccfbf9,
    0x64447467e58d8c30, 0x2c29a072f9b07189, 0xd8b7613f24471ad6, 0x6627c8d41185ebef, 0xa347d140beb61c96,
    0xde12b8f7255fb3aa, 0x9d324470404e1576, 0x9306574eb6763d51, 0xa80af9d2c79a47f3, 0x859c0777442e8b9b,
    0x69ac853d9db97e29},
   {0xc3407dfc2de6377e, 0x5b9e93eea4256f77, 0xadb58fdd50c845e0, 0x5219ff11a75bed86, 0x356b61cfd90b1de9,
    0xfb8f406e25abe037, 0x7a5a0231c0f60796, 0x9d3cd216e1f5020b, 0x0c6550fb6b48d8f3, 0xf57508c427ff1c62,
    0x4ad35ffa71cb407d, 0x6290a2da1666aa6d, 0xe284ec2349355f9f, 0xb3c307c53d7c84ec, 0x05e23c0468365a02,
    0x190bac4d6c9ebfa8, 0x94bbbee9e28b80fa, 0xa34fc777529cb9b5, 0xcc7b39f095bcd978, 0x2426addb0ce532e3,
    0x7e79329312ce4fc7, 0xab09a72eebec2917, 0xf8d15499f6b9d6c2, 0x1a55b8babf8c895d, 0xdb8add17fb769a85,
    0xb57f2f368658e81b, 0x8acd36f18f3f41f6, 0x5ce3b7bba50f11d3, 0x114dcc14d5ee2f0a, 0xb91a7fcded1030e8,
    0x81d5425fe55de7a1, 0xb6213bc1554adeee, 0x80144ef95f53f5f2, 0x1e7688186db4c10c, 0x3b912965db5fe1bc,
    0xc281715a97e8252d, 0x54a5d7e21c7f8171, 0x4b12535ccbc5522e, 0x1d289cefbea6f7f9, 0x6ef5f2217d2e729e,
    0xe6a7dc819b0d17ce, 0x1b94b41c05829b0e, 0x33d7493c622f711e, 0xdcf7f942fa5ce421, 0x600fba8b7f7a8ecb,
    0x46b60f011a83988e, 0x235b898e0dcf4c47, 0x957ab24f588592a9, 0x4354330572b5c28c, 0xa5f3ef84e9b8d542,
    0x8c711e02341b2d01, 0x0b1874ae6a62a657, 0x1213d8e306fc19ff, 0xfe6d7c6a4d9dba35, 0x65ed868f174cd4c9,
    0x88522ea0e6236550, 0x899322065c2d7703, 0xc01e690bfef4018b, 0x915982ed8abddaf8, 0xbe675b98ec3a4e4c,
    0xa996bf7f82f00db1, 0xe1daf8d49a27696a, 0x2effd5d3dc8986e7, 0xd153a51f2b1a2e81, 0x18caa0ebd690adfb,
    0x390e3134b243c51a, 0x2778b92cdff70416, 0x029f1851691c24a6, 0x5e7cafeacc133575, 0xfa4e4cc89fa5f264,
    0x5a5f9f481e2b7d24, 0x484c47ab18d764db, 0x400a27f2a1a7f479, 0xaeeb9b2a83da7315, 0x721c626879869734,
    0x042330a2d2384851, 0x85f672fd3765aff0, 0xba446b3a3e02061d, 0x73dd6ecec3888567, 0xffac70ccf793a866,
    0xdfa9edb5294ed2d4, 0x6c6aea7014325638, 0x834a5a0e8c41c307, 0xcdba35562fb2cb2b, 0x0ad97808d06cb404,
    0x0f3b440cb85aee06, 0xe5f9c876481f213b, 0x98deee1289c35809, 0x59018bbfcd394bd1, 0xe01bf47220297b39,
    0xde68e1139340c087, 0x9fa3ca4788e926ad, 0xbb85679c840c144e, 0x53d8f3b71d55ffd5, 0x0da45c5dd146caa0,
    0x6f34fe87c72060cd, 0x57fbc315cf6db784, 0xcee421a1fca0fdde, 0x3d2d0196607b8d4b, 0x642c8a29ad42c69a,
    0x14aff010bdd87508, 0xac74837beac657b3, 0x3216459ad821634d, 0x3fb219c70967a9ed, 0x06bc28f3bb246cf7,
    0xf2082c9126d562c6, 0x66b39278c45ee23c, 0xbd394f6f3f2878b9, 0xfd33689d9e8f8cc0, 0x37f4799eb017394f,
    0x108cc0b26fe03d59, 0xda4bd1b1417888d6, 0xb09d1332ee6eb219, 0x2f3ed975668794b4, 0x58c0871977375982,
    0x7561463d78ace990, 0x09876cff037e82f1, 0x7fb83e35a8c05d94, 0x26b9b58a65f91645, 0xef20b07e9873953f,
    0x3148516d0b3355b8, 0x41cb2b541ba9e62a, 0x790416c613e43163, 0xa011d380818e8f40, 0x3a5025c36151f3ef,
    0xd57095bdf92266d0, 0x498d4b0da2d97688, 0x8b0c3a57353153a5, 0x21c491df64d368e1, 0x8f2f0af5e7091bf4,
    0x2da1c1240f9bb012, 0xc43d59a92ccc49da, 0xbfa6573e56345c1f, 0x828b56a8364fd154, 0x9a41f643e0df7caf,
    0xbcf843c985266aea, 0x2b1de9d7b4bfdce5, 0x20059d79dedd7ab2, 0x6dabe6d6ae3c446b, 0x45e81bf6c991ae7b,
    0x6351ae7cac68b83e, 0xa432e32253b6c711, 0xd092a9b991143cd2, 0xcac711032e98b58f, 0xd8d4c9e02864ac70,
    0xc5fc550f96c25b89, 0xd7ef8dec903e4276, 0x67729ede7e50f06f, 0xeac28c7af045cf3d, 0xb15c1f945460a04a,
    0x9cfddeb05bfb1058, 0x93c69abce3a1fe5e, 0xeb0380dc4a4bdd6e, 0xd20db1e8f8081874, 0x229a8528b7c15e14,
    0x44291750739fbc28, 0xd3ccbd4e42060a27, 0xf62b1c33f4ed2a97, 0x86a8660ae4779905, 0xd62e814a2a305025,
    0x477703a7a08d8add, 0x7b9b0e977af815c5, 0x78c51a60a9ea2330, 0xa6adfb733aaae3b7, 0x97e5aa1e3199b60f,
    0x0000000000000000, 0xf4b404629df10e31, 0x5564db44a6719322, 0x9207961a59afec0d, 0x9624a6b88b97a45c,
    0x363575380a192b1c, 0x2c60cd82b595a241, 0x7d272664c1dc7932, 0x7142769faa94a1c1, 0xa1d0df263b809d13,
    0x1630e841d4c451ae, 0xc1df65ad44fa13d8, 0x13d2d445bcf20bac, 0xd915c546926abe23, 0x38cf3d92084dd749,
    0xe766d0272103059d, 0xc7634d5effde7f2f, 0x077d2455012a7ea4, 0xedbfa82ff16fb199, 0xaf2a978c39d46146,
    0x42953fa3c8bbd0df, 0xcb061da59496a7dc, 0x25e7a17db6eb20b0, 0x34aa6d6963050fba, 0xa76cf7d580a4f1e4,
    0xf7ea10954ee338c4, 0xfcf2643b24819e93, 0xcf252d0746aeef8d, 0x4ef06f58a3f3082c, 0x563acfb37563a5d7,
    0x5086e740ce47c920, 0x2982f186dda3f843, 0x87696aac5e798b56, 0x5d22bb1d1f010380, 0x035e14f7d31236f5,
    0x3cec0d30da759f18, 0xf3c920379cdb7095, 0xb8db736b571e22bb, 0xdd36f5e44052f672, 0xaac8ab8851e23b44,
    0xa857b3d938fe1fe2, 0x17f1e4e76eca43fd, 0xec7ea4894b61a3ca, 0x9e62c6e132e734fe, 0xd4b1991b432c7483,
    0x6ad6c283af163acf, 0x1ce9904904a8e5aa, 0x5fbda34c761d2726, 0xf910583f4cb7c491, 0xc6a241f845d06d7c,
    0x4f3163fe19fd1a7f, 0xe99c988d2357f9c8, 0x8eee06535d0709a7, 0x0efa48aa0254fc55, 0xb4be23903c56fa48,
    0x763f52caabbedf65, 0xeee1bcd8227d876c, 0xe345e085f33b4dcc, 0x3e731561b369bbbe, 0x2843fd2067adea10,
    0x2adce5710eb1ceb6, 0xb7e03767ef44ccbd, 0x8db012a48e153f52, 0x61ceb62dc5749c98, 0xe85d942b9959eb9b,
    0x4c6f7709caef2c8a, 0x84377e5b8d6bbda3, 0x30895dcbb13d47eb, 0x74a04a9bc2a2fbc3, 0x6b17ce251518289c,
    0xe438c4d0f2113368, 0x1fb784bed7bad35f, 0x9b80fae55ad16efc, 0x77fe5e6c11b0cd36, 0xc858095247849129,
    0x08466059b97090a2, 0x01c10ca6ba0e1253, 0x6988d6747c040c3a, 0x6849dad2c60a1e69, 0x5147ebe67449db73,
    0xc99905f4fd8a837a, 0x991fe2b433cd4a5a, 0xf09734c04fc94660, 0xa28ecbd1e892abe6, 0xf1563866f5c75433,
    0x4dae7baf70e13ed9, 0x7ce62ac27bd26b61, 0x70837a39109ab392, 0x90988e4b30b3c8ab, 0xb2020b63877296bf,
    0x156efcb607d6675b},
   {0xe63f55ce97c331d0, 0x25b506b0015bba16, 0xc8706e29e6ad9ba8, 0x5b43d3775d521f6a, 0x0bfa3d577035106e,
    0xab95fc172afb0e66, 0xf64b63979e7a3276, 0xf58b4562649dad4b, 0x48f7c3dbae0c83f1, 0xff31916642f5c8c5,
    0xcbb048dc1c4a0495, 0x66b8f83cdf622989, 0x35c130e908e2b9b0, 0x7c761a61f0b34fa1, 0x3601161cf205268d,
    0x9e54ccfe2219b7d6, 0x8b7d90a538940837, 0x9cd403588ea35d0b, 0xbc3c6fea9ccc5b5a, 0xe5ff733b6d24aeed,
    0xceed22de0f7eb8d2, 0xec8581cab1ab545e, 0xb96105e88ff8e71d, 0x8ca03501871a5ead, 0x76ccce65d6db2a2f,
    0x5883f582a7b58057, 0x3f7be4ed2e8adc3e, 0x0fe7be06355cd9c9, 0xee054e6c1d11be83, 0x1074365909b903a6,
    0x5dde9f80b4813c10, 0x4a770c7d02b6692c, 0x5379c8d5d7809039, 0xb4067448161ed409, 0x5f5e5026183bd6cd,
    0xe898029bf4c29df9, 0x7fb63c940a54d09c, 0xc5171f897f4ba8bc, 0xa6f28db7b31d3d72, 0x2e4f3be7716eaa78,
    0x0d6771a099e63314, 0x82076254e41bf284, 0x2f0fd2b42733df98, 0x5c9e76d3e2dc49f0, 0x7aeb569619606cdb,
    0x83478b07b2468764, 0xcfadcb8d5923cd32, 0x85dac7f05b95a41e, 0xb5469d1b4043a1e9, 0xb821ecbbd9a592fd,
    0x1b8e0b0e798c13c8, 0x62a57b6d9a0be02e, 0xfcf1b793b81257f8, 0x9d94ea0bd8fe28eb, 0x4cea408aeb654a56,
    0x23284a47e888996c, 0x2d8f1d128b893545, 0xf4cbac3132c0d8ab, 0xbd7c86b9ca912eba, 0x3a268eef3dbe6079,
    0xf0d62f6077a9110c, 0x2735c916ade150cb, 0x89fd5f03942ee2ea, 0x1acee25d2fd16628, 0x90f39bab41181bff,
    0x430dfe8cde39939f, 0xf70b8ac4c8274796, 0x1c53aeaac6024552, 0x13b410acf35e9c9b, 0xa532ab4249faa24f,
    0x2b1251e5625a163f, 0xd7e3e676da4841c7, 0xa7b264e4e5404892, 0xda8497d643ae72d3, 0x861ae105a1723b23,
    0x38a6414991048aa4, 0x6578dec92585b6b4, 0x0280cfa6acbaeadd, 0x88bdb650c273970a, 0x9333bd5ebbff84c2,
    0x4e6a8f2c47dfa08b, 0x321c954db76cef2a, 0x418d312a72837942, 0xb29b38bfffcdf773, 0x6c022c38f90a4c07,
    0x5a033a240b0f6a8a, 0x1f93885f3ce5da6f, 0xc38a537e96988bc6, 0x39e6a81ac759ff44, 0x29929e43cee0fce2,
    0x40cdd87924de0ca2, 0xe9d8ebc8a29fe819, 0x0c2798f3cfbb46f4, 0x55e484223e53b343, 0x4650948ecd0d2fd8,
    0x20e86cb2126f0651, 0x6d42c56baf5739e7, 0xa06fc1405ace1e08, 0x7babbfc54f3d193b, 0x424d17df8864e67f,
    0xd8045870ef14980e, 0xc6d7397c85ac3781, 0x21a885e1443273b1, 0x67f8116f893f5c69, 0x24f5efe35706cff6,
    0xd56329d076f2ab1a, 0x5e1eb9754e66a32d, 0x28d2771098bd8902, 0x8f6013f47dfdc190, 0x17a993fdb637553c,
    0xe0a219397e1012aa, 0x786b9930b5da8606, 0x6e82e39e55b0a6da, 0x875a0856f72f4ec3, 0x3741ff4fa458536d,
    0xac4859b3957558fc, 0x7ef6d5c75c09a57c, 0xc04a758b6c7f14fb, 0xf9acdd91ab26ebbf, 0x7391a467c5ef9668,
    0x335c7c1ee1319aca, 0xa91533b18641e4bb, 0xe4bf9a683b79db0d, 0x8e20faa72ba0b470, 0x51f907737b3a7ae4,
    0x2268a314bed5ec8c, 0xd944b123b949edee, 0x31dcb3b84d8b7017, 0xd3fe65279f218860, 0x097af2f1dc8ffab3,
    0x9b09a6fc312d0b91, 0xcc6ded78a3c4520f, 0x3481d9ba5ebfcc50, 0x4f2a667f1182d56b, 0xdfd9fdd4509ace94,
    0x26752045fbbc252b, 0xbffc491f662bc467, 0xdd593272fc202449, 0x3cbbc218d46d4303, 0x91b372f817456e1f,
    0x681faf69bc6385a0, 0xb686bbeebaa43ed4, 0x1469b5084cd0ca01, 0x98c98009cbca94ac, 0x6438379a73d8c354,
    0xc2caba2dc0c5fe26, 0x3e3b0dbe78d7a9de, 0x50b9ee202d670f04, 0x4590b27b37eab0e5, 0x6025b4cb36b10af3,
    0xfb2c1237079c0162, 0xa12f28130c936be8, 0x4b37e52e54eb1ccc, 0x083a1ba28ad28f53, 0xc10a9cd83a22611b,
    0x9f1425ad7444c236, 0x069d4cf7e9d3237a, 0xedc56899e7f621be, 0x778c273680865fcf, 0x309c5aeb1bd605f7,
    0x8de0dc52d1472b4d, 0xf8ec34c2fd7b9e5f, 0xea18cd3d58787724, 0xaad515447ca67b86, 0x9989695a9d97e14c,
    0x0000000000000000, 0xf196c63321f464ec, 0x71116bc169557cb5, 0xaf887f466f92c7c1, 0x972e3e0ffe964d65,
    0x190ec4a8d536f915, 0x95aef1a9522ca7b8, 0xdc19db21aa7d51a9, 0x94ee18fa0471d258, 0x8087adf248a11859,
    0xc457f6da2916dd5c, 0xfa6cfb6451c17482, 0xf256e0c6db13fbd1, 0x6a9f60cf10d96f7d, 0x4daaa9d9bd383fb6,
    0x03c026f5fae79f3d, 0xde99148706c7bb74, 0x2a52b8b6340763df, 0x6fc20acd03edd33a, 0xd423c08320afdefa,
    0xbbe1ca4e23420dc0, 0x966ed75ca8cb3885, 0xeb58246e0e2502c4, 0x055d6a021334bc47, 0xa47242111fa7d7af,
    0xe3623fcc84f78d97, 0x81c744a11efc6db9, 0xaec8961539cfb221, 0xf31609958d4e8e31, 0x63e5923ecc5695ce,
    0x47107ddd9b505a38, 0xa3afe7b5a0298135, 0x792b7063e387f3e6, 0x0140e953565d75e0, 0x12f4f9ffa503e97b,
    0x750ce8902c3cb512, 0xdbc47e8515f30733, 0x1ed3610c6ab8af8f, 0x5239218681dde5d9, 0xe222d69fd2aaf877,
    0xfe71783514a8bd25, 0xcaf0a18f4a177175, 0x61655d9860ec7f13, 0xe77fbc9dc19e4430, 0x2ccff441ddd440a5,
    0x16e97aaee06a20dc, 0xa855dae2d01c915b, 0x1d1347f9905f30b2, 0xb7c652bdecf94b34, 0xd03e43d265c6175d,
    0xfdb15ec0ee4f2218, 0x57644b8492e9599e, 0x07dda5a4bf8e569a, 0x54a46d71680ec6a3, 0x5624a2d7c4b42c7e,
    0xbebca04c3076b187, 0x7d36f332a6ee3a41, 0x3b6667bc6be31599, 0x695f463aea3ef040, 0xad08b0e0c3282d1c,
    0xb15b1e4a052a684e, 0x44d05b2861b7c505, 0x15295c5b1a8dbfe1, 0x744c01c37a61c0f2, 0x59c31cd1f1e8f5b7,
    0xef45a73f4b4ccb63, 0x6bdf899c46841a9d, 0x3dfb2b4b823036e3, 0xa2ef0ee6f674f4d5, 0x184e2dfb836b8cf5,
    0x1134df0a5fe47646, 0xbaa1231d751f7820, 0xd17eaa81339b62bd, 0xb01bf71953771dae, 0x849a2ea30dc8d1fe,
    0x705182923f080955, 0x0ea757556301ac29, 0x041d83514569c9a7, 0x0abad4042668658e, 0x49b72a88f851f611,
    0x8a3d79f66ec97dd7, 0xcd2d042bf59927ef, 0xc930877ab0f0ee48, 0x9273540deda2f122, 0xc797d02fd3f14261,
    0xe1e2f06a284d674a, 0xd2be8c74c97cfd80, 0x9a494faf67707e71, 0xb3dbd1eca9908293, 0x72d14d3493b2e388,
    0xd6a30f258c153427}};

STREEBOG_C

const uint64_t Botan::STREEBOG_C

extern

Definition at line 452 of file streebog_precalc.cpp.

                                          {{0xdd806559f2a64507,
                                            0x05767436cc744d23,
                                            0xa2422a08a460d315,
                                            0x4b7ce09192676901,
                                            0x714eb88d7585c4fc,
                                            0x2f6a76432e45d016,
                                            0xebcb2f81c0657c1f,
                                            0xb1085bda1ecadae9},
                                           {0xe679047021b19bb7,
                                            0x55dda21bd7cbcd56,
                                            0x5cb561c2db0aa7ca,
                                            0x9ab5176b12d69958,
                                            0x61d55e0f16b50131,
                                            0xf3feea720a232b98,
                                            0x4fe39d460f70b5d7,
                                            0x6fa3b58aa99d2f1a},
                                           {0x991e96f50aba0ab2,
                                            0xc2b6f443867adb31,
                                            0xc1c93a376062db09,
                                            0xd3e20fe490359eb1,
                                            0xf2ea7514b1297b7b,
                                            0x06f15e5f529c1f8b,
                                            0x0a39fc286a3d8435,
                                            0xf574dcac2bce2fc7},
                                           {0x220cbebc84e3d12e,
                                            0x3453eaa193e837f1,
                                            0xd8b71333935203be,
                                            0xa9d72c82ed03d675,
                                            0x9d721cad685e353f,
                                            0x488e857e335c3c7d,
                                            0xf948e1a05d71e4dd,
                                            0xef1fdfb3e81566d2},
                                           {0x601758fd7c6cfe57,
                                            0x7a56a27ea9ea63f5,
                                            0xdfff00b723271a16,
                                            0xbfcd1747253af5a3,
                                            0x359e35d7800fffbd,
                                            0x7f151c1f1686104a,
                                            0x9a3f410c6ca92363,
                                            0x4bea6bacad474799},
                                           {0xfa68407a46647d6e,
                                            0xbf71c57236904f35,
                                            0x0af21f66c2bec6b6,
                                            0xcffaa6b71c9ab7b4,
                                            0x187f9ab49af08ec6,
                                            0x2d66c4f95142a46c,
                                            0x6fa4c33b7a3039c0,
                                            0xae4faeae1d3ad3d9},
                                           {0x8886564d3a14d493,
                                            0x3517454ca23c4af3,
                                            0x06476983284a0504,
                                            0x0992abc52d822c37,
                                            0xd3473e33197a93c9,
                                            0x399ec6c7e6bf87c9,
                                            0x51ac86febf240954,
                                            0xf4c70e16eeaac5ec},
                                           {0xa47f0dd4bf02e71e,
                                            0x36acc2355951a8d9,
                                            0x69d18d2bd1a5c42f,
                                            0xf4892bcb929b0690,
                                            0x89b4443b4ddbc49a,
                                            0x4eb7f8719c36de1e,
                                            0x03e7aa020c6e4141,
                                            0x9b1f5b424d93c9a7},
                                           {0x7261445183235adb,
                                            0x0e38dc92cb1f2a60,
                                            0x7b2b8a9aa6079c54,
                                            0x800a440bdbb2ceb1,
                                            0x3cd955b7e00d0984,
                                            0x3a7d3a1b25894224,
                                            0x944c9ad8ec165fde,
                                            0x378f5a541631229b},
                                           {0x74b4c7fb98459ced,
                                            0x3698fad1153bb6c3,
                                            0x7a1e6c303b7652f4,
                                            0x9fe76702af69334b,
                                            0x1fffe18a1b336103,
                                            0x8941e71cff8a78db,
                                            0x382ae548b2e4f3f3,
                                            0xabbedea680056f52},
                                           {0x6bcaa4cd81f32d1b,
                                            0xdea2594ac06fd85d,
                                            0xefbacd1d7d476e98,
                                            0x8a1d71efea48b9ca,
                                            0x2001802114846679,
                                            0xd8fa6bbbebab0761,
                                            0x3002c6cd635afe94,
                                            0x7bcd9ed0efc889fb},
                                           {0x48bc924af11bd720,
                                            0xfaf417d5d9b21b99,
                                            0xe71da4aa88e12852,
                                            0x5d80ef9d1891cc86,
                                            0xf82012d430219f9b,
                                            0xcda43c32bcdf1d77,
                                            0xd21380b00449b17a,
                                            0x378ee767f11631ba}};

Referenced by Botan::Streebog::compress_64().

WORDS_448

size_t Botan::WORDS_448 = 7

constexpr

Definition at line 22 of file curve448_gf.h.

Referenced by Botan::Gf448Elem::bytes_are_canonical_representation(), Botan::Gf448Elem::ct_cond_assign(), Botan::Gf448Elem::ct_cond_swap(), Botan::Gf448Elem::is_zero(), and Botan::Gf448Elem::operator==().

X448_LEN

size_t Botan::X448_LEN = 56

constexpr

Definition at line 16 of file x448_internal.h.

Referenced by Botan::X448_PrivateKey::check_key(), decode_point(), decode_scalar(), Botan::X448_PrivateKey::X448_PrivateKey(), Botan::X448_PrivateKey::X448_PrivateKey(), and Botan::X448_PublicKey::X448_PublicKey().