_ZN5Botan9AEAD_Mode19set_associated_dataENSt3__14spanIKhLm18446744073709551615EEE:
   59|    684|      void set_associated_data(std::span<const uint8_t> ad) { set_associated_data_n(0, ad); }

_ZN5Botan11ASN1_ObjectC2ERKS0_:
  112|  1.03M|      ASN1_Object(const ASN1_Object&) = default;
_ZN5Botan11ASN1_ObjectD2Ev:
  114|  1.43M|      virtual ~ASN1_Object() = default;
_ZN5Botan10BER_ObjectC2Ev:
  122|   742k|      BER_Object() : m_type_tag(ASN1_Type::NoObject), m_class_tag(ASN1_Class::Universal) {}
_ZNK5Botan10BER_Object6is_setEv:
  132|  1.05M|      bool is_set() const { return m_type_tag != ASN1_Type::NoObject; }
_ZNK5Botan10BER_Object7taggingEv:
  134|   545k|      uint32_t tagging() const { return type_tag() | class_tag(); }
_ZNK5Botan10BER_Object8type_tagEv:
  136|   545k|      ASN1_Type type_tag() const { return m_type_tag; }
_ZNK5Botan10BER_Object9class_tagEv:
  138|   545k|      ASN1_Class class_tag() const { return m_class_tag; }
_ZNK5Botan10BER_Object4typeEv:
  140|   127k|      ASN1_Type type() const { return m_type_tag; }
_ZNK5Botan10BER_Object4bitsEv:
  144|  6.19M|      const uint8_t* bits() const { return m_value.data(); }
_ZNK5Botan10BER_Object6lengthEv:
  146|  12.7M|      size_t length() const { return m_value.size(); }
_ZN5Botan10BER_Object12mutable_bitsEm:
  163|   458k|      uint8_t* mutable_bits(size_t length) {
  164|   458k|         m_value.resize(length);
  165|   458k|         return m_value.data();
  166|   458k|      }
_ZN5Botan3OIDC2Ev:
  212|   127k|      explicit OID() {}
_ZN5Botan3OIDC2ESt16initializer_listIjE:
  223|    313|      explicit OID(std::initializer_list<uint32_t> init) : m_id(init) {
  224|    313|         BOTAN_ARG_CHECK(m_id.size() > 2 && m_id[0] <= 2 && (m_id[0] != 2 || m_id[1] <= 39), "Invalid OID");
  ------------------
  |  |   30|    313|   do {                                                          \
  |  |   31|  1.66k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 313, False: 0]
  |  |  |  Branch (31:12): [True: 313, False: 0]
  |  |  |  Branch (31:12): [True: 210, False: 103]
  |  |  |  Branch (31:12): [True: 103, False: 0]
  |  |  ------------------
  |  |   32|    313|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    313|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  225|    313|      }
_ZNK5Botan3OID5emptyEv:
  259|  28.5k|      bool empty() const { return m_id.empty(); }
_ZNK5Botan3OID9has_valueEv:
  265|  90.9k|      bool has_value() const { return (m_id.empty() == false); }
_ZNK5Botan3OID14get_componentsEv:
  271|   185k|      const std::vector<uint32_t>& get_components() const { return m_id; }
_ZNK5Botan3OIDeqERKS0_:
  303|   151k|      bool operator==(const OID& other) const { return m_id == other.m_id; }
_ZNK5Botan11ASN1_String5valueEv:
  407|  57.7k|      const std::string& value() const { return m_utf8_str; }
_ZNK5Botan11ASN1_String5emptyEv:
  411|  57.8k|      bool empty() const { return m_utf8_str.empty(); }
_ZNK5Botan19AlgorithmIdentifier3oidEv:
  447|  58.1k|      const OID& oid() const { return m_oid; }
_ZNK5Botan19AlgorithmIdentifier10parametersEv:
  449|  23.4k|      const std::vector<uint8_t>& parameters() const { return m_parameters; }
_ZNK5Botan19AlgorithmIdentifier20parameters_are_emptyEv:
  461|  11.5k|      bool parameters_are_empty() const { return m_parameters.empty(); }
_ZNK5Botan19AlgorithmIdentifier28parameters_are_null_or_emptyEv:
  463|  11.5k|      bool parameters_are_null_or_empty() const { return parameters_are_empty() || parameters_are_null(); }
  ------------------
  |  Branch (463:58): [True: 0, False: 11.5k]
  |  Branch (463:84): [True: 11.5k, False: 0]
  ------------------
_ZN5BotanorENS_10ASN1_ClassES0_:
   76|   296k|inline ASN1_Class operator|(ASN1_Class x, ASN1_Class y) {
   77|   296k|   return static_cast<ASN1_Class>(static_cast<uint32_t>(x) | static_cast<uint32_t>(y));
   78|   296k|}
_ZN5BotanorENS_9ASN1_TypeENS_10ASN1_ClassE:
   80|   545k|inline uint32_t operator|(ASN1_Type x, ASN1_Class y) { return static_cast<uint32_t>(x) | static_cast<uint32_t>(y); }
_ZN5BotanorENS_10ASN1_ClassENS_9ASN1_TypeE:
   82|  86.9k|inline uint32_t operator|(ASN1_Class x, ASN1_Type y) { return static_cast<uint32_t>(x) | static_cast<uint32_t>(y); }
_ZN5BotanneERKNS_3OIDES2_:
  320|  34.6k|inline bool operator!=(const OID& a, const OID& b) { return !(a == b); }
_ZN5Botan11ASN1_ObjectC2Ev:
  111|   395k|      ASN1_Object() = default;
_ZN5Botan10BER_ObjectC2EOS0_:
  128|   203k|      BER_Object(BER_Object&& other) = default;
_ZN5Botan10BER_ObjectaSEOS0_:
  130|  40.4k|      BER_Object& operator=(BER_Object&& other) = default;
_ZN5Botan19AlgorithmIdentifierC2Ev:
  439|  69.6k|      AlgorithmIdentifier() = default;
_ZN5Botan9ASN1_TimeC2Ev:
  354|  11.5k|      ASN1_Time() = default;

_ZN5Botan13ignore_paramsIJRKNS_3TLS15Session_SummaryEEEEvDpOT_:
  114|    245|void ignore_params(T&&... args) {
  115|    245|   (ignore_param(args), ...);
  116|    245|}
_ZN5Botan12ignore_paramIRKNS_3TLS15Session_SummaryEEEvOT_:
  111|    245|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKNSt3__16vectorINS_16X509_CertificateENS1_9allocatorIS3_EEEEEEEvDpOT_:
  114|     27|void ignore_params(T&&... args) {
  115|     27|   (ignore_param(args), ...);
  116|     27|}
_ZN5Botan12ignore_paramIRKNSt3__16vectorINS_16X509_CertificateENS1_9allocatorIS3_EEEEEEvOT_:
  111|     27|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKNS_3TLS26Certificate_Status_RequestEEEEvDpOT_:
  114|     27|void ignore_params(T&&... args) {
  115|     27|   (ignore_param(args), ...);
  116|     27|}
_ZN5Botan12ignore_paramIRKNS_3TLS26Certificate_Status_RequestEEEvOT_:
  111|     27|void ignore_param(T&&) {}
_ZN5Botan12ignore_paramIRPKhEEvOT_:
  111|  3.53k|void ignore_param(T&&) {}
_ZN5Botan12ignore_paramIRmEEvOT_:
  111|   461M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRmEEEvDpOT_:
  114|   461M|void ignore_params(T&&... args) {
  115|   461M|   (ignore_param(args), ...);
  116|   461M|}
_ZN5Botan13ignore_paramsIJRKmEEEvDpOT_:
  114|  6.58M|void ignore_params(T&&... args) {
  115|  6.58M|   (ignore_param(args), ...);
  116|  6.58M|}
_ZN5Botan12ignore_paramIRKmEEvOT_:
  111|   131M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKmS2_EEEvDpOT_:
  114|  62.5M|void ignore_params(T&&... args) {
  115|  62.5M|   (ignore_param(args), ...);
  116|  62.5M|}
_ZN5Botan13ignore_paramsIJRNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEEvDpOT_:
  114|    846|void ignore_params(T&&... args) {
  115|    846|   (ignore_param(args), ...);
  116|    846|}
_ZN5Botan12ignore_paramIRNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEvOT_:
  111|    846|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRhEEEvDpOT_:
  114|  58.1k|void ignore_params(T&&... args) {
  115|  58.1k|   (ignore_param(args), ...);
  116|  58.1k|}
_ZN5Botan12ignore_paramIRhEEvOT_:
  111|  58.1k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRPKhRmEEEvDpOT_:
  114|  3.53k|void ignore_params(T&&... args) {
  115|  3.53k|   (ignore_param(args), ...);
  116|  3.53k|}
_ZN5Botan13ignore_paramsIJRNS_3TLS16Protocol_VersionEEEEvDpOT_:
  114|  21.7k|void ignore_params(T&&... args) {
  115|  21.7k|   (ignore_param(args), ...);
  116|  21.7k|}
_ZN5Botan12ignore_paramIRNS_3TLS16Protocol_VersionEEEvOT_:
  111|  21.7k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRPKmRmEEEvDpOT_:
  114|  72.3k|void ignore_params(T&&... args) {
  115|  72.3k|   (ignore_param(args), ...);
  116|  72.3k|}
_ZN5Botan12ignore_paramIRPKmEEvOT_:
  111|  72.3k|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRNSt3__16vectorImNS_16secure_allocatorImEEEEEEEvDpOT_:
  114|  24.2M|void ignore_params(T&&... args) {
  115|  24.2M|   (ignore_param(args), ...);
  116|  24.2M|}
_ZN5Botan12ignore_paramIRNSt3__16vectorImNS_16secure_allocatorImEEEEEEvOT_:
  111|  24.2M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRlEEEvDpOT_:
  114|  24.2M|void ignore_params(T&&... args) {
  115|  24.2M|   (ignore_param(args), ...);
  116|  24.2M|}
_ZN5Botan12ignore_paramIRlEEvOT_:
  111|  24.2M|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKhEEEvDpOT_:
  114|    124|void ignore_params(T&&... args) {
  115|    124|   (ignore_param(args), ...);
  116|    124|}
_ZN5Botan12ignore_paramIRKhEEvOT_:
  111|    124|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRtEEEvDpOT_:
  114|    144|void ignore_params(T&&... args) {
  115|    144|   (ignore_param(args), ...);
  116|    144|}
_ZN5Botan12ignore_paramIRtEEvOT_:
  111|    144|void ignore_param(T&&) {}
_ZN5Botan13ignore_paramsIJRKNS_2CT4MaskItEEEEEvDpOT_:
  114|     72|void ignore_params(T&&... args) {
  115|     72|   (ignore_param(args), ...);
  116|     72|}
_ZN5Botan12ignore_paramIRKNS_2CT4MaskItEEEEvOT_:
  111|     72|void ignore_param(T&&) {}

_ZN5Botan11BER_Decoder14start_sequenceEv:
  112|   139k|      BER_Decoder start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder9raw_bytesINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EE:
  160|  46.5k|      BER_Decoder& raw_bytes(std::vector<uint8_t, Alloc>& out) {
  161|  46.5k|         out.clear();
  162|  46.5k|         uint8_t buf;
  163|  4.62M|         while(m_source->read_byte(buf))
  ------------------
  |  Branch (163:16): [True: 4.57M, False: 46.5k]
  ------------------
  164|  4.57M|            out.push_back(buf);
  165|  46.5k|         return (*this);
  166|  46.5k|      }
_ZN5Botan11BER_DecoderC2ENSt3__14spanIKhLm18446744073709551615EEE:
   31|  11.5k|      BER_Decoder(std::span<const uint8_t> buf) : BER_Decoder(buf.data(), buf.size()) {}
_ZN5Botan11BER_Decoder8get_nextERNS_10BER_ObjectE:
   68|  11.5k|      BER_Decoder& get_next(BER_Object& ber) {
   69|  11.5k|         ber = get_next_object();
   70|  11.5k|         return (*this);
   71|  11.5k|      }
_ZN5Botan11BER_Decoder9start_setEv:
  114|  58.1k|      BER_Decoder start_set() { return start_cons(ASN1_Type::Set, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder6decodeERm:
  178|  11.5k|      BER_Decoder& decode(size_t& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder6decodeERNS_6BigIntE:
  183|  63.5k|      BER_Decoder& decode(BigInt& out) { return decode(out, ASN1_Type::Integer, ASN1_Class::Universal); }
_ZN5Botan11BER_Decoder6decodeINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeE:
  195|  17.3k|      BER_Decoder& decode(std::vector<uint8_t, Alloc>& out, ASN1_Type real_type) {
  196|  17.3k|         return decode(out, real_type, real_type, ASN1_Class::Universal);
  197|  17.3k|      }
_ZN5Botan11BER_Decoder6decodeINS_16secure_allocatorIhEEEERS0_RNSt3__16vectorIhT_EENS_9ASN1_TypeE:
  195|  5.77k|      BER_Decoder& decode(std::vector<uint8_t, Alloc>& out, ASN1_Type real_type) {
  196|  5.77k|         return decode(out, real_type, real_type, ASN1_Class::Universal);
  197|  5.77k|      }
_ZN5Botan11BER_Decoder16decode_and_checkImEERS0_RKT_NSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE:
  254|  11.5k|      BER_Decoder& decode_and_check(const T& expected, std::string_view error_msg) {
  255|  11.5k|         T actual;
  256|  11.5k|         decode(actual);
  257|       |
  258|  11.5k|         if(actual != expected)
  ------------------
  |  Branch (258:13): [True: 0, False: 11.5k]
  ------------------
  259|      0|            throw Decoding_Error(error_msg);
  260|       |
  261|  11.5k|         return (*this);
  262|  11.5k|      }
_ZN5Botan11BER_Decoder15decode_optionalImEERS0_RT_NS_9ASN1_TypeENS_10ASN1_ClassERKS3_:
  313|  5.77k|BER_Decoder& BER_Decoder::decode_optional(T& out, ASN1_Type type_tag, ASN1_Class class_tag, const T& default_value) {
  314|  5.77k|   BER_Object obj = get_next_object();
  315|       |
  316|  5.77k|   if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (316:7): [True: 0, False: 5.77k]
  ------------------
  317|      0|      if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (317:10): [True: 0, False: 0]
  ------------------
  318|      0|         BER_Decoder(std::move(obj)).decode(out).verify_end();
  319|      0|      } else {
  320|      0|         push_back(std::move(obj));
  321|      0|         decode(out, type_tag, class_tag);
  322|      0|      }
  323|  5.77k|   } else {
  324|  5.77k|      out = default_value;
  325|  5.77k|      push_back(std::move(obj));
  326|  5.77k|   }
  327|       |
  328|  5.77k|   return (*this);
  329|  5.77k|}
_ZN5Botan11BER_Decoder22decode_optional_stringINSt3__19allocatorIhEEEERS0_RNS2_6vectorIhT_EENS_9ASN1_TypeEjNS_10ASN1_ClassE:
  271|  11.5k|                                          ASN1_Class class_tag = ASN1_Class::ContextSpecific) {
  272|  11.5k|         BER_Object obj = get_next_object();
  273|       |
  274|  11.5k|         ASN1_Type type_tag = static_cast<ASN1_Type>(expected_tag);
  275|       |
  276|  11.5k|         if(obj.is_a(type_tag, class_tag)) {
  ------------------
  |  Branch (276:13): [True: 0, False: 11.5k]
  ------------------
  277|      0|            if(class_tag == ASN1_Class::ExplicitContextSpecific) {
  ------------------
  |  Branch (277:16): [True: 0, False: 0]
  ------------------
  278|      0|               BER_Decoder(std::move(obj)).decode(out, real_type).verify_end();
  279|      0|            } else {
  280|      0|               push_back(std::move(obj));
  281|      0|               decode(out, real_type, type_tag, class_tag);
  282|      0|            }
  283|  11.5k|         } else {
  284|  11.5k|            out.clear();
  285|  11.5k|            push_back(std::move(obj));
  286|  11.5k|         }
  287|       |
  288|  11.5k|         return (*this);
  289|  11.5k|      }

_ZN5Botan6BigInt4zeroEv:
   44|  1.49M|      static BigInt zero() { return BigInt(); }
_ZN5Botan6BigInt3oneEv:
   49|  18.6k|      static BigInt one() { return BigInt::from_word(1); }
_ZN5Botan6BigIntC2EOS0_:
  145|  1.71M|      BigInt(BigInt&& other) { this->swap(other); }
_ZN5Botan6BigIntD2Ev:
  147|  22.7M|      ~BigInt() { const_time_unpoison(); }
_ZN5Botan6BigIntaSEOS0_:
  152|  3.03M|      BigInt& operator=(BigInt&& other) {
  153|  3.03M|         if(this != &other)
  ------------------
  |  Branch (153:13): [True: 3.03M, False: 0]
  ------------------
  154|  3.03M|            this->swap(other);
  155|       |
  156|  3.03M|         return (*this);
  157|  3.03M|      }
_ZN5Botan6BigInt4swapERS0_:
  168|  46.9M|      void swap(BigInt& other) {
  169|  46.9M|         m_data.swap(other.m_data);
  170|  46.9M|         std::swap(m_signedness, other.m_signedness);
  171|  46.9M|      }
_ZN5Botan6BigInt8swap_regERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  173|  39.9M|      void swap_reg(secure_vector<word>& reg) {
  174|  39.9M|         m_data.swap(reg);
  175|       |         // sign left unchanged
  176|  39.9M|      }
_ZN5Botan6BigIntpLERKS0_:
  182|  1.55M|      BigInt& operator+=(const BigInt& y) { return add(y.data(), y.sig_words(), y.sign()); }
_ZN5Botan6BigIntmIERKS0_:
  194|  1.50M|      BigInt& operator-=(const BigInt& y) { return sub(y.data(), y.sig_words(), y.sign()); }
_ZN5Botan6BigInt3subEPKmmNS0_4SignE:
  288|  1.50M|      BigInt& sub(const word y[], size_t y_words, Sign sign) {
  289|  1.50M|         return add(y, y_words, sign == Positive ? Negative : Positive);
  ------------------
  |  Branch (289:33): [True: 1.50M, False: 0]
  ------------------
  290|  1.50M|      }
_ZN5Botan6BigInt5clearEv:
  366|   397k|      void clear() {
  367|   397k|         m_data.set_to_zero();
  368|   397k|         m_signedness = Positive;
  369|   397k|      }
_ZNK5Botan6BigInt7is_evenEv:
  406|   119k|      bool is_even() const { return (get_bit(0) == 0); }
_ZNK5Botan6BigInt6is_oddEv:
  412|  49.8k|      bool is_odd() const { return (get_bit(0) == 1); }
_ZNK5Botan6BigInt10is_nonzeroEv:
  418|   118k|      bool is_nonzero() const { return (!is_zero()); }
_ZNK5Botan6BigInt7is_zeroEv:
  424|  29.7M|      bool is_zero() const { return (sig_words() == 0); }
_ZN5Botan6BigInt7set_bitEm:
  430|   213k|      void set_bit(size_t n) { conditionally_set_bit(n, true); }
_ZN5Botan6BigInt21conditionally_set_bitEmb:
  440|   558M|      void conditionally_set_bit(size_t n, bool set_it) {
  441|   558M|         const size_t which = n / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|   558M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  442|   558M|         const word mask = static_cast<word>(set_it) << (n % BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|   558M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  443|   558M|         m_data.set_word_at(which, word_at(which) | mask);
  444|   558M|      }
_ZN5Botan6BigInt9mask_bitsEm:
  456|  75.1M|      void mask_bits(size_t n) { m_data.mask_bits(n); }
_ZNK5Botan6BigInt7get_bitEm:
  463|   478M|      bool get_bit(size_t n) const { return ((word_at(n / BOTAN_MP_WORD_BITS) >> (n % BOTAN_MP_WORD_BITS)) & 1); }
  ------------------
  |  |   50|   478M|#define BOTAN_MP_WORD_BITS 64
  ------------------
                    bool get_bit(size_t n) const { return ((word_at(n / BOTAN_MP_WORD_BITS) >> (n % BOTAN_MP_WORD_BITS)) & 1); }
  ------------------
  |  |   50|   478M|#define BOTAN_MP_WORD_BITS 64
  ------------------
_ZNK5Botan6BigInt7word_atEm:
  514|  1.53G|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZN5Botan6BigInt11set_word_atEmm:
  516|   104M|      void set_word_at(size_t i, word w) { m_data.set_word_at(i, w); }
_ZN5Botan6BigInt9set_wordsEPKmm:
  518|  6.18M|      void set_words(const word w[], size_t len) { m_data.set_words(w, len); }
_ZNK5Botan6BigInt11is_negativeEv:
  524|   309M|      bool is_negative() const { return (sign() == Negative); }
_ZNK5Botan6BigInt11is_positiveEv:
  530|  7.32M|      bool is_positive() const { return (sign() == Positive); }
_ZNK5Botan6BigInt4signEv:
  536|   338M|      Sign sign() const { return (m_signedness); }
_ZNK5Botan6BigInt12reverse_signEv:
  541|   830k|      Sign reverse_sign() const {
  542|   830k|         if(sign() == Positive)
  ------------------
  |  Branch (542:13): [True: 830k, False: 0]
  ------------------
  543|   830k|            return Negative;
  544|      0|         return Positive;
  545|   830k|      }
_ZN5Botan6BigInt9flip_signEv:
  550|  3.72k|      void flip_sign() { set_sign(reverse_sign()); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  556|  9.45M|      void set_sign(Sign sign) {
  557|  9.45M|         if(sign == Negative && is_zero())
  ------------------
  |  Branch (557:13): [True: 3.83k, False: 9.44M]
  |  Branch (557:33): [True: 0, False: 3.83k]
  ------------------
  558|      0|            sign = Positive;
  559|       |
  560|  9.45M|         m_signedness = sign;
  561|  9.45M|      }
_ZNK5Botan6BigInt4sizeEv:
  572|  1.16G|      size_t size() const { return m_data.size(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  578|   166M|      size_t sig_words() const { return m_data.sig_words(); }
_ZN5Botan6BigInt12mutable_dataEv:
  603|   786M|      word* mutable_data() { return m_data.mutable_data(); }
_ZNK5Botan6BigInt4dataEv:
  609|   857M|      const word* data() const { return m_data.const_data(); }
_ZN5Botan6BigInt15get_word_vectorEv:
  614|  25.2M|      secure_vector<word>& get_word_vector() { return m_data.mutable_vector(); }
_ZNK5Botan6BigInt7grow_toEm:
  625|   389M|      void grow_to(size_t n) const { m_data.grow_to(n); }
_ZNK5Botan6BigInt19const_time_unpoisonEv:
  710|  22.7M|      void const_time_unpoison() const {}
_ZN5Botan6BigInt10power_of_2Em:
  726|  33.1k|      static BigInt power_of_2(size_t n) {
  727|  33.1k|         BigInt b;
  728|  33.1k|         b.set_bit(n);
  729|  33.1k|         return b;
  730|  33.1k|      }
_ZN5Botan6BigInt6encodeERKS0_:
  737|  11.5k|      static std::vector<uint8_t> encode(const BigInt& n) {
  738|  11.5k|         std::vector<uint8_t> output(n.bytes());
  739|  11.5k|         n.binary_encode(output.data());
  740|  11.5k|         return output;
  741|  11.5k|      }
_ZN5Botan6BigInt6decodeEPKhm:
  760|  34.1k|      static BigInt decode(const uint8_t buf[], size_t length) { return BigInt(buf, length); }
_ZN5Botan6BigInt4Data12mutable_dataEv:
  816|   793M|            word* mutable_data() {
  817|   793M|               invalidate_sig_words();
  818|   793M|               return m_reg.data();
  819|   793M|            }
_ZNK5Botan6BigInt4Data10const_dataEv:
  821|   857M|            const word* const_data() const { return m_reg.data(); }
_ZN5Botan6BigInt4Data14mutable_vectorEv:
  823|  25.2M|            secure_vector<word>& mutable_vector() {
  824|  25.2M|               invalidate_sig_words();
  825|  25.2M|               return m_reg;
  826|  25.2M|            }
_ZNK5Botan6BigInt4Data11get_word_atEm:
  830|  1.53G|            word get_word_at(size_t n) const {
  831|  1.53G|               if(n < m_reg.size())
  ------------------
  |  Branch (831:19): [True: 1.53G, False: 66.2k]
  ------------------
  832|  1.53G|                  return m_reg[n];
  833|  66.2k|               return 0;
  834|  1.53G|            }
_ZN5Botan6BigInt4Data11set_word_atEmm:
  836|   663M|            void set_word_at(size_t i, word w) {
  837|   663M|               invalidate_sig_words();
  838|   663M|               if(i >= m_reg.size()) {
  ------------------
  |  Branch (838:19): [True: 104M, False: 558M]
  ------------------
  839|   104M|                  if(w == 0)
  ------------------
  |  Branch (839:22): [True: 104M, False: 390k]
  ------------------
  840|   104M|                     return;
  841|   390k|                  grow_to(i + 1);
  842|   390k|               }
  843|   559M|               m_reg[i] = w;
  844|   559M|            }
_ZN5Botan6BigInt4Data9set_wordsEPKmm:
  846|  6.18M|            void set_words(const word w[], size_t len) {
  847|  6.18M|               invalidate_sig_words();
  848|  6.18M|               m_reg.assign(w, w + len);
  849|  6.18M|            }
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  851|   397k|            void set_to_zero() {
  852|   397k|               m_reg.resize(m_reg.capacity());
  853|   397k|               clear_mem(m_reg.data(), m_reg.size());
  854|   397k|               m_sig_words = 0;
  855|   397k|            }
_ZN5Botan6BigInt4Data9mask_bitsEm:
  863|  75.1M|            void mask_bits(size_t n) {
  864|  75.1M|               if(n == 0) {
  ------------------
  |  Branch (864:19): [True: 0, False: 75.1M]
  ------------------
  865|      0|                  return set_to_zero();
  866|      0|               }
  867|       |
  868|  75.1M|               const size_t top_word = n / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  75.1M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  869|       |
  870|       |               // if(top_word < sig_words()) ?
  871|  75.1M|               if(top_word < size()) {
  ------------------
  |  Branch (871:19): [True: 75.1M, False: 7.61k]
  ------------------
  872|  75.1M|                  const word mask = (static_cast<word>(1) << (n % BOTAN_MP_WORD_BITS)) - 1;
  ------------------
  |  |   50|  75.1M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  873|  75.1M|                  const size_t len = size() - (top_word + 1);
  874|  75.1M|                  if(len > 0) {
  ------------------
  |  Branch (874:22): [True: 75.1M, False: 4.78k]
  ------------------
  875|  75.1M|                     clear_mem(&m_reg[top_word + 1], len);
  876|  75.1M|                  }
  877|  75.1M|                  m_reg[top_word] &= mask;
  878|  75.1M|                  invalidate_sig_words();
  879|  75.1M|               }
  880|  75.1M|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
  882|   392M|            void grow_to(size_t n) const {
  883|   392M|               if(n > size()) {
  ------------------
  |  Branch (883:19): [True: 13.9M, False: 378M]
  ------------------
  884|  13.9M|                  if(n <= m_reg.capacity())
  ------------------
  |  Branch (884:22): [True: 3.43M, False: 10.4M]
  ------------------
  885|  3.43M|                     m_reg.resize(n);
  886|  10.4M|                  else
  887|  10.4M|                     m_reg.resize(n + (8 - (n % 8)));
  888|  13.9M|               }
  889|   392M|            }
_ZNK5Botan6BigInt4Data4sizeEv:
  891|  1.71G|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERS1_:
  900|  46.9M|            void swap(Data& other) {
  901|  46.9M|               m_reg.swap(other.m_reg);
  902|  46.9M|               std::swap(m_sig_words, other.m_sig_words);
  903|  46.9M|            }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  905|  40.2M|            void swap(secure_vector<word>& reg) {
  906|  40.2M|               m_reg.swap(reg);
  907|  40.2M|               invalidate_sig_words();
  908|  40.2M|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
  910|  1.60G|            void invalidate_sig_words() const { m_sig_words = sig_words_npos; }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
  912|   166M|            size_t sig_words() const {
  913|   166M|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (913:19): [True: 41.1M, False: 125M]
  ------------------
  914|  41.1M|                  m_sig_words = calc_sig_words();
  915|   125M|               } else {
  916|   125M|                  BOTAN_DEBUG_ASSERT(m_sig_words == calc_sig_words());
  ------------------
  |  |   99|   125M|      do {                          \
  |  |  100|   125M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  917|   125M|               }
  918|   166M|               return m_sig_words;
  919|   166M|            }
_ZN5BotanplERKNS_6BigIntES2_:
  937|   138k|inline BigInt operator+(const BigInt& x, const BigInt& y) { return BigInt::add2(x, y.data(), y.sig_words(), y.sign()); }
_ZN5BotanplERKNS_6BigIntEm:
  939|  9.99k|inline BigInt operator+(const BigInt& x, word y) { return BigInt::add2(x, &y, 1, BigInt::Positive); }
_ZN5BotanmiERKNS_6BigIntES2_:
  943|   826k|inline BigInt operator-(const BigInt& x, const BigInt& y) {
  944|   826k|   return BigInt::add2(x, y.data(), y.sig_words(), y.reverse_sign());
  945|   826k|}
_ZN5BotanmiERKNS_6BigIntEm:
  947|      6|inline BigInt operator-(const BigInt& x, word y) { return BigInt::add2(x, &y, 1, BigInt::Negative); }
_ZN5BotanmlEmRKNS_6BigIntE:
  952|  3.01M|inline BigInt operator*(word x, const BigInt& y) { return y * x; }
_ZN5BotaneqERKNS_6BigIntES2_:
  964|  80.7k|inline bool operator==(const BigInt& a, const BigInt& b) { return a.is_equal(b); }
_ZN5BotanneERKNS_6BigIntES2_:
  966|  65.1k|inline bool operator!=(const BigInt& a, const BigInt& b) { return !a.is_equal(b); }
_ZN5BotanleERKNS_6BigIntES2_:
  968|  57.0k|inline bool operator<=(const BigInt& a, const BigInt& b) { return (a.cmp(b) <= 0); }
_ZN5BotangeERKNS_6BigIntES2_:
  970|   115k|inline bool operator>=(const BigInt& a, const BigInt& b) { return (a.cmp(b) >= 0); }
_ZN5BotanltERKNS_6BigIntES2_:
  972|  1.90M|inline bool operator<(const BigInt& a, const BigInt& b) { return a.is_less_than(b); }
_ZN5BotangtERKNS_6BigIntES2_:
  974|  1.72M|inline bool operator>(const BigInt& a, const BigInt& b) { return b.is_less_than(a); }
_ZN5BotaneqERKNS_6BigIntEm:
  976|  95.3k|inline bool operator==(const BigInt& a, word b) { return (a.cmp_word(b) == 0); }
_ZN5BotanleERKNS_6BigIntEm:
  980|  13.7k|inline bool operator<=(const BigInt& a, word b) { return (a.cmp_word(b) <= 0); }
_ZN5BotangeERKNS_6BigIntEm:
  982|  13.7k|inline bool operator>=(const BigInt& a, word b) { return (a.cmp_word(b) >= 0); }
_ZN5BotanltERKNS_6BigIntEm:
  984|   142k|inline bool operator<(const BigInt& a, word b) { return (a.cmp_word(b) < 0); }
_ZN5BotangtERKNS_6BigIntEm:
  986|  1.78M|inline bool operator>(const BigInt& a, word b) { return (a.cmp_word(b) > 0); }
_Z4swapIN5Botan6BigIntEENSt3__19enable_ifIXaasr21is_move_constructibleIT_EE5valuesr18is_move_assignableIS4_EE5valueEvE4typeERS4_S7_:
  999|  1.72M|inline void swap<Botan::BigInt>(Botan::BigInt& x, Botan::BigInt& y) {
 1000|  1.72M|   x.swap(y);
 1001|  1.72M|}
_ZN5Botan6BigIntC2Ev:
   39|  16.7M|      BigInt() = default;
_ZN5Botan6BigIntC2ERKS0_:
   79|  3.92M|      BigInt(const BigInt& other) = default;
_ZN5Botan6BigIntaSERKS0_:
  162|  8.65M|      BigInt& operator=(const BigInt&) = default;
_ZN5Botan6BigInt13binary_decodeINS_16secure_allocatorIhEEEEvRKNSt3__16vectorIhT_EE:
  672|   248k|      void binary_decode(const std::vector<uint8_t, Alloc>& buf) {
  673|   248k|         binary_decode(buf.data(), buf.size());
  674|   248k|      }

_ZNK5Botan11BlockCipher11parallelismEv:
   54|    318|      virtual size_t parallelism() const { return 1; }
_ZNK5Botan11BlockCipher14parallel_bytesEv:
   59|    964|      size_t parallel_bytes() const { return parallelism() * block_size() * BOTAN_BLOCK_CIPHER_PAR_MULT; }
  ------------------
  |  |  429|    964|#define BOTAN_BLOCK_CIPHER_PAR_MULT 4
  ------------------
_ZNK5Botan11BlockCipher7encryptEPh:
   91|    464|      void encrypt(uint8_t block[]) const { encrypt_n(block, block, 1); }
_ZNK5Botan11BlockCipher7encryptENSt3__14spanIhLm18446744073709551615EEE:
  105|  2.41k|      void encrypt(std::span<uint8_t> block) const {
  106|  2.41k|         return encrypt_n(block.data(), block.data(), block.size() / block_size());
  107|  2.41k|      }
_ZNK5Botan11BlockCipher7encryptENSt3__14spanIKhLm18446744073709551615EEENS2_IhLm18446744073709551615EEE:
  122|  2.05k|      void encrypt(std::span<const uint8_t> in, std::span<uint8_t> out) const {
  123|  2.05k|         return encrypt_n(in.data(), out.data(), in.size() / block_size());
  124|  2.05k|      }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm16ELm0ELm1ENS_11BlockCipherEE8key_specEv:
  213|    409|      Key_Length_Specification key_spec() const final override { return Key_Length_Specification(KMIN, KMAX, KMOD); }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm16ELm0ELm1ENS_11BlockCipherEE10block_sizeEv:
  198|  3.36k|      size_t block_size() const final override { return BS; }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE8key_specEv:
  213|    919|      Key_Length_Specification key_spec() const final override { return Key_Length_Specification(KMIN, KMAX, KMOD); }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE10block_sizeEv:
  198|  3.35k|      size_t block_size() const final override { return BS; }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE13encrypt_n_xexEPhPKhm:
  201|     45|      void encrypt_n_xex(uint8_t data[], const uint8_t mask[], size_t blocks) const final override {
  202|     45|         xor_buf(data, mask, blocks * BS);
  203|     45|         this->encrypt_n(data, data, blocks);
  204|     45|         xor_buf(data, mask, blocks * BS);
  205|     45|      }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm16ELm32ELm0ELm1ENS_11BlockCipherEE13decrypt_n_xexEPhPKhm:
  207|    360|      void decrypt_n_xex(uint8_t data[], const uint8_t mask[], size_t blocks) const final override {
  208|    360|         xor_buf(data, mask, blocks * BS);
  209|    360|         this->decrypt_n(data, data, blocks);
  210|    360|         xor_buf(data, mask, blocks * BS);
  211|    360|      }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm8ELm16ELm24ELm8ENS_11BlockCipherEE8key_specEv:
  213|    174|      Key_Length_Specification key_spec() const final override { return Key_Length_Specification(KMIN, KMAX, KMOD); }
_ZNK5Botan25Block_Cipher_Fixed_ParamsILm8ELm16ELm24ELm8ENS_11BlockCipherEE10block_sizeEv:
  198|    242|      size_t block_size() const final override { return BS; }

_ZN5Botan20Buffered_Computation6updateEPKhm:
   34|   585k|      void update(const uint8_t in[], size_t length) { add_data(in, length); }
_ZN5Botan20Buffered_Computation6updateENSt3__14spanIKhLm18446744073709551615EEE:
   40|   651k|      void update(std::span<const uint8_t> in) { add_data(in.data(), in.size()); }
_ZN5Botan20Buffered_Computation6updateENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   55|  3.80k|      void update(std::string_view str) { add_data(cast_char_ptr_to_uint8(str.data()), str.size()); }
_ZN5Botan20Buffered_Computation5finalEPh:
   69|   381k|      void final(uint8_t out[]) { final_result(out); }
_ZN5Botan20Buffered_Computation12final_stdvecEv:
   83|  27.1k|      std::vector<uint8_t> final_stdvec() { return final<std::vector<uint8_t>>(); }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS2_9allocatorIhEEEEEET_v:
   77|  27.1k|      T final() {
   78|  27.1k|         T output(output_length());
   79|  27.1k|         final_result(output.data());
   80|  27.1k|         return output;
   81|  27.1k|      }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_v:
   77|   102k|      T final() {
   78|   102k|         T output(output_length());
   79|   102k|         final_result(output.data());
   80|   102k|         return output;
   81|   102k|      }
_ZN5Botan20Buffered_Computation7processINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_NS2_4spanIKhLm18446744073709551615EEE:
  128|  89.3k|      T process(std::span<const uint8_t> in) {
  129|  89.3k|         update(in);
  130|  89.3k|         return final<T>();
  131|  89.3k|      }
_ZN5Botan20Buffered_ComputationD2Ev:
  133|   115k|      virtual ~Buffered_Computation() = default;
_ZN5Botan20Buffered_Computation7processINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_PKhm:
  104|  11.5k|      T process(const uint8_t in[], size_t length) {
  105|  11.5k|         update(in, length);
  106|  11.5k|         return final<T>();
  107|  11.5k|      }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_:
   91|  89.3k|      void final(T& out) {
   92|  89.3k|         out.resize(output_length());
   93|  89.3k|         final_result(out.data());
   94|  89.3k|      }
_ZN5Botan20Buffered_Computation5finalINSt3__16vectorIhNS2_9allocatorIhEEEEEEvRT_:
   91|  41.9k|      void final(T& out) {
   92|  41.9k|         out.resize(output_length());
   93|  41.9k|         final_result(out.data());
   94|  41.9k|      }

_ZNK5Botan10ChaCha_RNG31max_number_of_bytes_per_requestEv:
  106|   296k|      size_t max_number_of_bytes_per_request() const override { return 0; }

_ZN5Botan11Cipher_Mode5startENSt3__14spanIKhLm18446744073709551615EEE:
   89|    880|      void start(std::span<const uint8_t> nonce) { start_msg(nonce.data(), nonce.size()); }
_ZN5Botan11Cipher_Mode6finishERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  146|    684|      void finish(secure_vector<uint8_t>& final_block, size_t offset = 0) { finish_msg(final_block, offset); }
_ZN5Botan11Cipher_Mode7processENSt3__14spanIhLm18446744073709551615EEE:
  123|    273|      size_t process(std::span<uint8_t> msg) { return this->process_msg(msg.data(), msg.size()); }
_ZN5Botan11Cipher_Mode7processEPhm:
  125|    196|      size_t process(uint8_t msg[], size_t msg_len) { return this->process_msg(msg, msg_len); }
_ZN5Botan11Cipher_Mode6updateINSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_m:
  133|    273|      void update(T& buffer, size_t offset = 0) {
  134|    273|         BOTAN_ASSERT(buffer.size() >= offset, "Offset ok");
  ------------------
  |  |   51|    273|   do {                                                                                 \
  |  |   52|    273|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 273]
  |  |  ------------------
  |  |   53|    273|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    273|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  135|    273|         const size_t written = process(std::span(buffer).subspan(offset));
  136|    273|         buffer.resize(offset + written);
  137|    273|      }

_ZN5Botan19Credentials_ManagerD2Ev:
   33|  5.77k|      virtual ~Credentials_Manager() = default;

_ZNK5Botan20Curve25519_PublicKey12public_valueEv:
   29|    604|      std::vector<uint8_t> public_value() const { return m_public; }
_ZNK5Botan20Curve25519_PublicKey9algo_nameEv:
   17|      1|      std::string algo_name() const override { return "Curve25519"; }
_ZNK5Botan21Curve25519_PrivateKey12public_valueEv:
   83|    604|      std::vector<uint8_t> public_value() const override { return Curve25519_PublicKey::public_value(); }
_ZN5Botan20Curve25519_PublicKeyC2Ev:
   53|    604|      Curve25519_PublicKey() = default;

_ZN5Botan8CurveGFpC2Ev:
   90|   202k|      CurveGFp() = default;
_ZNK5Botan13CurveGFp_Repr9curve_mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   60|  58.7M|      void curve_mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
   61|  58.7M|         BOTAN_DEBUG_ASSERT(x.sig_words() <= get_p_words());
  ------------------
  |  |   99|  58.7M|      do {                          \
  |  |  100|  58.7M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   62|  58.7M|         curve_mul_words(z, x.data(), x.size(), y, ws);
   63|  58.7M|      }
_ZNK5Botan13CurveGFp_Repr9curve_sqrERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   68|  59.2M|      void curve_sqr(BigInt& z, const BigInt& x, secure_vector<word>& ws) const {
   69|  59.2M|         BOTAN_DEBUG_ASSERT(x.sig_words() <= get_p_words());
  ------------------
  |  |   99|  59.2M|      do {                          \
  |  |  100|  59.2M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   70|  59.2M|         curve_sqr_words(z, x.data(), x.size(), ws);
   71|  59.2M|      }
_ZN5Botan8CurveGFpC2ERKNS_6BigIntES3_S3_:
   98|      6|      CurveGFp(const BigInt& p, const BigInt& a, const BigInt& b) : m_repr(choose_repr(p, a, b)) {}
_ZNK5Botan8CurveGFp5get_aEv:
  107|  23.1k|      const BigInt& get_a() const { return m_repr->get_a(); }
_ZNK5Botan8CurveGFp5get_bEv:
  112|  23.1k|      const BigInt& get_b() const { return m_repr->get_b(); }
_ZNK5Botan8CurveGFp5get_pEv:
  118|  11.2M|      const BigInt& get_p() const { return m_repr->get_p(); }
_ZNK5Botan8CurveGFp11get_p_wordsEv:
  120|  83.2k|      size_t get_p_words() const { return m_repr->get_p_words(); }
_ZNK5Botan8CurveGFp11get_ws_sizeEv:
  122|  11.0M|      size_t get_ws_size() const { return m_repr->get_ws_size(); }
_ZNK5Botan8CurveGFp9get_a_repEv:
  124|  2.84M|      const BigInt& get_a_rep() const { return m_repr->get_a_rep(); }
_ZNK5Botan8CurveGFp9get_b_repEv:
  126|  64.3k|      const BigInt& get_b_rep() const { return m_repr->get_b_rep(); }
_ZNK5Botan8CurveGFp9get_1_repEv:
  128|  87.0k|      const BigInt& get_1_rep() const { return m_repr->get_1_rep(); }
_ZNK5Botan8CurveGFp12a_is_minus_3Ev:
  130|  6.09M|      bool a_is_minus_3() const { return m_repr->a_is_minus_3(); }
_ZNK5Botan8CurveGFp9a_is_zeroEv:
  132|  6.09M|      bool a_is_zero() const { return m_repr->a_is_zero(); }
_ZNK5Botan8CurveGFp6is_oneERKNS_6BigIntE:
  134|  75.9k|      bool is_one(const BigInt& x) const { return m_repr->is_one(x); }
_ZNK5Botan8CurveGFp14invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  136|  57.8k|      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const { return m_repr->invert_element(x, ws); }
_ZNK5Botan8CurveGFp6to_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  138|  37.0k|      void to_rep(BigInt& x, secure_vector<word>& ws) const { m_repr->to_curve_rep(x, ws); }
_ZNK5Botan8CurveGFp8from_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  140|  57.7k|      void from_rep(BigInt& x, secure_vector<word>& ws) const { m_repr->from_curve_rep(x, ws); }
_ZNK5Botan8CurveGFp15from_rep_to_tmpERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  142|   128k|      BigInt from_rep_to_tmp(const BigInt& x, secure_vector<word>& ws) const {
  143|   128k|         BigInt xt(x);
  144|   128k|         m_repr->from_curve_rep(xt, ws);
  145|   128k|         return xt;
  146|   128k|      }
_ZNK5Botan8CurveGFp3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  150|  57.8M|      void mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  151|  57.8M|         m_repr->curve_mul(z, x, y, ws);
  152|  57.8M|      }
_ZNK5Botan8CurveGFp3mulERNS_6BigIntEPKmmRKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  154|  12.9M|      void mul(BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  155|  12.9M|         m_repr->curve_mul_words(z, x_w, x_size, y, ws);
  156|  12.9M|      }
_ZNK5Botan8CurveGFp3sqrERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  158|  45.0M|      void sqr(BigInt& z, const BigInt& x, secure_vector<word>& ws) const { m_repr->curve_sqr(z, x, ws); }
_ZNK5Botan8CurveGFp3sqrERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  160|  1.47M|      void sqr(BigInt& z, const word x_w[], size_t x_size, secure_vector<word>& ws) const {
  161|  1.47M|         m_repr->curve_sqr_words(z, x_w, x_size, ws);
  162|  1.47M|      }
_ZNK5Botan8CurveGFp10mul_to_tmpERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  168|   432k|      BigInt mul_to_tmp(const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  169|   432k|         BigInt z;
  170|   432k|         m_repr->curve_mul(z, x, y, ws);
  171|   432k|         return z;
  172|   432k|      }
_ZNK5Botan8CurveGFp10sqr_to_tmpERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  174|   326k|      BigInt sqr_to_tmp(const BigInt& x, secure_vector<word>& ws) const {
  175|   326k|         BigInt z;
  176|   326k|         m_repr->curve_sqr(z, x, ws);
  177|   326k|         return z;
  178|   326k|      }
_ZN5Botan8CurveGFp4swapERS0_:
  180|   191k|      void swap(CurveGFp& other) { std::swap(m_repr, other.m_repr); }
_ZNK5Botan8CurveGFpeqERKS0_:
  187|  83.2k|      inline bool operator==(const CurveGFp& other) const {
  188|  83.2k|         if(m_repr.get() == other.m_repr.get())
  ------------------
  |  Branch (188:13): [True: 83.2k, False: 0]
  ------------------
  189|  83.2k|            return true;
  190|       |
  191|      0|         return (get_p() == other.get_p()) && (get_a() == other.get_a()) && (get_b() == other.get_b());
  ------------------
  |  Branch (191:17): [True: 0, False: 0]
  |  Branch (191:47): [True: 0, False: 0]
  |  Branch (191:77): [True: 0, False: 0]
  ------------------
  192|  83.2k|      }
_ZN5Botan8CurveGFpC2ERKS0_:
  100|   249k|      CurveGFp(const CurveGFp&) = default;
_ZN5Botan8CurveGFpaSERKS0_:
  102|  14.4k|      CurveGFp& operator=(const CurveGFp&) = default;
_ZN5Botan13CurveGFp_ReprD2Ev:
   23|      6|      virtual ~CurveGFp_Repr() = default;

_ZN5Botan10DataSourceD2Ev:
   92|   262k|      virtual ~DataSource() = default;
_ZN5Botan17DataSource_MemoryC2EPKhm:
  118|  35.4k|      DataSource_Memory(const uint8_t in[], size_t length) : m_source(in, in + length), m_offset(0) {}
_ZN5Botan17DataSource_MemoryC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  124|  12.5k|      explicit DataSource_Memory(secure_vector<uint8_t> in) : m_source(std::move(in)), m_offset(0) {}
_ZN5Botan17DataSource_MemoryC2ERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  136|  5.77k|      explicit DataSource_Memory(const std::vector<uint8_t>& in) : m_source(in.begin(), in.end()), m_offset(0) {}
_ZN5Botan10DataSourceC2Ev:
   91|   262k|      DataSource() = default;

_ZN5Botan11DER_Encoder14start_sequenceEv:
   65|  64.3k|      DER_Encoder& start_sequence() { return start_cons(ASN1_Type::Sequence, ASN1_Class::Universal); }
_ZN5Botan11DER_Encoder9raw_bytesINSt3__19allocatorIhEEEERS0_RKNS2_6vectorIhT_EE:
   88|  29.4k|      DER_Encoder& raw_bytes(const std::vector<uint8_t, Alloc>& val) {
   89|  29.4k|         return raw_bytes(val.data(), val.size());
   90|  29.4k|      }
_ZN5Botan11DER_Encoder22start_context_specificEj:
   69|  23.3k|      DER_Encoder& start_context_specific(uint32_t tag) {
   70|  23.3k|         return start_cons(ASN1_Type(tag), ASN1_Class::ContextSpecific);
   71|  23.3k|      }
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  159|  23.4k|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector<uint8_t>& rep) {
  160|  23.4k|         return add_object(type_tag, class_tag, rep.data(), rep.size());
  161|  23.4k|      }
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  163|  17.6k|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const secure_vector<uint8_t>& rep) {
  164|  17.6k|         return add_object(type_tag, class_tag, rep.data(), rep.size());
  165|  17.6k|      }
_ZN5Botan11DER_Encoder12DER_SequenceC2EOS1_:
  188|   175k|                  m_set_contents(std::move(seq.m_set_contents)) {}
_ZN5Botan11DER_Encoder12DER_SequenceC2ERKS1_:
  198|  23.4k|            DER_Sequence(const DER_Sequence& seq) = default;
_ZN5Botan11DER_Encoder6encodeINSt3__19allocatorIhEEEERS0_RKNS2_6vectorIhT_EENS_9ASN1_TypeE:
   99|  5.95k|      DER_Encoder& encode(const std::vector<uint8_t, Alloc>& vec, ASN1_Type real_type) {
  100|  5.95k|         return encode(vec.data(), vec.size(), real_type);
  101|  5.95k|      }

_ZNK5Botan8EC_Group6OS2ECPENSt3__14spanIKhLm18446744073709551615EEE:
  337|  14.8k|      EC_Point OS2ECP(std::span<const uint8_t> encoded_point) const {
  338|  14.8k|         return this->OS2ECP(encoded_point.data(), encoded_point.size());
  339|  14.8k|      }
_ZN5Botan8EC_GroupC2ERKS0_:
  105|  19.6k|      EC_Group(const EC_Group&) = default;
_ZN5Botan8EC_GroupaSERKS0_:
  108|  18.6k|      EC_Group& operator=(const EC_Group&) = default;

_ZN5Botan8EC_PointC2Ev:
   42|   184k|      EC_Point() = default;
_ZN5Botan8EC_PointC2EOS0_:
   58|  18.1k|      EC_Point(EC_Point&& other) { this->swap(other); }
_ZN5Botan8EC_PointaSEOS0_:
   68|   171k|      EC_Point& operator=(EC_Point&& other) {
   69|   171k|         if(this != &other)
  ------------------
  |  Branch (69:13): [True: 171k, False: 0]
  ------------------
   70|   171k|            this->swap(other);
   71|   171k|         return (*this);
   72|   171k|      }
_ZNK5Botan8EC_Point5get_xEv:
  137|   312k|      const BigInt& get_x() const { return m_coord_x; }
_ZNK5Botan8EC_Point5get_yEv:
  144|   312k|      const BigInt& get_y() const { return m_coord_y; }
_ZNK5Botan8EC_Point5get_zEv:
  151|   304k|      const BigInt& get_z() const { return m_coord_z; }
_ZN5Botan8EC_Point11swap_coordsERNS_6BigIntES2_S2_:
  153|   147k|      void swap_coords(BigInt& new_x, BigInt& new_y, BigInt& new_z) {
  154|   147k|         m_coord_x.swap(new_x);
  155|   147k|         m_coord_y.swap(new_y);
  156|   147k|         m_coord_z.swap(new_z);
  157|   147k|      }
_ZNK5Botan8EC_Point7is_zeroEv:
  175|  11.8M|      bool is_zero() const { return m_coord_z.is_zero(); }
_ZN5Botan8EC_Point3addERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  212|  83.2k|      void add(const EC_Point& other, std::vector<BigInt>& workspace) {
  213|  83.2k|         BOTAN_ARG_CHECK(m_curve == other.m_curve, "cannot add points on different curves");
  ------------------
  |  |   30|  83.2k|   do {                                                          \
  |  |   31|  83.2k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 83.2k]
  |  |  ------------------
  |  |   32|  83.2k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  83.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  214|       |
  215|  83.2k|         const size_t p_words = m_curve.get_p_words();
  216|       |
  217|  83.2k|         add(other.m_coord_x.data(),
  218|  83.2k|             std::min(p_words, other.m_coord_x.size()),
  219|  83.2k|             other.m_coord_y.data(),
  220|  83.2k|             std::min(p_words, other.m_coord_y.size()),
  221|  83.2k|             other.m_coord_z.data(),
  222|  83.2k|             std::min(p_words, other.m_coord_z.size()),
  223|  83.2k|             workspace);
  224|  83.2k|      }
_ZNK5Botan8EC_Point4plusERKS0_RNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  293|  73.4k|      EC_Point plus(const EC_Point& other, std::vector<BigInt>& workspace) const {
  294|  73.4k|         EC_Point x = (*this);
  295|  73.4k|         x.add(other, workspace);
  296|  73.4k|         return x;
  297|  73.4k|      }
_ZNK5Botan8EC_Point9double_ofERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE:
  304|  68.7k|      EC_Point double_of(std::vector<BigInt>& workspace) const {
  305|  68.7k|         EC_Point x = (*this);
  306|  68.7k|         x.mult2(workspace);
  307|  68.7k|         return x;
  308|  68.7k|      }
_ZNK5Botan8EC_Point4zeroEv:
  313|  38.3k|      EC_Point zero() const { return EC_Point(m_curve); }
_ZNK5Botan8EC_Point9get_curveEv:
  321|  19.6k|      const CurveGFp& get_curve() const { return m_curve; }
_ZN5Botan8EC_PointC2ERKS0_:
   53|   171k|      EC_Point(const EC_Point&) = default;
_ZN5Botan8EC_PointaSERKS0_:
   63|  14.4k|      EC_Point& operator=(const EC_Point&) = default;

_ZNK5Botan12EC_PublicKey12public_pointEv:
   40|  34.1k|      const EC_Point& public_point() const { return m_public_key; }
_ZN5Botan12EC_PublicKeyD2Ev:
   32|  28.5k|      virtual ~EC_PublicKey() = default;
_ZN5Botan12EC_PublicKeyC2Ev:
  106|  18.6k|      EC_PublicKey() : m_domain_params{}, m_public_key{}, m_domain_encoding(EC_Group_Encoding::Explicit) {}
_ZN5Botan13EC_PrivateKeyD2Ev:
  136|  18.6k|      ~EC_PrivateKey() = default;
_ZNK5Botan12EC_PublicKey6domainEv:
   54|  38.3k|      const EC_Group& domain() const { return m_domain_params; }

_ZN5Botan14ECDH_PublicKeyC1ERKNS_8EC_GroupERKNS_8EC_PointE:
   35|  9.82k|      ECDH_PublicKey(const EC_Group& dom_par, const EC_Point& public_point) : EC_PublicKey(dom_par, public_point) {}
_ZNK5Botan14ECDH_PublicKey9algo_nameEv:
   41|  33.7k|      std::string algo_name() const override { return "ECDH"; }
_ZNK5Botan14ECDH_PublicKey12public_valueEv:
   46|  9.82k|      std::vector<uint8_t> public_value() const { return public_point().encode(EC_Point_Format::Uncompressed); }
_ZN5Botan15ECDH_PrivateKeyC1ERNS_21RandomNumberGeneratorERKNS_8EC_GroupERKNS_6BigIntE:
   85|  18.6k|            EC_PrivateKey(rng, domain, x) {}
_ZN5Botan14ECDH_PublicKeyC2Ev:
   56|  18.6k|      ECDH_PublicKey() = default;
_ZNK5Botan14ECDH_PublicKey12public_valueENS_15EC_Point_FormatE:
   51|  24.3k|      std::vector<uint8_t> public_value(EC_Point_Format format) const { return public_point().encode(format); }
_ZNK5Botan15ECDH_PrivateKey12public_valueEv:
   89|  5.68k|      std::vector<uint8_t> public_value() const override {
   90|  5.68k|         return ECDH_PublicKey::public_value(EC_Point_Format::Uncompressed);
   91|  5.68k|      }
_ZNK5Botan15ECDH_PrivateKey12public_valueENS_15EC_Point_FormatE:
   93|  18.6k|      std::vector<uint8_t> public_value(EC_Point_Format type) const { return ECDH_PublicKey::public_value(type); }

_ZNK5Botan9Exception4whatEv:
   93|    148|      const char* what() const noexcept override { return m_msg.c_str(); }
_ZN5Botan13Invalid_StateC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  208|    770|      explicit Invalid_State(std::string_view err) : Exception(err) {}

_ZN5Botan10hex_encodeENSt3__14spanIKhLm18446744073709551615EEEb:
   43|  11.5k|inline std::string hex_encode(std::span<const uint8_t> input, bool uppercase = true) {
   44|  11.5k|   return hex_encode(input.data(), input.size(), uppercase);
   45|  11.5k|}

_ZNK5Botan7AES_1284nameEv:
   27|     86|      std::string name() const override { return "AES-128"; }
_ZNK5Botan7AES_2564nameEv:
  108|    171|      std::string name() const override { return "AES-256"; }

_ZNK5Botan8ARIA_1284nameEv:
   33|     25|      std::string name() const override { return "ARIA-128"; }
_ZNK5Botan8ARIA_2564nameEv:
   79|     38|      std::string name() const override { return "ARIA-256"; }

_ZN5Botan8high_bitIjEEmT_:
   60|   140k|{
   61|   140k|   size_t hb = 0;
   62|       |
   63|   844k|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (63:38): [True: 703k, False: 140k]
  ------------------
   64|   703k|      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
   65|   703k|      hb += z;
   66|   703k|      n >>= z;
   67|   703k|   }
   68|       |
   69|   140k|   hb += n;
   70|       |
   71|   140k|   return hb;
   72|   140k|}
_ZN5Botan10ct_is_zeroIjEET_S1_:
   35|   703k|{
   36|   703k|   return expand_top_bit<T>(~x & (x - 1));
   37|   703k|}
_ZN5Botan14expand_top_bitIjEET_S1_:
   25|   703k|{
   26|   703k|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|   703k|}
_ZN5Botan9var_ctz32Ej:
  140|  1.44k|inline constexpr size_t var_ctz32(uint32_t n) {
  141|  1.44k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_ctz)
  142|  1.44k|   if(n == 0)
  ------------------
  |  Branch (142:7): [True: 0, False: 1.44k]
  ------------------
  143|      0|      return 32;
  144|  1.44k|   return __builtin_ctz(n);
  145|       |#else
  146|       |   return ctz<uint32_t>(n);
  147|       |#endif
  148|  1.44k|}
_ZN5Botan17significant_bytesImEEmT_:
   82|  29.4k|{
   83|  29.4k|   size_t b = 0;
   84|       |
   85|   117k|   for(size_t s = 8 * sizeof(n) / 2; s >= 8; s /= 2) {
  ------------------
  |  Branch (85:38): [True: 88.2k, False: 29.4k]
  ------------------
   86|  88.2k|      const size_t z = s * (~ct_is_zero(n >> s) & 1);
   87|  88.2k|      b += z / 8;
   88|  88.2k|      n >>= z;
   89|  88.2k|   }
   90|       |
   91|  29.4k|   b += (n != 0);
   92|       |
   93|  29.4k|   return b;
   94|  29.4k|}
_ZN5Botan10ct_is_zeroImEET_S1_:
   35|  2.57G|{
   36|  2.57G|   return expand_top_bit<T>(~x & (x - 1));
   37|  2.57G|}
_ZN5Botan14expand_top_bitImEET_S1_:
   25|  3.48G|{
   26|  3.48G|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|  3.48G|}
_ZN5Botan14expand_top_bitIhEET_S1_:
   25|   118M|{
   26|   118M|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|   118M|}
_ZN5Botan6chooseIhEET_S1_S1_S1_:
  168|   118M|inline constexpr T choose(T mask, T a, T b) {
  169|       |   //return (mask & a) | (~mask & b);
  170|   118M|   return (b ^ (mask & (a ^ b)));
  171|   118M|}
_ZN5Botan8high_bitImEEmT_:
   60|  6.58M|{
   61|  6.58M|   size_t hb = 0;
   62|       |
   63|  46.1M|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (63:38): [True: 39.5M, False: 6.58M]
  ------------------
   64|  39.5M|      const size_t z = s * ((~ct_is_zero(n >> s)) & 1);
   65|  39.5M|      hb += z;
   66|  39.5M|      n >>= z;
   67|  39.5M|   }
   68|       |
   69|  6.58M|   hb += n;
   70|       |
   71|  6.58M|   return hb;
   72|  6.58M|}
_ZN5Botan6chooseImEET_S1_S1_S1_:
  168|  9.54G|inline constexpr T choose(T mask, T a, T b) {
  169|       |   //return (mask & a) | (~mask & b);
  170|  9.54G|   return (b ^ (mask & (a ^ b)));
  171|  9.54G|}
_ZN5Botan10ct_is_zeroIhEET_S1_:
   35|  50.5M|{
   36|  50.5M|   return expand_top_bit<T>(~x & (x - 1));
   37|  50.5M|}
_ZN5Botan6chooseIjEET_S1_S1_S1_:
  168|   135M|inline constexpr T choose(T mask, T a, T b) {
  169|       |   //return (mask & a) | (~mask & b);
  170|   135M|   return (b ^ (mask & (a ^ b)));
  171|   135M|}
_ZN5Botan8majorityIjEET_S1_S1_S1_:
  174|  67.9M|inline constexpr T majority(T a, T b, T c) {
  175|       |   /*
  176|       |   Considering each bit of a, b, c individually
  177|       |
  178|       |   If a xor b is set, then c is the deciding vote.
  179|       |
  180|       |   If a xor b is not set then either a and b are both set or both unset.
  181|       |   In either case the value of c doesn't matter, and examining b (or a)
  182|       |   allows us to determine which case we are in.
  183|       |   */
  184|  67.9M|   return choose(a ^ b, c, b);
  185|  67.9M|}
_ZN5Botan9ceil_log2ImEEhT_:
  124|  95.9k|{
  125|  95.9k|   if(x >> (sizeof(T) * 8 - 1))
  ------------------
  |  Branch (125:7): [True: 0, False: 95.9k]
  ------------------
  126|      0|      return sizeof(T) * 8;
  127|       |
  128|  95.9k|   uint8_t result = 0;
  129|  95.9k|   T compare = 1;
  130|       |
  131|   674k|   while(compare < x) {
  ------------------
  |  Branch (131:10): [True: 578k, False: 95.9k]
  ------------------
  132|   578k|      compare <<= 1;
  133|   578k|      result++;
  134|   578k|   }
  135|       |
  136|  95.9k|   return result;
  137|  95.9k|}
_ZN5Botan13is_power_of_2ImEEbT_:
   47|  4.31M|{
   48|  4.31M|   return (arg != 0) && (arg != 1) && ((arg & static_cast<T>(arg - 1)) == 0);
  ------------------
  |  Branch (48:11): [True: 4.31M, False: 0]
  |  Branch (48:25): [True: 4.31M, False: 0]
  |  Branch (48:39): [True: 4.06M, False: 251k]
  ------------------
   49|  4.31M|}
_ZN5Botan8majorityImEET_S1_S1_S1_:
  174|  7.46M|inline constexpr T majority(T a, T b, T c) {
  175|       |   /*
  176|       |   Considering each bit of a, b, c individually
  177|       |
  178|       |   If a xor b is set, then c is the deciding vote.
  179|       |
  180|       |   If a xor b is not set then either a and b are both set or both unset.
  181|       |   In either case the value of c doesn't matter, and examining b (or a)
  182|       |   allows us to determine which case we are in.
  183|       |   */
  184|  7.46M|   return choose(a ^ b, c, b);
  185|  7.46M|}
_ZN5Botan3ctzImEEmT_:
  104|  16.6M|{
  105|       |   /*
  106|       |   * If n == 0 then this function will compute 8*sizeof(T)-1, so
  107|       |   * initialize lb to 1 if n == 0 to produce the expected result.
  108|       |   */
  109|  16.6M|   size_t lb = ct_is_zero(n) & 1;
  110|       |
  111|   116M|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (111:38): [True: 99.6M, False: 16.6M]
  ------------------
  112|  99.6M|      const T mask = (static_cast<T>(1) << s) - 1;
  113|  99.6M|      const size_t z = s * (ct_is_zero(n & mask) & 1);
  114|  99.6M|      lb += z;
  115|  99.6M|      n >>= z;
  116|  99.6M|   }
  117|       |
  118|  16.6M|   return lb;
  119|  16.6M|}
_ZN5Botan14expand_top_bitItEET_S1_:
   25|  29.1k|{
   26|  29.1k|   return static_cast<T>(0) - (a >> (sizeof(T) * 8 - 1));
   27|  29.1k|}
_ZN5Botan10ct_is_zeroItEET_S1_:
   35|  14.6k|{
   36|  14.6k|   return expand_top_bit<T>(~x & (x - 1));
   37|  14.6k|}

_ZN5Botan13reverse_bytesEt:
   19|  67.8k|inline constexpr uint16_t reverse_bytes(uint16_t x) {
   20|  67.8k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   21|  67.8k|   return __builtin_bswap16(x);
   22|       |#else
   23|       |   return static_cast<uint16_t>((x << 8) | (x >> 8));
   24|       |#endif
   25|  67.8k|}
_ZN5Botan13reverse_bytesEj:
   33|  19.8M|inline constexpr uint32_t reverse_bytes(uint32_t x) {
   34|  19.8M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   35|  19.8M|   return __builtin_bswap32(x);
   36|       |#else
   37|       |   // MSVC at least recognizes this as a bswap
   38|       |   return ((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) | ((x & 0xFF000000) >> 24);
   39|       |#endif
   40|  19.8M|}
_ZN5Botan13reverse_bytesEm:
   48|  5.88M|inline constexpr uint64_t reverse_bytes(uint64_t x) {
   49|  5.88M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   50|  5.88M|   return __builtin_bswap64(x);
   51|       |#else
   52|       |   uint32_t hi = static_cast<uint32_t>(x >> 32);
   53|       |   uint32_t lo = static_cast<uint32_t>(x);
   54|       |
   55|       |   hi = reverse_bytes(hi);
   56|       |   lo = reverse_bytes(lo);
   57|       |
   58|       |   return (static_cast<uint64_t>(lo) << 32) | hi;
   59|       |#endif
   60|  5.88M|}

_ZNK5Botan12Camellia_1284nameEv:
   25|     26|      std::string name() const override { return "Camellia-128"; }
_ZNK5Botan12Camellia_2564nameEv:
   69|     36|      std::string name() const override { return "Camellia-256"; }

_ZN5Botan14CBC_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE:
   78|     98|            CBC_Mode(std::move(cipher), std::move(padding)) {}
_ZN5Botan14CBC_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE:
  119|    189|            CBC_Mode(std::move(cipher), std::move(padding)), m_tempbuf(ideal_granularity()) {}
_ZNK5Botan8CBC_Mode6cipherEv:
   44|  2.30k|      const BlockCipher& cipher() const { return *m_cipher; }
_ZNK5Botan8CBC_Mode10block_sizeEv:
   51|    392|      size_t block_size() const { return m_block_size; }
_ZN5Botan8CBC_Mode5stateEv:
   53|    320|      secure_vector<uint8_t>& state() { return m_state; }
_ZN5Botan8CBC_Mode9state_ptrEv:
   55|  2.84k|      uint8_t* state_ptr() { return m_state.data(); }

_ZN5Botan14CCM_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm:
   93|     11|            CCM_Mode(std::move(cipher), tag_size, L) {}
_ZN5Botan14CCM_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm:
  116|     43|            CCM_Mode(std::move(cipher), tag_size, L) {}
_ZNK5Botan8CCM_Mode8tag_sizeEv:
   45|    341|      size_t tag_size() const override final { return m_tag_size; }
_ZNK5Botan8CCM_Mode1LEv:
   52|    330|      size_t L() const { return m_L; }
_ZNK5Botan8CCM_Mode6cipherEv:
   54|     55|      const BlockCipher& cipher() const { return *m_cipher; }
_ZNK5Botan8CCM_Mode6ad_bufEv:
   60|     55|      const secure_vector<uint8_t>& ad_buf() const { return m_ad_buf; }
_ZN5Botan8CCM_Mode7msg_bufEv:
   62|    110|      secure_vector<uint8_t>& msg_buf() { return m_msg_buf; }
_ZNK5Botan14CCM_Encryption13output_lengthEm:
   95|     20|      size_t output_length(size_t input_length) const override { return input_length + tag_size(); }
_ZNK5Botan14CCM_Decryption13output_lengthEm:
  118|     35|      size_t output_length(size_t input_length) const override {
  119|     35|         BOTAN_ARG_CHECK(input_length >= tag_size(), "Sufficient input");
  ------------------
  |  |   30|     35|   do {                                                          \
  |  |   31|     35|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 35]
  |  |  ------------------
  |  |   32|     35|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     35|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  120|     35|         return input_length - tag_size();
  121|     35|      }
_ZNK5Botan14CCM_Decryption18minimum_final_sizeEv:
  123|     36|      size_t minimum_final_size() const override { return tag_size(); }

_ZNK5Botan21ChaCha20Poly1305_Mode8key_specEv:
   37|    100|      Key_Length_Specification key_spec() const override { return Key_Length_Specification(32); }
_ZNK5Botan21ChaCha20Poly1305_Mode8tag_sizeEv:
   41|    448|      size_t tag_size() const override { return 16; }
_ZNK5Botan21ChaCha20Poly1305_Mode12cfrg_versionEv:
   59|    212|      bool cfrg_version() const { return m_nonce_len == 12 || m_nonce_len == 24; }
  ------------------
  |  Branch (59:42): [True: 212, False: 0]
  |  Branch (59:63): [True: 0, False: 0]
  ------------------
_ZNK5Botan27ChaCha20Poly1305_Encryption13output_lengthEm:
   74|     63|      size_t output_length(size_t input_length) const override { return input_length + tag_size(); }
_ZNK5Botan27ChaCha20Poly1305_Decryption13output_lengthEm:
   88|     43|      size_t output_length(size_t input_length) const override {
   89|     43|         BOTAN_ARG_CHECK(input_length >= tag_size(), "Sufficient input");
  ------------------
  |  |   30|     43|   do {                                                          \
  |  |   31|     43|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 43]
  |  |  ------------------
  |  |   32|     43|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     43|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   90|     43|         return input_length - tag_size();
   91|     43|      }
_ZNK5Botan27ChaCha20Poly1305_Decryption18minimum_final_sizeEv:
   93|     44|      size_t minimum_final_size() const override { return tag_size(); }

base64.cpp:_ZN5Botan11base_decodeIRNS_12_GLOBAL__N_16Base64EEEmOT_PhPKcmRmbb:
  118|  11.5k|                   bool ignore_ws = true) {
  119|  11.5k|   const size_t decoding_bytes_in = base.decoding_bytes_in();
  120|  11.5k|   const size_t decoding_bytes_out = base.decoding_bytes_out();
  121|       |
  122|  11.5k|   uint8_t* out_ptr = output;
  123|  11.5k|   std::vector<uint8_t> decode_buf(decoding_bytes_in, 0);
  124|  11.5k|   size_t decode_buf_pos = 0;
  125|  11.5k|   size_t final_truncate = 0;
  126|       |
  127|  11.5k|   clear_mem(output, base.decode_max_output(input_length));
  128|       |
  129|  16.2M|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (129:22): [True: 16.2M, False: 11.5k]
  ------------------
  130|  16.2M|      const uint8_t bin = base.lookup_binary_value(input[i]);
  131|       |
  132|  16.2M|      if(base.check_bad_char(bin, input[i], ignore_ws))  // May throw Invalid_Argument
  ------------------
  |  Branch (132:10): [True: 15.9M, False: 265k]
  ------------------
  133|  15.9M|      {
  134|  15.9M|         decode_buf[decode_buf_pos] = bin;
  135|  15.9M|         ++decode_buf_pos;
  136|  15.9M|      }
  137|       |
  138|       |      /*
  139|       |      * If we're at the end of the input, pad with 0s and truncate
  140|       |      */
  141|  16.2M|      if(final_inputs && (i == input_length - 1)) {
  ------------------
  |  Branch (141:10): [True: 16.2M, False: 0]
  |  Branch (141:26): [True: 11.5k, False: 16.2M]
  ------------------
  142|  11.5k|         if(decode_buf_pos) {
  ------------------
  |  Branch (142:13): [True: 0, False: 11.5k]
  ------------------
  143|      0|            for(size_t j = decode_buf_pos; j < decoding_bytes_in; ++j) {
  ------------------
  |  Branch (143:44): [True: 0, False: 0]
  ------------------
  144|      0|               decode_buf[j] = 0;
  145|      0|            }
  146|       |
  147|      0|            final_truncate = decoding_bytes_in - decode_buf_pos;
  148|      0|            decode_buf_pos = decoding_bytes_in;
  149|      0|         }
  150|  11.5k|      }
  151|       |
  152|  16.2M|      if(decode_buf_pos == decoding_bytes_in) {
  ------------------
  |  Branch (152:10): [True: 3.98M, False: 12.2M]
  ------------------
  153|  3.98M|         base.decode(out_ptr, decode_buf.data());
  154|       |
  155|  3.98M|         out_ptr += decoding_bytes_out;
  156|  3.98M|         decode_buf_pos = 0;
  157|  3.98M|         input_consumed = i + 1;
  158|  3.98M|      }
  159|  16.2M|   }
  160|       |
  161|  23.1k|   while(input_consumed < input_length && base.lookup_binary_value(input[input_consumed]) == 0x80) {
  ------------------
  |  Branch (161:10): [True: 11.5k, False: 11.5k]
  |  Branch (161:43): [True: 11.5k, False: 0]
  ------------------
  162|  11.5k|      ++input_consumed;
  163|  11.5k|   }
  164|       |
  165|  11.5k|   size_t written = (out_ptr - output) - base.bytes_to_remove(final_truncate);
  166|       |
  167|  11.5k|   return written;
  168|  11.5k|}
base64.cpp:_ZN5Botan18base_decode_to_vecINSt3__16vectorIhNS_16secure_allocatorIhEEEENS_12_GLOBAL__N_16Base64EEET_OT0_PKcmb:
  183|  11.5k|Vector base_decode_to_vec(Base&& base, const char input[], size_t input_length, bool ignore_ws) {
  184|  11.5k|   const size_t output_length = base.decode_max_output(input_length);
  185|  11.5k|   Vector bin(output_length);
  186|       |
  187|  11.5k|   const size_t written = base_decode_full(base, bin.data(), input, input_length, ignore_ws);
  188|       |
  189|  11.5k|   bin.resize(written);
  190|  11.5k|   return bin;
  191|  11.5k|}
base64.cpp:_ZN5Botan16base_decode_fullIRNS_12_GLOBAL__N_16Base64EEEmOT_PhPKcmb:
  171|  11.5k|size_t base_decode_full(Base&& base, uint8_t output[], const char input[], size_t input_length, bool ignore_ws) {
  172|  11.5k|   size_t consumed = 0;
  173|  11.5k|   const size_t written = base_decode(base, output, input, input_length, consumed, true, ignore_ws);
  174|       |
  175|  11.5k|   if(consumed != input_length) {
  ------------------
  |  Branch (175:7): [True: 0, False: 11.5k]
  ------------------
  176|      0|      throw Invalid_Argument(base.name() + " decoding failed, input did not have full bytes");
  177|      0|   }
  178|       |
  179|  11.5k|   return written;
  180|  11.5k|}

_ZN5Botan5CPUID13has_cpuid_bitENS0_10CPUID_bitsE:
  333|  3.01M|      static bool has_cpuid_bit(CPUID_bits elem) {
  334|  3.01M|         const uint32_t elem32 = static_cast<uint32_t>(elem);
  335|  3.01M|         return state().has_bit(elem32);
  336|  3.01M|      }
_ZN5Botan5CPUID5stateEv:
  362|  3.01M|      static CPUID_Data& state() {
  363|  3.01M|         static CPUID::CPUID_Data g_cpuid;
  364|  3.01M|         return g_cpuid;
  365|  3.01M|      }
_ZNK5Botan5CPUID10CPUID_Data7has_bitEj:
  350|  3.01M|            bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; }
_ZN5Botan5CPUID8has_sse2Ev:
  208|   996k|      static bool has_sse2() { return has_cpuid_bit(CPUID_SSE2_BIT); }
_ZN5Botan5CPUID9has_ssse3Ev:
  213|  7.61k|      static bool has_ssse3() { return has_sse2() && has_cpuid_bit(CPUID_SSSE3_BIT); }
  ------------------
  |  Branch (213:40): [True: 7.61k, False: 0]
  |  Branch (213:54): [True: 7.61k, False: 0]
  ------------------
_ZN5Botan5CPUID8has_avx2Ev:
  218|  29.6k|      static bool has_avx2() { return has_cpuid_bit(CPUID_AVX2_BIT); }
_ZN5Botan5CPUID10has_avx512Ev:
  225|  29.6k|      static bool has_avx512() { return has_cpuid_bit(CPUID_AVX512_BIT); }
_ZN5Botan5CPUID8has_bmi2Ev:
  240|  1.00M|      static bool has_bmi2() { return has_cpuid_bit(CPUID_BMI_BIT); }
_ZN5Botan5CPUID10has_aes_niEv:
  245|  6.80k|      static bool has_aes_ni() { return has_ssse3() && has_cpuid_bit(CPUID_AESNI_BIT); }
  ------------------
  |  Branch (245:41): [True: 6.80k, False: 0]
  |  Branch (245:56): [True: 6.80k, False: 0]
  ------------------
_ZN5Botan5CPUID9has_clmulEv:
  250|    811|      static bool has_clmul() { return has_ssse3() && has_cpuid_bit(CPUID_CLMUL_BIT); }
  ------------------
  |  Branch (250:40): [True: 811, False: 0]
  |  Branch (250:55): [True: 811, False: 0]
  ------------------
_ZN5Botan5CPUID13has_intel_shaEv:
  255|   935k|      static bool has_intel_sha() { return has_sse2() && has_cpuid_bit(CPUID_SHA_BIT); }
  ------------------
  |  Branch (255:44): [True: 935k, False: 0]
  |  Branch (255:58): [True: 0, False: 935k]
  ------------------
_ZN5Botan5CPUID10has_hw_aesEv:
  292|  6.35k|      static bool has_hw_aes() {
  293|  6.35k|#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
  294|  6.35k|         return has_aes_ni();
  295|       |#elif defined(BOTAN_TARGET_CPU_IS_ARM_FAMILY)
  296|       |         return has_arm_aes();
  297|       |#elif defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY)
  298|       |         return has_power_crypto();
  299|       |#else
  300|       |         return false;
  301|       |#endif
  302|  6.35k|      }
_ZN5Botan5CPUID22has_carryless_multiplyEv:
  308|    811|      static bool has_carryless_multiply() {
  309|    811|#if defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
  310|    811|         return has_clmul();
  311|       |#elif defined(BOTAN_TARGET_CPU_IS_ARM_FAMILY)
  312|       |         return has_arm_pmull();
  313|       |#elif defined(BOTAN_TARGET_ARCH_IS_PPC64)
  314|       |         return has_power_crypto();
  315|       |#else
  316|       |         return false;
  317|       |#endif
  318|    811|      }

_ZN5Botan2CT4MaskIhE5is_ltEhh:
  133|   600k|      static Mask<T> is_lt(T x, T y) { return Mask<T>(expand_top_bit<T>(x ^ ((x ^ y) | ((x - y) ^ x)))); }
_ZN5Botan2CT4MaskIhEC2Eh:
  279|   170M|      Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskIhE6selectEhh:
  228|   118M|      T select(T x, T y) const { return choose(value(), x, y); }
_ZNK5Botan2CT4MaskIhE5valueEv:
  276|   170M|      T value() const { return m_mask; }
_ZN5Botan2CT4MaskIhE15is_within_rangeEhhh:
  150|  50.5M|      static Mask<T> is_within_range(T v, T l, T u) {
  151|       |         //return Mask<T>::is_gte(v, l) & Mask<T>::is_lte(v, u);
  152|       |
  153|  50.5M|         const T v_lt_l = v ^ ((v ^ l) | ((v - l) ^ v));
  154|  50.5M|         const T v_gt_u = u ^ ((u ^ v) | ((u - v) ^ u));
  155|  50.5M|         const T either = v_lt_l | v_gt_u;
  156|  50.5M|         return ~Mask<T>(expand_top_bit(either));
  157|  50.5M|      }
_ZNK5Botan2CT4MaskIhEcoEv:
  213|  52.3M|      Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CT4MaskIhE9is_any_ofEhSt16initializer_listIhE:
  159|  16.8M|      static Mask<T> is_any_of(T v, std::initializer_list<T> accepted) {
  160|  16.8M|         T accept = 0;
  161|       |
  162|  67.3M|         for(auto a : accepted) {
  ------------------
  |  Branch (162:21): [True: 67.3M, False: 16.8M]
  ------------------
  163|  67.3M|            const T diff = a ^ v;
  164|  67.3M|            const T eq_zero = ~diff & (diff - 1);
  165|  67.3M|            accept |= eq_zero;
  166|  67.3M|         }
  167|       |
  168|  16.8M|         return Mask<T>(expand_top_bit(accept));
  169|  16.8M|      }
_ZN5Botan2CT4MaskImE8is_equalEmm:
  128|   668M|      static Mask<T> is_equal(T x, T y) { return Mask<T>::is_zero(static_cast<T>(x ^ y)); }
_ZN5Botan2CT4MaskImE5is_ltEmm:
  133|   914M|      static Mask<T> is_lt(T x, T y) { return Mask<T>(expand_top_bit<T>(x ^ ((x ^ y) | ((x - y) ^ x)))); }
_ZN5Botan2CT4MaskImEC2Em:
  279|  5.19G|      Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE11select_maskES2_S2_:
  239|   494M|      Mask<T> select_mask(Mask<T> x, Mask<T> y) const { return Mask<T>(select(x.value(), y.value())); }
_ZNK5Botan2CT4MaskImE5valueEv:
  276|  13.5G|      T value() const { return m_mask; }
_ZN5Botan2CT4MaskImEoRES2_:
  190|  16.6M|      Mask<T>& operator|=(Mask<T> o) {
  191|  16.6M|         m_mask |= o.value();
  192|  16.6M|         return (*this);
  193|  16.6M|      }
_ZN5Botan2CT4MaskImEaNES2_:
  174|   640k|      Mask<T>& operator&=(Mask<T> o) {
  175|   640k|         m_mask &= o.value();
  176|   640k|         return (*this);
  177|   640k|      }
_ZNK5Botan2CT4MaskImE13if_set_returnEm:
  218|  2.39G|      T if_set_return(T x) const { return m_mask & x; }
_ZN5Botan2CT4MaskImE6expandEm:
  109|  1.09G|      static Mask<T> expand(T v) { return ~Mask<T>::is_zero(v); }
_ZNK5Botan2CT4MaskImEcoEv:
  213|  1.49G|      Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskImE6selectEmm:
  228|  9.53G|      T select(T x, T y) const { return choose(value(), x, y); }
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  245|   218M|      void select_n(T output[], const T x[], const T y[], size_t len) const {
  246|  1.92G|         for(size_t i = 0; i != len; ++i)
  ------------------
  |  Branch (246:28): [True: 1.70G, False: 218M]
  ------------------
  247|  1.70G|            output[i] = this->select(x[i], y[i]);
  248|   218M|      }
_ZN5Botan2CT4MaskImE7is_zeroEm:
  123|  1.78G|      static Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(x)); }
_ZN5Botan2CT8unpoisonImEEvRT_:
   66|   455M|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|   455M|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|   455M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|   455M|#endif
   72|   455M|}
_ZNK5Botan2CT4MaskImE6is_setEv:
  271|   410M|      bool is_set() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  262|   410M|      T unpoisoned_value() const {
  263|   410M|         T r = value();
  264|   410M|         CT::unpoison(r);
  265|   410M|         return r;
  266|   410M|      }
_ZN5Botan2CT8unpoisonIKmEEvRT_:
   66|  6.58M|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|  6.58M|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|  6.58M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|  6.58M|#endif
   72|  6.58M|}
_ZN5Botan2CT4MaskIhE6expandEh:
  109|  1.85M|      static Mask<T> expand(T v) { return ~Mask<T>::is_zero(v); }
_ZN5Botan2CT4MaskIhE7is_zeroEh:
  123|  50.5M|      static Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(x)); }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  285|  6.28M|inline Mask<T> conditional_copy_mem(T cnd, T* to, const T* from0, const T* from1, size_t elems) {
  286|  6.28M|   const auto mask = CT::Mask<T>::expand(cnd);
  287|  6.28M|   mask.select_n(to, from0, from1, elems);
  288|  6.28M|   return mask;
  289|  6.28M|}
_ZN5Botan2CT20conditional_swap_ptrIPKmEEvbRT_S5_:
  309|  1.06M|inline void conditional_swap_ptr(bool cnd, T& x, T& y) {
  310|  1.06M|   uintptr_t xp = reinterpret_cast<uintptr_t>(x);
  311|  1.06M|   uintptr_t yp = reinterpret_cast<uintptr_t>(y);
  312|       |
  313|  1.06M|   conditional_swap<uintptr_t>(cnd, xp, yp);
  314|       |
  315|  1.06M|   x = reinterpret_cast<T>(xp);
  316|  1.06M|   y = reinterpret_cast<T>(yp);
  317|  1.06M|}
_ZN5Botan2CT16conditional_swapImEEvbRT_S3_:
  299|  2.12M|inline void conditional_swap(bool cnd, T& x, T& y) {
  300|  2.12M|   const auto swap = CT::Mask<T>::expand(cnd);
  301|       |
  302|  2.12M|   T t0 = swap.select(y, x);
  303|  2.12M|   T t1 = swap.select(x, y);
  304|  2.12M|   x = t0;
  305|  2.12M|   y = t1;
  306|  2.12M|}
_ZN5Botan2CT4MaskIhE3setEv:
   99|  58.1k|      static Mask<T> set() { return Mask<T>(static_cast<T>(~0)); }
_ZNK5Botan2CT4MaskIhE6is_setEv:
  271|  58.1k|      bool is_set() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskIhE16unpoisoned_valueEv:
  262|  58.1k|      T unpoisoned_value() const {
  263|  58.1k|         T r = value();
  264|  58.1k|         CT::unpoison(r);
  265|  58.1k|         return r;
  266|  58.1k|      }
_ZN5Botan2CT8unpoisonIhEEvRT_:
   66|  58.1k|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|  58.1k|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|  58.1k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|  58.1k|#endif
   72|  58.1k|}
_ZNK5Botan2CT4MaskItE5valueEv:
  276|  72.5k|      T value() const { return m_mask; }
_ZN5Botan2CT6poisonIhEEvPKT_m:
   48|  1.52k|inline void poison(const T* p, size_t n) {
   49|       |#if defined(BOTAN_HAS_VALGRIND)
   50|       |   VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
   51|       |#else
   52|  1.52k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  1.52k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   53|  1.52k|#endif
   54|  1.52k|}
_ZN5Botan2CT8unpoisonIhEEvPKT_m:
   57|  2.00k|inline void unpoison(const T* p, size_t n) {
   58|       |#if defined(BOTAN_HAS_VALGRIND)
   59|       |   VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   60|       |#else
   61|  2.00k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  2.00k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   62|  2.00k|#endif
   63|  2.00k|}
_ZN5Botan2CT4MaskIhE8is_equalEhh:
  128|  48.6M|      static Mask<T> is_equal(T x, T y) { return Mask<T>::is_zero(static_cast<T>(x ^ y)); }
_ZN5Botan2CT4MaskImE6is_gteEmm:
  148|   398M|      static Mask<T> is_gte(T x, T y) { return ~Mask<T>::is_lt(x, y); }
_ZN5Botan2CTorENS0_4MaskImEES2_:
  208|   449M|      friend Mask<T> operator|(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() | y.value()); }
_ZN5Botan2CTeoENS0_4MaskImEES2_:
  203|  46.2k|      friend Mask<T> operator^(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() ^ y.value()); }
_ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m:
  320|  11.5M|inline CT::Mask<T> all_zeros(const T elem[], size_t len) {
  321|  11.5M|   T sum = 0;
  322|  97.9M|   for(size_t i = 0; i != len; ++i)
  ------------------
  |  Branch (322:22): [True: 86.4M, False: 11.5M]
  ------------------
  323|  86.4M|      sum |= elem[i];
  324|  11.5M|   return CT::Mask<T>::is_zero(sum);
  325|  11.5M|}
_ZN5Botan2CTanENS0_4MaskImEES2_:
  198|  56.5M|      friend Mask<T> operator&(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() & y.value()); }
_ZN5Botan2CT4MaskIhEC2ImEENS1_IT_EE:
   92|  1.76k|      Mask(Mask<U> o) : m_mask(static_cast<T>(o.value())) {
   93|  1.76k|         static_assert(sizeof(U) > sizeof(T), "sizes ok");
   94|  1.76k|      }
_ZN5Botan2CT4MaskImE6is_lteEmm:
  143|  1.66M|      static Mask<T> is_lte(T x, T y) { return ~Mask<T>::is_gt(x, y); }
_ZN5Botan2CT4MaskImE5is_gtEmm:
  138|  1.66M|      static Mask<T> is_gt(T x, T y) { return Mask<T>::is_lt(y, x); }
_ZN5Botan2CT4MaskImE3setEv:
   99|  36.1k|      static Mask<T> set() { return Mask<T>(static_cast<T>(~0)); }
_ZN5Botan2CT6poisonImEEvPKT_m:
   48|  36.2k|inline void poison(const T* p, size_t n) {
   49|       |#if defined(BOTAN_HAS_VALGRIND)
   50|       |   VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
   51|       |#else
   52|  36.2k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  36.2k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   53|  36.2k|#endif
   54|  36.2k|}
_ZN5Botan2CT4MaskImE15if_set_zero_outEPmm:
  253|  36.1k|      void if_set_zero_out(T buf[], size_t elems) {
  254|   279k|         for(size_t i = 0; i != elems; ++i) {
  ------------------
  |  Branch (254:28): [True: 243k, False: 36.1k]
  ------------------
  255|   243k|            buf[i] = this->if_not_set_return(buf[i]);
  256|   243k|         }
  257|  36.1k|      }
_ZNK5Botan2CT4MaskImE17if_not_set_returnEm:
  223|  16.8M|      T if_not_set_return(T x) const { return ~m_mask & x; }
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   57|  36.1k|inline void unpoison(const T* p, size_t n) {
   58|       |#if defined(BOTAN_HAS_VALGRIND)
   59|       |   VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   60|       |#else
   61|  36.1k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  118|  36.1k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   62|  36.1k|#endif
   63|  36.1k|}
_ZN5Botan2CT4MaskImE7clearedEv:
  104|  1.72M|      static Mask<T> cleared() { return Mask<T>(0); }
_ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m:
  292|  62.7M|inline Mask<T> conditional_assign_mem(T cnd, T* sink, const T* src, size_t elems) {
  293|  62.7M|   const auto mask = CT::Mask<T>::expand(cnd);
  294|  62.7M|   mask.select_n(sink, src, sink, elems);
  295|  62.7M|   return mask;
  296|  62.7M|}
_ZN5Botan2CT8unpoisonIlEEvRT_:
   66|  24.2M|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|  24.2M|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|  24.2M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|  24.2M|#endif
   72|  24.2M|}
_ZN5Botan2CT8unpoisonIKhEEvRT_:
   66|    124|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|    124|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|    124|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|    124|#endif
   72|    124|}
_ZN5Botan2CT4MaskItE5is_ltEtt:
  133|  14.5k|      static Mask<T> is_lt(T x, T y) { return Mask<T>(expand_top_bit<T>(x ^ ((x ^ y) | ((x - y) ^ x)))); }
_ZN5Botan2CT4MaskItEC2Et:
  279|  72.6k|      Mask(T m) : m_mask(m) {}
_ZN5Botan2CT4MaskItE6is_lteEtt:
  143|  14.4k|      static Mask<T> is_lte(T x, T y) { return ~Mask<T>::is_gt(x, y); }
_ZN5Botan2CT4MaskItE5is_gtEtt:
  138|  14.4k|      static Mask<T> is_gt(T x, T y) { return Mask<T>::is_lt(y, x); }
_ZN5Botan2CT4MaskItE8is_equalEtt:
  128|  14.4k|      static Mask<T> is_equal(T x, T y) { return Mask<T>::is_zero(static_cast<T>(x ^ y)); }
_ZN5Botan2CT4MaskItE7is_zeroEt:
  123|  14.6k|      static Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(x)); }
_ZNK5Botan2CT4MaskItEcoEv:
  213|  29.0k|      Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CTanENS0_4MaskItEES2_:
  198|  14.5k|      friend Mask<T> operator&(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() & y.value()); }
_ZN5Botan2CT4MaskItEoRES2_:
  190|  14.3k|      Mask<T>& operator|=(Mask<T> o) {
  191|  14.3k|         m_mask |= o.value();
  192|  14.3k|         return (*this);
  193|  14.3k|      }
_ZNK5Botan2CT4MaskItE17if_not_set_returnEt:
  223|     72|      T if_not_set_return(T x) const { return ~m_mask & x; }
_ZNK5Botan2CT4MaskItE13if_set_returnEt:
  218|    144|      T if_set_return(T x) const { return m_mask & x; }
_ZN5Botan2CT8unpoisonItEEvRT_:
   66|    144|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|    144|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|    144|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|    144|#endif
   72|    144|}
_ZN5Botan2CT4MaskItE6expandEt:
  109|    144|      static Mask<T> expand(T v) { return ~Mask<T>::is_zero(v); }
_ZN5Botan2CT8unpoisonIKNS0_4MaskItEEEEvRT_:
   66|     72|inline void unpoison(T& p) {
   67|       |#if defined(BOTAN_HAS_VALGRIND)
   68|       |   VALGRIND_MAKE_MEM_DEFINED(&p, sizeof(T));
   69|       |#else
   70|     72|   BOTAN_UNUSED(p);
  ------------------
  |  |  118|     72|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   71|     72|#endif
   72|     72|}
_ZNK5Botan2CT4MaskItE6is_setEv:
  271|     72|      bool is_set() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskItE16unpoisoned_valueEv:
  262|     72|      T unpoisoned_value() const {
  263|     72|         T r = value();
  264|     72|         CT::unpoison(r);
  265|     72|         return r;
  266|     72|      }

_ZNK5Botan9TripleDES4nameEv:
   47|     87|      std::string name() const override { return "TripleDES"; }

_ZN5Botan9ct_divideERKNS_6BigIntES2_:
   49|  33.1k|inline BigInt ct_divide(const BigInt& x, const BigInt& y) {
   50|  33.1k|   BigInt q, r;
   51|  33.1k|   ct_divide(x, y, q, r);
   52|  33.1k|   return q;
   53|  33.1k|}

_ZN5Botan11carry_shiftEom:
  109|  8.54M|inline uint64_t carry_shift(const uint128_t a, size_t shift) { return static_cast<uint64_t>(a >> shift); }
_ZN5Botan13combine_lowerEomom:
  111|  2.41k|inline uint64_t combine_lower(const uint128_t a, size_t s1, const uint128_t b, size_t s2) {
  112|  2.41k|   return static_cast<uint64_t>((a >> s1) | (b << s2));
  113|  2.41k|}

_ZN5Botan8FE_25519C2ESt16initializer_listIiE:
   36|  1.53k|      FE_25519(std::initializer_list<int32_t> x) {
   37|  1.53k|         if(x.size() != 10)
  ------------------
  |  Branch (37:13): [True: 0, False: 1.53k]
  ------------------
   38|      0|            throw Invalid_Argument("Invalid FE_25519 initializer list");
   39|  1.53k|         copy_mem(m_fe, x.begin(), 10);
   40|  1.53k|      }

_ZN5Botan4EMSAD2Ev:
   25|  5.77k|      virtual ~EMSA() = default;

_ZNK5Botan13EMSA_PKCS1v1513hash_functionEv:
   38|  5.77k|      std::string hash_function() const override { return m_hash->name(); }

_ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_:
   51|  21.1k|std::string fmt(std::string_view format, const T&... args) {
   52|  21.1k|   std::ostringstream oss;
   53|  21.1k|   oss.imbue(std::locale::classic());
   54|  21.1k|   fmt_detail::do_fmt(oss, format, args...);
   55|  21.1k|   return oss.str();
   56|  21.1k|}
_ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_:
   23|  22.6k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|  22.6k|   size_t i = 0;
   25|       |
   26|   165k|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 165k, False: 0]
  ------------------
   27|   165k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 22.6k, False: 143k]
  |  Branch (27:30): [True: 22.6k, False: 0]
  |  Branch (27:59): [True: 22.6k, False: 0]
  ------------------
   28|  22.6k|         oss << val;
   29|  22.6k|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|   143k|      } else {
   31|   143k|         oss << format[i];
   32|   143k|      }
   33|       |
   34|   143k|      i += 1;
   35|   143k|   }
   36|  22.6k|}
_ZN5Botan10fmt_detail6do_fmtERNSt3__119basic_ostringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
   20|  34.6k|inline void do_fmt(std::ostringstream& oss, std::string_view format) { oss << format; }
_ZN5Botan3fmtIJNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEEES7_NS1_17basic_string_viewIcS4_EEDpRKT_:
   51|  11.9k|std::string fmt(std::string_view format, const T&... args) {
   52|  11.9k|   std::ostringstream oss;
   53|  11.9k|   oss.imbue(std::locale::classic());
   54|  11.9k|   fmt_detail::do_fmt(oss, format, args...);
   55|  11.9k|   return oss.str();
   56|  11.9k|}
_ZN5Botan10fmt_detail6do_fmtINSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEJEEEvRNS2_19basic_ostringstreamIcS5_S7_EENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   23|  11.9k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|  11.9k|   size_t i = 0;
   25|       |
   26|   117k|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 117k, False: 0]
  ------------------
   27|   117k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 11.9k, False: 105k]
  |  Branch (27:30): [True: 11.9k, False: 0]
  |  Branch (27:59): [True: 11.9k, False: 0]
  ------------------
   28|  11.9k|         oss << val;
   29|  11.9k|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|   105k|      } else {
   31|   105k|         oss << format[i];
   32|   105k|      }
   33|       |
   34|   105k|      i += 1;
   35|   105k|   }
   36|  11.9k|}
_ZN5Botan3fmtIJPKcS2_S2_EEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_:
   51|      5|std::string fmt(std::string_view format, const T&... args) {
   52|      5|   std::ostringstream oss;
   53|      5|   oss.imbue(std::locale::classic());
   54|      5|   fmt_detail::do_fmt(oss, format, args...);
   55|      5|   return oss.str();
   56|      5|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_S3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   23|      5|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|      5|   size_t i = 0;
   25|       |
   26|    105|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 105, False: 0]
  ------------------
   27|    105|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 5, False: 100]
  |  Branch (27:30): [True: 5, False: 0]
  |  Branch (27:59): [True: 5, False: 0]
  ------------------
   28|      5|         oss << val;
   29|      5|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|    100|      } else {
   31|    100|         oss << format[i];
   32|    100|      }
   33|       |
   34|    100|      i += 1;
   35|    100|   }
   36|      5|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   23|      5|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|      5|   size_t i = 0;
   25|       |
   26|     75|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 75, False: 0]
  ------------------
   27|     75|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 5, False: 70]
  |  Branch (27:30): [True: 5, False: 0]
  |  Branch (27:59): [True: 5, False: 0]
  ------------------
   28|      5|         oss << val;
   29|      5|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|     70|      } else {
   31|     70|         oss << format[i];
   32|     70|      }
   33|       |
   34|     70|      i += 1;
   35|     70|   }
   36|      5|}
_ZN5Botan10fmt_detail6do_fmtIPKcJEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   23|      5|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|      5|   size_t i = 0;
   25|       |
   26|     10|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 10, False: 0]
  ------------------
   27|     10|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 5, False: 5]
  |  Branch (27:30): [True: 5, False: 0]
  |  Branch (27:59): [True: 5, False: 0]
  ------------------
   28|      5|         oss << val;
   29|      5|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|      5|      } else {
   31|      5|         oss << format[i];
   32|      5|      }
   33|       |
   34|      5|      i += 1;
   35|      5|   }
   36|      5|}
_ZN5Botan3fmtIJPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEEEENS3_12basic_stringIcS6_NS3_9allocatorIcEEEES7_DpRKT_:
   51|  1.49k|std::string fmt(std::string_view format, const T&... args) {
   52|  1.49k|   std::ostringstream oss;
   53|  1.49k|   oss.imbue(std::locale::classic());
   54|  1.49k|   fmt_detail::do_fmt(oss, format, args...);
   55|  1.49k|   return oss.str();
   56|  1.49k|}
_ZN5Botan10fmt_detail6do_fmtIPKcJNSt3__117basic_string_viewIcNS4_11char_traitsIcEEEEEEEvRNS4_19basic_ostringstreamIcS7_NS4_9allocatorIcEEEES8_RKT_DpRKT0_:
   23|  1.49k|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|  1.49k|   size_t i = 0;
   25|       |
   26|  9.25k|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 9.25k, False: 0]
  ------------------
   27|  9.25k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 1.49k, False: 7.76k]
  |  Branch (27:30): [True: 1.49k, False: 0]
  |  Branch (27:59): [True: 1.49k, False: 0]
  ------------------
   28|  1.49k|         oss << val;
   29|  1.49k|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|  7.76k|      } else {
   31|  7.76k|         oss << format[i];
   32|  7.76k|      }
   33|       |
   34|  7.76k|      i += 1;
   35|  7.76k|   }
   36|  1.49k|}
_ZN5Botan3fmtIJNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEjEEENS1_12basic_stringIcS4_NS1_9allocatorIcEEEES5_DpRKT_:
   51|     42|std::string fmt(std::string_view format, const T&... args) {
   52|     42|   std::ostringstream oss;
   53|     42|   oss.imbue(std::locale::classic());
   54|     42|   fmt_detail::do_fmt(oss, format, args...);
   55|     42|   return oss.str();
   56|     42|}
_ZN5Botan10fmt_detail6do_fmtINSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEJjEEEvRNS2_19basic_ostringstreamIcS5_NS2_9allocatorIcEEEES6_RKT_DpRKT0_:
   23|     42|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|     42|   size_t i = 0;
   25|       |
   26|     42|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 42, False: 0]
  ------------------
   27|     42|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 42, False: 0]
  |  Branch (27:30): [True: 42, False: 0]
  |  Branch (27:59): [True: 42, False: 0]
  ------------------
   28|     42|         oss << val;
   29|     42|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|     42|      } else {
   31|      0|         oss << format[i];
   32|      0|      }
   33|       |
   34|      0|      i += 1;
   35|      0|   }
   36|     42|}
_ZN5Botan10fmt_detail6do_fmtIjJEEEvRNSt3__119basic_ostringstreamIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS2_17basic_string_viewIcS5_EERKT_DpRKT0_:
   23|     84|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   24|     84|   size_t i = 0;
   25|       |
   26|  1.55k|   while(i < format.size()) {
  ------------------
  |  Branch (26:10): [True: 1.55k, False: 0]
  ------------------
   27|  1.55k|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (27:10): [True: 84, False: 1.47k]
  |  Branch (27:30): [True: 84, False: 0]
  |  Branch (27:59): [True: 84, False: 0]
  ------------------
   28|     84|         oss << val;
   29|     84|         return do_fmt(oss, format.substr(i + 2), rest...);
   30|  1.47k|      } else {
   31|  1.47k|         oss << format[i];
   32|  1.47k|      }
   33|       |
   34|  1.47k|      i += 1;
   35|  1.47k|   }
   36|     84|}
_ZN5Botan3fmtIJjEEENSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEDpRKT_:
   51|     42|std::string fmt(std::string_view format, const T&... args) {
   52|     42|   std::ostringstream oss;
   53|     42|   oss.imbue(std::locale::classic());
   54|     42|   fmt_detail::do_fmt(oss, format, args...);
   55|     42|   return oss.str();
   56|     42|}

_ZN5Botan14GCM_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
   79|     54|            GCM_Mode(std::move(cipher), tag_size) {}
_ZN5Botan14GCM_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
  100|    128|            GCM_Mode(std::move(cipher), tag_size) {}
_ZNK5Botan8GCM_Mode8tag_sizeEv:
   38|    942|      size_t tag_size() const override final { return m_tag_size; }
_ZNK5Botan14GCM_Encryption13output_lengthEm:
   81|     92|      size_t output_length(size_t input_length) const override { return input_length + tag_size(); }
_ZNK5Botan14GCM_Decryption13output_lengthEm:
  102|     95|      size_t output_length(size_t input_length) const override {
  103|     95|         BOTAN_ARG_CHECK(input_length >= tag_size(), "Sufficient input");
  ------------------
  |  |   30|     95|   do {                                                          \
  |  |   31|     95|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 95]
  |  |  ------------------
  |  |   32|     95|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     95|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  104|     95|         return input_length - tag_size();
  105|     95|      }
_ZNK5Botan14GCM_Decryption18minimum_final_sizeEv:
  107|     96|      size_t minimum_final_size() const override { return tag_size(); }

_ZNK5Botan5GHASH8key_specEv:
   38|    182|      Key_Length_Specification key_spec() const override { return Key_Length_Specification(16); }

_ZN5Botan8get_byteILm0EmEEhT0_:
   52|   264k|{
   53|   264k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   264k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   264k|}
_ZN5Botan11make_uint16Ehh:
   63|   575k|inline constexpr uint16_t make_uint16(uint8_t i0, uint8_t i1) {
   64|   575k|   return static_cast<uint16_t>((static_cast<uint16_t>(i0) << 8) | i1);
   65|   575k|}
_ZN5Botan11make_uint32Ehhhh:
   75|  56.7k|inline constexpr uint32_t make_uint32(uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3) {
   76|  56.7k|   return ((static_cast<uint32_t>(i0) << 24) | (static_cast<uint32_t>(i1) << 16) | (static_cast<uint32_t>(i2) << 8) |
   77|  56.7k|           (static_cast<uint32_t>(i3)));
   78|  56.7k|}
_ZN5Botan7load_beItEET_PKhm:
  136|  67.8k|inline constexpr uint16_t load_be<uint16_t>(const uint8_t in[], size_t off) {
  137|  67.8k|   in += off * sizeof(uint16_t);
  138|       |
  139|  67.8k|#if defined(BOTAN_ENDIAN_N2B)
  140|  67.8k|   uint16_t x = 0;
  141|  67.8k|   typecast_copy(x, in);
  142|  67.8k|   return BOTAN_ENDIAN_N2B(x);
  ------------------
  |  |   26|  67.8k|   #define BOTAN_ENDIAN_N2B(x) reverse_bytes(x)
  ------------------
  143|       |#else
  144|       |   return make_uint16(in[0], in[1]);
  145|       |#endif
  146|  67.8k|}
_ZN5Botan7load_beIjEET_PKhm:
  174|  16.4M|inline constexpr uint32_t load_be<uint32_t>(const uint8_t in[], size_t off) {
  175|  16.4M|   in += off * sizeof(uint32_t);
  176|  16.4M|#if defined(BOTAN_ENDIAN_N2B)
  177|  16.4M|   uint32_t x = 0;
  178|  16.4M|   typecast_copy(x, in);
  179|  16.4M|   return BOTAN_ENDIAN_N2B(x);
  ------------------
  |  |   26|  16.4M|   #define BOTAN_ENDIAN_N2B(x) reverse_bytes(x)
  ------------------
  180|       |#else
  181|       |   return make_uint32(in[0], in[1], in[2], in[3]);
  182|       |#endif
  183|  16.4M|}
_ZN5Botan7load_leIjEET_PKhm:
  192|    318|inline constexpr uint32_t load_le<uint32_t>(const uint8_t in[], size_t off) {
  193|    318|   in += off * sizeof(uint32_t);
  194|    318|#if defined(BOTAN_ENDIAN_N2L)
  195|    318|   uint32_t x = 0;
  196|    318|   typecast_copy(x, in);
  197|    318|   return BOTAN_ENDIAN_N2L(x);
  ------------------
  |  |   24|    318|   #define BOTAN_ENDIAN_N2L(x) (x)
  ------------------
  198|       |#else
  199|       |   return make_uint32(in[3], in[2], in[1], in[0]);
  200|       |#endif
  201|    318|}
_ZN5Botan7load_beImEET_PKhm:
  210|  4.47M|inline constexpr uint64_t load_be<uint64_t>(const uint8_t in[], size_t off) {
  211|  4.47M|   in += off * sizeof(uint64_t);
  212|  4.47M|#if defined(BOTAN_ENDIAN_N2B)
  213|  4.47M|   uint64_t x = 0;
  214|  4.47M|   typecast_copy(x, in);
  215|  4.47M|   return BOTAN_ENDIAN_N2B(x);
  ------------------
  |  |   26|  4.47M|   #define BOTAN_ENDIAN_N2B(x) reverse_bytes(x)
  ------------------
  216|       |#else
  217|       |   return make_uint64(in[0], in[1], in[2], in[3], in[4], in[5], in[6], in[7]);
  218|       |#endif
  219|  4.47M|}
_ZN5Botan7load_leImEET_PKhm:
  228|  7.49k|inline constexpr uint64_t load_le<uint64_t>(const uint8_t in[], size_t off) {
  229|  7.49k|   in += off * sizeof(uint64_t);
  230|  7.49k|#if defined(BOTAN_ENDIAN_N2L)
  231|  7.49k|   uint64_t x = 0;
  232|  7.49k|   typecast_copy(x, in);
  233|  7.49k|   return BOTAN_ENDIAN_N2L(x);
  ------------------
  |  |   24|  7.49k|   #define BOTAN_ENDIAN_N2L(x) (x)
  ------------------
  234|       |#else
  235|       |   return make_uint64(in[7], in[6], in[5], in[4], in[3], in[2], in[1], in[0]);
  236|       |#endif
  237|  7.49k|}
_ZN5Botan8store_beEtPh:
  407|     63|inline constexpr void store_be(uint16_t in, uint8_t out[2]) {
  408|     63|#if defined(BOTAN_ENDIAN_N2B)
  409|     63|   uint16_t o = BOTAN_ENDIAN_N2B(in);
  ------------------
  |  |   26|     63|   #define BOTAN_ENDIAN_N2B(x) reverse_bytes(x)
  ------------------
  410|     63|   typecast_copy(out, o);
  411|       |#else
  412|       |   out[0] = get_byte<0>(in);
  413|       |   out[1] = get_byte<1>(in);
  414|       |#endif
  415|     63|}
_ZN5Botan8store_beEjPh:
  437|  3.38M|inline constexpr void store_be(uint32_t in, uint8_t out[4]) {
  438|  3.38M|#if defined(BOTAN_ENDIAN_B2N)
  439|  3.38M|   uint32_t o = BOTAN_ENDIAN_B2N(in);
  ------------------
  |  |   27|  3.38M|   #define BOTAN_ENDIAN_B2N(x) reverse_bytes(x)
  ------------------
  440|  3.38M|   typecast_copy(out, o);
  441|       |#else
  442|       |   out[0] = get_byte<0>(in);
  443|       |   out[1] = get_byte<1>(in);
  444|       |   out[2] = get_byte<2>(in);
  445|       |   out[3] = get_byte<3>(in);
  446|       |#endif
  447|  3.38M|}
_ZN5Botan8store_beEmPh:
  471|  1.40M|inline constexpr void store_be(uint64_t in, uint8_t out[8]) {
  472|  1.40M|#if defined(BOTAN_ENDIAN_B2N)
  473|  1.40M|   uint64_t o = BOTAN_ENDIAN_B2N(in);
  ------------------
  |  |   27|  1.40M|   #define BOTAN_ENDIAN_B2N(x) reverse_bytes(x)
  ------------------
  474|  1.40M|   typecast_copy(out, o);
  475|       |#else
  476|       |   out[0] = get_byte<0>(in);
  477|       |   out[1] = get_byte<1>(in);
  478|       |   out[2] = get_byte<2>(in);
  479|       |   out[3] = get_byte<3>(in);
  480|       |   out[4] = get_byte<4>(in);
  481|       |   out[5] = get_byte<5>(in);
  482|       |   out[6] = get_byte<6>(in);
  483|       |   out[7] = get_byte<7>(in);
  484|       |#endif
  485|  1.40M|}
_ZN5Botan8store_leEmPh:
  492|  2.84k|inline constexpr void store_le(uint64_t in, uint8_t out[8]) {
  493|  2.84k|#if defined(BOTAN_ENDIAN_L2N)
  494|  2.84k|   uint64_t o = BOTAN_ENDIAN_L2N(in);
  ------------------
  |  |   25|  2.84k|   #define BOTAN_ENDIAN_L2N(x) (x)
  ------------------
  495|  2.84k|   typecast_copy(out, o);
  496|       |#else
  497|       |   out[0] = get_byte<7>(in);
  498|       |   out[1] = get_byte<6>(in);
  499|       |   out[2] = get_byte<5>(in);
  500|       |   out[3] = get_byte<4>(in);
  501|       |   out[4] = get_byte<3>(in);
  502|       |   out[5] = get_byte<2>(in);
  503|       |   out[6] = get_byte<1>(in);
  504|       |   out[7] = get_byte<0>(in);
  505|       |#endif
  506|  2.84k|}
_ZN5Botan12get_byte_varImEEhmT_:
   40|   370k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) {
   41|   370k|   return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
   42|   370k|}
_ZN5Botan8get_byteILm0EjEEhT0_:
   52|   127k|{
   53|   127k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   127k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   127k|}
_ZN5Botan8get_byteILm1EjEEhT0_:
   52|   236k|{
   53|   236k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   236k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   236k|}
_ZN5Botan8get_byteILm2EjEEhT0_:
   52|   236k|{
   53|   236k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   236k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   236k|}
_ZN5Botan8get_byteILm3EjEEhT0_:
   52|   236k|{
   53|   236k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   236k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   236k|}
_ZN5Botan8store_beIjEEvPhT_S2_:
  527|    136|inline constexpr void store_be(uint8_t out[], T x0, T x1) {
  528|    136|   store_be(x0, out + (0 * sizeof(T)));
  529|    136|   store_be(x1, out + (1 * sizeof(T)));
  530|    136|}
_ZN5Botan7load_beImEEvPKhRT_S4_:
  328|  3.27k|inline constexpr void load_be(const uint8_t in[], T& x0, T& x1) {
  329|  3.27k|   x0 = load_be<T>(in, 0);
  330|  3.27k|   x1 = load_be<T>(in, 1);
  331|  3.27k|}
_ZN5Botan8get_byteILm1EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm2EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm3EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm4EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm5EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm6EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8get_byteILm7EmEEhT0_:
   52|  73.5k|{
   53|  73.5k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|  73.5k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|  73.5k|}
_ZN5Botan8store_beImEEvPhT_S2_:
  527|  3.45k|inline constexpr void store_be(uint8_t out[], T x0, T x1) {
  528|  3.45k|   store_be(x0, out + (0 * sizeof(T)));
  529|  3.45k|   store_be(x1, out + (1 * sizeof(T)));
  530|  3.45k|}
_ZN5Botan7load_beIjEEvPKhRT_S4_S4_S4_:
  342|  2.01k|inline constexpr void load_be(const uint8_t in[], T& x0, T& x1, T& x2, T& x3) {
  343|  2.01k|   x0 = load_be<T>(in, 0);
  344|  2.01k|   x1 = load_be<T>(in, 1);
  345|  2.01k|   x2 = load_be<T>(in, 2);
  346|  2.01k|   x3 = load_be<T>(in, 3);
  347|  2.01k|}
_ZN5Botan8store_beIjEEvPhT_S2_S2_S2_:
  557|  2.35k|inline constexpr void store_be(uint8_t out[], T x0, T x1, T x2, T x3) {
  558|  2.35k|   store_be(x0, out + (0 * sizeof(T)));
  559|  2.35k|   store_be(x1, out + (1 * sizeof(T)));
  560|  2.35k|   store_be(x2, out + (2 * sizeof(T)));
  561|  2.35k|   store_be(x3, out + (3 * sizeof(T)));
  562|  2.35k|}
_ZN5Botan12get_byte_varIjEEhmT_:
   40|  1.06k|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) {
   41|  1.06k|   return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
   42|  1.06k|}
_ZN5Botan7load_leIjEEvPT_PKhm:
  298|    102|inline constexpr void load_le(T out[], const uint8_t in[], size_t count) {
  299|    102|   if(count > 0) {
  ------------------
  |  Branch (299:7): [True: 102, False: 0]
  ------------------
  300|    102|#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  301|    102|      typecast_copy(out, in, count);
  302|       |
  303|       |#elif defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  304|       |      typecast_copy(out, in, count);
  305|       |
  306|       |      const size_t blocks = count - (count % 4);
  307|       |      const size_t left = count - blocks;
  308|       |
  309|       |      for(size_t i = 0; i != blocks; i += 4)
  310|       |         bswap_4(out + i);
  311|       |
  312|       |      for(size_t i = 0; i != left; ++i)
  313|       |         out[blocks + i] = reverse_bytes(out[blocks + i]);
  314|       |#else
  315|       |      for(size_t i = 0; i != count; ++i)
  316|       |         out[i] = load_le<T>(in, i);
  317|       |#endif
  318|    102|   }
  319|    102|}
_ZN5Botan15copy_out_vec_beIjNS_16secure_allocatorIjEEEEvPhmRKNSt3__16vectorIT_T0_EE:
  626|   420k|void copy_out_vec_be(uint8_t out[], size_t out_bytes, const std::vector<T, Alloc>& in) {
  627|   420k|   copy_out_be(out, out_bytes, in.data());
  628|   420k|}
_ZN5Botan11copy_out_beIjEEvPhmPKT_:
  613|   420k|void copy_out_be(uint8_t out[], size_t out_bytes, const T in[]) {
  614|  3.74M|   while(out_bytes >= sizeof(T)) {
  ------------------
  |  Branch (614:10): [True: 3.32M, False: 420k]
  ------------------
  615|  3.32M|      store_be(in[0], out);
  616|  3.32M|      out += sizeof(T);
  617|  3.32M|      out_bytes -= sizeof(T);
  618|  3.32M|      in += 1;
  619|  3.32M|   }
  620|       |
  621|   420k|   for(size_t i = 0; i != out_bytes; ++i)
  ------------------
  |  Branch (621:22): [True: 0, False: 420k]
  ------------------
  622|      0|      out[i] = get_byte_var(i % 8, in[0]);
  623|   420k|}
_ZN5Botan15copy_out_vec_beImNS_16secure_allocatorImEEEEvPhmRKNSt3__16vectorIT_T0_EE:
  626|  39.2k|void copy_out_vec_be(uint8_t out[], size_t out_bytes, const std::vector<T, Alloc>& in) {
  627|  39.2k|   copy_out_be(out, out_bytes, in.data());
  628|  39.2k|}
_ZN5Botan11copy_out_beImEEvPhmPKT_:
  613|  40.5k|void copy_out_be(uint8_t out[], size_t out_bytes, const T in[]) {
  614|   278k|   while(out_bytes >= sizeof(T)) {
  ------------------
  |  Branch (614:10): [True: 238k, False: 40.5k]
  ------------------
  615|   238k|      store_be(in[0], out);
  616|   238k|      out += sizeof(T);
  617|   238k|      out_bytes -= sizeof(T);
  618|   238k|      in += 1;
  619|   238k|   }
  620|       |
  621|  40.5k|   for(size_t i = 0; i != out_bytes; ++i)
  ------------------
  |  Branch (621:22): [True: 0, False: 40.5k]
  ------------------
  622|      0|      out[i] = get_byte_var(i % 8, in[0]);
  623|  40.5k|}
_ZN5Botan7load_beImEEvPT_PKhm:
  380|  1.24k|inline constexpr void load_be(T out[], const uint8_t in[], size_t count) {
  381|  1.24k|   if(count > 0) {
  ------------------
  |  Branch (381:7): [True: 1.24k, False: 0]
  ------------------
  382|       |#if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  383|       |      typecast_copy(out, in, count);
  384|       |
  385|       |#elif defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  386|  1.24k|      typecast_copy(out, in, count);
  387|  1.24k|      const size_t blocks = count - (count % 4);
  388|  1.24k|      const size_t left = count - blocks;
  389|       |
  390|  1.24k|      for(size_t i = 0; i != blocks; i += 4)
  ------------------
  |  Branch (390:25): [True: 0, False: 1.24k]
  ------------------
  391|      0|         bswap_4(out + i);
  392|       |
  393|  3.72k|      for(size_t i = 0; i != left; ++i)
  ------------------
  |  Branch (393:25): [True: 2.48k, False: 1.24k]
  ------------------
  394|  2.48k|         out[blocks + i] = reverse_bytes(out[blocks + i]);
  395|       |#else
  396|       |      for(size_t i = 0; i != count; ++i)
  397|       |         out[i] = load_be<T>(in, i);
  398|       |#endif
  399|  1.24k|   }
  400|  1.24k|}
_ZN5Botan8store_leImEEvPhT_S2_:
  515|    106|inline constexpr void store_le(uint8_t out[], T x0, T x1) {
  516|    106|   store_le(x0, out + (0 * sizeof(T)));
  517|    106|   store_le(x1, out + (1 * sizeof(T)));
  518|    106|}
_ZN5Botan8store_leImEEvPhT_S2_S2_S2_:
  541|    604|inline constexpr void store_le(uint8_t out[], T x0, T x1, T x2, T x3) {
  542|    604|   store_le(x0, out + (0 * sizeof(T)));
  543|    604|   store_le(x1, out + (1 * sizeof(T)));
  544|    604|   store_le(x2, out + (2 * sizeof(T)));
  545|    604|   store_le(x3, out + (3 * sizeof(T)));
  546|    604|}
_ZN5Botan8get_byteILm0EtEEhT0_:
   52|   165k|{
   53|   165k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   165k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   165k|}
_ZN5Botan8get_byteILm1EtEEhT0_:
   52|   165k|{
   53|   165k|   const size_t shift = ((~B) & (sizeof(T) - 1)) << 3;
   54|   165k|   return static_cast<uint8_t>((input >> shift) & 0xFF);
   55|   165k|}
_ZN5Botan7load_beIhEET_PKhm:
  106|  2.76M|inline constexpr T load_be(const uint8_t in[], size_t off) {
  107|  2.76M|   in += off * sizeof(T);
  108|  2.76M|   T out = 0;
  109|  5.52M|   for(size_t i = 0; i != sizeof(T); ++i)
  ------------------
  |  Branch (109:22): [True: 2.76M, False: 2.76M]
  ------------------
  110|  2.76M|      out = static_cast<T>((out << 8) | in[i]);
  111|  2.76M|   return out;
  112|  2.76M|}
_ZN5Botan12get_byte_varIhEEhmT_:
   40|  3.59M|inline constexpr uint8_t get_byte_var(size_t byte_num, T input) {
   41|  3.59M|   return static_cast<uint8_t>(input >> (((~byte_num) & (sizeof(T) - 1)) << 3));
   42|  3.59M|}

_ZNK5Botan16MDx_HashFunction15hash_block_sizeEv:
   29|  19.2k|      size_t hash_block_size() const override final { return m_buffer.size(); }

_ZNK5Botan12Null_Padding15valid_blocksizeEm:
  133|    287|      bool valid_blocksize(size_t) const override { return true; }
_ZN5Botan28BlockCipherModePaddingMethodD2Ev:
   64|    287|      virtual ~BlockCipherModePaddingMethod() = default;

_ZNK5Botan14Montgomery_Int19const_time_unpoisonEv:
  124|  15.7k|      void const_time_unpoison() const { return m_v.const_time_unpoison(); }
_ZNK5Botan17Montgomery_Params1pEv:
  148|  31.5k|      const BigInt& p() const { return m_p; }
_ZNK5Botan17Montgomery_Params2R1Ev:
  150|  15.7k|      const BigInt& R1() const { return m_r1; }
_ZNK5Botan17Montgomery_Params2R2Ev:
  152|  15.7k|      const BigInt& R2() const { return m_r2; }
_ZNK5Botan17Montgomery_Params7p_wordsEv:
  158|   171k|      size_t p_words() const { return m_p_words; }

_ZN5Botan17monty_exp_vartimeENSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntES7_:
   49|  9.98k|inline BigInt monty_exp_vartime(std::shared_ptr<const Montgomery_Params> params_p, const BigInt& g, const BigInt& k) {
   50|  9.98k|   auto precomputed = monty_precompute(params_p, g, 4, false);
   51|  9.98k|   return monty_execute_vartime(*precomputed, k);
   52|  9.98k|}

_ZN5Botan10word8_sub3EPmPKmS2_m:
  413|   517M|inline word word8_sub3(word z[8], const word x[8], const word y[8], word carry) {
  414|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  415|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbl"))
  416|       |       : [carry] "=r"(carry)
  417|       |       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  418|       |       : "cc", "memory");
  419|       |
  420|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  421|   517M|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  422|   517M|       : [carry] "=r"(carry)
  423|   517M|       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  424|   517M|       : "cc", "memory");
  425|       |
  426|       |#else
  427|       |   z[0] = word_sub(x[0], y[0], &carry);
  428|       |   z[1] = word_sub(x[1], y[1], &carry);
  429|       |   z[2] = word_sub(x[2], y[2], &carry);
  430|       |   z[3] = word_sub(x[3], y[3], &carry);
  431|       |   z[4] = word_sub(x[4], y[4], &carry);
  432|       |   z[5] = word_sub(x[5], y[5], &carry);
  433|       |   z[6] = word_sub(x[6], y[6], &carry);
  434|       |   z[7] = word_sub(x[7], y[7], &carry);
  435|       |#endif
  436|       |
  437|   517M|   return carry;
  438|   517M|}
_ZN5Botan8word_subEmmPm:
  326|  1.64G|inline word word_sub(word x, word y, word* carry) {
  327|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  328|       |   asm(ADD_OR_SUBTRACT(ASM("sbbl %[y],%[x]"))
  329|       |       : [x] "=r"(x), [carry] "=r"(*carry)
  330|       |       : "0"(x), [y] "rm"(y), "1"(*carry)
  331|       |       : "cc");
  332|       |   return x;
  333|       |
  334|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  335|  1.64G|   asm(ADD_OR_SUBTRACT(ASM("sbbq %[y],%[x]"))
  336|  1.64G|       : [x] "=r"(x), [carry] "=r"(*carry)
  337|  1.64G|       : "0"(x), [y] "rm"(y), "1"(*carry)
  338|  1.64G|       : "cc");
  339|  1.64G|   return x;
  340|       |
  341|       |#else
  342|       |   word t0 = x - y;
  343|       |   word c1 = (t0 > x);
  344|       |   word z = t0 - *carry;
  345|       |   *carry = c1 | (z > t0);
  346|       |   return z;
  347|       |#endif
  348|  1.64G|}
_ZN5Botan10word8_add3EPmPKmS2_m:
  296|   157M|inline word word8_add3(word z[8], const word x[8], const word y[8], word carry) {
  297|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  298|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcl"))
  299|       |       : [carry] "=r"(carry)
  300|       |       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  301|       |       : "cc", "memory");
  302|       |
  303|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  304|   157M|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  305|   157M|       : [carry] "=r"(carry)
  306|   157M|       : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  307|   157M|       : "cc", "memory");
  308|       |
  309|       |#else
  310|       |   z[0] = word_add(x[0], y[0], &carry);
  311|       |   z[1] = word_add(x[1], y[1], &carry);
  312|       |   z[2] = word_add(x[2], y[2], &carry);
  313|       |   z[3] = word_add(x[3], y[3], &carry);
  314|       |   z[4] = word_add(x[4], y[4], &carry);
  315|       |   z[5] = word_add(x[5], y[5], &carry);
  316|       |   z[6] = word_add(x[6], y[6], &carry);
  317|       |   z[7] = word_add(x[7], y[7], &carry);
  318|       |#endif
  319|       |
  320|   157M|   return carry;
  321|   157M|}
_ZN5Botan8word_addEmmPm:
  237|   778M|inline word word_add(word x, word y, word* carry) {
  238|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  239|       |   asm(ADD_OR_SUBTRACT(ASM("adcl %[y],%[x]"))
  240|       |       : [x] "=r"(x), [carry] "=r"(*carry)
  241|       |       : "0"(x), [y] "rm"(y), "1"(*carry)
  242|       |       : "cc");
  243|       |   return x;
  244|       |
  245|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  246|       |
  247|   778M|   asm(ADD_OR_SUBTRACT(ASM("adcq %[y],%[x]"))
  248|   778M|       : [x] "=r"(x), [carry] "=r"(*carry)
  249|   778M|       : "0"(x), [y] "rm"(y), "1"(*carry)
  250|   778M|       : "cc");
  251|   778M|   return x;
  252|       |
  253|       |#else
  254|       |   word z = x + y;
  255|       |   word c1 = (z < x);
  256|       |   z += *carry;
  257|       |   *carry = c1 | (z < *carry);
  258|       |   return z;
  259|       |#endif
  260|   778M|}
_ZN5Botan10word_madd2EmmPm:
   44|  39.2M|inline word word_madd2(word a, word b, word* c) {
   45|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
   46|       |   asm(R"(
   47|       |      mull %[b]
   48|       |      addl %[c],%[a]
   49|       |      adcl $0,%[carry]
   50|       |      )"
   51|       |       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
   52|       |       : "0"(a), "1"(b), [c] "g"(*c)
   53|       |       : "cc");
   54|       |
   55|       |   return a;
   56|       |
   57|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
   58|  39.2M|   asm(R"(
   59|  39.2M|      mulq %[b]
   60|  39.2M|      addq %[c],%[a]
   61|  39.2M|      adcq $0,%[carry]
   62|  39.2M|      )"
   63|  39.2M|       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
   64|  39.2M|       : "0"(a), "1"(b), [c] "g"(*c)
   65|  39.2M|       : "cc");
   66|       |
   67|  39.2M|   return a;
   68|       |
   69|       |#elif defined(BOTAN_MP_DWORD)
   70|       |   const BOTAN_MP_DWORD s = static_cast<BOTAN_MP_DWORD>(a) * b + *c;
   71|       |   *c = static_cast<word>(s >> BOTAN_MP_WORD_BITS);
   72|       |   return static_cast<word>(s);
   73|       |#else
   74|       |   static_assert(BOTAN_MP_WORD_BITS == 64, "Unexpected word size");
   75|       |
   76|       |   word hi = 0, lo = 0;
   77|       |
   78|       |   mul64x64_128(a, b, &lo, &hi);
   79|       |
   80|       |   lo += *c;
   81|       |   hi += (lo < *c);  // carry?
   82|       |
   83|       |   *c = hi;
   84|       |   return lo;
   85|       |#endif
   86|  39.2M|}
_ZN5Botan10word_madd3EmmmPm:
   91|  2.78M|inline word word_madd3(word a, word b, word c, word* d) {
   92|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
   93|       |   asm(R"(
   94|       |      mull %[b]
   95|       |
   96|       |      addl %[c],%[a]
   97|       |      adcl $0,%[carry]
   98|       |
   99|       |      addl %[d],%[a]
  100|       |      adcl $0,%[carry]
  101|       |      )"
  102|       |       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  103|       |       : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  104|       |       : "cc");
  105|       |
  106|       |   return a;
  107|       |
  108|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  109|  2.78M|   asm(R"(
  110|  2.78M|      mulq %[b]
  111|  2.78M|
  112|  2.78M|      addq %[c],%[a]
  113|  2.78M|      adcq $0,%[carry]
  114|  2.78M|
  115|  2.78M|      addq %[d],%[a]
  116|  2.78M|      adcq $0,%[carry]
  117|  2.78M|      )"
  118|  2.78M|       : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  119|  2.78M|       : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  120|  2.78M|       : "cc");
  121|       |
  122|  2.78M|   return a;
  123|       |
  124|       |#elif defined(BOTAN_MP_DWORD)
  125|       |   const BOTAN_MP_DWORD s = static_cast<BOTAN_MP_DWORD>(a) * b + c + *d;
  126|       |   *d = static_cast<word>(s >> BOTAN_MP_WORD_BITS);
  127|       |   return static_cast<word>(s);
  128|       |#else
  129|       |   static_assert(BOTAN_MP_WORD_BITS == 64, "Unexpected word size");
  130|       |
  131|       |   word hi = 0, lo = 0;
  132|       |
  133|       |   mul64x64_128(a, b, &lo, &hi);
  134|       |
  135|       |   lo += c;
  136|       |   hi += (lo < c);  // carry?
  137|       |
  138|       |   lo += *d;
  139|       |   hi += (lo < *d);  // carry?
  140|       |
  141|       |   *d = hi;
  142|       |   return lo;
  143|       |#endif
  144|  2.78M|}
_ZN5Botan10word8_add2EPmPKmm:
  265|   879k|inline word word8_add2(word x[8], const word y[8], word carry) {
  266|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  267|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcl"))
  268|       |       : [carry] "=r"(carry)
  269|       |       : [x] "r"(x), [y] "r"(y), "0"(carry)
  270|       |       : "cc", "memory");
  271|       |
  272|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  273|       |
  274|   879k|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  275|   879k|       : [carry] "=r"(carry)
  276|   879k|       : [x] "r"(x), [y] "r"(y), "0"(carry)
  277|   879k|       : "cc", "memory");
  278|       |
  279|       |#else
  280|       |   x[0] = word_add(x[0], y[0], &carry);
  281|       |   x[1] = word_add(x[1], y[1], &carry);
  282|       |   x[2] = word_add(x[2], y[2], &carry);
  283|       |   x[3] = word_add(x[3], y[3], &carry);
  284|       |   x[4] = word_add(x[4], y[4], &carry);
  285|       |   x[5] = word_add(x[5], y[5], &carry);
  286|       |   x[6] = word_add(x[6], y[6], &carry);
  287|       |   x[7] = word_add(x[7], y[7], &carry);
  288|       |#endif
  289|       |
  290|   879k|   return carry;
  291|   879k|}
_ZN5Botan10word8_sub2EPmPKmm:
  353|   760k|inline word word8_sub2(word x[8], const word y[8], word carry) {
  354|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  355|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbl"))
  356|       |       : [carry] "=r"(carry)
  357|       |       : [x] "r"(x), [y] "r"(y), "0"(carry)
  358|       |       : "cc", "memory");
  359|       |
  360|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  361|   760k|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
  362|   760k|       : [carry] "=r"(carry)
  363|   760k|       : [x] "r"(x), [y] "r"(y), "0"(carry)
  364|   760k|       : "cc", "memory");
  365|       |
  366|       |#else
  367|       |   x[0] = word_sub(x[0], y[0], &carry);
  368|       |   x[1] = word_sub(x[1], y[1], &carry);
  369|       |   x[2] = word_sub(x[2], y[2], &carry);
  370|       |   x[3] = word_sub(x[3], y[3], &carry);
  371|       |   x[4] = word_sub(x[4], y[4], &carry);
  372|       |   x[5] = word_sub(x[5], y[5], &carry);
  373|       |   x[6] = word_sub(x[6], y[6], &carry);
  374|       |   x[7] = word_sub(x[7], y[7], &carry);
  375|       |#endif
  376|       |
  377|   760k|   return carry;
  378|   760k|}
_ZN5Botan14word8_sub2_revEPmPKmm:
  383|  1.02k|inline word word8_sub2_rev(word x[8], const word y[8], word carry) {
  384|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  385|       |   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbl"))
  386|       |       : [carry] "=r"(carry)
  387|       |       : [x] "r"(y), [y] "r"(x), [z] "r"(x), "0"(carry)
  388|       |       : "cc", "memory");
  389|       |
  390|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  391|  1.02k|   asm(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  392|  1.02k|       : [carry] "=r"(carry)
  393|  1.02k|       : [x] "r"(y), [y] "r"(x), [z] "r"(x), "0"(carry)
  394|  1.02k|       : "cc", "memory");
  395|       |
  396|       |#else
  397|       |   x[0] = word_sub(y[0], x[0], &carry);
  398|       |   x[1] = word_sub(y[1], x[1], &carry);
  399|       |   x[2] = word_sub(y[2], x[2], &carry);
  400|       |   x[3] = word_sub(y[3], x[3], &carry);
  401|       |   x[4] = word_sub(y[4], x[4], &carry);
  402|       |   x[5] = word_sub(y[5], x[5], &carry);
  403|       |   x[6] = word_sub(y[6], x[6], &carry);
  404|       |   x[7] = word_sub(y[7], x[7], &carry);
  405|       |#endif
  406|       |
  407|  1.02k|   return carry;
  408|  1.02k|}
_ZN5Botan13word8_linmul2EPmmm:
  443|   381M|inline word word8_linmul2(word x[8], word y, word carry) {
  444|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  445|       |   asm(DO_8_TIMES(LINMUL_OP, "x") : [carry] "=r"(carry) : [x] "r"(x), [y] "rm"(y), "0"(carry) : "cc", "%eax", "%edx");
  446|       |
  447|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  448|   381M|   asm(DO_8_TIMES(LINMUL_OP, "x") : [carry] "=r"(carry) : [x] "r"(x), [y] "rm"(y), "0"(carry) : "cc", "%rax", "%rdx");
  449|       |
  450|       |#else
  451|       |   x[0] = word_madd2(x[0], y, &carry);
  452|       |   x[1] = word_madd2(x[1], y, &carry);
  453|       |   x[2] = word_madd2(x[2], y, &carry);
  454|       |   x[3] = word_madd2(x[3], y, &carry);
  455|       |   x[4] = word_madd2(x[4], y, &carry);
  456|       |   x[5] = word_madd2(x[5], y, &carry);
  457|       |   x[6] = word_madd2(x[6], y, &carry);
  458|       |   x[7] = word_madd2(x[7], y, &carry);
  459|       |#endif
  460|       |
  461|   381M|   return carry;
  462|   381M|}
_ZN5Botan13word8_linmul3EPmPKmmm:
  467|   292k|inline word word8_linmul3(word z[8], const word x[8], word y, word carry) {
  468|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  469|       |   asm(DO_8_TIMES(LINMUL_OP, "z")
  470|       |       : [carry] "=r"(carry)
  471|       |       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  472|       |       : "cc", "%eax", "%edx");
  473|       |
  474|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  475|   292k|   asm(DO_8_TIMES(LINMUL_OP, "z")
  476|   292k|       : [carry] "=r"(carry)
  477|   292k|       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  478|   292k|       : "cc", "%rax", "%rdx");
  479|       |
  480|       |#else
  481|       |   z[0] = word_madd2(x[0], y, &carry);
  482|       |   z[1] = word_madd2(x[1], y, &carry);
  483|       |   z[2] = word_madd2(x[2], y, &carry);
  484|       |   z[3] = word_madd2(x[3], y, &carry);
  485|       |   z[4] = word_madd2(x[4], y, &carry);
  486|       |   z[5] = word_madd2(x[5], y, &carry);
  487|       |   z[6] = word_madd2(x[6], y, &carry);
  488|       |   z[7] = word_madd2(x[7], y, &carry);
  489|       |#endif
  490|       |
  491|   292k|   return carry;
  492|   292k|}
_ZN5Botan11word8_madd3EPmPKmmm:
  497|  4.06M|inline word word8_madd3(word z[8], const word x[8], word y, word carry) {
  498|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  499|       |   asm(DO_8_TIMES(MULADD_OP, "")
  500|       |       : [carry] "=r"(carry)
  501|       |       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  502|       |       : "cc", "%eax", "%edx");
  503|       |
  504|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  505|  4.06M|   asm(DO_8_TIMES(MULADD_OP, "")
  506|  4.06M|       : [carry] "=r"(carry)
  507|  4.06M|       : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  508|  4.06M|       : "cc", "%rax", "%rdx");
  509|       |
  510|       |#else
  511|       |   z[0] = word_madd3(x[0], y, z[0], &carry);
  512|       |   z[1] = word_madd3(x[1], y, z[1], &carry);
  513|       |   z[2] = word_madd3(x[2], y, z[2], &carry);
  514|       |   z[3] = word_madd3(x[3], y, z[3], &carry);
  515|       |   z[4] = word_madd3(x[4], y, z[4], &carry);
  516|       |   z[5] = word_madd3(x[5], y, z[5], &carry);
  517|       |   z[6] = word_madd3(x[6], y, z[6], &carry);
  518|       |   z[7] = word_madd3(x[7], y, z[7], &carry);
  519|       |#endif
  520|       |
  521|  4.06M|   return carry;
  522|  4.06M|}
_ZN5Botan12word3_muladdEPmS0_S0_mm:
  528|  8.32G|inline void word3_muladd(word* w2, word* w1, word* w0, word x, word y) {
  529|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  530|       |   word z0 = 0, z1 = 0;
  531|       |
  532|       |   asm("mull %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  533|       |
  534|       |   asm(R"(
  535|       |       addl %[z0],%[w0]
  536|       |       adcl %[z1],%[w1]
  537|       |       adcl $0,%[w2]
  538|       |       )"
  539|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  540|       |       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  541|       |       : "cc");
  542|       |
  543|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  544|  8.32G|   word z0 = 0, z1 = 0;
  545|       |
  546|  8.32G|   asm("mulq %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  547|       |
  548|  8.32G|   asm(R"(
  549|  8.32G|       addq %[z0],%[w0]
  550|  8.32G|       adcq %[z1],%[w1]
  551|  8.32G|       adcq $0,%[w2]
  552|  8.32G|       )"
  553|  8.32G|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  554|  8.32G|       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  555|  8.32G|       : "cc");
  556|       |
  557|       |#else
  558|       |   word carry = *w0;
  559|       |   *w0 = word_madd2(x, y, &carry);
  560|       |   *w1 += carry;
  561|       |   *w2 += (*w1 < carry);
  562|       |#endif
  563|  8.32G|}
_ZN5Botan9word3_addEPmS0_S0_m:
  569|   851M|inline void word3_add(word* w2, word* w1, word* w0, word x) {
  570|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  571|       |   asm(R"(
  572|       |      addl %[x],%[w0]
  573|       |      adcl $0,%[w1]
  574|       |      adcl $0,%[w2]
  575|       |      )"
  576|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  577|       |       : [x] "r"(x), "0"(*w0), "1"(*w1), "2"(*w2)
  578|       |       : "cc");
  579|       |
  580|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  581|   851M|   asm(R"(
  582|   851M|      addq %[x],%[w0]
  583|   851M|      adcq $0,%[w1]
  584|   851M|      adcq $0,%[w2]
  585|   851M|      )"
  586|   851M|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  587|   851M|       : [x] "r"(x), "0"(*w0), "1"(*w1), "2"(*w2)
  588|   851M|       : "cc");
  589|       |
  590|       |#else
  591|       |   *w0 += x;
  592|       |   word c1 = (*w0 < x);
  593|       |   *w1 += c1;
  594|       |   word c2 = (*w1 < c1);
  595|       |   *w2 += c2;
  596|       |#endif
  597|   851M|}
_ZN5Botan14word3_muladd_2EPmS0_S0_mm:
  603|  1.75G|inline void word3_muladd_2(word* w2, word* w1, word* w0, word x, word y) {
  604|       |#if defined(BOTAN_MP_USE_X86_32_ASM)
  605|       |   word z0 = 0, z1 = 0;
  606|       |
  607|       |   asm("mull %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  608|       |
  609|       |   asm(R"(
  610|       |      addl %[z0],%[w0]
  611|       |      adcl %[z1],%[w1]
  612|       |      adcl $0,%[w2]
  613|       |
  614|       |      addl %[z0],%[w0]
  615|       |      adcl %[z1],%[w1]
  616|       |      adcl $0,%[w2]
  617|       |      )"
  618|       |       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  619|       |       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  620|       |       : "cc");
  621|       |
  622|       |#elif defined(BOTAN_MP_USE_X86_64_ASM)
  623|  1.75G|   word z0 = 0, z1 = 0;
  624|       |
  625|  1.75G|   asm("mulq %[y]" : "=a"(z0), "=d"(z1) : "a"(x), [y] "rm"(y) : "cc");
  626|       |
  627|  1.75G|   asm(R"(
  628|  1.75G|      addq %[z0],%[w0]
  629|  1.75G|      adcq %[z1],%[w1]
  630|  1.75G|      adcq $0,%[w2]
  631|  1.75G|
  632|  1.75G|      addq %[z0],%[w0]
  633|  1.75G|      adcq %[z1],%[w1]
  634|  1.75G|      adcq $0,%[w2]
  635|  1.75G|      )"
  636|  1.75G|       : [w0] "=r"(*w0), [w1] "=r"(*w1), [w2] "=r"(*w2)
  637|  1.75G|       : [z0] "r"(z0), [z1] "r"(z1), "0"(*w0), "1"(*w1), "2"(*w2)
  638|  1.75G|       : "cc");
  639|       |
  640|       |#else
  641|       |   word carry = 0;
  642|       |   x = word_madd2(x, y, &carry);
  643|       |   y = carry;
  644|       |
  645|       |   word top = (y >> (BOTAN_MP_WORD_BITS - 1));
  646|       |   y <<= 1;
  647|       |   y |= (x >> (BOTAN_MP_WORD_BITS - 1));
  648|       |   x <<= 1;
  649|       |
  650|       |   carry = 0;
  651|       |   *w0 = word_add(*w0, x, &carry);
  652|       |   *w1 = word_add(*w1, y, &carry);
  653|       |   *w2 = word_add(*w2, top, &carry);
  654|       |#endif
  655|  1.75G|}

_ZN5Botan10bigint_cmpEPKmmS1_m:
  468|  3.06M|inline int32_t bigint_cmp(const word x[], size_t x_size, const word y[], size_t y_size) {
  469|  3.06M|   static_assert(sizeof(word) >= sizeof(uint32_t), "Size assumption");
  470|       |
  471|  3.06M|   const word LT = static_cast<word>(-1);
  472|  3.06M|   const word EQ = 0;
  473|  3.06M|   const word GT = 1;
  474|       |
  475|  3.06M|   const size_t common_elems = std::min(x_size, y_size);
  476|       |
  477|  3.06M|   word result = EQ;  // until found otherwise
  478|       |
  479|  20.9M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (479:22): [True: 17.9M, False: 3.06M]
  ------------------
  480|  17.9M|      const auto is_eq = CT::Mask<word>::is_equal(x[i], y[i]);
  481|  17.9M|      const auto is_lt = CT::Mask<word>::is_lt(x[i], y[i]);
  482|       |
  483|  17.9M|      result = is_eq.select(result, is_lt.select(LT, GT));
  484|  17.9M|   }
  485|       |
  486|  3.06M|   if(x_size < y_size) {
  ------------------
  |  Branch (486:7): [True: 194k, False: 2.86M]
  ------------------
  487|   194k|      word mask = 0;
  488|  1.26M|      for(size_t i = x_size; i != y_size; i++)
  ------------------
  |  Branch (488:30): [True: 1.07M, False: 194k]
  ------------------
  489|  1.07M|         mask |= y[i];
  490|       |
  491|       |      // If any bits were set in high part of y, then x < y
  492|   194k|      result = CT::Mask<word>::is_zero(mask).select(result, LT);
  493|  2.86M|   } else if(y_size < x_size) {
  ------------------
  |  Branch (493:14): [True: 31.9k, False: 2.83M]
  ------------------
  494|  31.9k|      word mask = 0;
  495|   250k|      for(size_t i = y_size; i != x_size; i++)
  ------------------
  |  Branch (495:30): [True: 218k, False: 31.9k]
  ------------------
  496|   218k|         mask |= x[i];
  497|       |
  498|       |      // If any bits were set in high part of x, then x > y
  499|  31.9k|      result = CT::Mask<word>::is_zero(mask).select(result, GT);
  500|  31.9k|   }
  501|       |
  502|  3.06M|   CT::unpoison(result);
  503|  3.06M|   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
  ------------------
  |  |   99|  3.06M|      do {                          \
  |  |  100|  3.06M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  504|  3.06M|   return static_cast<int32_t>(result);
  505|  3.06M|}
_ZN5Botan15bigint_ct_is_eqEPKmmS1_m:
  542|   145k|inline CT::Mask<word> bigint_ct_is_eq(const word x[], size_t x_size, const word y[], size_t y_size) {
  543|   145k|   const size_t common_elems = std::min(x_size, y_size);
  544|       |
  545|   145k|   word diff = 0;
  546|       |
  547|  1.10M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (547:22): [True: 954k, False: 145k]
  ------------------
  548|   954k|      diff |= (x[i] ^ y[i]);
  549|   954k|   }
  550|       |
  551|       |   // If any bits were set in high part of x/y, then they are not equal
  552|   145k|   if(x_size < y_size) {
  ------------------
  |  Branch (552:7): [True: 430, False: 145k]
  ------------------
  553|  3.13k|      for(size_t i = x_size; i != y_size; i++)
  ------------------
  |  Branch (553:30): [True: 2.70k, False: 430]
  ------------------
  554|  2.70k|         diff |= y[i];
  555|   145k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (555:14): [True: 817, False: 144k]
  ------------------
  556|  4.01k|      for(size_t i = y_size; i != x_size; i++)
  ------------------
  |  Branch (556:30): [True: 3.19k, False: 817]
  ------------------
  557|  3.19k|         diff |= x[i];
  558|    817|   }
  559|       |
  560|   145k|   return CT::Mask<word>::is_zero(diff);
  561|   145k|}
_ZN5Botan15bigint_ct_is_ltEPKmmS1_mb:
  513|  69.1M|   const word x[], size_t x_size, const word y[], size_t y_size, bool lt_or_equal = false) {
  514|  69.1M|   const size_t common_elems = std::min(x_size, y_size);
  515|       |
  516|  69.1M|   auto is_lt = CT::Mask<word>::expand(lt_or_equal);
  517|       |
  518|   564M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (518:22): [True: 494M, False: 69.1M]
  ------------------
  519|   494M|      const auto eq = CT::Mask<word>::is_equal(x[i], y[i]);
  520|   494M|      const auto lt = CT::Mask<word>::is_lt(x[i], y[i]);
  521|   494M|      is_lt = eq.select_mask(is_lt, lt);
  522|   494M|   }
  523|       |
  524|  69.1M|   if(x_size < y_size) {
  ------------------
  |  Branch (524:7): [True: 29.9k, False: 69.1M]
  ------------------
  525|  29.9k|      word mask = 0;
  526|   352k|      for(size_t i = x_size; i != y_size; i++)
  ------------------
  |  Branch (526:30): [True: 322k, False: 29.9k]
  ------------------
  527|   322k|         mask |= y[i];
  528|       |      // If any bits were set in high part of y, then is_lt should be forced true
  529|  29.9k|      is_lt |= CT::Mask<word>::expand(mask);
  530|  69.1M|   } else if(y_size < x_size) {
  ------------------
  |  Branch (530:14): [True: 188k, False: 68.9M]
  ------------------
  531|   188k|      word mask = 0;
  532|   767k|      for(size_t i = y_size; i != x_size; i++)
  ------------------
  |  Branch (532:30): [True: 578k, False: 188k]
  ------------------
  533|   578k|         mask |= x[i];
  534|       |
  535|       |      // If any bits were set in high part of x, then is_lt should be false
  536|   188k|      is_lt &= CT::Mask<word>::is_zero(mask);
  537|   188k|   }
  538|       |
  539|  69.1M|   return is_lt;
  540|  69.1M|}
_ZN5Botan11bigint_sub3EPmPKmmS2_m:
  308|   284M|inline word bigint_sub3(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  309|   284M|   word borrow = 0;
  310|       |
  311|   284M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|   284M|   do {                                                                                 \
  |  |   52|   284M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 284M]
  |  |  ------------------
  |  |   53|   284M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   284M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  312|       |
  313|   284M|   const size_t blocks = y_size - (y_size % 8);
  314|       |
  315|   667M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (315:22): [True: 383M, False: 284M]
  ------------------
  316|   383M|      borrow = word8_sub3(z + i, x + i, y + i, borrow);
  317|       |
  318|   703M|   for(size_t i = blocks; i != y_size; ++i)
  ------------------
  |  Branch (318:27): [True: 418M, False: 284M]
  ------------------
  319|   418M|      z[i] = word_sub(x[i], y[i], &borrow);
  320|       |
  321|  1.03G|   for(size_t i = y_size; i != x_size; ++i)
  ------------------
  |  Branch (321:27): [True: 752M, False: 284M]
  ------------------
  322|   752M|      z[i] = word_sub(x[i], 0, &borrow);
  323|       |
  324|   284M|   return borrow;
  325|   284M|}
_ZN5Botan14bigint_cnd_addEmPmmPKmm:
   40|   116M|inline word bigint_cnd_add(word cnd, word x[], word x_size, const word y[], size_t y_size) {
   41|   116M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|   116M|   do {                                                                                 \
  |  |   52|   116M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 116M]
  |  |  ------------------
  |  |   53|   116M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   116M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|   116M|   const auto mask = CT::Mask<word>::expand(cnd);
   44|       |
   45|   116M|   word carry = 0;
   46|       |
   47|   116M|   const size_t blocks = y_size - (y_size % 8);
   48|   116M|   word z[8] = {0};
   49|       |
   50|   175M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (50:22): [True: 59.1M, False: 116M]
  ------------------
   51|  59.1M|      carry = word8_add3(z, x + i, y + i, carry);
   52|  59.1M|      mask.select_n(x + i, z, x + i, 8);
   53|  59.1M|   }
   54|       |
   55|   434M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (55:27): [True: 317M, False: 116M]
  ------------------
   56|   317M|      z[0] = word_add(x[i], y[i], &carry);
   57|   317M|      x[i] = mask.select(z[0], x[i]);
   58|   317M|   }
   59|       |
   60|   140M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (60:27): [True: 24.2M, False: 116M]
  ------------------
   61|  24.2M|      z[0] = word_add(x[i], 0, &carry);
   62|  24.2M|      x[i] = mask.select(z[0], x[i]);
   63|  24.2M|   }
   64|       |
   65|   116M|   return mask.if_set_return(carry);
   66|   116M|}
_ZN5Botan15bigint_cnd_swapEmPmS0_m:
   29|   111M|inline void bigint_cnd_swap(word cnd, word x[], word y[], size_t size) {
   30|   111M|   const auto mask = CT::Mask<word>::expand(cnd);
   31|       |
   32|  2.91G|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (32:22): [True: 2.80G, False: 111M]
  ------------------
   33|  2.80G|      const word a = x[i];
   34|  2.80G|      const word b = y[i];
   35|  2.80G|      x[i] = mask.select(b, a);
   36|  2.80G|      y[i] = mask.select(a, b);
   37|  2.80G|   }
   38|   111M|}
_ZN5Botan14bigint_cnd_addEmPmPKmm:
   72|  92.4M|inline word bigint_cnd_add(word cnd, word x[], const word y[], size_t size) {
   73|  92.4M|   return bigint_cnd_add(cnd, x, size, y, size);
   74|  92.4M|}
_ZN5Botan14bigint_cnd_subEmPmmPKmm:
   80|   112M|inline word bigint_cnd_sub(word cnd, word x[], size_t x_size, const word y[], size_t y_size) {
   81|   112M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|   112M|   do {                                                                                 \
  |  |   52|   112M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 112M]
  |  |  ------------------
  |  |   53|   112M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   112M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   82|       |
   83|   112M|   const auto mask = CT::Mask<word>::expand(cnd);
   84|       |
   85|   112M|   word carry = 0;
   86|       |
   87|   112M|   const size_t blocks = y_size - (y_size % 8);
   88|   112M|   word z[8] = {0};
   89|       |
   90|   202M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (90:22): [True: 90.1M, False: 112M]
  ------------------
   91|  90.1M|      carry = word8_sub3(z, x + i, y + i, carry);
   92|  90.1M|      mask.select_n(x + i, z, x + i, 8);
   93|  90.1M|   }
   94|       |
   95|   288M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (95:27): [True: 176M, False: 112M]
  ------------------
   96|   176M|      z[0] = word_sub(x[i], y[i], &carry);
   97|   176M|      x[i] = mask.select(z[0], x[i]);
   98|   176M|   }
   99|       |
  100|   112M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (100:27): [True: 0, False: 112M]
  ------------------
  101|      0|      z[0] = word_sub(x[i], 0, &carry);
  102|      0|      x[i] = mask.select(z[0], x[i]);
  103|      0|   }
  104|       |
  105|   112M|   return mask.if_set_return(carry);
  106|   112M|}
_ZN5Botan14bigint_cnd_subEmPmPKmm:
  112|   112M|inline word bigint_cnd_sub(word cnd, word x[], const word y[], size_t size) {
  113|   112M|   return bigint_cnd_sub(cnd, x, size, y, size);
  114|   112M|}
_ZN5Botan21bigint_cnd_add_or_subENS_2CT4MaskImEEPmPKmm:
  123|  46.2k|inline void bigint_cnd_add_or_sub(CT::Mask<word> mask, word x[], const word y[], size_t size) {
  124|  46.2k|   const size_t blocks = size - (size % 8);
  125|       |
  126|  46.2k|   word carry = 0;
  127|  46.2k|   word borrow = 0;
  128|       |
  129|  46.2k|   word t0[8] = {0};
  130|  46.2k|   word t1[8] = {0};
  131|       |
  132|   323k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (132:22): [True: 277k, False: 46.2k]
  ------------------
  133|   277k|      carry = word8_add3(t0, x + i, y + i, carry);
  134|   277k|      borrow = word8_sub3(t1, x + i, y + i, borrow);
  135|       |
  136|  2.49M|      for(size_t j = 0; j != 8; ++j)
  ------------------
  |  Branch (136:25): [True: 2.21M, False: 277k]
  ------------------
  137|  2.21M|         x[i + j] = mask.select(t0[j], t1[j]);
  138|   277k|   }
  139|       |
  140|  46.2k|   for(size_t i = blocks; i != size; ++i) {
  ------------------
  |  Branch (140:27): [True: 0, False: 46.2k]
  ------------------
  141|      0|      const word a = word_add(x[i], y[i], &carry);
  142|      0|      const word s = word_sub(x[i], y[i], &borrow);
  143|       |
  144|      0|      x[i] = mask.select(a, s);
  145|      0|   }
  146|  46.2k|}
_ZN5Botan17bigint_cnd_addsubENS_2CT4MaskImEEPmPKmS5_m:
  157|  62.5M|inline word bigint_cnd_addsub(CT::Mask<word> mask, word x[], const word y[], const word z[], size_t size) {
  158|  62.5M|   const size_t blocks = size - (size % 8);
  159|       |
  160|  62.5M|   word carry = 0;
  161|  62.5M|   word borrow = 0;
  162|       |
  163|  62.5M|   word t0[8] = {0};
  164|  62.5M|   word t1[8] = {0};
  165|       |
  166|   104M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (166:22): [True: 42.3M, False: 62.5M]
  ------------------
  167|  42.3M|      carry = word8_add3(t0, x + i, y + i, carry);
  168|  42.3M|      borrow = word8_sub3(t1, x + i, z + i, borrow);
  169|       |
  170|   381M|      for(size_t j = 0; j != 8; ++j)
  ------------------
  |  Branch (170:25): [True: 338M, False: 42.3M]
  ------------------
  171|   338M|         x[i + j] = mask.select(t0[j], t1[j]);
  172|  42.3M|   }
  173|       |
  174|   194M|   for(size_t i = blocks; i != size; ++i) {
  ------------------
  |  Branch (174:27): [True: 132M, False: 62.5M]
  ------------------
  175|   132M|      t0[0] = word_add(x[i], y[i], &carry);
  176|   132M|      t1[0] = word_sub(x[i], z[i], &borrow);
  177|   132M|      x[i] = mask.select(t0[0], t1[0]);
  178|   132M|   }
  179|       |
  180|  62.5M|   return mask.select(carry, borrow);
  181|  62.5M|}
_ZN5Botan14bigint_cnd_absEmPmm:
  188|  30.8M|inline void bigint_cnd_abs(word cnd, word x[], size_t size) {
  189|  30.8M|   const auto mask = CT::Mask<word>::expand(cnd);
  190|       |
  191|  30.8M|   word carry = mask.if_set_return(1);
  192|   251M|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (192:22): [True: 220M, False: 30.8M]
  ------------------
  193|   220M|      const word z = word_add(~x[i], 0, &carry);
  194|   220M|      x[i] = mask.select(z, x[i]);
  195|   220M|   }
  196|  30.8M|}
_ZN5Botan14bigint_add2_ncEPmmPKmm:
  201|  2.15M|inline word bigint_add2_nc(word x[], size_t x_size, const word y[], size_t y_size) {
  202|  2.15M|   word carry = 0;
  203|       |
  204|  2.15M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  2.15M|   do {                                                                                 \
  |  |   52|  2.15M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 2.15M]
  |  |  ------------------
  |  |   53|  2.15M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  2.15M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  205|       |
  206|  2.15M|   const size_t blocks = y_size - (y_size % 8);
  207|       |
  208|  3.03M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (208:22): [True: 879k, False: 2.15M]
  ------------------
  209|   879k|      carry = word8_add2(x + i, y + i, carry);
  210|       |
  211|  2.89M|   for(size_t i = blocks; i != y_size; ++i)
  ------------------
  |  Branch (211:27): [True: 738k, False: 2.15M]
  ------------------
  212|   738k|      x[i] = word_add(x[i], y[i], &carry);
  213|       |
  214|  21.9M|   for(size_t i = y_size; i != x_size; ++i)
  ------------------
  |  Branch (214:27): [True: 19.7M, False: 2.15M]
  ------------------
  215|  19.7M|      x[i] = word_add(x[i], 0, &carry);
  216|       |
  217|  2.15M|   return carry;
  218|  2.15M|}
_ZN5Botan14bigint_add3_ncEPmPKmmS2_m:
  223|  57.1M|inline word bigint_add3_nc(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  224|  57.1M|   if(x_size < y_size) {
  ------------------
  |  Branch (224:7): [True: 20.9k, False: 57.1M]
  ------------------
  225|  20.9k|      return bigint_add3_nc(z, y, y_size, x, x_size);
  226|  20.9k|   }
  227|       |
  228|  57.1M|   word carry = 0;
  229|       |
  230|  57.1M|   const size_t blocks = y_size - (y_size % 8);
  231|       |
  232|   112M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (232:22): [True: 55.6M, False: 57.1M]
  ------------------
  233|  55.6M|      carry = word8_add3(z + i, x + i, y + i, carry);
  234|       |
  235|   120M|   for(size_t i = blocks; i != y_size; ++i)
  ------------------
  |  Branch (235:27): [True: 63.3M, False: 57.1M]
  ------------------
  236|  63.3M|      z[i] = word_add(x[i], y[i], &carry);
  237|       |
  238|  57.2M|   for(size_t i = y_size; i != x_size; ++i)
  ------------------
  |  Branch (238:27): [True: 138k, False: 57.1M]
  ------------------
  239|   138k|      z[i] = word_add(x[i], 0, &carry);
  240|       |
  241|  57.1M|   return carry;
  242|  57.1M|}
_ZN5Botan11bigint_add2EPmmPKmm:
  251|  1.67M|inline void bigint_add2(word x[], size_t x_size, const word y[], size_t y_size) {
  252|  1.67M|   x[x_size] += bigint_add2_nc(x, x_size, y, y_size);
  253|  1.67M|}
_ZN5Botan11bigint_add3EPmPKmmS2_m:
  258|   148k|inline void bigint_add3(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  259|   148k|   z[x_size > y_size ? x_size : y_size] += bigint_add3_nc(z, x, x_size, y, y_size);
  ------------------
  |  Branch (259:6): [True: 23.2k, False: 125k]
  ------------------
  260|   148k|}
_ZN5Botan11bigint_sub2EPmmPKmm:
  265|  25.8M|inline word bigint_sub2(word x[], size_t x_size, const word y[], size_t y_size) {
  266|  25.8M|   word borrow = 0;
  267|       |
  268|  25.8M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   51|  25.8M|   do {                                                                                 \
  |  |   52|  25.8M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 25.8M]
  |  |  ------------------
  |  |   53|  25.8M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  25.8M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  269|       |
  270|  25.8M|   const size_t blocks = y_size - (y_size % 8);
  271|       |
  272|  26.6M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (272:22): [True: 760k, False: 25.8M]
  ------------------
  273|   760k|      borrow = word8_sub2(x + i, y + i, borrow);
  274|       |
  275|   161M|   for(size_t i = blocks; i != y_size; ++i)
  ------------------
  |  Branch (275:27): [True: 135M, False: 25.8M]
  ------------------
  276|   135M|      x[i] = word_sub(x[i], y[i], &borrow);
  277|       |
  278|  51.8M|   for(size_t i = y_size; i != x_size; ++i)
  ------------------
  |  Branch (278:27): [True: 25.9M, False: 25.8M]
  ------------------
  279|  25.9M|      x[i] = word_sub(x[i], 0, &borrow);
  280|       |
  281|  25.8M|   return borrow;
  282|  25.8M|}
_ZN5Botan15bigint_sub2_revEPmPKmm:
  287|    226|inline void bigint_sub2_rev(word x[], const word y[], size_t y_size) {
  288|    226|   word borrow = 0;
  289|       |
  290|    226|   const size_t blocks = y_size - (y_size % 8);
  291|       |
  292|  1.25k|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (292:22): [True: 1.02k, False: 226]
  ------------------
  293|  1.02k|      borrow = word8_sub2_rev(x + i, y + i, borrow);
  294|       |
  295|    953|   for(size_t i = blocks; i != y_size; ++i)
  ------------------
  |  Branch (295:27): [True: 727, False: 226]
  ------------------
  296|    727|      x[i] = word_sub(y[i], x[i], &borrow);
  297|       |
  298|    226|   BOTAN_ASSERT(borrow == 0, "y must be greater than x");
  ------------------
  |  |   51|    226|   do {                                                                                 \
  |  |   52|    226|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 226]
  |  |  ------------------
  |  |   53|    226|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    226|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  299|    226|}
_ZN5Botan14bigint_sub_absEPmPKmS2_mS0_:
  339|   196k|inline CT::Mask<word> bigint_sub_abs(word z[], const word x[], const word y[], size_t N, word ws[]) {
  340|       |   // Subtract in both direction then conditional copy out the result
  341|       |
  342|   196k|   word* ws0 = ws;
  343|   196k|   word* ws1 = ws + N;
  344|       |
  345|   196k|   word borrow0 = 0;
  346|   196k|   word borrow1 = 0;
  347|       |
  348|   196k|   const size_t blocks = N - (N % 8);
  349|       |
  350|   589k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (350:22): [True: 392k, False: 196k]
  ------------------
  351|   392k|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  352|   392k|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  353|   392k|   }
  354|       |
  355|   196k|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (355:27): [True: 0, False: 196k]
  ------------------
  356|      0|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  357|      0|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  358|      0|   }
  359|       |
  360|   196k|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  361|   196k|}
_ZN5Botan11bigint_shl1EPmmmmm:
  366|  2.95M|inline void bigint_shl1(word x[], size_t x_size, size_t x_words, size_t word_shift, size_t bit_shift) {
  367|  2.95M|   copy_mem(x + word_shift, x, x_words);
  368|  2.95M|   clear_mem(x, word_shift);
  369|       |
  370|  2.95M|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  371|  2.95M|   const size_t carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  2.95M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  372|       |
  373|  2.95M|   word carry = 0;
  374|  18.1M|   for(size_t i = word_shift; i != x_size; ++i) {
  ------------------
  |  Branch (374:31): [True: 15.1M, False: 2.95M]
  ------------------
  375|  15.1M|      const word w = x[i];
  376|  15.1M|      x[i] = (w << bit_shift) | carry;
  377|  15.1M|      carry = carry_mask.if_set_return(w >> carry_shift);
  378|  15.1M|   }
  379|  2.95M|}
_ZN5Botan11bigint_shr1EPmmmm:
  381|  66.6M|inline void bigint_shr1(word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  382|  66.6M|   const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
  ------------------
  |  Branch (382:23): [True: 66.6M, False: 7.43k]
  ------------------
  383|       |
  384|  66.6M|   if(top > 0)
  ------------------
  |  Branch (384:7): [True: 66.6M, False: 7.43k]
  ------------------
  385|  66.6M|      copy_mem(x, x + word_shift, top);
  386|  66.6M|   clear_mem(x + top, std::min(word_shift, x_size));
  387|       |
  388|  66.6M|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  389|  66.6M|   const size_t carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  66.6M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  390|       |
  391|  66.6M|   word carry = 0;
  392|       |
  393|   556M|   for(size_t i = 0; i != top; ++i) {
  ------------------
  |  Branch (393:22): [True: 490M, False: 66.6M]
  ------------------
  394|   490M|      const word w = x[top - i - 1];
  395|   490M|      x[top - i - 1] = (w >> bit_shift) | carry;
  396|   490M|      carry = carry_mask.if_set_return(w << carry_shift);
  397|   490M|   }
  398|  66.6M|}
_ZN5Botan11bigint_shl2EPmPKmmmm:
  400|  1.47M|inline void bigint_shl2(word y[], const word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  401|  1.47M|   copy_mem(y + word_shift, x, x_size);
  402|       |
  403|  1.47M|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  404|  1.47M|   const size_t carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  1.47M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  405|       |
  406|  1.47M|   word carry = 0;
  407|  9.77M|   for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) {
  ------------------
  |  Branch (407:31): [True: 8.30M, False: 1.47M]
  ------------------
  408|  8.30M|      const word w = y[i];
  409|  8.30M|      y[i] = (w << bit_shift) | carry;
  410|  8.30M|      carry = carry_mask.if_set_return(w >> carry_shift);
  411|  8.30M|   }
  412|  1.47M|}
_ZN5Botan11bigint_shr2EPmPKmmmm:
  414|  50.7M|inline void bigint_shr2(word y[], const word x[], size_t x_size, size_t word_shift, size_t bit_shift) {
  415|  50.7M|   const size_t new_size = x_size < word_shift ? 0 : (x_size - word_shift);
  ------------------
  |  Branch (415:28): [True: 210, False: 50.7M]
  ------------------
  416|       |
  417|  50.7M|   if(new_size > 0)
  ------------------
  |  Branch (417:7): [True: 50.7M, False: 3.20k]
  ------------------
  418|  50.7M|      copy_mem(y, x + word_shift, new_size);
  419|       |
  420|  50.7M|   const auto carry_mask = CT::Mask<word>::expand(bit_shift);
  421|  50.7M|   const size_t carry_shift = carry_mask.if_set_return(BOTAN_MP_WORD_BITS - bit_shift);
  ------------------
  |  |   50|  50.7M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  422|       |
  423|  50.7M|   word carry = 0;
  424|   558M|   for(size_t i = new_size; i > 0; --i) {
  ------------------
  |  Branch (424:29): [True: 507M, False: 50.7M]
  ------------------
  425|   507M|      word w = y[i - 1];
  426|   507M|      y[i - 1] = (w >> bit_shift) | carry;
  427|   507M|      carry = carry_mask.if_set_return(w << carry_shift);
  428|   507M|   }
  429|  50.7M|}
_ZN5Botan14bigint_linmul2EPmmm:
  434|   104M|[[nodiscard]] inline word bigint_linmul2(word x[], size_t x_size, word y) {
  435|   104M|   const size_t blocks = x_size - (x_size % 8);
  436|       |
  437|   104M|   word carry = 0;
  438|       |
  439|   485M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (439:22): [True: 381M, False: 104M]
  ------------------
  440|   381M|      carry = word8_linmul2(x + i, y, carry);
  441|       |
  442|   131M|   for(size_t i = blocks; i != x_size; ++i)
  ------------------
  |  Branch (442:27): [True: 27.4M, False: 104M]
  ------------------
  443|  27.4M|      x[i] = word_madd2(x[i], y, &carry);
  444|       |
  445|   104M|   return carry;
  446|   104M|}
_ZN5Botan14bigint_linmul3EPmPKmmm:
  448|  1.57M|inline void bigint_linmul3(word z[], const word x[], size_t x_size, word y) {
  449|  1.57M|   const size_t blocks = x_size - (x_size % 8);
  450|       |
  451|  1.57M|   word carry = 0;
  452|       |
  453|  1.87M|   for(size_t i = 0; i != blocks; i += 8)
  ------------------
  |  Branch (453:22): [True: 292k, False: 1.57M]
  ------------------
  454|   292k|      carry = word8_linmul3(z + i, x + i, y, carry);
  455|       |
  456|  7.32M|   for(size_t i = blocks; i != x_size; ++i)
  ------------------
  |  Branch (456:27): [True: 5.75M, False: 1.57M]
  ------------------
  457|  5.75M|      z[i] = word_madd2(x[i], y, &carry);
  458|       |
  459|  1.57M|   z[x_size] = carry;
  460|  1.57M|}
_ZN5Botan14bigint_sub_absEPmPKmmS2_m:
  576|  1.06M|inline int32_t bigint_sub_abs(word z[], const word x[], size_t x_size, const word y[], size_t y_size) {
  577|  1.06M|   const int32_t relative_size = bigint_cmp(x, x_size, y, y_size);
  578|       |
  579|       |   // Swap if relative_size == -1
  580|  1.06M|   const bool need_swap = relative_size < 0;
  581|  1.06M|   CT::conditional_swap_ptr(need_swap, x, y);
  582|  1.06M|   CT::conditional_swap(need_swap, x_size, y_size);
  583|       |
  584|       |   /*
  585|       |   * We know at this point that x >= y so if y_size is larger than
  586|       |   * x_size, we are guaranteed they are just leading zeros which can
  587|       |   * be ignored
  588|       |   */
  589|  1.06M|   y_size = std::min(x_size, y_size);
  590|       |
  591|  1.06M|   bigint_sub3(z, x, x_size, y, y_size);
  592|       |
  593|  1.06M|   return relative_size;
  594|  1.06M|}
_ZN5Botan14bigint_mod_subEPmPKmS2_mS0_:
  605|  42.3M|inline void bigint_mod_sub(word t[], const word s[], const word mod[], size_t mod_sw, word ws[]) {
  606|       |   // is t < s or not?
  607|  42.3M|   const auto is_lt = bigint_ct_is_lt(t, mod_sw, s, mod_sw);
  608|       |
  609|       |   // ws = p - s
  610|  42.3M|   const word borrow = bigint_sub3(ws, mod, mod_sw, s, mod_sw);
  611|       |
  612|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  613|  42.3M|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, mod_sw);
  614|       |
  615|  42.3M|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|  42.3M|      do {                          \
  |  |  100|  42.3M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  616|  42.3M|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|  42.3M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  617|  42.3M|}
_ZN5Botan12bigint_divopEmmm:
  637|  1.50M|inline word bigint_divop(word n1, word n0, word d) {
  638|  1.50M|   if(d == 0)
  ------------------
  |  Branch (638:7): [True: 0, False: 1.50M]
  ------------------
  639|      0|      throw Invalid_Argument("bigint_divop divide by zero");
  640|       |
  641|  1.50M|#if defined(BOTAN_MP_DWORD)
  642|  1.50M|   return static_cast<word>(((static_cast<BOTAN_MP_DWORD>(n1) << BOTAN_MP_WORD_BITS) | n0) / d);
  ------------------
  |  |   50|  1.50M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  643|       |#else
  644|       |
  645|       |   word high = n1 % d;
  646|       |   word quotient = 0;
  647|       |
  648|       |   for(size_t i = 0; i != BOTAN_MP_WORD_BITS; ++i) {
  649|       |      const word high_top_bit = high >> (BOTAN_MP_WORD_BITS - 1);
  650|       |
  651|       |      high <<= 1;
  652|       |      high |= (n0 >> (BOTAN_MP_WORD_BITS - 1 - i)) & 1;
  653|       |      quotient <<= 1;
  654|       |
  655|       |      if(high_top_bit || high >= d) {
  656|       |         high -= d;
  657|       |         quotient |= 1;
  658|       |      }
  659|       |   }
  660|       |
  661|       |   return quotient;
  662|       |#endif
  663|  1.50M|}
_ZN5Botan12bigint_modopEmmm:
  668|   265k|inline word bigint_modop(word n1, word n0, word d) {
  669|   265k|   if(d == 0)
  ------------------
  |  Branch (669:7): [True: 0, False: 265k]
  ------------------
  670|      0|      throw Invalid_Argument("bigint_modop divide by zero");
  671|       |
  672|   265k|#if defined(BOTAN_MP_DWORD)
  673|   265k|   return ((static_cast<BOTAN_MP_DWORD>(n1) << BOTAN_MP_WORD_BITS) | n0) % d;
  ------------------
  |  |   50|   265k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  674|       |#else
  675|       |   word z = bigint_divop(n1, n0, d);
  676|       |   word dummy = 0;
  677|       |   z = word_madd2(z, d, &dummy);
  678|       |   return (n0 - z);
  679|       |#endif
  680|   265k|}
_ZN5Botan17bigint_monty_redcEPmPKmmmS0_m:
  727|  62.7M|inline void bigint_monty_redc(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  728|  62.7M|   const size_t z_size = 2 * p_size;
  729|       |
  730|  62.7M|   BOTAN_ARG_CHECK(ws_size >= p_size + 1, "Montgomery workspace too small");
  ------------------
  |  |   30|  62.7M|   do {                                                          \
  |  |   31|  62.7M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 62.7M]
  |  |  ------------------
  |  |   32|  62.7M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  62.7M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  731|       |
  732|  62.7M|   if(p_size == 4)
  ------------------
  |  Branch (732:7): [True: 5.42M, False: 57.3M]
  ------------------
  733|  5.42M|      bigint_monty_redc_4(z, p, p_dash, ws);
  734|  57.3M|   else if(p_size == 6)
  ------------------
  |  Branch (734:12): [True: 13.9M, False: 43.4M]
  ------------------
  735|  13.9M|      bigint_monty_redc_6(z, p, p_dash, ws);
  736|  43.4M|   else if(p_size == 8)
  ------------------
  |  Branch (736:12): [True: 41.7M, False: 1.72M]
  ------------------
  737|  41.7M|      bigint_monty_redc_8(z, p, p_dash, ws);
  738|  1.72M|   else if(p_size == 16)
  ------------------
  |  Branch (738:12): [True: 0, False: 1.72M]
  ------------------
  739|      0|      bigint_monty_redc_16(z, p, p_dash, ws);
  740|  1.72M|   else if(p_size == 24)
  ------------------
  |  Branch (740:12): [True: 0, False: 1.72M]
  ------------------
  741|      0|      bigint_monty_redc_24(z, p, p_dash, ws);
  742|  1.72M|   else if(p_size == 32)
  ------------------
  |  Branch (742:12): [True: 109k, False: 1.61M]
  ------------------
  743|   109k|      bigint_monty_redc_32(z, p, p_dash, ws);
  744|  1.61M|   else
  745|  1.61M|      bigint_monty_redc_generic(z, z_size, p, p_size, p_dash, ws);
  746|  62.7M|}
_ZN5Botan16bigint_mod_sub_nILm4EEEvPmPKmS3_S1_:
  620|  6.23M|inline void bigint_mod_sub_n(word t[], const word s[], const word mod[], word ws[]) {
  621|       |   // is t < s or not?
  622|  6.23M|   const auto is_lt = bigint_ct_is_lt(t, N, s, N);
  623|       |
  624|       |   // ws = p - s
  625|  6.23M|   const word borrow = bigint_sub3(ws, mod, N, s, N);
  626|       |
  627|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  628|  6.23M|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, N);
  629|       |
  630|  6.23M|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|  6.23M|      do {                          \
  |  |  100|  6.23M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  631|  6.23M|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|  6.23M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  632|  6.23M|}
_ZN5Botan16bigint_mod_sub_nILm6EEEvPmPKmS3_S1_:
  620|  13.9M|inline void bigint_mod_sub_n(word t[], const word s[], const word mod[], word ws[]) {
  621|       |   // is t < s or not?
  622|  13.9M|   const auto is_lt = bigint_ct_is_lt(t, N, s, N);
  623|       |
  624|       |   // ws = p - s
  625|  13.9M|   const word borrow = bigint_sub3(ws, mod, N, s, N);
  626|       |
  627|       |   // Compute either (t - s) or (t + (p - s)) depending on mask
  628|  13.9M|   const word carry = bigint_cnd_addsub(is_lt, t, ws, s, N);
  629|       |
  630|  13.9M|   BOTAN_DEBUG_ASSERT(borrow == 0 && carry == 0);
  ------------------
  |  |   99|  13.9M|      do {                          \
  |  |  100|  13.9M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  631|  13.9M|   BOTAN_UNUSED(carry, borrow);
  ------------------
  |  |  118|  13.9M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  632|  13.9M|}

_ZN5Botan14OCB_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
  100|     45|            OCB_Mode(std::move(cipher), tag_size) {}
_ZN5Botan14OCB_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
  119|     92|            OCB_Mode(std::move(cipher), tag_size) {}
_ZNK5Botan8OCB_Mode8tag_sizeEv:
   45|    612|      size_t tag_size() const override final { return m_tag_size; }
_ZNK5Botan8OCB_Mode10block_sizeEv:
   62|    638|      size_t block_size() const { return m_block_size; }
_ZNK5Botan8OCB_Mode10par_blocksEv:
   64|    405|      size_t par_blocks() const { return m_par_blocks; }
_ZNK5Botan14OCB_Encryption13output_lengthEm:
  102|     68|      size_t output_length(size_t input_length) const override { return input_length + tag_size(); }
_ZNK5Botan14OCB_Decryption13output_lengthEm:
  121|     58|      size_t output_length(size_t input_length) const override {
  122|     58|         BOTAN_ASSERT(input_length >= tag_size(), "Sufficient input");
  ------------------
  |  |   51|     58|   do {                                                                                 \
  |  |   52|     58|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 58]
  |  |  ------------------
  |  |   53|     58|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     58|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  123|     58|         return input_length - tag_size();
  124|     58|      }
_ZNK5Botan14OCB_Decryption18minimum_final_sizeEv:
  126|     60|      size_t minimum_final_size() const override { return tag_size(); }

_ZN5Botan6PK_Ops13Key_AgreementD2Ev:
  134|  9.82k|      virtual ~Key_Agreement() = default;
_ZN5Botan6PK_Ops12VerificationD2Ev:
   83|  5.77k|      virtual ~Verification() = default;

_ZN5Botan6PK_Ops22Key_Agreement_with_KDFD2Ev:
  115|  9.82k|      ~Key_Agreement_with_KDF() = default;

_ZNK5Botan8Poly13058key_specEv:
   30|    106|      Key_Length_Specification key_spec() const override { return Key_Length_Specification(32); }

_ZN5Botan15prefetch_arraysIKhJLm256ELm256ELm256ELm256EEEET_DpRAT0__S2_:
   36|  1.32k|{
   37|  1.32k|   return (static_cast<T>(prefetch_array_raw(sizeof(T) * Ns, arr)) & ...);
   38|  1.32k|}

_ZN5Botan10TLS_12_PRFC2ENSt3__110unique_ptrINS_25MessageAuthenticationCodeENS1_14default_deleteIS3_EEEE:
   37|  15.1k|      explicit TLS_12_PRF(std::unique_ptr<MessageAuthenticationCode> mac) : m_mac(std::move(mac)) {}

_ZN5Botan4rotlILm1EjEET0_S1_:
   23|  22.6k|{
   24|  22.6k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  22.6k|}
_ZN5Botan4rotlILm4EjEET0_S1_:
   23|  4.83k|{
   24|  4.83k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  4.83k|}
_ZN5Botan4rotrILm20EjEET0_S1_:
   35|  4.83k|{
   36|  4.83k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  4.83k|}
_ZN5Botan4rotrILm18EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm6EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotlILm9EjEET0_S1_:
   23|  4.83k|{
   24|  4.83k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  4.83k|}
_ZN5Botan4rotrILm4EjEET0_S1_:
   35|   236k|{
   36|   236k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|   236k|}
_ZN5Botan4rotrILm1EjEET0_S1_:
   35|  4.83k|{
   36|  4.83k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  4.83k|}
_ZN5Botan4rotrILm9EjEET0_S1_:
   35|  4.83k|{
   36|  4.83k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  4.83k|}
_ZN5Botan4rotlILm6EjEET0_S1_:
   23|  4.83k|{
   24|  4.83k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  4.83k|}
_ZN5Botan4rotlILm18EjEET0_S1_:
   23|  4.83k|{
   24|  4.83k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  4.83k|}
_ZN5Botan4rotlILm20EjEET0_S1_:
   23|  4.83k|{
   24|  4.83k|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  4.83k|}
_ZN5Botan4rotrILm8EjEET0_S1_:
   35|  3.38k|{
   36|  3.38k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  3.38k|}
_ZN5Botan4rotlILm5EjEET0_S1_:
   23|  8.90M|{
   24|  8.90M|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  8.90M|}
_ZN5Botan4rotrILm2EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm22EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm7EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm13EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan3rhoILm2ELm13ELm22EjEET2_S1_:
   51|  65.7M|inline constexpr T rho(T x) {
   52|  65.7M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  65.7M|}
_ZN5Botan3rhoILm6ELm11ELm25EjEET2_S1_:
   51|  65.7M|inline constexpr T rho(T x) {
   52|  65.7M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  65.7M|}
_ZN5Botan4rotrILm11EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm25EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan5sigmaILm7ELm18ELm3EjEET2_S1_:
   43|  65.7M|inline constexpr T sigma(T x) {
   44|  65.7M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  65.7M|}
_ZN5Botan5sigmaILm17ELm19ELm10EjEET2_S1_:
   43|  65.7M|inline constexpr T sigma(T x) {
   44|  65.7M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  65.7M|}
_ZN5Botan4rotrILm17EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm19EjEET0_S1_:
   35|  65.7M|{
   36|  65.7M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  65.7M|}
_ZN5Botan4rotrILm16EjEET0_S1_:
   35|  32.0k|{
   36|  32.0k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  32.0k|}
_ZN5Botan4rotrILm24EjEET0_S1_:
   35|  3.38k|{
   36|  3.38k|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  3.38k|}
_ZN5Botan4rotrILm8EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotrILm39EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotrILm34EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotrILm14EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotrILm19EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotlILm30EjEET0_S1_:
   23|  8.90M|{
   24|  8.90M|   return static_cast<T>((input << ROT) | (input >> (8 * sizeof(T) - ROT)));
   25|  8.90M|}
_ZN5Botan3rhoILm14ELm18ELm41EmEET2_S1_:
   51|  7.46M|inline constexpr T rho(T x) {
   52|  7.46M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  7.46M|}
_ZN5Botan4rotrILm18EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan4rotrILm41EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan3rhoILm28ELm34ELm39EmEET2_S1_:
   51|  7.46M|inline constexpr T rho(T x) {
   52|  7.46M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ rotr<R3>(x);
   53|  7.46M|}
_ZN5Botan4rotrILm28EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan5sigmaILm19ELm61ELm6EmEET2_S1_:
   43|  7.46M|inline constexpr T sigma(T x) {
   44|  7.46M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  7.46M|}
_ZN5Botan4rotrILm61EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}
_ZN5Botan5sigmaILm1ELm8ELm7EmEET2_S1_:
   43|  7.46M|inline constexpr T sigma(T x) {
   44|  7.46M|   return rotr<R1>(x) ^ rotr<R2>(x) ^ (x >> S);
   45|  7.46M|}
_ZN5Botan4rotrILm1EmEET0_S1_:
   35|  7.46M|{
   36|  7.46M|   return static_cast<T>((input >> ROT) | (input << (8 * sizeof(T) - ROT)));
   37|  7.46M|}

_ZN5Botan8round_upEmm:
   21|   831k|inline size_t round_up(size_t n, size_t align_to) {
   22|   831k|   BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
  ------------------
  |  |   30|   831k|   do {                                                          \
  |  |   31|   831k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 831k]
  |  |  ------------------
  |  |   32|   831k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|   831k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   23|       |
   24|   831k|   if(n % align_to)
  ------------------
  |  Branch (24:7): [True: 541k, False: 289k]
  ------------------
   25|   541k|      n += align_to - (n % align_to);
   26|   831k|   return n;
   27|   831k|}

_ZN5Botan11checked_addEmmPKci:
   30|  4.63k|inline size_t checked_add(size_t x, size_t y, const char* file, int line) {
   31|  4.63k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_add_overflow)
   32|  4.63k|   size_t z;
   33|  4.63k|   if(__builtin_add_overflow(x, y, &z)) [[unlikely]]
  ------------------
  |  Branch (33:7): [True: 0, False: 4.63k]
  ------------------
   34|       |#elif defined(_MSC_VER)
   35|       |   size_t z;
   36|       |   if(SizeTAdd(x, y, &z) != S_OK) [[unlikely]]
   37|       |#else
   38|       |   size_t z = x + y;
   39|       |   if(z < x) [[unlikely]]
   40|       |#endif
   41|      0|   {
   42|      0|      throw Integer_Overflow_Detected(file, line);
   43|      0|   }
   44|  4.63k|   return z;
   45|  4.63k|}
_ZN5Botan11checked_mulEmm:
   47|  24.4M|inline std::optional<size_t> checked_mul(size_t x, size_t y) {
   48|  24.4M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_add_overflow)
   49|  24.4M|   size_t z;
   50|  24.4M|   if(__builtin_mul_overflow(x, y, &z)) [[unlikely]]
  ------------------
  |  Branch (50:7): [True: 0, False: 24.4M]
  ------------------
   51|       |#elif defined(_MSC_VER)
   52|       |   size_t z;
   53|       |   if(SizeTMult(x, y, &z) != S_OK) [[unlikely]]
   54|       |#else
   55|       |   size_t z = x * y;
   56|       |   if(y && z / y != x) [[unlikely]]
   57|       |#endif
   58|      0|   {
   59|      0|      return std::nullopt;
   60|      0|   }
   61|  24.4M|   return z;
   62|  24.4M|}

_ZNK5Botan9SCAN_Name9arg_countEv:
   49|  93.1k|      size_t arg_count() const { return m_args.size(); }
_ZNK5Botan9SCAN_Name9algo_nameEv:
   44|   207k|      const std::string algo_name() const { return m_alg_name; }
_ZN5Botan18probe_providers_ofINS_11BlockCipherEEENSt3__16vectorINS2_12basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS7_IS9_EEEENS2_17basic_string_viewIcS6_EERKSB_:
  106|     88|                                            const std::vector<std::string>& possible = {"base"}) {
  107|     88|   std::vector<std::string> providers;
  108|    176|   for(auto&& prov : possible) {
  ------------------
  |  Branch (108:20): [True: 176, False: 88]
  ------------------
  109|    176|      auto o = T::create(algo_spec, prov);
  110|    176|      if(o) {
  ------------------
  |  Branch (110:10): [True: 88, False: 88]
  ------------------
  111|     88|         providers.push_back(prov);  // available
  112|     88|      }
  113|    176|   }
  114|     88|   return providers;
  115|     88|}
_ZN5Botan18probe_providers_ofINS_12HashFunctionEEENSt3__16vectorINS2_12basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEENS7_IS9_EEEENS2_17basic_string_viewIcS6_EERKSB_:
  106|    124|                                            const std::vector<std::string>& possible = {"base"}) {
  107|    124|   std::vector<std::string> providers;
  108|    248|   for(auto&& prov : possible) {
  ------------------
  |  Branch (108:20): [True: 248, False: 124]
  ------------------
  109|    248|      auto o = T::create(algo_spec, prov);
  110|    248|      if(o) {
  ------------------
  |  Branch (110:10): [True: 124, False: 124]
  ------------------
  111|    124|         providers.push_back(prov);  // available
  112|    124|      }
  113|    248|   }
  114|    124|   return providers;
  115|    124|}

_ZN5Botan5SHA_1C2Ev:
   32|  11.7k|      SHA_1() : MDx_HashFunction(64, true, true), m_digest(5) { clear(); }
_ZNK5Botan5SHA_14nameEv:
   20|    231|      std::string name() const override { return "SHA-1"; }
_ZNK5Botan5SHA_113output_lengthEv:
   22|  35.3k|      size_t output_length() const override { return 20; }

_ZN5Botan7SHA_256C2Ev:
   59|  81.0k|      SHA_256() : MDx_HashFunction(64, true, true), m_digest(8) { clear(); }
_ZNK5Botan7SHA_2564nameEv:
   47|  11.5k|      std::string name() const override { return "SHA-256"; }
_ZNK5Botan7SHA_25613output_lengthEv:
   49|   908k|      size_t output_length() const override { return 32; }

_ZN5Botan9SHA2_32_FEjjjRjjjjS0_S0_jjjj:
   31|  65.7M|                                  uint32_t magic) {
   32|  65.7M|   uint32_t A_rho = rho<2, 13, 22>(A);
   33|  65.7M|   uint32_t E_rho = rho<6, 11, 25>(E);
   34|  65.7M|   uint32_t M2_sigma = sigma<17, 19, 10>(M2);
   35|  65.7M|   uint32_t M4_sigma = sigma<7, 18, 3>(M4);
   36|  65.7M|   H += magic + E_rho + choose(E, F, G) + M1;
   37|  65.7M|   D += H;
   38|  65.7M|   H += A_rho + majority(A, B, C);
   39|  65.7M|   M1 += M2_sigma + M3 + M4_sigma;
   40|  65.7M|}

_ZN5Botan7SHA_384C2Ev:
   31|  3.17k|      SHA_384() : MDx_HashFunction(128, true, true, 16), m_digest(8) { clear(); }
_ZNK5Botan7SHA_3844nameEv:
   20|     92|      std::string name() const override { return "SHA-384"; }
_ZNK5Botan7SHA_38413output_lengthEv:
   22|  81.6k|      size_t output_length() const override { return 48; }

_ZN5Botan9SHA2_64_FEmmmRmmmmS0_S0_mmmm:
   31|  7.46M|                                  uint64_t magic) {
   32|  7.46M|   const uint64_t E_rho = rho<14, 18, 41>(E);
   33|  7.46M|   const uint64_t A_rho = rho<28, 34, 39>(A);
   34|  7.46M|   const uint64_t M2_sigma = sigma<19, 61, 6>(M2);
   35|  7.46M|   const uint64_t M4_sigma = sigma<1, 8, 7>(M4);
   36|  7.46M|   H += magic + E_rho + choose(E, F, G) + M1;
   37|  7.46M|   D += H;
   38|  7.46M|   H += A_rho + majority(A, B, C);
   39|  7.46M|   M1 += M2_sigma + M3 + M4_sigma;
   40|  7.46M|}

_ZN5Botan9SIMD_4x325splatEj:
  129|  95.6k|      static SIMD_4x32 splat(uint32_t B) noexcept {
  130|  95.6k|#if defined(BOTAN_SIMD_USE_SSE2)
  131|  95.6k|         return SIMD_4x32(_mm_set1_epi32(B));
  132|       |#elif defined(BOTAN_SIMD_USE_NEON)
  133|       |         return SIMD_4x32(vdupq_n_u32(B));
  134|       |#else
  135|       |         return SIMD_4x32(B, B, B, B);
  136|       |#endif
  137|  95.6k|      }
_ZN5Botan9SIMD_4x32C2EDv2_x:
  605|  12.0M|      explicit SIMD_4x32(native_simd_type x) noexcept : m_simd(x) {}
_ZN5Botan9SIMD_4x327load_beEPKv:
  172|   445k|      static SIMD_4x32 load_be(const void* in) noexcept {
  173|   445k|#if defined(BOTAN_SIMD_USE_SSE2)
  174|   445k|         return load_le(in).bswap();
  175|       |
  176|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  177|       |         uint32_t R[4];
  178|       |         Botan::load_be(R, static_cast<const uint8_t*>(in), 4);
  179|       |         return SIMD_4x32(R);
  180|       |
  181|       |#elif defined(BOTAN_SIMD_USE_NEON)
  182|       |         SIMD_4x32 l(vld1q_u32(static_cast<const uint32_t*>(in)));
  183|       |         return CPUID::is_little_endian() ? l.bswap() : l;
  184|       |#endif
  185|   445k|      }
_ZN5Botan9SIMD_4x327load_leEPKv:
  156|   544k|      static SIMD_4x32 load_le(const void* in) noexcept {
  157|   544k|#if defined(BOTAN_SIMD_USE_SSE2)
  158|   544k|         return SIMD_4x32(_mm_loadu_si128(reinterpret_cast<const __m128i*>(in)));
  159|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  160|       |         uint32_t R[4];
  161|       |         Botan::load_le(R, static_cast<const uint8_t*>(in), 4);
  162|       |         return SIMD_4x32(R);
  163|       |#elif defined(BOTAN_SIMD_USE_NEON)
  164|       |         SIMD_4x32 l(vld1q_u32(static_cast<const uint32_t*>(in)));
  165|       |         return CPUID::is_big_endian() ? l.bswap() : l;
  166|       |#endif
  167|   544k|      }
_ZNK5Botan9SIMD_4x325bswapEv:
  474|   445k|      SIMD_4x32 bswap() const noexcept {
  475|   445k|#if defined(BOTAN_SIMD_USE_SSE2)
  476|       |
  477|   445k|         __m128i T = m_simd;
  478|   445k|         T = _mm_shufflehi_epi16(T, _MM_SHUFFLE(2, 3, 0, 1));
  479|   445k|         T = _mm_shufflelo_epi16(T, _MM_SHUFFLE(2, 3, 0, 1));
  480|   445k|         return SIMD_4x32(_mm_or_si128(_mm_srli_epi16(T, 8), _mm_slli_epi16(T, 8)));
  481|       |
  482|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  483|       |
  484|       |         union {
  485|       |               __vector unsigned int V;
  486|       |               uint32_t R[4];
  487|       |         } vec;
  488|       |
  489|       |         vec.V = m_simd;
  490|       |         bswap_4(vec.R);
  491|       |         return SIMD_4x32(vec.R[0], vec.R[1], vec.R[2], vec.R[3]);
  492|       |
  493|       |#elif defined(BOTAN_SIMD_USE_NEON)
  494|       |         return SIMD_4x32(vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(m_simd))));
  495|       |#endif
  496|   445k|      }
_ZN5Botan9SIMD_4x32eOERKS0_:
  383|  7.20M|      void operator^=(const SIMD_4x32& other) noexcept {
  384|  7.20M|#if defined(BOTAN_SIMD_USE_SSE2)
  385|  7.20M|         m_simd = _mm_xor_si128(m_simd, other.m_simd);
  386|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  387|       |         m_simd = vec_xor(m_simd, other.m_simd);
  388|       |#elif defined(BOTAN_SIMD_USE_NEON)
  389|       |         m_simd = veorq_u32(m_simd, other.m_simd);
  390|       |#endif
  391|  7.20M|      }
_ZNK5Botan9SIMD_4x32eoERKS0_:
  339|  42.2k|      SIMD_4x32 operator^(const SIMD_4x32& other) const noexcept {
  340|  42.2k|         SIMD_4x32 retval(*this);
  341|  42.2k|         retval ^= other;
  342|  42.2k|         return retval;
  343|  42.2k|      }
_ZN5Botan9SIMD_4x32oRERKS0_:
  395|  8.47k|      void operator|=(const SIMD_4x32& other) noexcept {
  396|  8.47k|#if defined(BOTAN_SIMD_USE_SSE2)
  397|  8.47k|         m_simd = _mm_or_si128(m_simd, other.m_simd);
  398|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  399|       |         m_simd = vec_or(m_simd, other.m_simd);
  400|       |#elif defined(BOTAN_SIMD_USE_NEON)
  401|       |         m_simd = vorrq_u32(m_simd, other.m_simd);
  402|       |#endif
  403|  8.47k|      }
_ZNK5Botan9SIMD_4x328store_leEPh:
  196|  2.24M|      void store_le(uint8_t out[]) const noexcept {
  197|  2.24M|#if defined(BOTAN_SIMD_USE_SSE2)
  198|       |
  199|  2.24M|         _mm_storeu_si128(reinterpret_cast<__m128i*>(out), raw());
  200|       |
  201|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  202|       |
  203|       |         union {
  204|       |               __vector unsigned int V;
  205|       |               uint32_t R[4];
  206|       |         } vec;
  207|       |
  208|       |         vec.V = raw();
  209|       |         Botan::store_le(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]);
  210|       |
  211|       |#elif defined(BOTAN_SIMD_USE_NEON)
  212|       |         if(CPUID::is_little_endian()) {
  213|       |            vst1q_u8(out, vreinterpretq_u8_u32(m_simd));
  214|       |         } else {
  215|       |            vst1q_u8(out, vreinterpretq_u8_u32(bswap().m_simd));
  216|       |         }
  217|       |#endif
  218|  2.24M|      }
_ZNK5Botan9SIMD_4x323rawEv:
  603|  11.6M|      native_simd_type raw() const noexcept { return m_simd; }
_ZNK5Botan9SIMD_4x324rotlILm1EEES0_v:
  281|  1.78M|      {
  282|  1.78M|#if defined(BOTAN_SIMD_USE_SSE2)
  283|       |
  284|  1.78M|         return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_simd, static_cast<int>(ROT)),
  285|  1.78M|                                       _mm_srli_epi32(m_simd, static_cast<int>(32 - ROT))));
  286|       |
  287|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  288|       |
  289|       |         const unsigned int r = static_cast<unsigned int>(ROT);
  290|       |         __vector unsigned int rot = {r, r, r, r};
  291|       |         return SIMD_4x32(vec_rl(m_simd, rot));
  292|       |
  293|       |#elif defined(BOTAN_SIMD_USE_NEON)
  294|       |
  295|       |   #if defined(BOTAN_TARGET_ARCH_IS_ARM64)
  296|       |
  297|       |         if constexpr(ROT == 8) {
  298|       |            const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14};
  299|       |            const uint8x16_t mask = vld1q_u8(maskb);
  300|       |            return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask)));
  301|       |         } else if constexpr(ROT == 16) {
  302|       |            return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd))));
  303|       |         }
  304|       |   #endif
  305|       |         return SIMD_4x32(
  306|       |            vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), vshrq_n_u32(m_simd, static_cast<int>(32 - ROT))));
  307|       |#endif
  308|  1.78M|      }
_ZNK5Botan9SIMD_4x324rotlILm2EEES0_v:
  281|  1.78M|      {
  282|  1.78M|#if defined(BOTAN_SIMD_USE_SSE2)
  283|       |
  284|  1.78M|         return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_simd, static_cast<int>(ROT)),
  285|  1.78M|                                       _mm_srli_epi32(m_simd, static_cast<int>(32 - ROT))));
  286|       |
  287|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  288|       |
  289|       |         const unsigned int r = static_cast<unsigned int>(ROT);
  290|       |         __vector unsigned int rot = {r, r, r, r};
  291|       |         return SIMD_4x32(vec_rl(m_simd, rot));
  292|       |
  293|       |#elif defined(BOTAN_SIMD_USE_NEON)
  294|       |
  295|       |   #if defined(BOTAN_TARGET_ARCH_IS_ARM64)
  296|       |
  297|       |         if constexpr(ROT == 8) {
  298|       |            const uint8_t maskb[16] = {3, 0, 1, 2, 7, 4, 5, 6, 11, 8, 9, 10, 15, 12, 13, 14};
  299|       |            const uint8x16_t mask = vld1q_u8(maskb);
  300|       |            return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask)));
  301|       |         } else if constexpr(ROT == 16) {
  302|       |            return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd))));
  303|       |         }
  304|       |   #endif
  305|       |         return SIMD_4x32(
  306|       |            vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), vshrq_n_u32(m_simd, static_cast<int>(32 - ROT))));
  307|       |#endif
  308|  1.78M|      }
_ZN5Botan9SIMD_4x32C2Ev:
   86|  1.58k|      {
   87|  1.58k|#if defined(BOTAN_SIMD_USE_SSE2)
   88|  1.58k|         m_simd = _mm_setzero_si128();
   89|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   90|       |         m_simd = vec_splat_u32(0);
   91|       |#elif defined(BOTAN_SIMD_USE_NEON)
   92|       |         m_simd = vdupq_n_u32(0);
   93|       |#endif
   94|  1.58k|      }
_ZN5Botan9SIMD_4x32C2Ejjjj:
  113|     96|      SIMD_4x32(uint32_t B0, uint32_t B1, uint32_t B2, uint32_t B3) noexcept {
  114|     96|#if defined(BOTAN_SIMD_USE_SSE2)
  115|     96|         m_simd = _mm_set_epi32(B3, B2, B1, B0);
  116|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  117|       |         __vector unsigned int val = {B0, B1, B2, B3};
  118|       |         m_simd = val;
  119|       |#elif defined(BOTAN_SIMD_USE_NEON)
  120|       |         // Better way to do this?
  121|       |         const uint32_t B[4] = {B0, B1, B2, B3};
  122|       |         m_simd = vld1q_u32(B);
  123|       |#endif
  124|     96|      }
_ZN5Botan9SIMD_4x328splat_u8Eh:
  142|      2|      static SIMD_4x32 splat_u8(uint8_t B) noexcept {
  143|      2|#if defined(BOTAN_SIMD_USE_SSE2)
  144|      2|         return SIMD_4x32(_mm_set1_epi8(B));
  145|       |#elif defined(BOTAN_SIMD_USE_NEON)
  146|       |         return SIMD_4x32(vreinterpretq_u32_u8(vdupq_n_u8(B)));
  147|       |#else
  148|       |         const uint32_t B4 = make_uint32(B, B, B, B);
  149|       |         return SIMD_4x32(B4, B4, B4, B4);
  150|       |#endif
  151|      2|      }
_ZNK5Botan9SIMD_4x328store_leEPj:
  187|  2.22M|      void store_le(uint32_t out[4]) const noexcept { this->store_le(reinterpret_cast<uint8_t*>(out)); }
_ZNK5Botan9SIMD_4x328store_leEPm:
  191|    728|      void store_le(uint64_t out[2]) const noexcept { this->store_le(reinterpret_cast<uint8_t*>(out)); }
_ZNK5Botan9SIMD_4x32plERKS0_:
  321|  2.22M|      SIMD_4x32 operator+(const SIMD_4x32& other) const noexcept {
  322|  2.22M|         SIMD_4x32 retval(*this);
  323|  2.22M|         retval += other;
  324|  2.22M|         return retval;
  325|  2.22M|      }
_ZN5Botan9SIMD_4x32pLERKS0_:
  363|  2.22M|      void operator+=(const SIMD_4x32& other) noexcept {
  364|  2.22M|#if defined(BOTAN_SIMD_USE_SSE2)
  365|  2.22M|         m_simd = _mm_add_epi32(m_simd, other.m_simd);
  366|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  367|       |         m_simd = vec_add(m_simd, other.m_simd);
  368|       |#elif defined(BOTAN_SIMD_USE_NEON)
  369|       |         m_simd = vaddq_u32(m_simd, other.m_simd);
  370|       |#endif
  371|  2.22M|      }
_ZNK5Botan9SIMD_4x3217shift_elems_rightILm1EEES0_v:
  522|  1.78M|      {
  523|  1.78M|#if defined(BOTAN_SIMD_USE_SSE2)
  524|  1.78M|         return SIMD_4x32(_mm_srli_si128(raw(), 4 * I));
  525|       |#elif defined(BOTAN_SIMD_USE_NEON)
  526|       |         return SIMD_4x32(vextq_u32(raw(), vdupq_n_u32(0), I));
  527|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  528|       |         const __vector unsigned int zero = vec_splat_u32(0);
  529|       |
  530|       |         const __vector unsigned char shuf[3] = {
  531|       |            {4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19},
  532|       |            {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23},
  533|       |            {12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27},
  534|       |         };
  535|       |
  536|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  537|       |#endif
  538|  1.78M|      }
_ZNK5Botan9SIMD_4x3216shift_elems_leftILm3EEES0_v:
  501|  1.78M|      {
  502|  1.78M|#if defined(BOTAN_SIMD_USE_SSE2)
  503|  1.78M|         return SIMD_4x32(_mm_slli_si128(raw(), 4 * I));
  504|       |#elif defined(BOTAN_SIMD_USE_NEON)
  505|       |         return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I));
  506|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  507|       |         const __vector unsigned int zero = vec_splat_u32(0);
  508|       |
  509|       |         const __vector unsigned char shuf[3] = {
  510|       |            {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11},
  511|       |            {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7},
  512|       |            {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3},
  513|       |         };
  514|       |
  515|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  516|       |#endif
  517|  1.78M|      }
_ZNK5Botan9SIMD_4x3216shift_elems_leftILm1EEES0_v:
  501|  5.64k|      {
  502|  5.64k|#if defined(BOTAN_SIMD_USE_SSE2)
  503|  5.64k|         return SIMD_4x32(_mm_slli_si128(raw(), 4 * I));
  504|       |#elif defined(BOTAN_SIMD_USE_NEON)
  505|       |         return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I));
  506|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  507|       |         const __vector unsigned int zero = vec_splat_u32(0);
  508|       |
  509|       |         const __vector unsigned char shuf[3] = {
  510|       |            {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11},
  511|       |            {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7},
  512|       |            {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3},
  513|       |         };
  514|       |
  515|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  516|       |#endif
  517|  5.64k|      }
_ZNK5Botan9SIMD_4x3216shift_elems_leftILm2EEES0_v:
  501|  2.82k|      {
  502|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  503|  2.82k|         return SIMD_4x32(_mm_slli_si128(raw(), 4 * I));
  504|       |#elif defined(BOTAN_SIMD_USE_NEON)
  505|       |         return SIMD_4x32(vextq_u32(vdupq_n_u32(0), raw(), 4 - I));
  506|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  507|       |         const __vector unsigned int zero = vec_splat_u32(0);
  508|       |
  509|       |         const __vector unsigned char shuf[3] = {
  510|       |            {16, 17, 18, 19, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11},
  511|       |            {16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, 6, 7},
  512|       |            {16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 0, 1, 2, 3},
  513|       |         };
  514|       |
  515|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  516|       |#endif
  517|  2.82k|      }
_ZNK5Botan9SIMD_4x3217shift_elems_rightILm2EEES0_v:
  522|  15.4k|      {
  523|  15.4k|#if defined(BOTAN_SIMD_USE_SSE2)
  524|  15.4k|         return SIMD_4x32(_mm_srli_si128(raw(), 4 * I));
  525|       |#elif defined(BOTAN_SIMD_USE_NEON)
  526|       |         return SIMD_4x32(vextq_u32(raw(), vdupq_n_u32(0), I));
  527|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  528|       |         const __vector unsigned int zero = vec_splat_u32(0);
  529|       |
  530|       |         const __vector unsigned char shuf[3] = {
  531|       |            {4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19},
  532|       |            {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23},
  533|       |            {12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27},
  534|       |         };
  535|       |
  536|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  537|       |#endif
  538|  15.4k|      }
_ZNK5Botan9SIMD_4x323shrILi31EEES0_v:
  432|  5.64k|      SIMD_4x32 shr() const noexcept {
  433|  5.64k|#if defined(BOTAN_SIMD_USE_SSE2)
  434|  5.64k|         return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT));
  435|       |
  436|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  437|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  438|       |         const __vector unsigned int shifts = {s, s, s, s};
  439|       |         return SIMD_4x32(vec_sr(m_simd, shifts));
  440|       |#elif defined(BOTAN_SIMD_USE_NEON)
  441|       |         return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT));
  442|       |#endif
  443|  5.64k|      }
_ZNK5Botan9SIMD_4x323shlILi1EEES0_v:
  418|  5.64k|      {
  419|  5.64k|#if defined(BOTAN_SIMD_USE_SSE2)
  420|  5.64k|         return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT));
  421|       |
  422|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  423|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  424|       |         const __vector unsigned int shifts = {s, s, s, s};
  425|       |         return SIMD_4x32(vec_sl(m_simd, shifts));
  426|       |#elif defined(BOTAN_SIMD_USE_NEON)
  427|       |         return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT));
  428|       |#endif
  429|  5.64k|      }
_ZNK5Botan9SIMD_4x3217shift_elems_rightILm3EEES0_v:
  522|  2.82k|      {
  523|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  524|  2.82k|         return SIMD_4x32(_mm_srli_si128(raw(), 4 * I));
  525|       |#elif defined(BOTAN_SIMD_USE_NEON)
  526|       |         return SIMD_4x32(vextq_u32(raw(), vdupq_n_u32(0), I));
  527|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  528|       |         const __vector unsigned int zero = vec_splat_u32(0);
  529|       |
  530|       |         const __vector unsigned char shuf[3] = {
  531|       |            {4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19},
  532|       |            {8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23},
  533|       |            {12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27},
  534|       |         };
  535|       |
  536|       |         return SIMD_4x32(vec_perm(raw(), zero, shuf[I - 1]));
  537|       |#endif
  538|  2.82k|      }
_ZNK5Botan9SIMD_4x323shlILi31EEES0_v:
  418|  2.82k|      {
  419|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  420|  2.82k|         return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT));
  421|       |
  422|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  423|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  424|       |         const __vector unsigned int shifts = {s, s, s, s};
  425|       |         return SIMD_4x32(vec_sl(m_simd, shifts));
  426|       |#elif defined(BOTAN_SIMD_USE_NEON)
  427|       |         return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT));
  428|       |#endif
  429|  2.82k|      }
_ZNK5Botan9SIMD_4x323shlILi30EEES0_v:
  418|  2.82k|      {
  419|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  420|  2.82k|         return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT));
  421|       |
  422|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  423|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  424|       |         const __vector unsigned int shifts = {s, s, s, s};
  425|       |         return SIMD_4x32(vec_sl(m_simd, shifts));
  426|       |#elif defined(BOTAN_SIMD_USE_NEON)
  427|       |         return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT));
  428|       |#endif
  429|  2.82k|      }
_ZNK5Botan9SIMD_4x323shlILi25EEES0_v:
  418|  2.82k|      {
  419|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  420|  2.82k|         return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT));
  421|       |
  422|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  423|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  424|       |         const __vector unsigned int shifts = {s, s, s, s};
  425|       |         return SIMD_4x32(vec_sl(m_simd, shifts));
  426|       |#elif defined(BOTAN_SIMD_USE_NEON)
  427|       |         return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT));
  428|       |#endif
  429|  2.82k|      }
_ZNK5Botan9SIMD_4x323shrILi7EEES0_v:
  432|  2.82k|      SIMD_4x32 shr() const noexcept {
  433|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  434|  2.82k|         return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT));
  435|       |
  436|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  437|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  438|       |         const __vector unsigned int shifts = {s, s, s, s};
  439|       |         return SIMD_4x32(vec_sr(m_simd, shifts));
  440|       |#elif defined(BOTAN_SIMD_USE_NEON)
  441|       |         return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT));
  442|       |#endif
  443|  2.82k|      }
_ZNK5Botan9SIMD_4x323shrILi2EEES0_v:
  432|  2.82k|      SIMD_4x32 shr() const noexcept {
  433|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  434|  2.82k|         return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT));
  435|       |
  436|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  437|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  438|       |         const __vector unsigned int shifts = {s, s, s, s};
  439|       |         return SIMD_4x32(vec_sr(m_simd, shifts));
  440|       |#elif defined(BOTAN_SIMD_USE_NEON)
  441|       |         return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT));
  442|       |#endif
  443|  2.82k|      }
_ZNK5Botan9SIMD_4x323shrILi1EEES0_v:
  432|  2.82k|      SIMD_4x32 shr() const noexcept {
  433|  2.82k|#if defined(BOTAN_SIMD_USE_SSE2)
  434|  2.82k|         return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT));
  435|       |
  436|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
  437|       |         const unsigned int s = static_cast<unsigned int>(SHIFT);
  438|       |         const __vector unsigned int shifts = {s, s, s, s};
  439|       |         return SIMD_4x32(vec_sr(m_simd, shifts));
  440|       |#elif defined(BOTAN_SIMD_USE_NEON)
  441|       |         return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT));
  442|       |#endif
  443|  2.82k|      }

_ZN5Botan9SIMD_8x3215reset_registersEv:
  303|  29.4k|      static void reset_registers() noexcept { _mm256_zeroupper(); }
_ZN5Botan9SIMD_8x32C2EDv4_x:
  311|  10.8M|      SIMD_8x32(__m256i x) noexcept : m_avx2(x) {}
_ZN5Botan9SIMD_8x329transposeERS0_S1_S1_S1_:
  254|   117k|      static void transpose(SIMD_8x32& B0, SIMD_8x32& B1, SIMD_8x32& B2, SIMD_8x32& B3) noexcept {
  255|   117k|         const __m256i T0 = _mm256_unpacklo_epi32(B0.m_avx2, B1.m_avx2);
  256|   117k|         const __m256i T1 = _mm256_unpacklo_epi32(B2.m_avx2, B3.m_avx2);
  257|   117k|         const __m256i T2 = _mm256_unpackhi_epi32(B0.m_avx2, B1.m_avx2);
  258|   117k|         const __m256i T3 = _mm256_unpackhi_epi32(B2.m_avx2, B3.m_avx2);
  259|       |
  260|   117k|         B0.m_avx2 = _mm256_unpacklo_epi64(T0, T1);
  261|   117k|         B1.m_avx2 = _mm256_unpackhi_epi64(T0, T1);
  262|   117k|         B2.m_avx2 = _mm256_unpacklo_epi64(T2, T3);
  263|   117k|         B3.m_avx2 = _mm256_unpackhi_epi64(T2, T3);
  264|   117k|      }
_ZNK5Botan9SIMD_8x328store_leEPh:
   59|   471k|      void store_le(uint8_t out[]) const noexcept { _mm256_storeu_si256(reinterpret_cast<__m256i*>(out), m_avx2); }
_ZN5Botan9SIMD_8x3214zero_registersEv:
  306|  29.4k|      static void zero_registers() noexcept { _mm256_zeroall(); }
_ZN5Botan9SIMD_8x325splatEj:
   48|   943k|      static SIMD_8x32 splat(uint32_t B) noexcept { return SIMD_8x32(_mm256_set1_epi32(B)); }
_ZN5Botan9SIMD_8x32eOERKS0_:
  209|  9.43M|      void operator^=(const SIMD_8x32& other) { m_avx2 = _mm256_xor_si256(m_avx2, other.m_avx2); }
_ZNK5Botan9SIMD_8x324rotlILm7EEES0_v:
   67|  2.35M|      {
   68|       |#if defined(__AVX512VL__)
   69|       |         return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT));
   70|       |#else
   71|  2.35M|         if constexpr(ROT == 8) {
  ------------------
  |  Branch (71:23): [Folded - Ignored]
  ------------------
   72|  2.35M|            const __m256i shuf_rotl_8 = _mm256_set_epi8(14,
   73|  2.35M|                                                        13,
   74|  2.35M|                                                        12,
   75|  2.35M|                                                        15,
   76|  2.35M|                                                        10,
   77|  2.35M|                                                        9,
   78|  2.35M|                                                        8,
   79|  2.35M|                                                        11,
   80|  2.35M|                                                        6,
   81|  2.35M|                                                        5,
   82|  2.35M|                                                        4,
   83|  2.35M|                                                        7,
   84|  2.35M|                                                        2,
   85|  2.35M|                                                        1,
   86|  2.35M|                                                        0,
   87|  2.35M|                                                        3,
   88|  2.35M|                                                        14,
   89|  2.35M|                                                        13,
   90|  2.35M|                                                        12,
   91|  2.35M|                                                        15,
   92|  2.35M|                                                        10,
   93|  2.35M|                                                        9,
   94|  2.35M|                                                        8,
   95|  2.35M|                                                        11,
   96|  2.35M|                                                        6,
   97|  2.35M|                                                        5,
   98|  2.35M|                                                        4,
   99|  2.35M|                                                        7,
  100|  2.35M|                                                        2,
  101|  2.35M|                                                        1,
  102|  2.35M|                                                        0,
  103|  2.35M|                                                        3);
  104|       |
  105|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8));
  106|  2.35M|         } else if constexpr(ROT == 16) {
  ------------------
  |  Branch (106:30): [Folded - Ignored]
  ------------------
  107|  2.35M|            const __m256i shuf_rotl_16 = _mm256_set_epi8(13,
  108|  2.35M|                                                         12,
  109|  2.35M|                                                         15,
  110|  2.35M|                                                         14,
  111|  2.35M|                                                         9,
  112|  2.35M|                                                         8,
  113|  2.35M|                                                         11,
  114|  2.35M|                                                         10,
  115|  2.35M|                                                         5,
  116|  2.35M|                                                         4,
  117|  2.35M|                                                         7,
  118|  2.35M|                                                         6,
  119|  2.35M|                                                         1,
  120|  2.35M|                                                         0,
  121|  2.35M|                                                         3,
  122|  2.35M|                                                         2,
  123|  2.35M|                                                         13,
  124|  2.35M|                                                         12,
  125|  2.35M|                                                         15,
  126|  2.35M|                                                         14,
  127|  2.35M|                                                         9,
  128|  2.35M|                                                         8,
  129|  2.35M|                                                         11,
  130|  2.35M|                                                         10,
  131|  2.35M|                                                         5,
  132|  2.35M|                                                         4,
  133|  2.35M|                                                         7,
  134|  2.35M|                                                         6,
  135|  2.35M|                                                         1,
  136|  2.35M|                                                         0,
  137|  2.35M|                                                         3,
  138|  2.35M|                                                         2);
  139|       |
  140|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16));
  141|  2.35M|         } else {
  142|  2.35M|            return SIMD_8x32(_mm256_or_si256(_mm256_slli_epi32(m_avx2, static_cast<int>(ROT)),
  143|  2.35M|                                             _mm256_srli_epi32(m_avx2, static_cast<int>(32 - ROT))));
  144|  2.35M|         }
  145|  2.35M|#endif
  146|  2.35M|      }
_ZN5Botan9SIMD_8x32C2Ejjjjjjjj:
   43|  58.9k|                         uint32_t B7) noexcept {
   44|  58.9k|         m_avx2 = _mm256_set_epi32(B7, B6, B5, B4, B3, B2, B1, B0);
   45|  58.9k|      }
_ZNK5Botan9SIMD_8x32plERKS0_:
  168|   117k|      SIMD_8x32 operator+(const SIMD_8x32& other) const noexcept {
  169|   117k|         SIMD_8x32 retval(*this);
  170|   117k|         retval += other;
  171|   117k|         return retval;
  172|   117k|      }
_ZN5Botan9SIMD_8x32pLERKS0_:
  203|  10.0M|      void operator+=(const SIMD_8x32& other) { m_avx2 = _mm256_add_epi32(m_avx2, other.m_avx2); }
_ZN5Botan9SIMD_8x329transposeERS0_S1_S1_S1_S1_S1_S1_S1_:
  274|  58.9k|                            SIMD_8x32& B7) noexcept {
  275|  58.9k|         transpose(B0, B1, B2, B3);
  276|  58.9k|         transpose(B4, B5, B6, B7);
  277|       |
  278|  58.9k|         swap_tops(B0, B4);
  279|  58.9k|         swap_tops(B1, B5);
  280|  58.9k|         swap_tops(B2, B6);
  281|  58.9k|         swap_tops(B3, B7);
  282|  58.9k|      }
_ZNK5Botan9SIMD_8x326handleEv:
  308|   943k|      __m256i BOTAN_AVX2_FN handle() const noexcept { return m_avx2; }
_ZN5Botan9SIMD_8x329swap_topsERS0_S1_:
  315|   235k|      static void swap_tops(SIMD_8x32& A, SIMD_8x32& B) {
  316|   235k|         SIMD_8x32 T0 = _mm256_permute2x128_si256(A.handle(), B.handle(), 0 + (2 << 4));
  317|   235k|         SIMD_8x32 T1 = _mm256_permute2x128_si256(A.handle(), B.handle(), 1 + (3 << 4));
  318|   235k|         A = T0;
  319|   235k|         B = T1;
  320|   235k|      }
_ZNK5Botan9SIMD_8x324rotlILm16EEES0_v:
   67|  2.35M|      {
   68|       |#if defined(__AVX512VL__)
   69|       |         return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT));
   70|       |#else
   71|  2.35M|         if constexpr(ROT == 8) {
  ------------------
  |  Branch (71:23): [Folded - Ignored]
  ------------------
   72|  2.35M|            const __m256i shuf_rotl_8 = _mm256_set_epi8(14,
   73|  2.35M|                                                        13,
   74|  2.35M|                                                        12,
   75|  2.35M|                                                        15,
   76|  2.35M|                                                        10,
   77|  2.35M|                                                        9,
   78|  2.35M|                                                        8,
   79|  2.35M|                                                        11,
   80|  2.35M|                                                        6,
   81|  2.35M|                                                        5,
   82|  2.35M|                                                        4,
   83|  2.35M|                                                        7,
   84|  2.35M|                                                        2,
   85|  2.35M|                                                        1,
   86|  2.35M|                                                        0,
   87|  2.35M|                                                        3,
   88|  2.35M|                                                        14,
   89|  2.35M|                                                        13,
   90|  2.35M|                                                        12,
   91|  2.35M|                                                        15,
   92|  2.35M|                                                        10,
   93|  2.35M|                                                        9,
   94|  2.35M|                                                        8,
   95|  2.35M|                                                        11,
   96|  2.35M|                                                        6,
   97|  2.35M|                                                        5,
   98|  2.35M|                                                        4,
   99|  2.35M|                                                        7,
  100|  2.35M|                                                        2,
  101|  2.35M|                                                        1,
  102|  2.35M|                                                        0,
  103|  2.35M|                                                        3);
  104|       |
  105|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8));
  106|  2.35M|         } else if constexpr(ROT == 16) {
  ------------------
  |  Branch (106:30): [Folded - Ignored]
  ------------------
  107|  2.35M|            const __m256i shuf_rotl_16 = _mm256_set_epi8(13,
  108|  2.35M|                                                         12,
  109|  2.35M|                                                         15,
  110|  2.35M|                                                         14,
  111|  2.35M|                                                         9,
  112|  2.35M|                                                         8,
  113|  2.35M|                                                         11,
  114|  2.35M|                                                         10,
  115|  2.35M|                                                         5,
  116|  2.35M|                                                         4,
  117|  2.35M|                                                         7,
  118|  2.35M|                                                         6,
  119|  2.35M|                                                         1,
  120|  2.35M|                                                         0,
  121|  2.35M|                                                         3,
  122|  2.35M|                                                         2,
  123|  2.35M|                                                         13,
  124|  2.35M|                                                         12,
  125|  2.35M|                                                         15,
  126|  2.35M|                                                         14,
  127|  2.35M|                                                         9,
  128|  2.35M|                                                         8,
  129|  2.35M|                                                         11,
  130|  2.35M|                                                         10,
  131|  2.35M|                                                         5,
  132|  2.35M|                                                         4,
  133|  2.35M|                                                         7,
  134|  2.35M|                                                         6,
  135|  2.35M|                                                         1,
  136|  2.35M|                                                         0,
  137|  2.35M|                                                         3,
  138|  2.35M|                                                         2);
  139|       |
  140|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16));
  141|  2.35M|         } else {
  142|  2.35M|            return SIMD_8x32(_mm256_or_si256(_mm256_slli_epi32(m_avx2, static_cast<int>(ROT)),
  143|  2.35M|                                             _mm256_srli_epi32(m_avx2, static_cast<int>(32 - ROT))));
  144|  2.35M|         }
  145|  2.35M|#endif
  146|  2.35M|      }
_ZNK5Botan9SIMD_8x324rotlILm12EEES0_v:
   67|  2.35M|      {
   68|       |#if defined(__AVX512VL__)
   69|       |         return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT));
   70|       |#else
   71|  2.35M|         if constexpr(ROT == 8) {
  ------------------
  |  Branch (71:23): [Folded - Ignored]
  ------------------
   72|  2.35M|            const __m256i shuf_rotl_8 = _mm256_set_epi8(14,
   73|  2.35M|                                                        13,
   74|  2.35M|                                                        12,
   75|  2.35M|                                                        15,
   76|  2.35M|                                                        10,
   77|  2.35M|                                                        9,
   78|  2.35M|                                                        8,
   79|  2.35M|                                                        11,
   80|  2.35M|                                                        6,
   81|  2.35M|                                                        5,
   82|  2.35M|                                                        4,
   83|  2.35M|                                                        7,
   84|  2.35M|                                                        2,
   85|  2.35M|                                                        1,
   86|  2.35M|                                                        0,
   87|  2.35M|                                                        3,
   88|  2.35M|                                                        14,
   89|  2.35M|                                                        13,
   90|  2.35M|                                                        12,
   91|  2.35M|                                                        15,
   92|  2.35M|                                                        10,
   93|  2.35M|                                                        9,
   94|  2.35M|                                                        8,
   95|  2.35M|                                                        11,
   96|  2.35M|                                                        6,
   97|  2.35M|                                                        5,
   98|  2.35M|                                                        4,
   99|  2.35M|                                                        7,
  100|  2.35M|                                                        2,
  101|  2.35M|                                                        1,
  102|  2.35M|                                                        0,
  103|  2.35M|                                                        3);
  104|       |
  105|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8));
  106|  2.35M|         } else if constexpr(ROT == 16) {
  ------------------
  |  Branch (106:30): [Folded - Ignored]
  ------------------
  107|  2.35M|            const __m256i shuf_rotl_16 = _mm256_set_epi8(13,
  108|  2.35M|                                                         12,
  109|  2.35M|                                                         15,
  110|  2.35M|                                                         14,
  111|  2.35M|                                                         9,
  112|  2.35M|                                                         8,
  113|  2.35M|                                                         11,
  114|  2.35M|                                                         10,
  115|  2.35M|                                                         5,
  116|  2.35M|                                                         4,
  117|  2.35M|                                                         7,
  118|  2.35M|                                                         6,
  119|  2.35M|                                                         1,
  120|  2.35M|                                                         0,
  121|  2.35M|                                                         3,
  122|  2.35M|                                                         2,
  123|  2.35M|                                                         13,
  124|  2.35M|                                                         12,
  125|  2.35M|                                                         15,
  126|  2.35M|                                                         14,
  127|  2.35M|                                                         9,
  128|  2.35M|                                                         8,
  129|  2.35M|                                                         11,
  130|  2.35M|                                                         10,
  131|  2.35M|                                                         5,
  132|  2.35M|                                                         4,
  133|  2.35M|                                                         7,
  134|  2.35M|                                                         6,
  135|  2.35M|                                                         1,
  136|  2.35M|                                                         0,
  137|  2.35M|                                                         3,
  138|  2.35M|                                                         2);
  139|       |
  140|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16));
  141|  2.35M|         } else {
  142|  2.35M|            return SIMD_8x32(_mm256_or_si256(_mm256_slli_epi32(m_avx2, static_cast<int>(ROT)),
  143|  2.35M|                                             _mm256_srli_epi32(m_avx2, static_cast<int>(32 - ROT))));
  144|  2.35M|         }
  145|  2.35M|#endif
  146|  2.35M|      }
_ZNK5Botan9SIMD_8x324rotlILm8EEES0_v:
   67|  2.35M|      {
   68|       |#if defined(__AVX512VL__)
   69|       |         return SIMD_8x32(_mm256_rol_epi32(m_avx2, ROT));
   70|       |#else
   71|  2.35M|         if constexpr(ROT == 8) {
  ------------------
  |  Branch (71:23): [Folded - Ignored]
  ------------------
   72|  2.35M|            const __m256i shuf_rotl_8 = _mm256_set_epi8(14,
   73|  2.35M|                                                        13,
   74|  2.35M|                                                        12,
   75|  2.35M|                                                        15,
   76|  2.35M|                                                        10,
   77|  2.35M|                                                        9,
   78|  2.35M|                                                        8,
   79|  2.35M|                                                        11,
   80|  2.35M|                                                        6,
   81|  2.35M|                                                        5,
   82|  2.35M|                                                        4,
   83|  2.35M|                                                        7,
   84|  2.35M|                                                        2,
   85|  2.35M|                                                        1,
   86|  2.35M|                                                        0,
   87|  2.35M|                                                        3,
   88|  2.35M|                                                        14,
   89|  2.35M|                                                        13,
   90|  2.35M|                                                        12,
   91|  2.35M|                                                        15,
   92|  2.35M|                                                        10,
   93|  2.35M|                                                        9,
   94|  2.35M|                                                        8,
   95|  2.35M|                                                        11,
   96|  2.35M|                                                        6,
   97|  2.35M|                                                        5,
   98|  2.35M|                                                        4,
   99|  2.35M|                                                        7,
  100|  2.35M|                                                        2,
  101|  2.35M|                                                        1,
  102|  2.35M|                                                        0,
  103|  2.35M|                                                        3);
  104|       |
  105|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_8));
  106|  2.35M|         } else if constexpr(ROT == 16) {
  107|  2.35M|            const __m256i shuf_rotl_16 = _mm256_set_epi8(13,
  108|  2.35M|                                                         12,
  109|  2.35M|                                                         15,
  110|  2.35M|                                                         14,
  111|  2.35M|                                                         9,
  112|  2.35M|                                                         8,
  113|  2.35M|                                                         11,
  114|  2.35M|                                                         10,
  115|  2.35M|                                                         5,
  116|  2.35M|                                                         4,
  117|  2.35M|                                                         7,
  118|  2.35M|                                                         6,
  119|  2.35M|                                                         1,
  120|  2.35M|                                                         0,
  121|  2.35M|                                                         3,
  122|  2.35M|                                                         2,
  123|  2.35M|                                                         13,
  124|  2.35M|                                                         12,
  125|  2.35M|                                                         15,
  126|  2.35M|                                                         14,
  127|  2.35M|                                                         9,
  128|  2.35M|                                                         8,
  129|  2.35M|                                                         11,
  130|  2.35M|                                                         10,
  131|  2.35M|                                                         5,
  132|  2.35M|                                                         4,
  133|  2.35M|                                                         7,
  134|  2.35M|                                                         6,
  135|  2.35M|                                                         1,
  136|  2.35M|                                                         0,
  137|  2.35M|                                                         3,
  138|  2.35M|                                                         2);
  139|       |
  140|  2.35M|            return SIMD_8x32(_mm256_shuffle_epi8(m_avx2, shuf_rotl_16));
  141|  2.35M|         } else {
  142|  2.35M|            return SIMD_8x32(_mm256_or_si256(_mm256_slli_epi32(m_avx2, static_cast<int>(ROT)),
  143|  2.35M|                                             _mm256_srli_epi32(m_avx2, static_cast<int>(32 - ROT))));
  144|  2.35M|         }
  145|  2.35M|#endif
  146|  2.35M|      }

_ZN5Botan12value_existsINSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EEEEbRKNS1_6vectorIT_NS5_ISB_EEEERKT0_:
   89|  4.91k|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  11.1k|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 11.1k, False: 0]
  ------------------
   91|  11.1k|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 4.91k, False: 6.25k]
  ------------------
   92|  4.91k|         return true;
   93|      0|   return false;
   94|  4.91k|}
_ZN5Botan12value_existsINS_3TLS12Group_ParamsES2_EEbRKNSt3__16vectorIT_NS3_9allocatorIS5_EEEERKT0_:
   89|   276k|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  1.00M|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 763k, False: 236k]
  ------------------
   91|   763k|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 39.5k, False: 723k]
  ------------------
   92|  39.5k|         return true;
   93|   236k|   return false;
   94|   276k|}
_ZN5Botan12value_existsINS_3TLS16Signature_SchemeES2_EEbRKNSt3__16vectorIT_NS3_9allocatorIS5_EEEERKT0_:
   89|  9.82k|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  84.2k|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 76.8k, False: 7.38k]
  ------------------
   91|  76.8k|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 2.43k, False: 74.4k]
  ------------------
   92|  2.43k|         return true;
   93|  7.38k|   return false;
   94|  9.82k|}
_ZN5Botan15multimap_insertINS_3OIDENSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEEEvRNS2_8multimapIT_T0_NS2_4lessISA_EENS6_INS2_4pairIKSA_SB_EEEEEERSF_RKSB_:
   81|  57.7k|void multimap_insert(std::multimap<K, V>& multimap, const K& key, const V& value) {
   82|  57.7k|   multimap.insert(std::make_pair(key, value));
   83|  57.7k|}
_ZN5Botan12value_existsINS_3TLS16Protocol_VersionES2_EEbRKNSt3__16vectorIT_NS3_9allocatorIS5_EEEERKT0_:
   89|    354|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  1.16k|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 1.13k, False: 27]
  ------------------
   91|  1.13k|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 327, False: 811]
  ------------------
   92|    327|         return true;
   93|     27|   return false;
   94|    354|}
_ZN5Botan12value_existsIttEEbRKNSt3__16vectorIT_NS1_9allocatorIS3_EEEERKT0_:
   89|  1.07M|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  3.22M|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 2.17M, False: 1.04M]
  ------------------
   91|  2.17M|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 21.8k, False: 2.15M]
  ------------------
   92|  21.8k|         return true;
   93|  1.04M|   return false;
   94|  1.07M|}
_ZN5Botan12value_existsIhhEEbRKNSt3__16vectorIT_NS1_9allocatorIS3_EEEERKT0_:
   89|  25.0k|bool value_exists(const std::vector<T>& vec, const OT& val) {
   90|  28.2k|   for(size_t i = 0; i != vec.size(); ++i)
  ------------------
  |  Branch (90:22): [True: 28.2k, False: 30]
  ------------------
   91|  28.2k|      if(vec[i] == val)
  ------------------
  |  Branch (91:10): [True: 24.9k, False: 3.23k]
  ------------------
   92|  24.9k|         return true;
   93|     30|   return false;
   94|  25.0k|}
tls_channel_impl_12.cpp:_ZN5Botan13map_remove_ifINSt3__13mapItNS1_10shared_ptrINS_3TLS23Connection_Cipher_StateEEENS1_4lessItEENS1_9allocatorINS1_4pairIKtS6_EEEEEEZNS4_15Channel_Impl_1216activate_sessionEvE3$_0EEvT0_RT_:
   97|    490|void map_remove_if(Pred pred, T& assoc) {
   98|    490|   auto i = assoc.begin();
   99|  1.47k|   while(i != assoc.end()) {
  ------------------
  |  Branch (99:10): [True: 980, False: 490]
  ------------------
  100|    980|      if(pred(i->first))
  ------------------
  |  Branch (100:10): [True: 490, False: 490]
  ------------------
  101|    490|         assoc.erase(i++);
  102|    490|      else
  103|    490|         i++;
  104|    980|   }
  105|    490|}

_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_EncryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS2_14default_deleteIS4_EEEENS3_INS_25MessageAuthenticationCodeENS5_IS8_EEEEmmNS0_16Protocol_VersionEb:
  128|     98|                                   use_encrypt_then_mac) {}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_DecryptionC2ENSt3__110unique_ptrINS_11BlockCipherENS2_14default_deleteIS4_EEEENS3_INS_25MessageAuthenticationCodeENS5_IS8_EEEEmmNS0_16Protocol_VersionEb:
  160|    189|                                   use_encrypt_then_mac) {}
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode8tag_sizeEv:
   39|  1.29k|      size_t tag_size() const override final { return m_tag_size; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode7iv_sizeEv:
   62|     52|      size_t iv_size() const { return m_iv_size; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode10block_sizeEv:
   64|    922|      size_t block_size() const { return m_block_size; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode20use_encrypt_then_macEv:
   66|    779|      bool use_encrypt_then_mac() const { return m_use_encrypt_then_mac; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode20is_datagram_protocolEv:
   68|     72|      bool is_datagram_protocol() const { return m_is_datagram; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3cbcEv:
   70|    679|      Cipher_Mode& cbc() const { return *m_cbc; }
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3macEv:
   72|  1.03k|      MessageAuthenticationCode& mac() const {
   73|  1.03k|         BOTAN_ASSERT_NONNULL(m_mac);
  ------------------
  |  |   87|  1.03k|   do {                                                                                   \
  |  |   88|  1.03k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 1.03k]
  |  |  ------------------
  |  |   89|  1.03k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  1.03k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   74|  1.03k|         return *m_mac;
   75|  1.03k|      }
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode9cbc_stateEv:
   77|    405|      secure_vector<uint8_t>& cbc_state() { return m_cbc_state; }
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode10assoc_dataEv:
   79|    172|      std::vector<uint8_t>& assoc_data() { return m_ad; }
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode3msgEv:
   81|    420|      secure_vector<uint8_t>& msg() { return m_msg; }
_ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption18minimum_final_sizeEv:
  164|     88|      size_t minimum_final_size() const override { return tag_size(); }

_ZNK5Botan3TLS12Channel_Impl14is_downgradingEv:
  255|  2.36k|      bool is_downgrading() const { return m_downgrade_info && m_downgrade_info->will_downgrade; }
  ------------------
  |  Branch (255:44): [True: 0, False: 2.36k]
  |  Branch (255:64): [True: 0, False: 0]
  ------------------
_ZN5Botan3TLS12Channel_Impl18send_warning_alertENS0_9AlertTypeE:
   70|    377|      void send_warning_alert(Alert::Type type) { send_alert(Alert(type, false)); }
_ZN5Botan3TLS12Channel_Impl16send_fatal_alertENS0_9AlertTypeE:
   75|  3.41k|      void send_fatal_alert(Alert::Type type) { send_alert(Alert(type, true)); }
_ZN5Botan3TLS12Channel_ImplD2Ev:
   45|  5.77k|      virtual ~Channel_Impl() = default;

_ZN5Botan3TLS15Channel_Impl_123rngEv:
  169|  78.5k|      RandomNumberGenerator& rng() { return *m_rng; }
_ZN5Botan3TLS15Channel_Impl_1215session_managerEv:
  171|  23.8k|      Session_Manager& session_manager() { return *m_session_manager; }
_ZNK5Botan3TLS15Channel_Impl_126policyEv:
  173|   176k|      const Policy& policy() const { return *m_policy; }
_ZNK5Botan3TLS15Channel_Impl_129callbacksEv:
  175|   186k|      Callbacks& callbacks() const { return *m_callbacks; }
_ZNK5Botan3TLS15Channel_Impl_1212active_stateEv:
  201|   204k|      const Handshake_State* active_state() const { return m_active_state.get(); }
_ZNK5Botan3TLS15Channel_Impl_1213pending_stateEv:
  203|   110k|      const Handshake_State* pending_state() const { return m_pending_state.get(); }

_ZN5Botan3TLS14Handshake_Hash6updateERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
   25|   104k|      void update(const std::vector<uint8_t>& in) { m_data += in; }
_ZN5Botan3TLS14Handshake_Hash5resetEv:
   31|  3.80k|      void reset() { m_data.clear(); }

_ZN5Botan3TLS19Stream_Handshake_IOC2ENSt3__18functionIFvNS0_11Record_TypeERKNS2_6vectorIhNS2_9allocatorIhEEEEEEE:
   87|  23.3k|      explicit Stream_Handshake_IO(writer_fn writer) : m_send_hs(writer) {}
_ZNK5Botan3TLS19Stream_Handshake_IO14have_more_dataEv:
   93|  26.3k|      bool have_more_data() const override { return m_queue.empty() == false; }
_ZN5Botan3TLS21Datagram_Handshake_IOC2ENSt3__18functionIFvtNS0_11Record_TypeERKNS2_6vectorIhNS2_9allocatorIhEEEEEEERNS0_27Connection_Sequence_NumbersEtmm:
  128|    708|            m_mtu(mtu) {}
_ZN5Botan3TLS21Datagram_Handshake_IO12Message_InfoC2EtNS0_14Handshake_TypeERKNSt3__16vectorIhNS4_9allocatorIhEEEE:
  195|     13|                  epoch(e), msg_type(mt), msg_bits(msg) {}
_ZN5Botan3TLS21Datagram_Handshake_IO12Message_InfoC2Ev:
  197|     13|            Message_Info() : epoch(0xFFFF), msg_type(Handshake_Type::None) {}
_ZN5Botan3TLS12Handshake_IOC2Ev:
   71|  24.0k|      Handshake_IO() = default;
_ZN5Botan3TLS12Handshake_IOD2Ev:
   77|  24.0k|      virtual ~Handshake_IO() = default;

_ZN5Botan3TLS15Handshake_State12handshake_ioEv:
   67|   180k|      Handshake_IO& handshake_io() { return *m_handshake_io; }
_ZNK5Botan3TLS15Handshake_State7versionEv:
  104|   129k|      Protocol_Version version() const { return m_version; }
_ZNK5Botan3TLS15Handshake_State12client_helloEv:
  131|   358k|      const Client_Hello_12* client_hello() const { return m_client_hello.get(); }
_ZNK5Botan3TLS15Handshake_State12server_helloEv:
  133|  89.7k|      const Server_Hello_12* server_hello() const { return m_server_hello.get(); }
_ZNK5Botan3TLS15Handshake_State12server_certsEv:
  135|    177|      const Certificate_12* server_certs() const { return m_server_certs.get(); }
_ZNK5Botan3TLS15Handshake_State10server_kexEv:
  137|  47.9k|      const Server_Key_Exchange* server_kex() const { return m_server_kex.get(); }
_ZNK5Botan3TLS15Handshake_State12client_certsEv:
  143|    245|      const Certificate_12* client_certs() const { return m_client_certs.get(); }
_ZNK5Botan3TLS15Handshake_State10client_kexEv:
  145|  14.6k|      const Client_Key_Exchange* client_kex() const { return m_client_kex.get(); }
_ZNK5Botan3TLS15Handshake_State18new_session_ticketEv:
  153|    245|      const New_Session_Ticket_12* new_session_ticket() const { return m_new_session_ticket.get(); }
_ZNK5Botan3TLS15Handshake_State15server_finishedEv:
  155|    245|      const Finished_12* server_finished() const { return m_server_finished.get(); }
_ZNK5Botan3TLS15Handshake_State15client_finishedEv:
  157|    245|      const Finished_12* client_finished() const { return m_client_finished.get(); }
_ZNK5Botan3TLS15Handshake_State12session_keysEv:
  161|  1.49k|      const Session_Keys& session_keys() const { return m_session_keys; }
_ZNK5Botan3TLS15Handshake_State9callbacksEv:
  163|  34.1k|      Callbacks& callbacks() const { return m_callbacks; }
_ZN5Botan3TLS15Handshake_State4hashEv:
  169|   108k|      Handshake_Hash& hash() { return m_handshake_hash; }
_ZNK5Botan3TLS15Handshake_State4hashEv:
  171|  1.67k|      const Handshake_Hash& hash() const { return m_handshake_hash; }

_ZN5Botan3TLS15TLS_Data_ReaderC2EPKcNSt3__14spanIKhLm18446744073709551615EEE:
   29|   204k|            m_typename(type), m_buf(buf_in), m_offset(0) {}
_ZN5Botan3TLS15TLS_Data_Reader8get_byteEv:
   79|   130k|      uint8_t get_byte() {
   80|   130k|         assert_at_least(1);
   81|   130k|         uint8_t result = m_buf[m_offset];
   82|   130k|         m_offset += 1;
   83|   130k|         return result;
   84|   130k|      }
_ZNK5Botan3TLS15TLS_Data_Reader15assert_at_leastEm:
  157|  1.19M|      void assert_at_least(size_t n) const {
  158|  1.19M|         if(m_buf.size() - m_offset < n)
  ------------------
  |  Branch (158:13): [True: 301, False: 1.19M]
  ------------------
  159|    301|            throw_decode_error("Expected " + std::to_string(n) + " bytes remaining, only " +
  160|    301|                               std::to_string(m_buf.size() - m_offset) + " left");
  161|  1.19M|      }
_ZNK5Botan3TLS15TLS_Data_Reader18throw_decode_errorENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  163|    970|      [[noreturn]] void throw_decode_error(std::string_view why) const {
  164|    970|         throw Decoding_Error(fmt("Invalid {}: {}", m_typename, why));
  165|    970|      }
_ZN5Botan3TLS15TLS_Data_Reader12discard_nextEm:
   48|  1.35k|      void discard_next(size_t bytes) {
   49|  1.35k|         assert_at_least(bytes);
   50|  1.35k|         m_offset += bytes;
   51|  1.35k|      }
_ZN5Botan3TLS15TLS_Data_Reader12get_uint16_tEv:
   67|   510k|      uint16_t get_uint16_t() {
   68|   510k|         assert_at_least(2);
   69|   510k|         uint16_t result = make_uint16(m_buf[m_offset], m_buf[m_offset + 1]);
   70|   510k|         m_offset += 2;
   71|   510k|         return result;
   72|   510k|      }
_ZNK5Botan3TLS15TLS_Data_Reader11read_so_farEv:
   36|  2.54k|      size_t read_so_far() const { return m_offset; }
_ZNK5Botan3TLS15TLS_Data_Reader13has_remainingEv:
   40|   388k|      bool has_remaining() const { return (remaining_bytes() > 0); }
_ZNK5Botan3TLS15TLS_Data_Reader15remaining_bytesEv:
   38|   574k|      size_t remaining_bytes() const { return m_buf.size() - m_offset; }
_ZNK5Botan3TLS15TLS_Data_Reader11assert_doneEv:
   31|   176k|      void assert_done() const {
   32|   176k|         if(has_remaining())
  ------------------
  |  Branch (32:13): [True: 627, False: 175k]
  ------------------
   33|    627|            throw_decode_error("Extra bytes at end of message");
   34|   176k|      }
_ZN5Botan3TLS15TLS_Data_Reader13get_remainingEv:
   42|  4.05k|      std::vector<uint8_t> get_remaining() { return std::vector<uint8_t>(m_buf.begin() + m_offset, m_buf.end()); }
_ZN5Botan3TLS15TLS_Data_Reader20get_data_read_so_farEv:
   44|  4.05k|      std::vector<uint8_t> get_data_read_so_far() {
   45|  4.05k|         return std::vector<uint8_t>(m_buf.begin(), m_buf.begin() + m_offset);
   46|  4.05k|      }
_ZN5Botan3TLS15TLS_Data_Reader12get_uint32_tEv:
   53|    725|      uint32_t get_uint32_t() {
   54|    725|         assert_at_least(4);
   55|    725|         uint32_t result = make_uint32(m_buf[m_offset], m_buf[m_offset + 1], m_buf[m_offset + 2], m_buf[m_offset + 3]);
   56|    725|         m_offset += 4;
   57|    725|         return result;
   58|    725|      }
_ZN5Botan3TLS15TLS_Data_Reader20get_tls_length_valueEm:
  100|  1.82k|      std::vector<uint8_t> get_tls_length_value(size_t len_bytes) {
  101|  1.82k|         return get_fixed<uint8_t>(get_length_field(len_bytes));
  102|  1.82k|      }
_ZN5Botan3TLS15TLS_Data_Reader10get_stringEmmm:
  118|  16.8k|      std::string get_string(size_t len_bytes, size_t min_bytes, size_t max_bytes) {
  119|  16.8k|         std::vector<uint8_t> v = get_range_vector<uint8_t>(len_bytes, min_bytes, max_bytes);
  120|       |
  121|  16.8k|         return std::string(cast_uint8_ptr_to_char(v.data()), v.size());
  122|  16.8k|      }
_ZN5Botan3TLS15TLS_Data_Reader16get_length_fieldEm:
  130|   116k|      size_t get_length_field(size_t len_bytes) {
  131|   116k|         assert_at_least(len_bytes);
  132|       |
  133|   116k|         if(len_bytes == 1)
  ------------------
  |  Branch (133:13): [True: 73.1k, False: 43.2k]
  ------------------
  134|  73.1k|            return get_byte();
  135|  43.2k|         else if(len_bytes == 2)
  ------------------
  |  Branch (135:18): [True: 43.2k, False: 20]
  ------------------
  136|  43.2k|            return get_uint16_t();
  137|     20|         else if(len_bytes == 3)
  ------------------
  |  Branch (137:18): [True: 0, False: 20]
  ------------------
  138|      0|            return get_uint24_t();
  139|       |
  140|     20|         throw_decode_error("Bad length size");
  141|     20|      }
_ZN5Botan3TLS15TLS_Data_Reader13get_num_elemsEmmmm:
  143|   114k|      size_t get_num_elems(size_t len_bytes, size_t T_size, size_t min_elems, size_t max_elems) {
  144|   114k|         const size_t byte_length = get_length_field(len_bytes);
  145|       |
  146|   114k|         if(byte_length % T_size != 0)
  ------------------
  |  Branch (146:13): [True: 15, False: 114k]
  ------------------
  147|     15|            throw_decode_error("Size isn't multiple of T");
  148|       |
  149|   114k|         const size_t num_elems = byte_length / T_size;
  150|       |
  151|   114k|         if(num_elems < min_elems || num_elems > max_elems)
  ------------------
  |  Branch (151:13): [True: 45, False: 114k]
  |  Branch (151:38): [True: 13, False: 114k]
  ------------------
  152|     27|            throw_decode_error("Length field outside parameters");
  153|       |
  154|   114k|         return num_elems;
  155|   114k|      }
_ZN5Botan3TLS15TLS_Data_Reader9get_fixedIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEm:
  125|   319k|      std::vector<T> get_fixed(size_t size) {
  126|   319k|         return get_elem<T, std::vector<T>>(size);
  127|   319k|      }
_ZN5Botan3TLS15TLS_Data_Reader8get_elemIhNSt3__16vectorIhNS3_9allocatorIhEEEEEET0_m:
   87|   410k|      Container get_elem(size_t num_elems) {
   88|   410k|         assert_at_least(num_elems * sizeof(T));
   89|       |
   90|   410k|         Container result(num_elems);
   91|       |
   92|  3.17M|         for(size_t i = 0; i != num_elems; ++i)
  ------------------
  |  Branch (92:28): [True: 2.76M, False: 410k]
  ------------------
   93|  2.76M|            result[i] = load_be<T>(&m_buf[m_offset], i);
   94|       |
   95|   410k|         m_offset += num_elems * sizeof(T);
   96|       |
   97|   410k|         return result;
   98|   410k|      }
_ZN5Botan3TLS15TLS_Data_Reader16get_range_vectorIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm:
  112|  42.8k|      std::vector<T> get_range_vector(size_t len_bytes, size_t min_elems, size_t max_elems) {
  113|  42.8k|         const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems);
  114|       |
  115|  42.8k|         return get_elem<T, std::vector<T>>(num_elems);
  116|  42.8k|      }
_ZN5Botan3TLS15TLS_Data_Reader9get_rangeIhEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm:
  105|  45.3k|      std::vector<T> get_range(size_t len_bytes, size_t min_elems, size_t max_elems) {
  106|  45.3k|         const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems);
  107|       |
  108|  45.3k|         return get_elem<T, std::vector<T>>(num_elems);
  109|  45.3k|      }
_ZN5Botan3TLS23append_tls_length_valueIhNSt3__19allocatorIhEES4_EEvRNS2_6vectorIhT0_EERKNS5_IT_T1_EEm:
  196|  50.6k|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, const std::vector<T, Alloc2>& vals, size_t tag_size) {
  197|  50.6k|   append_tls_length_value(buf, vals.data(), vals.size(), tag_size);
  198|  50.6k|}
_ZN5Botan3TLS23append_tls_length_valueIhNSt3__19allocatorIhEEEEvRNS2_6vectorIhT0_EEPKT_mm:
  176|  73.2k|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, const T* vals, size_t vals_size, size_t tag_size) {
  177|  73.2k|   const size_t T_size = sizeof(T);
  178|  73.2k|   const size_t val_bytes = T_size * vals_size;
  179|       |
  180|  73.2k|   if(tag_size != 1 && tag_size != 2 && tag_size != 3)
  ------------------
  |  Branch (180:7): [True: 20.8k, False: 52.4k]
  |  Branch (180:24): [True: 0, False: 20.8k]
  |  Branch (180:41): [True: 0, False: 0]
  ------------------
  181|      0|      throw Invalid_Argument("append_tls_length_value: invalid tag size");
  182|       |
  183|  73.2k|   if((tag_size == 1 && val_bytes > 255) || (tag_size == 2 && val_bytes > 65535) ||
  ------------------
  |  Branch (183:8): [True: 52.4k, False: 20.8k]
  |  Branch (183:25): [True: 0, False: 52.4k]
  |  Branch (183:46): [True: 20.8k, False: 52.4k]
  |  Branch (183:63): [True: 0, False: 20.8k]
  ------------------
  184|  73.2k|      (tag_size == 3 && val_bytes > 16777215))
  ------------------
  |  Branch (184:8): [True: 0, False: 73.2k]
  |  Branch (184:25): [True: 0, False: 0]
  ------------------
  185|      0|      throw Invalid_Argument("append_tls_length_value: value too large");
  186|       |
  187|   167k|   for(size_t i = 0; i != tag_size; ++i)
  ------------------
  |  Branch (187:22): [True: 94.0k, False: 73.2k]
  ------------------
  188|  94.0k|      buf.push_back(get_byte_var(sizeof(val_bytes) - tag_size + i, val_bytes));
  189|       |
  190|  2.99M|   for(size_t i = 0; i != vals_size; ++i)
  ------------------
  |  Branch (190:22): [True: 2.92M, False: 73.2k]
  ------------------
  191|  5.85M|      for(size_t j = 0; j != T_size; ++j)
  ------------------
  |  Branch (191:25): [True: 2.92M, False: 2.92M]
  ------------------
  192|  2.92M|         buf.push_back(get_byte_var(j, vals[i]));
  193|  73.2k|}
_ZN5Botan3TLS15TLS_Data_Reader9get_rangeItEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm:
  105|    436|      std::vector<T> get_range(size_t len_bytes, size_t min_elems, size_t max_elems) {
  106|    436|         const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems);
  107|       |
  108|    436|         return get_elem<T, std::vector<T>>(num_elems);
  109|    436|      }
_ZN5Botan3TLS15TLS_Data_Reader8get_elemItNSt3__16vectorItNS3_9allocatorItEEEEEET0_m:
   87|  26.4k|      Container get_elem(size_t num_elems) {
   88|  26.4k|         assert_at_least(num_elems * sizeof(T));
   89|       |
   90|  26.4k|         Container result(num_elems);
   91|       |
   92|  92.0k|         for(size_t i = 0; i != num_elems; ++i)
  ------------------
  |  Branch (92:28): [True: 65.5k, False: 26.4k]
  ------------------
   93|  65.5k|            result[i] = load_be<T>(&m_buf[m_offset], i);
   94|       |
   95|  26.4k|         m_offset += num_elems * sizeof(T);
   96|       |
   97|  26.4k|         return result;
   98|  26.4k|      }
_ZN5Botan3TLS15TLS_Data_Reader16get_range_vectorItEENSt3__16vectorIT_NS3_9allocatorIS5_EEEEmmm:
  112|  26.0k|      std::vector<T> get_range_vector(size_t len_bytes, size_t min_elems, size_t max_elems) {
  113|  26.0k|         const size_t num_elems = get_num_elems(len_bytes, sizeof(T), min_elems, max_elems);
  114|       |
  115|  26.0k|         return get_elem<T, std::vector<T>>(num_elems);
  116|  26.0k|      }
_ZN5Botan3TLS23append_tls_length_valueINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EENS2_17basic_string_viewIcNS2_11char_traitsIcEEEEm:
  201|  20.8k|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, std::string_view str, size_t tag_size) {
  202|  20.8k|   append_tls_length_value(buf, cast_char_ptr_to_uint8(str.data()), str.size(), tag_size);
  203|  20.8k|}
_ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEENSt3__19allocatorIhEEEEvRNS4_6vectorIhT0_EERKNS7_IT_T1_EEm:
  196|    496|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, const std::vector<T, Alloc2>& vals, size_t tag_size) {
  197|    496|   append_tls_length_value(buf, vals.data(), vals.size(), tag_size);
  198|    496|}
_ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT0_EEPKT_mm:
  176|  19.1k|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, const T* vals, size_t vals_size, size_t tag_size) {
  177|  19.1k|   const size_t T_size = sizeof(T);
  178|  19.1k|   const size_t val_bytes = T_size * vals_size;
  179|       |
  180|  19.1k|   if(tag_size != 1 && tag_size != 2 && tag_size != 3)
  ------------------
  |  Branch (180:7): [True: 19.1k, False: 0]
  |  Branch (180:24): [True: 0, False: 19.1k]
  |  Branch (180:41): [True: 0, False: 0]
  ------------------
  181|      0|      throw Invalid_Argument("append_tls_length_value: invalid tag size");
  182|       |
  183|  19.1k|   if((tag_size == 1 && val_bytes > 255) || (tag_size == 2 && val_bytes > 65535) ||
  ------------------
  |  Branch (183:8): [True: 0, False: 19.1k]
  |  Branch (183:25): [True: 0, False: 0]
  |  Branch (183:46): [True: 19.1k, False: 0]
  |  Branch (183:63): [True: 0, False: 19.1k]
  ------------------
  184|  19.1k|      (tag_size == 3 && val_bytes > 16777215))
  ------------------
  |  Branch (184:8): [True: 0, False: 19.1k]
  |  Branch (184:25): [True: 0, False: 0]
  ------------------
  185|      0|      throw Invalid_Argument("append_tls_length_value: value too large");
  186|       |
  187|  57.3k|   for(size_t i = 0; i != tag_size; ++i)
  ------------------
  |  Branch (187:22): [True: 38.2k, False: 19.1k]
  ------------------
  188|  38.2k|      buf.push_back(get_byte_var(sizeof(val_bytes) - tag_size + i, val_bytes));
  189|       |
  190|   686k|   for(size_t i = 0; i != vals_size; ++i)
  ------------------
  |  Branch (190:22): [True: 667k, False: 19.1k]
  ------------------
  191|  1.33M|      for(size_t j = 0; j != T_size; ++j)
  ------------------
  |  Branch (191:25): [True: 667k, False: 667k]
  ------------------
  192|   667k|         buf.push_back(get_byte_var(j, vals[i]));
  193|  19.1k|}
_ZN5Botan3TLS23append_tls_length_valueIhNS_16secure_allocatorIhEES3_EEvRNSt3__16vectorIhT0_EERKNS5_IT_T1_EEm:
  196|  18.6k|void append_tls_length_value(std::vector<uint8_t, Alloc>& buf, const std::vector<T, Alloc2>& vals, size_t tag_size) {
  197|  18.6k|   append_tls_length_value(buf, vals.data(), vals.size(), tag_size);
  198|  18.6k|}

_ZNK5Botan3TLS13Record_Header6neededEv:
   80|  65.7k|      size_t needed() const { return m_needed; }
_ZNK5Botan3TLS13Record_Header4typeEv:
   94|   236k|      Record_Type type() const {
   95|   236k|         BOTAN_ASSERT_NOMSG(m_needed == 0);
  ------------------
  |  |   60|   236k|   do {                                                                     \
  |  |   61|   236k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 236k]
  |  |  ------------------
  |  |   62|   236k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   236k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   96|   236k|         return m_type;
   97|   236k|      }
_ZNK5Botan3TLS13Record_Header5epochEv:
   92|  1.23k|      uint16_t epoch() const { return static_cast<uint16_t>(sequence() >> 48); }
_ZNK5Botan3TLS13Record_Header7versionEv:
   82|  85.7k|      Protocol_Version version() const {
   83|  85.7k|         BOTAN_ASSERT_NOMSG(m_needed == 0);
  ------------------
  |  |   60|  85.7k|   do {                                                                     \
  |  |   61|  85.7k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 85.7k]
  |  |  ------------------
  |  |   62|  85.7k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  85.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   84|  85.7k|         return m_version;
   85|  85.7k|      }
_ZNK5Botan3TLS13Record_Header8sequenceEv:
   87|  46.3k|      uint64_t sequence() const {
   88|  46.3k|         BOTAN_ASSERT_NOMSG(m_needed == 0);
  ------------------
  |  |   60|  46.3k|   do {                                                                     \
  |  |   61|  46.3k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 46.3k]
  |  |  ------------------
  |  |   62|  46.3k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  46.3k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   89|  46.3k|         return m_sequence;
   90|  46.3k|      }
_ZN5Botan3TLS23Connection_Cipher_State4aeadEv:
   46|    694|      AEAD_Mode& aead() {
   47|    694|         BOTAN_ASSERT_NONNULL(m_aead.get());
  ------------------
  |  |   87|    694|   do {                                                                                   \
  |  |   88|    694|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 694]
  |  |  ------------------
  |  |   89|    694|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|    694|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   48|    694|         return *m_aead.get();
   49|    694|      }
_ZNK5Botan3TLS23Connection_Cipher_State26nonce_bytes_from_handshakeEv:
   57|    356|      size_t nonce_bytes_from_handshake() const { return m_nonce_bytes_from_handshake; }
_ZNK5Botan3TLS23Connection_Cipher_State23nonce_bytes_from_recordEv:
   59|  2.05k|      size_t nonce_bytes_from_record() const { return m_nonce_bytes_from_record; }
_ZNK5Botan3TLS23Connection_Cipher_State12nonce_formatEv:
   61|    996|      Nonce_Format nonce_format() const { return m_nonce_format; }
_ZN5Botan3TLS13Record_HeaderC2EmNS0_16Protocol_VersionENS0_11Record_TypeE:
   75|  64.9k|            m_needed(0), m_sequence(sequence), m_version(version), m_type(type) {}
_ZN5Botan3TLS13Record_HeaderC2Em:
   78|    763|            m_needed(needed), m_sequence(0), m_version(Protocol_Version()), m_type(Record_Type::Invalid) {}

_ZN5Botan3TLS25Datagram_Sequence_NumbersC2Ev:
   79|    708|      Datagram_Sequence_Numbers() { Datagram_Sequence_Numbers::reset(); }
_ZN5Botan3TLS25Datagram_Sequence_Numbers5resetEv:
   81|    708|      void reset() override {
   82|    708|         m_write_seqs.clear();
   83|    708|         m_write_seqs[0] = 0;
   84|    708|         m_write_epoch = 0;
   85|    708|         m_read_epoch = 0;
   86|    708|         m_window_highest = 0;
   87|    708|         m_window_bits = 0;
   88|    708|      }
_ZN5Botan3TLS27Connection_Sequence_NumbersD2Ev:
   20|  5.47k|      virtual ~Connection_Sequence_Numbers() = default;
_ZNK5Botan3TLS25Datagram_Sequence_Numbers19current_write_epochEv:
   99|    267|      uint16_t current_write_epoch() const override { return m_write_epoch; }
_ZN5Botan3TLS25Datagram_Sequence_Numbers19next_write_sequenceEt:
  101|    267|      uint64_t next_write_sequence(uint16_t epoch) override {
  102|    267|         auto i = m_write_seqs.find(epoch);
  103|    267|         BOTAN_ASSERT(i != m_write_seqs.end(), "Found epoch");
  ------------------
  |  |   51|    267|   do {                                                                                 \
  |  |   52|    267|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 267]
  |  |  ------------------
  |  |   53|    267|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    267|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  104|    267|         return (static_cast<uint64_t>(epoch) << 48) | i->second++;
  105|    267|      }
_ZNK5Botan3TLS25Datagram_Sequence_Numbers12already_seenEm:
  109|    521|      bool already_seen(uint64_t sequence) const override {
  110|    521|         const size_t window_size = sizeof(m_window_bits) * 8;
  111|       |
  112|    521|         if(sequence > m_window_highest) {
  ------------------
  |  Branch (112:13): [True: 410, False: 111]
  ------------------
  113|    410|            return false;
  114|    410|         }
  115|       |
  116|    111|         const uint64_t offset = m_window_highest - sequence;
  117|       |
  118|    111|         if(offset >= window_size) {
  ------------------
  |  Branch (118:13): [True: 81, False: 30]
  ------------------
  119|     81|            return true;  // really old?
  120|     81|         }
  121|       |
  122|     30|         return (((m_window_bits >> offset) & 1) == 1);
  123|    111|      }
_ZN5Botan3TLS25Datagram_Sequence_Numbers11read_acceptEm:
  125|    374|      void read_accept(uint64_t sequence) override {
  126|    374|         const size_t window_size = sizeof(m_window_bits) * 8;
  127|       |
  128|    374|         if(sequence > m_window_highest) {
  ------------------
  |  Branch (128:13): [True: 349, False: 25]
  ------------------
  129|       |            // We've received a later sequence which advances our window
  130|    349|            const uint64_t offset = sequence - m_window_highest;
  131|    349|            m_window_highest += offset;
  132|       |
  133|    349|            if(offset >= window_size)
  ------------------
  |  Branch (133:16): [True: 318, False: 31]
  ------------------
  134|    318|               m_window_bits = 0;
  135|     31|            else
  136|     31|               m_window_bits <<= offset;
  137|       |
  138|    349|            m_window_bits |= 0x01;
  139|    349|         } else {
  140|     25|            const uint64_t offset = m_window_highest - sequence;
  141|       |
  142|     25|            if(offset < window_size) {
  ------------------
  |  Branch (142:16): [True: 25, False: 0]
  ------------------
  143|       |               // We've received an old sequence but still within our window
  144|     25|               m_window_bits |= (static_cast<uint64_t>(1) << offset);
  145|     25|            } else {
  146|       |               // This occurs only if we have reset state (DTLS reconnection case)
  147|      0|               m_window_highest = sequence;
  148|      0|               m_window_bits = 0;
  149|      0|            }
  150|     25|         }
  151|    374|      }
_ZN5Botan3TLS23Stream_Sequence_NumbersC2Ev:
   39|  4.76k|      Stream_Sequence_Numbers() { Stream_Sequence_Numbers::reset(); }
_ZN5Botan3TLS23Stream_Sequence_Numbers5resetEv:
   41|  4.76k|      void reset() override {
   42|  4.76k|         m_write_seq_no = 0;
   43|  4.76k|         m_read_seq_no = 0;
   44|  4.76k|         m_read_epoch = 0;
   45|  4.76k|         m_write_epoch = 0;
   46|  4.76k|      }
_ZN5Botan3TLS23Stream_Sequence_Numbers21new_read_cipher_stateEv:
   48|    515|      void new_read_cipher_state() override {
   49|    515|         m_read_seq_no = 0;
   50|    515|         m_read_epoch++;
   51|    515|      }
_ZN5Botan3TLS23Stream_Sequence_Numbers22new_write_cipher_stateEv:
   53|    245|      void new_write_cipher_state() override {
   54|    245|         m_write_seq_no = 0;
   55|    245|         m_write_epoch++;
   56|    245|      }
_ZNK5Botan3TLS23Stream_Sequence_Numbers18current_read_epochEv:
   58|  59.1k|      uint16_t current_read_epoch() const override { return m_read_epoch; }
_ZNK5Botan3TLS23Stream_Sequence_Numbers19current_write_epochEv:
   60|  70.5k|      uint16_t current_write_epoch() const override { return m_write_epoch; }
_ZN5Botan3TLS23Stream_Sequence_Numbers19next_write_sequenceEt:
   62|  70.0k|      uint64_t next_write_sequence(uint16_t) override { return m_write_seq_no++; }
_ZN5Botan3TLS23Stream_Sequence_Numbers18next_read_sequenceEv:
   64|  58.6k|      uint64_t next_read_sequence() override { return m_read_seq_no; }

_ZNK5Botan3TLS12Session_Keys15client_aead_keyEv:
   28|    515|      const secure_vector<uint8_t>& client_aead_key() const { return m_c_aead; }
_ZNK5Botan3TLS12Session_Keys15server_aead_keyEv:
   33|    245|      const secure_vector<uint8_t>& server_aead_key() const { return m_s_aead; }
_ZNK5Botan3TLS12Session_Keys12client_nonceEv:
   38|    515|      const std::vector<uint8_t>& client_nonce() const { return m_c_nonce; }
_ZNK5Botan3TLS12Session_Keys12server_nonceEv:
   43|    245|      const std::vector<uint8_t>& server_nonce() const { return m_s_nonce; }
_ZNK5Botan3TLS12Session_Keys13master_secretEv:
   48|    735|      const secure_vector<uint8_t>& master_secret() const { return m_master_sec; }
_ZNK5Botan3TLS12Session_Keys8aead_keyENS0_15Connection_SideE:
   50|    760|      const secure_vector<uint8_t>& aead_key(Connection_Side side) const {
   51|    760|         return (side == Connection_Side::Client) ? client_aead_key() : server_aead_key();
  ------------------
  |  Branch (51:17): [True: 515, False: 245]
  ------------------
   52|    760|      }
_ZNK5Botan3TLS12Session_Keys5nonceENS0_15Connection_SideE:
   54|    760|      const std::vector<uint8_t>& nonce(Connection_Side side) const {
   55|    760|         return (side == Connection_Side::Client) ? client_nonce() : server_nonce();
  ------------------
  |  Branch (55:17): [True: 515, False: 245]
  ------------------
   56|    760|      }
_ZN5Botan3TLS12Session_KeysC2Ev:
   58|  24.0k|      Session_Keys() = default;

_ZNK5Botan3KDF10derive_keyINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_mPKhmS9_mS9_m:
   91|  29.7k|                   size_t label_len = 0) const {
   92|  29.7k|         T key(key_len);
   93|  29.7k|         kdf(key.data(), key.size(), secret, secret_len, salt, salt_len, label, label_len);
   94|  29.7k|         return key;
   95|  29.7k|      }
_ZN5Botan3KDFD2Ev:
   25|  15.1k|      virtual ~KDF() = default;
_ZNK5Botan3KDF10derive_keyINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_mNS2_4spanIKhLm18446744073709551615EEESA_SA_:
  131|  15.1k|                   std::span<const uint8_t> label) const {
  132|  15.1k|         return derive_key<T>(
  133|  15.1k|            key_len, secret.data(), secret.size(), salt.data(), salt.size(), label.data(), label.size());
  134|  15.1k|      }

_ZN5Botan25MessageAuthenticationCodeD2Ev:
   50|  19.3k|      virtual ~MessageAuthenticationCode() = default;

_ZN5Botan21Allocator_InitializerC2Ev:
   44|      1|      Allocator_Initializer() { initialize_allocator(); }
_ZN5Botan13typecast_copyImEEvPT_PKhm:
  140|  4.64M|{
  141|  4.64M|   std::memcpy(out, in, sizeof(T) * N);
  142|  4.64M|}
_ZN5Botan13typecast_copyImEEvPhPT_m:
  133|  1.49M|{
  134|  1.49M|   std::memcpy(out, in, sizeof(T) * N);
  135|  1.49M|}
_ZN5Botan21constant_time_compareEPKhS1_m:
   80|    304|inline bool constant_time_compare(const uint8_t x[], const uint8_t y[], size_t len) {
   81|    304|   return ct_compare_u8(x, y, len) == 0xFF;
   82|    304|}
_ZN5Botan11clear_bytesEPvm:
   92|   426M|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
   93|   426M|   if(bytes > 0) {
  ------------------
  |  Branch (93:7): [True: 358M, False: 68.0M]
  ------------------
   94|   358M|      std::memset(ptr, 0, bytes);
   95|   358M|   }
   96|   426M|}
_ZN5Botan7set_memEPhmh:
  171|  5.77k|inline constexpr void set_mem(uint8_t* ptr, size_t n, uint8_t val) {
  172|  5.77k|   if(n > 0) {
  ------------------
  |  Branch (172:7): [True: 5.77k, False: 0]
  ------------------
  173|  5.77k|      std::memset(ptr, val, n);
  174|  5.77k|   }
  175|  5.77k|}
_ZN5Botan22cast_char_ptr_to_uint8EPKc:
  177|  59.3k|inline const uint8_t* cast_char_ptr_to_uint8(const char* s) { return reinterpret_cast<const uint8_t*>(s); }
_ZN5Botan22cast_uint8_ptr_to_charEPKh:
  179|  69.4k|inline const char* cast_uint8_ptr_to_char(const uint8_t* b) { return reinterpret_cast<const char*>(b); }
_ZN5Botan22cast_uint8_ptr_to_charEPh:
  183|  16.7k|inline char* cast_uint8_ptr_to_char(uint8_t* b) { return reinterpret_cast<char*>(b); }
_ZN5Botan7xor_bufEPhPKhm:
  228|   103k|inline void xor_buf(uint8_t out[], const uint8_t in[], size_t length) {
  229|   103k|   const size_t blocks = length - (length % 32);
  230|       |
  231|   177k|   for(size_t i = 0; i != blocks; i += 32) {
  ------------------
  |  Branch (231:22): [True: 74.0k, False: 103k]
  ------------------
  232|  74.0k|      uint64_t x[4];
  233|  74.0k|      uint64_t y[4];
  234|       |
  235|  74.0k|      typecast_copy(x, out + i, 4);
  236|  74.0k|      typecast_copy(y, in + i, 4);
  237|       |
  238|  74.0k|      x[0] ^= y[0];
  239|  74.0k|      x[1] ^= y[1];
  240|  74.0k|      x[2] ^= y[2];
  241|  74.0k|      x[3] ^= y[3];
  242|       |
  243|  74.0k|      typecast_copy(out + i, x, 4);
  244|  74.0k|   }
  245|       |
  246|   778k|   for(size_t i = blocks; i != length; ++i) {
  ------------------
  |  Branch (246:27): [True: 674k, False: 103k]
  ------------------
  247|   674k|      out[i] ^= in[i];
  248|   674k|   }
  249|   103k|}
_ZN5Botan7xor_bufEPhPKhS2_m:
  258|  4.52k|inline void xor_buf(uint8_t out[], const uint8_t in[], const uint8_t in2[], size_t length) {
  259|  4.52k|   const size_t blocks = length - (length % 32);
  260|       |
  261|  8.56k|   for(size_t i = 0; i != blocks; i += 32) {
  ------------------
  |  Branch (261:22): [True: 4.03k, False: 4.52k]
  ------------------
  262|  4.03k|      uint64_t x[4];
  263|  4.03k|      uint64_t y[4];
  264|       |
  265|  4.03k|      typecast_copy(x, in + i, 4);
  266|  4.03k|      typecast_copy(y, in2 + i, 4);
  267|       |
  268|  4.03k|      x[0] ^= y[0];
  269|  4.03k|      x[1] ^= y[1];
  270|  4.03k|      x[2] ^= y[2];
  271|  4.03k|      x[3] ^= y[3];
  272|       |
  273|  4.03k|      typecast_copy(out + i, x, 4);
  274|  4.03k|   }
  275|       |
  276|  56.8k|   for(size_t i = blocks; i != length; ++i) {
  ------------------
  |  Branch (276:27): [True: 52.2k, False: 4.52k]
  ------------------
  277|  52.2k|      out[i] = in[i] ^ in2[i];
  278|  52.2k|   }
  279|  4.52k|}
_ZN5Botan9clear_memIhEEvPT_m:
  109|  1.16M|inline constexpr void clear_mem(T* ptr, size_t n) {
  110|  1.16M|   clear_bytes(ptr, sizeof(T) * n);
  111|  1.16M|}
_ZN5Botan9clear_memImEEvPT_m:
  109|   425M|inline constexpr void clear_mem(T* ptr, size_t n) {
  110|   425M|   clear_bytes(ptr, sizeof(T) * n);
  111|   425M|}
_ZN5Botan8copy_memIhEEvPT_PKS1_m:
  122|  24.2M|{
  123|  24.2M|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|  24.2M|   do {                                                                                          \
  |  |   79|  48.3M|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 24.1M, False: 75.3k]
  |  |  |  Branch (79:23): [True: 24.1M, False: 0]
  |  |  |  Branch (79:23): [True: 24.1M, False: 0]
  |  |  ------------------
  |  |   80|  24.2M|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  24.2M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|  24.2M|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (125:7): [True: 24.2M, False: 95]
  |  Branch (125:24): [True: 24.2M, False: 409]
  |  Branch (125:42): [True: 24.1M, False: 74.7k]
  ------------------
  126|  24.1M|      std::memmove(out, in, sizeof(T) * n);
  127|  24.1M|   }
  128|  24.2M|}
_ZN5Botan13typecast_copyItEEvPT_PKhm:
  140|  67.8k|{
  141|  67.8k|   std::memcpy(out, in, sizeof(T) * N);
  142|  67.8k|}
_ZN5Botan13typecast_copyItEEvRT_PKh:
  152|  67.8k|{
  153|  67.8k|   typecast_copy(&out, in, 1);
  154|  67.8k|}
_ZN5Botan13typecast_copyIjEEvPT_PKhm:
  140|  16.4M|{
  141|  16.4M|   std::memcpy(out, in, sizeof(T) * N);
  142|  16.4M|}
_ZN5Botan13typecast_copyIjEEvRT_PKh:
  152|  16.4M|{
  153|  16.4M|   typecast_copy(&out, in, 1);
  154|  16.4M|}
_ZN5Botan13typecast_copyImEEvRT_PKh:
  152|  4.48M|{
  153|  4.48M|   typecast_copy(&out, in, 1);
  154|  4.48M|}
_ZN5Botan13typecast_copyItEEvPhPT_m:
  133|     63|{
  134|     63|   std::memcpy(out, in, sizeof(T) * N);
  135|     63|}
_ZN5Botan13typecast_copyItEEvPhT_:
  145|     63|inline constexpr void typecast_copy(uint8_t out[], T in) {
  146|     63|   typecast_copy(out, &in, 1);
  147|     63|}
_ZN5Botan13typecast_copyIjEEvPhPT_m:
  133|  3.38M|{
  134|  3.38M|   std::memcpy(out, in, sizeof(T) * N);
  135|  3.38M|}
_ZN5Botan13typecast_copyIjEEvPhT_:
  145|  3.38M|inline constexpr void typecast_copy(uint8_t out[], T in) {
  146|  3.38M|   typecast_copy(out, &in, 1);
  147|  3.38M|}
_ZN5Botan13typecast_copyImEEvPhT_:
  145|  1.41M|inline constexpr void typecast_copy(uint8_t out[], T in) {
  146|  1.41M|   typecast_copy(out, &in, 1);
  147|  1.41M|}
_ZN5Botan8copy_memImEEvPT_PKS1_m:
  122|   127M|{
  123|   127M|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|   127M|   do {                                                                                          \
  |  |   79|   255M|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 127M, False: 42.6k]
  |  |  |  Branch (79:23): [True: 127M, False: 0]
  |  |  |  Branch (79:23): [True: 127M, False: 0]
  |  |  ------------------
  |  |   80|   127M|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|   127M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|   127M|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (125:7): [True: 127M, False: 19.6k]
  |  Branch (125:24): [True: 127M, False: 0]
  |  Branch (125:42): [True: 127M, False: 23.0k]
  ------------------
  126|   127M|      std::memmove(out, in, sizeof(T) * n);
  127|   127M|   }
  128|   127M|}
_ZN5Botan9clear_memIjEEvPT_m:
  109|  23.7k|inline constexpr void clear_mem(T* ptr, size_t n) {
  110|  23.7k|   clear_bytes(ptr, sizeof(T) * n);
  111|  23.7k|}
_ZN5Botan13buffer_insertIhNS_16secure_allocatorIhEEEEmRNSt3__16vectorIT_T0_EEmPKS5_m:
  203|  1.06M|size_t buffer_insert(std::vector<T, Alloc>& buf, size_t buf_offset, const T input[], size_t input_length) {
  204|  1.06M|   BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
  ------------------
  |  |   60|  1.06M|   do {                                                                     \
  |  |   61|  1.06M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1.06M]
  |  |  ------------------
  |  |   62|  1.06M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  1.06M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  205|  1.06M|   const size_t to_copy = std::min(input_length, buf.size() - buf_offset);
  206|  1.06M|   if(to_copy > 0) {
  ------------------
  |  Branch (206:7): [True: 662k, False: 407k]
  ------------------
  207|   662k|      copy_mem(&buf[buf_offset], input, to_copy);
  208|   662k|   }
  209|  1.06M|   return to_copy;
  210|  1.06M|}
_ZN5BotaneOINS_16secure_allocatorIhEES2_EERNSt3__16vectorIhT_EES7_RKNS4_IhT0_EE:
  296|    552|std::vector<uint8_t, Alloc>& operator^=(std::vector<uint8_t, Alloc>& out, const std::vector<uint8_t, Alloc2>& in) {
  297|    552|   if(out.size() < in.size())
  ------------------
  |  Branch (297:7): [True: 0, False: 552]
  ------------------
  298|      0|      out.resize(in.size());
  299|       |
  300|    552|   xor_buf(out.data(), in.data(), in.size());
  301|    552|   return out;
  302|    552|}
_ZN5Botan13buffer_insertIhNSt3__19allocatorIhEEEEmRNS1_6vectorIT_T0_EEmPKS5_m:
  203|  12.1k|size_t buffer_insert(std::vector<T, Alloc>& buf, size_t buf_offset, const T input[], size_t input_length) {
  204|  12.1k|   BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
  ------------------
  |  |   60|  12.1k|   do {                                                                     \
  |  |   61|  12.1k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 12.1k]
  |  |  ------------------
  |  |   62|  12.1k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  12.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  205|  12.1k|   const size_t to_copy = std::min(input_length, buf.size() - buf_offset);
  206|  12.1k|   if(to_copy > 0) {
  ------------------
  |  Branch (206:7): [True: 11.9k, False: 182]
  ------------------
  207|  11.9k|      copy_mem(&buf[buf_offset], input, to_copy);
  208|  11.9k|   }
  209|  12.1k|   return to_copy;
  210|  12.1k|}
_ZN5Botan13buffer_insertIhNS_16secure_allocatorIhEENSt3__19allocatorIhEEEEmRNS3_6vectorIT_T0_EEmRKNS6_IS7_T1_EE:
  213|    551|size_t buffer_insert(std::vector<T, Alloc>& buf, size_t buf_offset, const std::vector<T, Alloc2>& input) {
  214|    551|   BOTAN_ASSERT_NOMSG(buf_offset <= buf.size());
  ------------------
  |  |   60|    551|   do {                                                                     \
  |  |   61|    551|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 551]
  |  |  ------------------
  |  |   62|    551|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    551|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  215|    551|   const size_t to_copy = std::min(input.size(), buf.size() - buf_offset);
  216|    551|   if(to_copy > 0) {
  ------------------
  |  Branch (216:7): [True: 551, False: 0]
  ------------------
  217|    551|      copy_mem(&buf[buf_offset], input.data(), to_copy);
  218|    551|   }
  219|    551|   return to_copy;
  220|    551|}
_ZN5Botan8copy_memIiEEvPT_PKS1_m:
  122|  1.53k|{
  123|  1.53k|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |   78|  1.53k|   do {                                                                                          \
  |  |   79|  3.07k|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 1.53k, False: 0]
  |  |  |  Branch (79:23): [True: 1.53k, False: 0]
  |  |  |  Branch (79:23): [True: 1.53k, False: 0]
  |  |  ------------------
  |  |   80|  1.53k|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  1.53k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|  1.53k|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (125:7): [True: 1.53k, False: 0]
  |  Branch (125:24): [True: 1.53k, False: 0]
  |  Branch (125:42): [True: 1.53k, False: 0]
  ------------------
  126|  1.53k|      std::memmove(out, in, sizeof(T) * n);
  127|  1.53k|   }
  128|  1.53k|}
_ZN5Botan7xor_bufINSt3__19allocatorIhEEEEvRNS1_6vectorIhT_EEPKhm:
  286|    235|void xor_buf(std::vector<uint8_t, Alloc>& out, const uint8_t* in, size_t n) {
  287|    235|   xor_buf(out.data(), in, n);
  288|    235|}

_ZNK5Botan10Public_Key13message_partsEv:
  165|  11.5k|      virtual size_t message_parts() const { return 1; }
_ZNK5Botan10Public_Key17message_part_sizeEv:
  176|  5.77k|      virtual size_t message_part_size() const { return 0; }
_ZNK5Botan10Public_Key29default_x509_signature_formatEv:
  178|  5.77k|      virtual Signature_Format default_x509_signature_format() const {
  179|  5.77k|         return (this->message_parts() >= 2) ? Signature_Format::DerSequence : Signature_Format::Standard;
  ------------------
  |  Branch (179:17): [True: 0, False: 5.77k]
  ------------------
  180|  5.77k|      }
_ZN5Botan22create_hex_fingerprintENSt3__14spanIKhLm18446744073709551615EEENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
  367|  11.5k|inline std::string create_hex_fingerprint(std::span<const uint8_t> vec, std::string_view hash_name) {
  368|  11.5k|   return create_hex_fingerprint(vec.data(), vec.size(), hash_name);
  369|  11.5k|}
_ZN5Botan14Asymmetric_KeyD2Ev:
   57|  40.6k|      virtual ~Asymmetric_Key() = default;

_ZN5Botan15Key_ConstraintsC2Ev:
  143|  5.77k|      Key_Constraints() : m_value(0) {}

_ZNK5Botan7X509_DN8get_bitsEv:
   58|  11.5k|      const std::vector<uint8_t>& get_bits() const { return m_dn_bits; }
_ZN5Botan15NameConstraintsC2Ev:
  295|  5.77k|      NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
_ZN5Botan10ExtensionsC2Ev:
  513|  5.77k|      Extensions() {}
_ZN5Botan7X509_DNC2Ev:
   37|  11.9k|      X509_DN() = default;
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Authority_Key_IDEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension9Key_UsageEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension14Subject_Key_IDEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension16Name_ConstraintsEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension17Basic_ConstraintsEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23Issuer_Alternative_NameEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension24Subject_Alternative_NameEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension18Extended_Key_UsageEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension20Certificate_PoliciesEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension28Authority_Information_AccessEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }
_ZNK5Botan10Extensions23get_extension_object_asINS_14Cert_Extension23CRL_Distribution_PointsEEEPKT_RKNS_3OIDE:
  393|  5.77k|      const T* get_extension_object_as(const OID& oid = T::static_oid()) const {
  394|  5.77k|         if(const Certificate_Extension* extn = get_extension_object(oid)) {
  ------------------
  |  Branch (394:42): [True: 0, False: 5.77k]
  ------------------
  395|       |            // Unknown_Extension oid_name is empty
  396|      0|            if(extn->oid_name().empty()) {
  ------------------
  |  Branch (396:16): [True: 0, False: 0]
  ------------------
  397|      0|               return nullptr;
  398|      0|            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
  ------------------
  |  Branch (398:32): [True: 0, False: 0]
  ------------------
  399|      0|               return extn_as_T;
  400|      0|            } else {
  401|      0|               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
  402|      0|            }
  403|      0|         }
  404|       |
  405|  5.77k|         return nullptr;
  406|  5.77k|      }

_ZN5Botan11PK_Verifier14verify_messageENSt3__14spanIKhLm18446744073709551615EEES4_:
  320|  5.77k|      bool verify_message(std::span<const uint8_t> msg, std::span<const uint8_t> sig) {
  321|  5.77k|         return verify_message(msg.data(), msg.size(), sig.data(), sig.size());
  322|  5.77k|      }
_ZNK5Botan16PK_Key_Agreement10derive_keyEmNSt3__14spanIKhLm18446744073709551615EEENS1_17basic_string_viewIcNS1_11char_traitsIcEEEE:
  457|  9.82k|      SymmetricKey derive_key(size_t key_len, const std::span<const uint8_t> in, std::string_view params = "") const {
  458|  9.82k|         return derive_key(key_len, in.data(), in.size(), cast_char_ptr_to_uint8(params.data()), params.length());
  459|  9.82k|      }

_ZNK5Botan15Modular_Reducer11get_modulusEv:
   20|      6|      const BigInt& get_modulus() const { return m_modulus; }
_ZNK5Botan15Modular_Reducer8multiplyERKNS_6BigIntES3_:
   30|  33.1k|      BigInt multiply(const BigInt& x, const BigInt& y) const { return reduce(x * y); }
_ZNK5Botan15Modular_Reducer6squareERKNS_6BigIntE:
   43|  33.1k|      BigInt square(const BigInt& x) const { return reduce(Botan::square(x)); }

_ZN5Botan21RandomNumberGeneratorD2Ev:
   32|  5.77k|      virtual ~RandomNumberGenerator() = default;
_ZN5Botan21RandomNumberGenerator9randomizeENSt3__14spanIhLm18446744073709551615EEE:
   52|   296k|      void randomize(std::span<uint8_t> output) { this->fill_bytes_with_input(output, {}); }
_ZN5Botan21RandomNumberGenerator9randomizeEPhm:
   54|     26|      void randomize(uint8_t output[], size_t length) { this->randomize(std::span(output, length)); }
_ZN5Botan21RandomNumberGenerator11add_entropyENSt3__14spanIKhLm18446744073709551615EEE:
   75|      1|      void add_entropy(std::span<const uint8_t> input) { this->fill_bytes_with_input({}, input); }
_ZN5Botan21RandomNumberGenerator10random_vecENSt3__14spanIhLm18446744073709551615EEE:
  180|   296k|      void random_vec(std::span<uint8_t> v) { this->randomize(v); }
_ZN5Botan21RandomNumberGenerator10random_vecINSt3__16vectorIhNS_16secure_allocatorIhEEEEEEvRT_m:
  191|   254k|      void random_vec(T& v, size_t bytes) {
  192|   254k|         v.resize(bytes);
  193|   254k|         random_vec(v);
  194|   254k|      }
_ZN5Botan21RandomNumberGeneratorC2Ev:
   34|  5.77k|      RandomNumberGenerator() = default;
_ZN5Botan21RandomNumberGenerator10random_vecINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_m:
  206|   249k|      T random_vec(size_t bytes) {
  207|   249k|         T result;
  208|   249k|         random_vec(result, bytes);
  209|   249k|         return result;
  210|   249k|      }
_ZN5Botan21RandomNumberGenerator10random_vecINSt3__16vectorIhNS2_9allocatorIhEEEEEEvRT_m:
  191|  41.9k|      void random_vec(T& v, size_t bytes) {
  192|  41.9k|         v.resize(bytes);
  193|  41.9k|         random_vec(v);
  194|  41.9k|      }
_ZN5Botan21RandomNumberGenerator10random_vecINSt3__16vectorIhNS2_9allocatorIhEEEEEET_m:
  206|  41.9k|      T random_vec(size_t bytes) {
  207|  41.9k|         T result;
  208|  41.9k|         random_vec(result, bytes);
  209|  41.9k|         return result;
  210|  41.9k|      }

_ZN5Botan13RSA_PublicKeyC2Ev:
   83|  5.77k|      RSA_PublicKey() = default;

_ZN5Botan16secure_allocatorIhE8allocateEm:
   45|  1.53M|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan16secure_allocatorIhE10deallocateEPhm:
   47|  1.53M|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE10deallocateEPmm:
   47|  22.7M|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE8allocateEm:
   45|  22.7M|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE:
   56|   214k|inline bool operator!=(const secure_allocator<T>&, const secure_allocator<U>&) {
   57|   214k|   return false;
   58|   214k|}
_ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPS5_T1_EE:
   98|  1.09k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::pair<T*, L>& in) {
   99|  1.09k|   out.insert(out.end(), in.first, in.first + in.second);
  100|  1.09k|   return out;
  101|  1.09k|}
_ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE:
   80|      6|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|      6|   out.insert(out.end(), in.begin(), in.end());
   82|      6|   return out;
   83|      6|}
_ZN5BotanpLIhNS_16secure_allocatorIhEEmEERNSt3__16vectorIT_T0_EES8_RKNS3_4pairIPKS5_T1_EE:
   92|   294k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::pair<const T*, L>& in) {
   93|   294k|   out.insert(out.end(), in.first, in.first + in.second);
   94|   294k|   return out;
   95|   294k|}
_ZN5BotanpLIhNS_16secure_allocatorIhEENSt3__19allocatorIhEEEERNS3_6vectorIT_T0_EESA_RKNS6_IS7_T1_EE:
   80|    124|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|    124|   out.insert(out.end(), in.begin(), in.end());
   82|    124|   return out;
   83|    124|}
_ZN5Botan7zeroiseIhNS_16secure_allocatorIhEEEEvRNSt3__16vectorIT_T0_EE:
  108|   606k|void zeroise(std::vector<T, Alloc>& vec) {
  109|   606k|   clear_mem(vec.data(), vec.size());
  110|   606k|}
_ZN5Botan16secure_allocatorIjE10deallocateEPjm:
   47|  94.0k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5BotanpLIhNSt3__19allocatorIhEEmEERNS1_6vectorIT_T0_EES8_RKNS1_4pairIPKS5_T1_EE:
   92|    490|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::pair<const T*, L>& in) {
   93|    490|   out.insert(out.end(), in.first, in.first + in.second);
   94|    490|   return out;
   95|    490|}
_ZN5BotanpLIhNSt3__19allocatorIhEES3_EERNS1_6vectorIT_T0_EES8_RKNS4_IS5_T1_EE:
   80|   222k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|   222k|   out.insert(out.end(), in.begin(), in.end());
   82|   222k|   return out;
   83|   222k|}
_ZN5Botan7zeroiseIhNSt3__19allocatorIhEEEEvRNS1_6vectorIT_T0_EE:
  108|    551|void zeroise(std::vector<T, Alloc>& vec) {
  109|    551|   clear_mem(vec.data(), vec.size());
  110|    551|}
_ZN5Botan6unlockIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEERKNS2_IS3_NS_16secure_allocatorIS3_EEEE:
   75|    490|std::vector<T> unlock(const secure_vector<T>& in) {
   76|    490|   return std::vector<T>(in.begin(), in.end());
   77|    490|}
_ZN5Botan16secure_allocatorIjE8allocateEm:
   45|  94.0k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan7zeroiseIjNS_16secure_allocatorIjEEEEvRNSt3__16vectorIT_T0_EE:
  108|  23.7k|void zeroise(std::vector<T, Alloc>& vec) {
  109|  23.7k|   clear_mem(vec.data(), vec.size());
  110|  23.7k|}
_ZN5BotanpLIhNSt3__19allocatorIhEENS_16secure_allocatorIhEEEERNS1_6vectorIT_T0_EESA_RKNS6_IS7_T1_EE:
   80|  1.67k|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   81|  1.67k|   out.insert(out.end(), in.begin(), in.end());
   82|  1.67k|   return out;
   83|  1.67k|}

_ZN5Botan12Stateful_RNGC2Ev:
   58|      1|      Stateful_RNG() : m_reseed_interval(0) {}

_ZN5Botan12StreamCipher6cipherEPKhPhm:
   56|    652|      void cipher(const uint8_t in[], uint8_t out[], size_t len) { cipher_bytes(in, out, len); }
_ZN5Botan12StreamCipher15write_keystreamEPhm:
   78|    106|      void write_keystream(uint8_t out[], size_t len) { generate_keystream(out, len); }
_ZN5Botan12StreamCipher15write_keystreamENSt3__14spanIhLm18446744073709551615EEE:
   87|   296k|      void write_keystream(std::span<uint8_t> out) { generate_keystream(out.data(), out.size()); }
_ZN5Botan12StreamCipher7cipher1EPhm:
  107|    101|      void cipher1(uint8_t buf[], size_t len) { cipher(buf, buf, len); }
_ZN5Botan12StreamCipher8encipherENSt3__14spanIhLm18446744073709551615EEE:
  121|    369|      void encipher(std::span<uint8_t> inout) { cipher(inout.data(), inout.data(), inout.size()); }
_ZN5Botan12StreamCipher6set_ivEPKhm:
  157|    759|      void set_iv(const uint8_t iv[], size_t iv_len) { set_iv_bytes(iv, iv_len); }
_ZN5Botan12StreamCipher15keystream_bytesINSt3__16vectorIhNS_16secure_allocatorIhEEEEEET_m:
   95|      1|      T keystream_bytes(size_t bytes) {
   96|      1|         T out(bytes);
   97|      1|         write_keystream(out);
   98|      1|         return out;
   99|      1|      }

_ZNK5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEE3getEv:
   52|  66.2k|      const T& get() const { return m_value; }
_ZNK5Botan6detail14Strong_AdapterINSt3__16vectorIhNS2_9allocatorIhEEEEE4sizeEv:
  115|  2.57k|      size_type size() const noexcept(noexcept(this->get().size())) { return this->get().size(); }
_ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2ERKS7_:
   43|  24.5k|      Strong_Base(const Strong_Base&) = default;
_ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2EOS7_:
   44|  50.2k|      Strong_Base(Strong_Base&&) = default;
_ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEaSEOS7_:
   46|  26.2k|      Strong_Base& operator=(Strong_Base&&) = default;
_ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2Ev:
   42|  44.5k|      Strong_Base() = default;
_ZN5Botan6detail11Strong_BaseINSt3__16vectorIhNS2_9allocatorIhEEEEEC2ES6_:
   48|  50.7k|      constexpr explicit Strong_Base(T v) : m_value(std::move(v)) {}
_ZNK5Botan6detail14Strong_AdapterINSt3__16vectorIhNS2_9allocatorIhEEEEE5emptyEv:
  131|  42.6k|      {
  132|  42.6k|         return this->get().empty();
  133|  42.6k|      }

_ZN5Botan24Key_Length_SpecificationC2Em:
   27|    675|      explicit Key_Length_Specification(size_t keylen) : m_min_keylen(keylen), m_max_keylen(keylen), m_keylen_mod(1) {}
_ZN5Botan24Key_Length_SpecificationC2Emmm:
   36|  35.4k|            m_min_keylen(min_k), m_max_keylen(max_k ? max_k : min_k), m_keylen_mod(k_mod) {}
_ZNK5Botan24Key_Length_Specification15valid_keylengthEm:
   42|  36.1k|      bool valid_keylength(size_t length) const {
   43|  36.1k|         return ((length >= m_min_keylen) && (length <= m_max_keylen) && (length % m_keylen_mod == 0));
  ------------------
  |  Branch (43:18): [True: 36.1k, False: 0]
  |  Branch (43:46): [True: 36.1k, False: 0]
  |  Branch (43:74): [True: 36.1k, False: 0]
  ------------------
   44|  36.1k|      }
_ZNK5Botan18SymmetricAlgorithm15valid_keylengthEm:
  107|  36.1k|      bool valid_keylength(size_t length) const { return key_spec().valid_keylength(length); }
_ZN5Botan18SymmetricAlgorithm7set_keyERKNS_11OctetStringE:
  113|  3.80k|      void set_key(const SymmetricKey& key) { set_key(key.begin(), key.length()); }
_ZN5Botan18SymmetricAlgorithm7set_keyENSt3__14spanIKhLm18446744073709551615EEE:
  119|    946|      void set_key(std::span<const uint8_t> key) { set_key(key.data(), key.size()); }
_ZNK5Botan18SymmetricAlgorithm23assert_key_material_setEv:
  139|   774k|      void assert_key_material_set() const { assert_key_material_set(has_keying_material()); }
_ZNK5Botan18SymmetricAlgorithm23assert_key_material_setEb:
  141|   775k|      void assert_key_material_set(bool predicate) const {
  142|   775k|         if(!predicate)
  ------------------
  |  Branch (142:13): [True: 0, False: 775k]
  ------------------
  143|      0|            throw_key_not_set_error();
  144|   775k|      }
_ZN5Botan18SymmetricAlgorithmD2Ev:
   79|  21.5k|      virtual ~SymmetricAlgorithm() = default;

_ZNK5Botan11OctetString6lengthEv:
   27|  19.6k|      size_t length() const { return m_data.size(); }
_ZNK5Botan11OctetString5emptyEv:
   31|  3.80k|      bool empty() const { return m_data.empty(); }
_ZNK5Botan11OctetString7bits_ofEv:
   36|  18.6k|      secure_vector<uint8_t> bits_of() const { return m_data; }
_ZNK5Botan11OctetString5beginEv:
   41|  3.80k|      const uint8_t* begin() const { return m_data.data(); }
_ZN5Botan11OctetStringC2ENSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  100|  9.06k|      explicit OctetString(secure_vector<uint8_t> in) : m_data(std::move(in)) {}

_ZNK5Botan3TLS5Alert8is_validEv:
   79|  3.78k|      bool is_valid() const { return (m_type_code != AlertType::None); }
_ZNK5Botan3TLS5Alert8is_fatalEv:
   90|  49.3k|      bool is_fatal() const { return m_fatal; }
_ZNK5Botan3TLS5Alert4typeEv:
   95|  69.7k|      Type type() const { return m_type_code; }
_ZN5Botan3TLS5AlertC2ENS0_9AlertTypeEb:
  118|  3.78k|      Alert(Type type_code, bool fatal = false) : m_fatal(fatal), m_type_code(type_code) {}

_ZN5Botan3TLS9is_x25519ENS0_12Group_ParamsE:
  102|    605|constexpr bool is_x25519(const Group_Params group) { return group == Group_Params::X25519; }
_ZN5Botan3TLS7is_ecdhENS0_12Group_ParamsE:
  104|  34.1k|constexpr bool is_ecdh(const Group_Params group) {
  105|  34.1k|   return group == Group_Params::SECP256R1 || group == Group_Params::SECP384R1 || group == Group_Params::SECP521R1 ||
  ------------------
  |  Branch (105:11): [True: 3.42k, False: 30.7k]
  |  Branch (105:47): [True: 4.17k, False: 26.5k]
  |  Branch (105:83): [True: 10.7k, False: 15.8k]
  ------------------
  106|  34.1k|          group == Group_Params::BRAINPOOL256R1 || group == Group_Params::BRAINPOOL384R1 ||
  ------------------
  |  Branch (106:11): [True: 3.28k, False: 12.5k]
  |  Branch (106:52): [True: 4.07k, False: 8.51k]
  ------------------
  107|  34.1k|          group == Group_Params::BRAINPOOL512R1;
  ------------------
  |  Branch (107:11): [True: 7.90k, False: 605]
  ------------------
  108|  34.1k|}
_ZN5Botan3TLS5is_dhENS0_12Group_ParamsE:
  110|  34.1k|constexpr bool is_dh(const Group_Params group) {
  111|  34.1k|   return group == Group_Params::FFDHE_2048 || group == Group_Params::FFDHE_3072 || group == Group_Params::FFDHE_4096 ||
  ------------------
  |  Branch (111:11): [True: 0, False: 34.1k]
  |  Branch (111:48): [True: 0, False: 34.1k]
  |  Branch (111:85): [True: 0, False: 34.1k]
  ------------------
  112|  34.1k|          group == Group_Params::FFDHE_6144 || group == Group_Params::FFDHE_8192;
  ------------------
  |  Branch (112:11): [True: 0, False: 34.1k]
  |  Branch (112:48): [True: 0, False: 34.1k]
  ------------------
  113|  34.1k|}
_ZN5Botan3TLS19key_exchange_is_pskENS0_8Kex_AlgoE:
  134|  15.4k|inline bool key_exchange_is_psk(Kex_Algo m) {
  135|  15.4k|   return (m == Kex_Algo::PSK || m == Kex_Algo::ECDHE_PSK || m == Kex_Algo::DHE_PSK);
  ------------------
  |  Branch (135:12): [True: 497, False: 14.9k]
  |  Branch (135:34): [True: 14.9k, False: 0]
  |  Branch (135:62): [True: 0, False: 0]
  ------------------
  136|  15.4k|}

_ZN5Botan3TLS9CallbacksD2Ev:
   46|  5.77k|      virtual ~Callbacks() = default;
_ZN5Botan3TLS9Callbacks23tls_session_establishedERKNS0_15Session_SummaryE:
   87|    245|      virtual void tls_session_established(const Session_Summary& session) { BOTAN_UNUSED(session); }
  ------------------
  |  |  118|    245|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
_ZN5Botan3TLS9Callbacks21tls_session_activatedEv:
   93|    245|      virtual void tls_session_activated() {}
_ZN5Botan3TLS9Callbacks26tls_peer_closed_connectionEv:
  115|    377|      virtual bool tls_peer_closed_connection() { return true; }
_ZN5Botan3TLS9Callbacks23tls_provide_cert_statusERKNSt3__16vectorINS_16X509_CertificateENS2_9allocatorIS4_EEEERKNS0_26Certificate_Status_RequestE:
  196|     27|                                                           const Certificate_Status_Request& csr) {
  197|     27|         BOTAN_UNUSED(chain);
  ------------------
  |  |  118|     27|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  198|     27|         BOTAN_UNUSED(csr);
  ------------------
  |  |  118|     27|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  199|     27|         return std::vector<uint8_t>();
  200|     27|      }

_ZN5Botan3TLS7Channel13received_dataEPKhm:
   48|  5.77k|      size_t received_data(const uint8_t buf[], size_t buf_size) { return this->from_peer(std::span(buf, buf_size)); }
_ZN5Botan3TLS7ChannelD2Ev:
   34|  5.77k|      virtual ~Channel() = default;

_ZNK5Botan3TLS11Ciphersuite5validEv:
  128|  2.01M|      bool valid() const { return m_usable; }
_ZNK5Botan3TLS11Ciphersuite16ciphersuite_codeEv:
   62|  2.48M|      uint16_t ciphersuite_code() const { return m_ciphersuite_code; }
_ZNK5Botan3TLS11Ciphersuite8kex_algoEv:
   89|    245|      std::string kex_algo() const { return kex_method_to_string(kex_method()); }
_ZNK5Botan3TLS11Ciphersuite10kex_methodEv:
   91|   124k|      Kex_Algo kex_method() const { return m_kex_algo; }
_ZNK5Botan3TLS11Ciphersuite8sig_algoEv:
   96|  2.75k|      std::string sig_algo() const { return auth_method_to_string(auth_method()); }
_ZNK5Botan3TLS11Ciphersuite11auth_methodEv:
   98|  69.4k|      Auth_Method auth_method() const { return m_auth_method; }
_ZNK5Botan3TLS11Ciphersuite11cipher_algoEv:
  103|  14.2k|      std::string cipher_algo() const { return m_cipher_algo; }
_ZNK5Botan3TLS11Ciphersuite8mac_algoEv:
  108|  21.4k|      std::string mac_algo() const { return m_mac_algo; }
_ZNK5Botan3TLS11Ciphersuite8prf_algoEv:
  110|  16.8k|      std::string prf_algo() const { return kdf_algo_to_string(m_prf_algo); }
_ZNK5Botan3TLS11Ciphersuite13cipher_keylenEv:
  115|  14.9k|      size_t cipher_keylen() const { return m_cipher_keylen; }
_ZNK5Botan3TLS11Ciphersuite12nonce_formatEv:
  121|    760|      Nonce_Format nonce_format() const { return m_nonce_format; }
_ZNK5Botan3TLS11Ciphersuite10mac_keylenEv:
  123|  14.9k|      size_t mac_keylen() const { return m_mac_keylen; }
_ZNK5Botan3TLS11CiphersuiteltEt:
  134|   426k|      bool operator<(const uint16_t c) const { return ciphersuite_code() < c; }
_ZN5Botan3TLS11CiphersuiteC2EtPKcNS0_11Auth_MethodENS0_8Kex_AlgoES3_mS3_mNS0_8KDF_AlgoENS0_12Nonce_FormatE:
  158|     94|            m_mac_keylen(mac_keylen) {
  159|     94|         m_usable = is_usable();
  160|     94|      }

_ZN5Botan3TLS13TLS_ExceptionC2ENS0_9AlertTypeENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE:
   26|  1.24k|            Exception(err_msg), m_alert_type(type) {}
_ZNK5Botan3TLS13TLS_Exception4typeEv:
   23|  1.24k|      Alert::Type type() const { return m_alert_type; }
_ZN5Botan3TLS18Unexpected_MessageC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   41|    190|      explicit Unexpected_Message(std::string_view err) : TLS_Exception(AlertType::UnexpectedMessage, err) {}

_ZN5Botan3TLS21Server_Name_Indicator11static_typeEv:
  119|   102k|      static Extension_Code static_type() { return Extension_Code::ServerNameIndication; }
_ZNK5Botan3TLS21Server_Name_Indicator4typeEv:
  121|  44.4k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS21Server_Name_Indicator9host_nameEv:
  127|  3.75k|      std::string host_name() const { return m_sni_host_name; }
_ZN5Botan3TLS23Renegotiation_Extension11static_typeEv:
  142|   321k|      static Extension_Code static_type() { return Extension_Code::SafeRenegotiation; }
_ZNK5Botan3TLS23Renegotiation_Extension4typeEv:
  144|   226k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS23Renegotiation_ExtensionC2ERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  148|  10.4k|      explicit Renegotiation_Extension(const std::vector<uint8_t>& bits) : m_reneg_data(bits) {}
_ZNK5Botan3TLS23Renegotiation_Extension18renegotiation_infoEv:
  152|  21.0k|      const std::vector<uint8_t>& renegotiation_info() const { return m_reneg_data; }
_ZNK5Botan3TLS23Renegotiation_Extension5emptyEv:
  156|  10.4k|      bool empty() const override { return false; }  // always send this
_ZN5Botan3TLS39Application_Layer_Protocol_Notification11static_typeEv:
  167|  78.4k|      static Extension_Code static_type() { return Extension_Code::ApplicationLayerProtocolNegotiation; }
_ZNK5Botan3TLS39Application_Layer_Protocol_Notification4typeEv:
  169|  53.8k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS39Application_Layer_Protocol_Notification9protocolsEv:
  171|  1.76k|      const std::vector<std::string>& protocols() const { return m_protocols; }
_ZN5Botan3TLS39Application_Layer_Protocol_NotificationC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  179|  1.73k|            m_protocols(1, std::string(protocol)) {}
_ZNK5Botan3TLS39Application_Layer_Protocol_Notification5emptyEv:
  191|  1.73k|      bool empty() const override { return m_protocols.empty(); }
_ZN5Botan3TLS24Session_Ticket_Extension11static_typeEv:
  202|  91.2k|      static Extension_Code static_type() { return Extension_Code::SessionTicket; }
_ZNK5Botan3TLS24Session_Ticket_Extension4typeEv:
  204|  48.3k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS24Session_Ticket_Extension8contentsEv:
  209|  2.93k|      const Session_Ticket& contents() const { return m_ticket; }
_ZN5Botan3TLS16Supported_Groups11static_typeEv:
  239|   587k|      static Extension_Code static_type() { return Extension_Code::SupportedGroups; }
_ZNK5Botan3TLS16Supported_Groups4typeEv:
  241|   546k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS23Supported_Point_Formats11static_typeEv:
  273|  36.8k|      static Extension_Code static_type() { return Extension_Code::EcPointFormats; }
_ZNK5Botan3TLS23Supported_Point_Formats4typeEv:
  275|  18.2k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS23Supported_Point_FormatsC2Eb:
  279|    584|      explicit Supported_Point_Formats(bool prefer_compressed) : m_prefers_compressed(prefer_compressed) {}
_ZNK5Botan3TLS23Supported_Point_Formats5emptyEv:
  283|    584|      bool empty() const override { return false; }
_ZN5Botan3TLS23Supported_Point_Formats18prefers_compressedEv:
  285|    583|      bool prefers_compressed() { return m_prefers_compressed; }
_ZN5Botan3TLS20Signature_Algorithms11static_typeEv:
  296|  23.5k|      static Extension_Code static_type() { return Extension_Code::SignatureAlgorithms; }
_ZNK5Botan3TLS20Signature_Algorithms4typeEv:
  298|  2.74k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS20Signature_Algorithms17supported_schemesEv:
  300|    273|      const std::vector<Signature_Scheme>& supported_schemes() const { return m_schemes; }
_ZN5Botan3TLS25Signature_Algorithms_Cert11static_typeEv:
  329|  31.6k|      static Extension_Code static_type() { return Extension_Code::CertSignatureAlgorithms; }
_ZNK5Botan3TLS25Signature_Algorithms_Cert4typeEv:
  331|  10.5k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS25Signature_Algorithms_Cert17supported_schemesEv:
  333|    497|      const std::vector<Signature_Scheme>& supported_schemes() const { return m_schemes; }
_ZN5Botan3TLS24SRTP_Protection_Profiles11static_typeEv:
  352|  1.42k|      static Extension_Code static_type() { return Extension_Code::UseSrtp; }
_ZNK5Botan3TLS24SRTP_Protection_Profiles4typeEv:
  354|  1.17k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS22Extended_Master_Secret11static_typeEv:
  377|  70.2k|      static Extension_Code static_type() { return Extension_Code::ExtendedMasterSecret; }
_ZNK5Botan3TLS22Extended_Master_Secret4typeEv:
  379|  34.3k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS22Extended_Master_Secret5emptyEv:
  383|  1.33k|      bool empty() const override { return false; }
_ZN5Botan3TLS16Encrypt_then_MAC11static_typeEv:
  395|  49.6k|      static Extension_Code static_type() { return Extension_Code::EncryptThenMac; }
_ZNK5Botan3TLS16Encrypt_then_MAC4typeEv:
  397|  31.9k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS16Encrypt_then_MAC5emptyEv:
  401|    816|      bool empty() const override { return false; }
_ZN5Botan3TLS26Certificate_Status_Request11static_typeEv:
  415|  43.9k|      static Extension_Code static_type() { return Extension_Code::CertificateStatusRequest; }
_ZNK5Botan3TLS26Certificate_Status_Request4typeEv:
  417|  22.7k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS26Certificate_Status_Request5emptyEv:
  421|    581|      bool empty() const override { return false; }
_ZN5Botan3TLS18Supported_Versions11static_typeEv:
  453|  26.0k|      static Extension_Code static_type() { return Extension_Code::SupportedVersions; }
_ZNK5Botan3TLS18Supported_Versions4typeEv:
  455|    993|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS18Supported_Versions8versionsEv:
  469|    354|      const std::vector<Protocol_Version>& versions() const { return m_versions; }
_ZN5Botan3TLS17Record_Size_Limit11static_typeEv:
  484|  14.2k|      static Extension_Code static_type() { return Extension_Code::RecordSizeLimit; }
_ZNK5Botan3TLS17Record_Size_Limit4typeEv:
  486|  14.2k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS6Cookie11static_typeEv:
  510|  3.77k|      static Extension_Code static_type() { return Extension_Code::Cookie; }
_ZNK5Botan3TLS6Cookie4typeEv:
  512|  3.77k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS22PSK_Key_Exchange_Modes11static_typeEv:
  533|  5.27k|      static Extension_Code static_type() { return Extension_Code::PskKeyExchangeModes; }
_ZNK5Botan3TLS22PSK_Key_Exchange_Modes4typeEv:
  535|  5.27k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS23Certificate_Authorities11static_typeEv:
  556|    373|      static Extension_Code static_type() { return Extension_Code::CertificateAuthorities; }
_ZNK5Botan3TLS23Certificate_Authorities4typeEv:
  558|    373|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS3PSK11static_typeEv:
  578|    201|      static Extension_Code static_type() { return Extension_Code::PresharedKey; }
_ZNK5Botan3TLS3PSK4typeEv:
  580|    201|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS9Key_Share11static_typeEv:
  657|  4.25k|      static Extension_Code static_type() { return Extension_Code::KeyShare; }
_ZNK5Botan3TLS9Key_Share4typeEv:
  659|  4.25k|      Extension_Code type() const override { return static_type(); }
_ZN5Botan3TLS19EarlyDataIndication11static_typeEv:
  723|  8.69k|      static Extension_Code static_type() { return Extension_Code::EarlyData; }
_ZNK5Botan3TLS19EarlyDataIndication4typeEv:
  725|  8.69k|      Extension_Code type() const override { return static_type(); }
_ZNK5Botan3TLS17Unknown_Extension4typeEv:
  762|  3.29M|      Extension_Code type() const override { return m_type; }
_ZNK5Botan3TLS10Extensions3hasENS0_14Extension_CodeE:
  790|   350k|      bool has(Extension_Code type) const { return get(type) != nullptr; }
_ZN5Botan3TLS10Extensions3addEPNS0_9ExtensionE:
  796|  25.7k|      void add(Extension* extn) { add(std::unique_ptr<Extension>(extn)); }
_ZZNK5Botan3TLS10Extensions3getENS0_14Extension_CodeEENKUlRKT_E_clINSt3__110unique_ptrINS0_9ExtensionENS8_14default_deleteISA_EEEEEEDaS5_:
  800|  4.01M|            m_extensions.cbegin(), m_extensions.cend(), [type](const auto& ext) { return ext->type() == type; });
_ZNK5Botan3TLS10Extensions3getENS0_14Extension_CodeE:
  798|   771k|      Extension* get(Extension_Code type) const {
  799|   771k|         const auto i = std::find_if(
  800|   771k|            m_extensions.cbegin(), m_extensions.cend(), [type](const auto& ext) { return ext->type() == type; });
  801|       |
  802|   771k|         return (i != m_extensions.end()) ? i->get() : nullptr;
  ------------------
  |  Branch (802:17): [True: 111k, False: 659k]
  ------------------
  803|   771k|      }
_ZNK5Botan3TLS10Extensions3getINS0_26Certificate_Status_RequestEEEPT_v:
  781|  21.1k|      T* get() const {
  782|  21.1k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  21.1k|      }
_ZNK5Botan3TLS10Extensions3getINS0_39Application_Layer_Protocol_NotificationEEEPT_v:
  781|  24.6k|      T* get() const {
  782|  24.6k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  24.6k|      }
_ZNK5Botan3TLS10Extensions3getINS0_16Supported_GroupsEEEPT_v:
  781|  40.4k|      T* get() const {
  782|  40.4k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  40.4k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_26Certificate_Status_RequestEEEbv:
  786|  21.1k|      bool has() const {
  787|  21.1k|         return get<T>() != nullptr;
  788|  21.1k|      }
_ZN5Botan3TLS9ExtensionD2Ev:
  111|   188k|      virtual ~Extension() = default;
_ZN5Botan3TLS23Renegotiation_ExtensionC2Ev:
  146|  10.3k|      Renegotiation_Extension() = default;
_ZN5Botan3TLS22Extended_Master_SecretC2Ev:
  385|  1.33k|      Extended_Master_Secret() = default;
_ZN5Botan3TLS16Encrypt_then_MACC2Ev:
  403|    816|      Encrypt_then_MAC() = default;
_ZNK5Botan3TLS10Extensions3getINS0_18Supported_VersionsEEEPT_v:
  781|  25.0k|      T* get() const {
  782|  25.0k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  25.0k|      }
_ZN5Botan3TLS10ExtensionsC2Ev:
  859|  47.0k|      Extensions() = default;
_ZNK5Botan3TLS10Extensions3getINS0_20Signature_AlgorithmsEEEPT_v:
  781|  20.8k|      T* get() const {
  782|  20.8k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  20.8k|      }
_ZNK5Botan3TLS10Extensions3getINS0_25Signature_Algorithms_CertEEEPT_v:
  781|  21.1k|      T* get() const {
  782|  21.1k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  21.1k|      }
_ZNK5Botan3TLS10Extensions3getINS0_23Supported_Point_FormatsEEEPT_v:
  781|  18.6k|      T* get() const {
  782|  18.6k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  18.6k|      }
_ZNK5Botan3TLS10Extensions3getINS0_21Server_Name_IndicatorEEEPT_v:
  781|  57.6k|      T* get() const {
  782|  57.6k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  57.6k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_23Renegotiation_ExtensionEEEbv:
  786|  63.1k|      bool has() const {
  787|  63.1k|         return get<T>() != nullptr;
  788|  63.1k|      }
_ZNK5Botan3TLS10Extensions3getINS0_23Renegotiation_ExtensionEEEPT_v:
  781|  94.5k|      T* get() const {
  782|  94.5k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  94.5k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_24Session_Ticket_ExtensionEEEbv:
  786|  21.7k|      bool has() const {
  787|  21.7k|         return get<T>() != nullptr;
  788|  21.7k|      }
_ZNK5Botan3TLS10Extensions3getINS0_24Session_Ticket_ExtensionEEEPT_v:
  781|  42.9k|      T* get() const {
  782|  42.9k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  42.9k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_39Application_Layer_Protocol_NotificationEEEbv:
  786|  22.9k|      bool has() const {
  787|  22.9k|         return get<T>() != nullptr;
  788|  22.9k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_22Extended_Master_SecretEEEbv:
  786|  35.8k|      bool has() const {
  787|  35.8k|         return get<T>() != nullptr;
  788|  35.8k|      }
_ZNK5Botan3TLS10Extensions3getINS0_22Extended_Master_SecretEEEPT_v:
  781|  35.8k|      T* get() const {
  782|  35.8k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  35.8k|      }
_ZNK5Botan3TLS10Extensions3hasINS0_16Encrypt_then_MACEEEbv:
  786|  17.6k|      bool has() const {
  787|  17.6k|         return get<T>() != nullptr;
  788|  17.6k|      }
_ZNK5Botan3TLS10Extensions3getINS0_16Encrypt_then_MACEEEPT_v:
  781|  17.6k|      T* get() const {
  782|  17.6k|         return dynamic_cast<T*>(get(T::static_type()));
  783|  17.6k|      }
_ZNK5Botan3TLS10Extensions3getINS0_24SRTP_Protection_ProfilesEEEPT_v:
  781|    245|      T* get() const {
  782|    245|         return dynamic_cast<T*>(get(T::static_type()));
  783|    245|      }

_ZNK5Botan3TLS17Handshake_Message9wire_typeEv:
   41|  66.8k|      virtual Handshake_Type wire_type() const {
   42|       |         // Usually equal to the Handshake_Type enum value,
   43|       |         // with the exception of TLS 1.3 Hello Retry Request.
   44|  66.8k|         return type();
   45|  66.8k|      }
_ZN5Botan3TLS17Handshake_MessageD2Ev:
   52|   107k|      virtual ~Handshake_Message() = default;
_ZN5Botan3TLS17Handshake_MessageC2Ev:
   53|   107k|      Handshake_Message() = default;

_ZNK5Botan3TLS20Hello_Verify_Request4typeEv:
   57|  7.59k|      Handshake_Type type() const override { return Handshake_Type::HelloVerifyRequest; }
_ZNK5Botan3TLS20Hello_Verify_Request6cookieEv:
   59|  3.80k|      const std::vector<uint8_t>& cookie() const { return m_cookie; }
_ZN5Botan3TLS15Server_Hello_128SettingsC2ENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEENS0_16Protocol_VersionEtb:
  313|  20.9k|                  m_offer_session_ticket(offer_session_ticket) {}
_ZNK5Botan3TLS15Server_Hello_128Settings10session_idEv:
  315|  20.9k|            const Session_ID& session_id() const { return m_new_session_id; }
_ZNK5Botan3TLS15Server_Hello_128Settings16protocol_versionEv:
  317|  41.9k|            Protocol_Version protocol_version() const { return m_new_session_version; }
_ZNK5Botan3TLS15Server_Hello_128Settings11ciphersuiteEv:
  319|  20.9k|            uint16_t ciphersuite() const { return m_ciphersuite; }
_ZNK5Botan3TLS15Server_Hello_128Settings20offer_session_ticketEv:
  321|  2.89k|            bool offer_session_ticket() const { return m_offer_session_ticket; }
_ZNK5Botan3TLS19Client_Key_Exchange17pre_master_secretEv:
  482|  14.6k|      const secure_vector<uint8_t>& pre_master_secret() const { return m_pre_master; }
_ZNK5Botan3TLS14Certificate_124typeEv:
  511|    352|      Handshake_Type type() const override { return Handshake_Type::Certificate; }
_ZNK5Botan3TLS14Certificate_1210cert_chainEv:
  513|    177|      const std::vector<X509_Certificate>& cert_chain() const { return m_certs; }
_ZNK5Botan3TLS8Finished4typeEv:
  788|    490|      Handshake_Type type() const override { return Handshake_Type::Finished; }
_ZNK5Botan3TLS19Server_Key_Exchange4typeEv:
  836|  41.6k|      Handshake_Type type() const override { return Handshake_Type::ServerKeyExchange; }
_ZNK5Botan3TLS19Server_Key_Exchange6paramsEv:
  838|  38.9k|      const std::vector<uint8_t>& params() const { return m_params; }
_ZNK5Botan3TLS19Server_Key_Exchange12shared_groupEv:
  849|  14.8k|      const std::optional<Group_Params>& shared_group() const { return m_shared_group; }
_ZNK5Botan3TLS17Server_Hello_Done4typeEv:
  880|  41.6k|      Handshake_Type type() const override { return Handshake_Type::ServerHelloDone; }
_ZNK5Botan3TLS18Change_Cipher_Spec4typeEv:
  972|    245|      Handshake_Type type() const override { return Handshake_Type::HandshakeCCS; }
_ZNK5Botan3TLS18Change_Cipher_Spec9serializeEv:
  974|    245|      std::vector<uint8_t> serialize() const override { return std::vector<uint8_t>(1, 1); }

_ZN5Botan3TLS6PolicyD2Ev:
  441|  5.77k|      virtual ~Policy() = default;

_ZN5Botan3TLS18Server_InformationC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEEt:
   34|  6.02k|            m_hostname(hostname), m_service(""), m_port(port) {}

_ZN5Botan3TLS14Session_HandleC2ENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_11Session_ID_EJEEE:
   72|    167|      Session_Handle(Session_ID id) : m_handle(std::move(id)) { validate_constraints(); }
_ZN5Botan3TLS14Session_HandleC2ENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_15Session_Ticket_EJEEE:
   83|  2.40k|      Session_Handle(Session_Ticket ticket) : m_handle(std::move(ticket)) { validate_constraints(); }
_ZN5Botan3TLS12Session_BaseC2ENSt3__16chrono10time_pointINS3_12system_clockENS3_8durationIxNS2_5ratioILl1ELl1000000EEEEEEENS0_16Protocol_VersionEtNS0_15Connection_SideEtbbNS2_6vectorINS_16X509_CertificateENS2_9allocatorISE_EEEENS0_18Server_InformationE:
  158|    245|            m_server_info(std::move(server_info)) {}
_ZNK5Botan3TLS12Session_Base7versionEv:
  172|    245|      Protocol_Version version() const { return m_version; }
_ZN5Botan3TLS15Session_Summary14set_session_idENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_11Session_ID_EJEEE:
  279|    245|      void set_session_id(Session_ID id) { m_session_id = std::move(id); }
_ZNK5Botan3TLS7Session13lifetime_hintEv:
  420|    245|      std::chrono::seconds lifetime_hint() const { return m_lifetime_hint; }

_ZN5Botan3TLS15Session_ManagerD2Ev:
  214|  5.77k|      virtual ~Session_Manager() = default;
_ZN5Botan3TLS15Session_Manager21emits_session_ticketsEv:
  212|  20.9k|      virtual bool emits_session_tickets() { return false; }

_ZN5Botan3TLS20Session_Manager_Noop9establishERKNS0_7SessionERKNSt3__18optionalINS_6StrongINS5_6vectorIhNS5_9allocatorIhEEEENS0_11Session_ID_EJEEEEEb:
   29|    245|                                              bool = false) override {
   30|    245|         return std::nullopt;
   31|    245|      }
_ZN5Botan3TLS20Session_Manager_Noop6removeERKNS0_14Session_HandleE:
   35|    122|      size_t remove(const Session_Handle&) override { return 0; }
_ZN5Botan3TLS20Session_Manager_Noop12retrieve_oneERKNS0_14Session_HandleE:
   40|  2.45k|      std::optional<Session> retrieve_one(const Session_Handle&) override { return std::nullopt; }

_ZNK5Botan3TLS16Signature_SchemeeqERKS1_:
   91|  76.8k|      bool operator==(const Signature_Scheme& rhs) const { return m_code == rhs.m_code; }

_ZN5Botan3TLS6TicketC2ENS_6StrongINSt3__16vectorIhNS3_9allocatorIhEEEENS0_22Opaque_Session_Handle_EJEEEj:
   32|    721|            m_identity(std::move(identity)), m_obfuscated_age(obfuscated_age) {}

_ZN5Botan3TLS16Protocol_VersionC2Ev:
   51|  51.8k|      Protocol_Version() : m_version(0) {}
_ZN5Botan3TLS16Protocol_VersionC2Et:
   53|   242k|      explicit Protocol_Version(uint16_t code) : m_version(code) {}
_ZN5Botan3TLS16Protocol_VersionC2ENS0_12Version_CodeE:
   58|   144k|      Protocol_Version(Version_Code named_version) : Protocol_Version(static_cast<uint16_t>(named_version)) {}
_ZN5Botan3TLS16Protocol_VersionC2Ehh:
   65|  95.6k|            Protocol_Version(static_cast<uint16_t>((static_cast<uint16_t>(major) << 8) | minor)) {}
_ZNK5Botan3TLS16Protocol_Version13major_versionEv:
   80|   580k|      uint8_t major_version() const { return static_cast<uint8_t>(m_version >> 8); }
_ZNK5Botan3TLS16Protocol_Version13minor_versionEv:
   85|   121k|      uint8_t minor_version() const { return static_cast<uint8_t>(m_version & 0xFF); }
_ZNK5Botan3TLS16Protocol_VersioneqERKS1_:
  115|  80.2k|      bool operator==(const Protocol_Version& other) const { return (m_version == other.m_version); }
_ZNK5Botan3TLS16Protocol_VersionneERKS1_:
  120|  15.7k|      bool operator!=(const Protocol_Version& other) const { return (m_version != other.m_version); }
_ZNK5Botan3TLS16Protocol_VersiongeERKS1_:
  130|  24.6k|      bool operator>=(const Protocol_Version& other) const { return (*this == other || *this > other); }
  ------------------
  |  Branch (130:70): [True: 170, False: 24.5k]
  |  Branch (130:88): [True: 24.5k, False: 3]
  ------------------
_ZNK5Botan3TLS16Protocol_VersionleERKS1_:
  140|  27.2k|      bool operator<=(const Protocol_Version& other) const { return (*this == other || *this < other); }
  ------------------
  |  Branch (140:70): [True: 27.2k, False: 0]
  |  Branch (140:88): [True: 0, False: 0]
  ------------------

_ZN5Botan14Cert_Extension17Basic_Constraints10static_oidEv:
   37|  5.77k|      static OID static_oid() { return OID("2.5.29.19"); }
_ZN5Botan14Cert_Extension9Key_Usage10static_oidEv:
   66|  5.77k|      static OID static_oid() { return OID("2.5.29.15"); }
_ZN5Botan14Cert_Extension14Subject_Key_ID10static_oidEv:
   98|  5.77k|      static OID static_oid() { return OID("2.5.29.14"); }
_ZN5Botan14Cert_Extension16Authority_Key_ID10static_oidEv:
  128|  5.77k|      static OID static_oid() { return OID("2.5.29.35"); }
_ZN5Botan14Cert_Extension24Subject_Alternative_Name10static_oidEv:
  150|  5.77k|      static OID static_oid() { return OID("2.5.29.17"); }
_ZN5Botan14Cert_Extension23Issuer_Alternative_Name10static_oidEv:
  178|  5.77k|      static OID static_oid() { return OID("2.5.29.18"); }
_ZN5Botan14Cert_Extension18Extended_Key_Usage10static_oidEv:
  214|  5.77k|      static OID static_oid() { return OID("2.5.29.37"); }
_ZN5Botan14Cert_Extension16Name_Constraints10static_oidEv:
  250|  5.77k|      static OID static_oid() { return OID("2.5.29.30"); }
_ZN5Botan14Cert_Extension20Certificate_Policies10static_oidEv:
  280|  5.77k|      static OID static_oid() { return OID("2.5.29.32"); }
_ZN5Botan14Cert_Extension28Authority_Information_Access10static_oidEv:
  318|  5.77k|      static OID static_oid() { return OID("1.3.6.1.5.5.7.1.1"); }
_ZN5Botan14Cert_Extension23CRL_Distribution_Points10static_oidEv:
  422|  5.77k|      static OID static_oid() { return OID("2.5.29.31"); }

_ZN5Botan4X5098load_keyENSt3__16vectorIhNS1_9allocatorIhEEEE:
   61|  5.77k|inline std::unique_ptr<Public_Key> load_key(std::vector<uint8_t> enc) {
   62|  5.77k|   DataSource_Memory source(std::move(enc));
   63|  5.77k|   return X509::load_key(source);
   64|  5.77k|}

_ZN5Botan11X509_ObjectC2ERKS0_:
   96|  42.5k|      X509_Object(const X509_Object&) = default;
_ZNK5Botan11X509_Object9signatureEv:
   37|  11.7k|      const std::vector<uint8_t>& signature() const { return m_sig; }
_ZNK5Botan11X509_Object11signed_bodyEv:
   42|  11.7k|      const std::vector<uint8_t>& signed_body() const { return m_tbs_bits; }
_ZNK5Botan11X509_Object19signature_algorithmEv:
   47|  17.5k|      const AlgorithmIdentifier& signature_algorithm() const { return m_sig_algo; }
_ZN5Botan11X509_ObjectD2Ev:
  103|  48.3k|      virtual ~X509_Object() = default;
_ZN5Botan11X509_ObjectC2Ev:
  121|  5.77k|      X509_Object() = default;

_ZN5Botan16X509_CertificateC2ERKS0_:
  405|  42.5k|      X509_Certificate(const X509_Certificate& other) = default;

LLVMFuzzerInitialize:
   24|      2|extern "C" int LLVMFuzzerInitialize(int*, char***) {
   25|       |   /*
   26|       |   * This disables the mlock pool, as overwrites within the pool are
   27|       |   * opaque to ASan or other instrumentation.
   28|       |   */
   29|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   30|      2|   return 0;
   31|      2|}
LLVMFuzzerTestOneInput:
   34|  5.78k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   35|  5.78k|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (35:7): [True: 5.77k, False: 9]
  ------------------
   36|  5.77k|      fuzz(in, len);
   37|  5.77k|   }
   38|  5.78k|   return 0;
   39|  5.78k|}
_Z20fuzzer_rng_as_sharedv:
   43|  5.77k|inline std::shared_ptr<Botan::RandomNumberGenerator> fuzzer_rng_as_shared() {
   44|  5.77k|   static std::shared_ptr<Botan::ChaCha_RNG> rng =
   45|  5.77k|      std::make_shared<Botan::ChaCha_RNG>(Botan::secure_vector<uint8_t>(32));
   46|  5.77k|   return rng;
   47|  5.77k|}

_Z4fuzzPKhm:
  169|  5.77k|void fuzz(const uint8_t in[], size_t len) {
  170|  5.77k|   if(len <= 1)
  ------------------
  |  Branch (170:7): [True: 1, False: 5.77k]
  ------------------
  171|      1|      return;
  172|       |
  173|  5.77k|   auto session_manager = std::make_shared<Botan::TLS::Session_Manager_Noop>();
  174|  5.77k|   auto policy = std::make_shared<Fuzzer_TLS_Policy>();
  175|  5.77k|   Botan::TLS::Server_Information info("server.name", 443);
  176|  5.77k|   auto creds = std::make_shared<Fuzzer_TLS_Server_Creds>();
  177|  5.77k|   auto callbacks = std::make_shared<Fuzzer_TLS_Server_Callbacks>();
  178|       |
  179|  5.77k|   const bool is_datagram = in[0] & 1;
  180|       |
  181|  5.77k|   Botan::TLS::Server server(callbacks, session_manager, creds, policy, fuzzer_rng_as_shared(), is_datagram);
  182|       |
  183|  5.77k|   try {
  184|  5.77k|      server.received_data(in + 1, len - 1);
  185|  5.77k|   } catch(std::exception& e) {}
  186|  5.77k|}
_ZNK17Fuzzer_TLS_Policy11allow_tls13Ev:
  118|  25.9k|      bool allow_tls13() const override { return false; }
_ZNK17Fuzzer_TLS_Policy16ciphersuite_listEN5Botan3TLS16Protocol_VersionE:
  120|  21.1k|      std::vector<uint16_t> ciphersuite_list(Botan::TLS::Protocol_Version) const override {
  121|  21.1k|         std::vector<uint16_t> ciphersuites;
  122|       |
  123|  1.99M|         for(auto&& suite : Botan::TLS::Ciphersuite::all_known_ciphersuites()) {
  ------------------
  |  Branch (123:27): [True: 1.99M, False: 21.1k]
  ------------------
  124|  1.99M|            if(suite.valid())
  ------------------
  |  Branch (124:16): [True: 1.99M, False: 0]
  ------------------
  125|  1.99M|               ciphersuites.push_back(suite.ciphersuite_code());
  126|  1.99M|         }
  127|       |
  128|  21.1k|         return ciphersuites;
  129|  21.1k|      }
_ZN23Fuzzer_TLS_Server_CredsC2Ev:
   68|  5.77k|      Fuzzer_TLS_Server_Creds() {
   69|  5.77k|         Botan::DataSource_Memory cert_in(fixed_rsa_cert);
   70|  5.77k|         m_rsa_cert.reset(new Botan::X509_Certificate(cert_in));
   71|       |
   72|  5.77k|         Botan::DataSource_Memory key_in(fixed_rsa_key);
   73|  5.77k|         m_rsa_key.reset(Botan::PKCS8::load_key(key_in).release());
   74|  5.77k|      }
_ZN23Fuzzer_TLS_Server_Creds10cert_chainERKNSt3__16vectorINS0_12basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEENS5_IS7_EEEERKNS1_IN5Botan19AlgorithmIdentifierENS5_ISD_EEEERKS7_SJ_:
   80|  63.5k|         const std::string& /*hostname*/) override {
   81|  63.5k|         std::vector<Botan::X509_Certificate> v;
   82|       |
   83|  63.5k|         for(auto algo : algos) {
  ------------------
  |  Branch (83:24): [True: 63.5k, False: 42.3k]
  ------------------
   84|  63.5k|            if(algo == "RSA") {
  ------------------
  |  Branch (84:16): [True: 21.1k, False: 42.3k]
  ------------------
   85|  21.1k|               v.push_back(*m_rsa_cert);
   86|  21.1k|               break;
   87|  21.1k|            }
   88|  63.5k|         }
   89|       |
   90|  63.5k|         return v;
   91|  63.5k|      }
_ZN23Fuzzer_TLS_Server_Creds15private_key_forERKN5Botan16X509_CertificateERKNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEESC_:
   95|    177|                                                          const std::string& /*context*/) override {
   96|    177|         if(type == "RSA")
  ------------------
  |  Branch (96:13): [True: 0, False: 177]
  ------------------
   97|      0|            return m_rsa_key;
   98|    177|         return nullptr;
   99|    177|      }
_ZN23Fuzzer_TLS_Server_Creds17psk_identity_hintERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEES8_:
  101|  20.8k|      std::string psk_identity_hint(const std::string&, const std::string&) override { return "psk_hint"; }
_ZN23Fuzzer_TLS_Server_Creds3pskERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEES8_S8_:
  105|  19.2k|      Botan::SymmetricKey psk(const std::string&, const std::string&, const std::string&) override {
  106|  19.2k|         return Botan::SymmetricKey("AABBCCDDEEFF00112233445566778899");
  107|  19.2k|      }
_ZN27Fuzzer_TLS_Server_Callbacks13tls_emit_dataENSt3__14spanIKhLm18446744073709551615EEE:
  134|  70.3k|      void tls_emit_data(std::span<const uint8_t>) override {
  135|       |         // discard
  136|  70.3k|      }
_ZN27Fuzzer_TLS_Server_Callbacks9tls_alertEN5Botan3TLS5AlertE:
  142|  19.6k|      void tls_alert(Botan::TLS::Alert) override {
  143|       |         // ignore alert
  144|  19.6k|      }
_ZN27Fuzzer_TLS_Server_Callbacks30tls_server_choose_app_protocolERKNSt3__16vectorINS0_12basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEENS5_IS7_EEEE:
  146|  1.76k|      std::string tls_server_choose_app_protocol(const std::vector<std::string>& client_protos) override {
  147|  1.76k|         if(client_protos.size() > 1)
  ------------------
  |  Branch (147:13): [True: 118, False: 1.65k]
  ------------------
  148|    118|            return client_protos[0];
  149|  1.65k|         else
  150|  1.65k|            return "fuzzy";
  151|  1.76k|      }

_ZN5Botan19AlgorithmIdentifierC2ERKNS_3OIDERKNSt3__16vectorIhNS4_9allocatorIhEEEE:
   19|  11.6k|      m_oid(oid), m_parameters(param) {}
_ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEERKNS1_6vectorIhNS1_9allocatorIhEEEE:
   25|  5.84k|      AlgorithmIdentifier(OID::from_string(oid), param) {}
_ZN5Botan19AlgorithmIdentifierC2ERKNS_3OIDENS0_15Encoding_OptionE:
   30|  6.32k|AlgorithmIdentifier::AlgorithmIdentifier(const OID& oid, Encoding_Option option) : m_oid(oid), m_parameters() {
   31|  6.32k|   const uint8_t DER_NULL[] = {0x05, 0x00};
   32|       |
   33|  6.32k|   if(option == USE_NULL_PARAM) {
  ------------------
  |  Branch (33:7): [True: 5.51k, False: 807]
  ------------------
   34|  5.51k|      m_parameters.assign(DER_NULL, DER_NULL + 2);
   35|  5.51k|   }
   36|  6.32k|}
_ZN5Botan19AlgorithmIdentifierC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS0_15Encoding_OptionE:
   42|  5.84k|      m_oid(OID::from_string(oid)), m_parameters() {
   43|  5.84k|   const uint8_t DER_NULL[] = {0x05, 0x00};
   44|       |
   45|  5.84k|   if(option == USE_NULL_PARAM) {
  ------------------
  |  Branch (45:7): [True: 5.84k, False: 0]
  ------------------
   46|  5.84k|      m_parameters.assign(DER_NULL, DER_NULL + 2);
   47|  5.84k|   }
   48|  5.84k|}
_ZNK5Botan19AlgorithmIdentifier19parameters_are_nullEv:
   50|  11.5k|bool AlgorithmIdentifier::parameters_are_null() const {
   51|  11.5k|   return (m_parameters.size() == 2 && (m_parameters[0] == 0x05) && (m_parameters[1] == 0x00));
  ------------------
  |  Branch (51:12): [True: 11.5k, False: 0]
  |  Branch (51:40): [True: 11.5k, False: 0]
  |  Branch (51:69): [True: 11.5k, False: 0]
  ------------------
   52|  11.5k|}
_ZN5BotaneqERKNS_19AlgorithmIdentifierES2_:
   54|  5.77k|bool operator==(const AlgorithmIdentifier& a1, const AlgorithmIdentifier& a2) {
   55|  5.77k|   if(a1.oid() != a2.oid()) {
  ------------------
  |  Branch (55:7): [True: 0, False: 5.77k]
  ------------------
   56|      0|      return false;
   57|      0|   }
   58|       |
   59|       |   /*
   60|       |   * Treat NULL and empty as equivalent
   61|       |   */
   62|  5.77k|   if(a1.parameters_are_null_or_empty() && a2.parameters_are_null_or_empty()) {
  ------------------
  |  Branch (62:7): [True: 5.77k, False: 0]
  |  Branch (62:44): [True: 5.77k, False: 0]
  ------------------
   63|  5.77k|      return true;
   64|  5.77k|   }
   65|       |
   66|      0|   return (a1.parameters() == a2.parameters());
   67|  5.77k|}
_ZN5BotanneERKNS_19AlgorithmIdentifierES2_:
   69|  5.77k|bool operator!=(const AlgorithmIdentifier& a1, const AlgorithmIdentifier& a2) { return !(a1 == a2); }
_ZNK5Botan19AlgorithmIdentifier11encode_intoERNS_11DER_EncoderE:
   74|  23.4k|void AlgorithmIdentifier::encode_into(DER_Encoder& codec) const {
   75|  23.4k|   codec.start_sequence().encode(oid()).raw_bytes(parameters()).end_cons();
   76|  23.4k|}
_ZN5Botan19AlgorithmIdentifier11decode_fromERNS_11BER_DecoderE:
   81|  28.8k|void AlgorithmIdentifier::decode_from(BER_Decoder& codec) {
   82|  28.8k|   codec.start_sequence().decode(m_oid).raw_bytes(m_parameters).end_cons();
   83|  28.8k|}

_ZNK5Botan11ASN1_Object10BER_encodeEv:
   18|  11.7k|std::vector<uint8_t> ASN1_Object::BER_encode() const {
   19|  11.7k|   std::vector<uint8_t> output;
   20|  11.7k|   DER_Encoder der(output);
   21|  11.7k|   this->encode_into(der);
   22|  11.7k|   return output;
   23|  11.7k|}
_ZNK5Botan10BER_Object11assert_is_aENS_9ASN1_TypeENS_10ASN1_ClassENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE:
   28|   301k|void BER_Object::assert_is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag, std::string_view descr) const {
   29|   301k|   if(this->is_a(expected_type_tag, expected_class_tag) == false) {
  ------------------
  |  Branch (29:7): [True: 121, False: 301k]
  ------------------
   30|    121|      std::stringstream msg;
   31|       |
   32|    121|      msg << "Tag mismatch when decoding " << descr << " got ";
   33|       |
   34|    121|      if(m_class_tag == ASN1_Class::NoObject && m_type_tag == ASN1_Type::NoObject) {
  ------------------
  |  Branch (34:10): [True: 10, False: 111]
  |  Branch (34:49): [True: 10, False: 0]
  ------------------
   35|     10|         msg << "EOF";
   36|    111|      } else {
   37|    111|         if(m_class_tag == ASN1_Class::Universal || m_class_tag == ASN1_Class::Constructed) {
  ------------------
  |  Branch (37:13): [True: 29, False: 82]
  |  Branch (37:53): [True: 58, False: 24]
  ------------------
   38|     87|            msg << asn1_tag_to_string(m_type_tag);
   39|     87|         } else {
   40|     24|            msg << std::to_string(static_cast<uint32_t>(m_type_tag));
   41|     24|         }
   42|       |
   43|    111|         msg << "/" << asn1_class_to_string(m_class_tag);
   44|    111|      }
   45|       |
   46|    121|      msg << " expected ";
   47|       |
   48|    121|      if(expected_class_tag == ASN1_Class::Universal || expected_class_tag == ASN1_Class::Constructed) {
  ------------------
  |  Branch (48:10): [True: 0, False: 121]
  |  Branch (48:57): [True: 121, False: 0]
  ------------------
   49|    121|         msg << asn1_tag_to_string(expected_type_tag);
   50|    121|      } else {
   51|      0|         msg << std::to_string(static_cast<uint32_t>(expected_type_tag));
   52|      0|      }
   53|       |
   54|    121|      msg << "/" << asn1_class_to_string(expected_class_tag);
   55|       |
   56|    121|      throw BER_Decoding_Error(msg.str());
   57|    121|   }
   58|   301k|}
_ZNK5Botan10BER_Object4is_aENS_9ASN1_TypeENS_10ASN1_ClassE:
   60|   324k|bool BER_Object::is_a(ASN1_Type expected_type_tag, ASN1_Class expected_class_tag) const {
   61|   324k|   return (m_type_tag == expected_type_tag && m_class_tag == expected_class_tag);
  ------------------
  |  Branch (61:12): [True: 301k, False: 23.2k]
  |  Branch (61:47): [True: 301k, False: 6]
  ------------------
   62|   324k|}
_ZNK5Botan10BER_Object4is_aEiNS_10ASN1_ClassE:
   64|  5.77k|bool BER_Object::is_a(int expected_type_tag, ASN1_Class expected_class_tag) const {
   65|  5.77k|   return is_a(ASN1_Type(expected_type_tag), expected_class_tag);
   66|  5.77k|}
_ZN5Botan10BER_Object11set_taggingENS_9ASN1_TypeENS_10ASN1_ClassE:
   68|   475k|void BER_Object::set_tagging(ASN1_Type type_tag, ASN1_Class class_tag) {
   69|   475k|   m_type_tag = type_tag;
   70|   475k|   m_class_tag = class_tag;
   71|   475k|}
_ZN5Botan20asn1_class_to_stringENS_10ASN1_ClassE:
   73|    232|std::string asn1_class_to_string(ASN1_Class type) {
   74|    232|   switch(type) {
   75|     29|      case ASN1_Class::Universal:
  ------------------
  |  Branch (75:7): [True: 29, False: 203]
  ------------------
   76|     29|         return "UNIVERSAL";
   77|    179|      case ASN1_Class::Constructed:
  ------------------
  |  Branch (77:7): [True: 179, False: 53]
  ------------------
   78|    179|         return "CONSTRUCTED";
   79|      4|      case ASN1_Class::ContextSpecific:
  ------------------
  |  Branch (79:7): [True: 4, False: 228]
  ------------------
   80|      4|         return "CONTEXT_SPECIFIC";
   81|      1|      case ASN1_Class::Application:
  ------------------
  |  Branch (81:7): [True: 1, False: 231]
  ------------------
   82|      1|         return "APPLICATION";
   83|      3|      case ASN1_Class::Private:
  ------------------
  |  Branch (83:7): [True: 3, False: 229]
  ------------------
   84|      3|         return "PRIVATE";
   85|      0|      case ASN1_Class::NoObject:
  ------------------
  |  Branch (85:7): [True: 0, False: 232]
  ------------------
   86|      0|         return "NO_OBJECT";
   87|     16|      default:
  ------------------
  |  Branch (87:7): [True: 16, False: 216]
  ------------------
   88|     16|         return "CLASS(" + std::to_string(static_cast<size_t>(type)) + ")";
   89|    232|   }
   90|    232|}
_ZN5Botan18asn1_tag_to_stringENS_9ASN1_TypeE:
   92|    208|std::string asn1_tag_to_string(ASN1_Type type) {
   93|    208|   switch(type) {
   94|    107|      case ASN1_Type::Sequence:
  ------------------
  |  Branch (94:7): [True: 107, False: 101]
  ------------------
   95|    107|         return "SEQUENCE";
   96|       |
   97|     22|      case ASN1_Type::Set:
  ------------------
  |  Branch (97:7): [True: 22, False: 186]
  ------------------
   98|     22|         return "SET";
   99|       |
  100|      2|      case ASN1_Type::PrintableString:
  ------------------
  |  Branch (100:7): [True: 2, False: 206]
  ------------------
  101|      2|         return "PRINTABLE STRING";
  102|       |
  103|      1|      case ASN1_Type::NumericString:
  ------------------
  |  Branch (103:7): [True: 1, False: 207]
  ------------------
  104|      1|         return "NUMERIC STRING";
  105|       |
  106|      1|      case ASN1_Type::Ia5String:
  ------------------
  |  Branch (106:7): [True: 1, False: 207]
  ------------------
  107|      1|         return "IA5 STRING";
  108|       |
  109|      1|      case ASN1_Type::TeletexString:
  ------------------
  |  Branch (109:7): [True: 1, False: 207]
  ------------------
  110|      1|         return "T61 STRING";
  111|       |
  112|      2|      case ASN1_Type::Utf8String:
  ------------------
  |  Branch (112:7): [True: 2, False: 206]
  ------------------
  113|      2|         return "UTF8 STRING";
  114|       |
  115|      1|      case ASN1_Type::VisibleString:
  ------------------
  |  Branch (115:7): [True: 1, False: 207]
  ------------------
  116|      1|         return "VISIBLE STRING";
  117|       |
  118|      1|      case ASN1_Type::BmpString:
  ------------------
  |  Branch (118:7): [True: 1, False: 207]
  ------------------
  119|      1|         return "BMP STRING";
  120|       |
  121|      1|      case ASN1_Type::UniversalString:
  ------------------
  |  Branch (121:7): [True: 1, False: 207]
  ------------------
  122|      1|         return "UNIVERSAL STRING";
  123|       |
  124|      1|      case ASN1_Type::UtcTime:
  ------------------
  |  Branch (124:7): [True: 1, False: 207]
  ------------------
  125|      1|         return "UTC TIME";
  126|       |
  127|      1|      case ASN1_Type::GeneralizedTime:
  ------------------
  |  Branch (127:7): [True: 1, False: 207]
  ------------------
  128|      1|         return "GENERALIZED TIME";
  129|       |
  130|      1|      case ASN1_Type::OctetString:
  ------------------
  |  Branch (130:7): [True: 1, False: 207]
  ------------------
  131|      1|         return "OCTET STRING";
  132|       |
  133|      2|      case ASN1_Type::BitString:
  ------------------
  |  Branch (133:7): [True: 2, False: 206]
  ------------------
  134|      2|         return "BIT STRING";
  135|       |
  136|      1|      case ASN1_Type::Enumerated:
  ------------------
  |  Branch (136:7): [True: 1, False: 207]
  ------------------
  137|      1|         return "ENUMERATED";
  138|       |
  139|      1|      case ASN1_Type::Integer:
  ------------------
  |  Branch (139:7): [True: 1, False: 207]
  ------------------
  140|      1|         return "INTEGER";
  141|       |
  142|      2|      case ASN1_Type::Null:
  ------------------
  |  Branch (142:7): [True: 2, False: 206]
  ------------------
  143|      2|         return "NULL";
  144|       |
  145|      3|      case ASN1_Type::ObjectId:
  ------------------
  |  Branch (145:7): [True: 3, False: 205]
  ------------------
  146|      3|         return "OBJECT";
  147|       |
  148|      1|      case ASN1_Type::Boolean:
  ------------------
  |  Branch (148:7): [True: 1, False: 207]
  ------------------
  149|      1|         return "BOOLEAN";
  150|       |
  151|      1|      case ASN1_Type::NoObject:
  ------------------
  |  Branch (151:7): [True: 1, False: 207]
  ------------------
  152|      1|         return "NO_OBJECT";
  153|       |
  154|     55|      default:
  ------------------
  |  Branch (154:7): [True: 55, False: 153]
  ------------------
  155|     55|         return "TAG(" + std::to_string(static_cast<uint32_t>(type)) + ")";
  156|    208|   }
  157|    208|}
_ZN5Botan18BER_Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  162|    277|BER_Decoding_Error::BER_Decoding_Error(std::string_view str) : Decoding_Error(fmt("BER: {}", str)) {}
_ZN5Botan11BER_Bad_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEj:
  164|     42|BER_Bad_Tag::BER_Bad_Tag(std::string_view str, uint32_t tagging) : BER_Decoding_Error(fmt("{}: {}", str, tagging)) {}
_ZN5Botan4ASN115put_in_sequenceERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  171|  23.1k|std::vector<uint8_t> put_in_sequence(const std::vector<uint8_t>& contents) {
  172|  23.1k|   return ASN1::put_in_sequence(contents.data(), contents.size());
  173|  23.1k|}
_ZN5Botan4ASN115put_in_sequenceEPKhm:
  175|  23.1k|std::vector<uint8_t> put_in_sequence(const uint8_t bits[], size_t len) {
  176|  23.1k|   std::vector<uint8_t> output;
  177|  23.1k|   DER_Encoder(output).start_sequence().raw_bytes(bits, len).end_cons();
  178|  23.1k|   return output;
  179|  23.1k|}
_ZN5Botan4ASN19to_stringERKNS_10BER_ObjectE:
  184|  69.3k|std::string to_string(const BER_Object& obj) { return std::string(cast_uint8_ptr_to_char(obj.bits()), obj.length()); }
_ZN5Botan4ASN19maybe_BERERNS_10DataSourceE:
  189|  17.3k|bool maybe_BER(DataSource& source) {
  190|  17.3k|   uint8_t first_u8;
  191|  17.3k|   if(!source.peek_byte(first_u8)) {
  ------------------
  |  Branch (191:7): [True: 0, False: 17.3k]
  ------------------
  192|      0|      BOTAN_ASSERT_EQUAL(source.read_byte(first_u8), 0, "Expected EOF");
  ------------------
  |  |   69|      0|   do {                                                                                                \
  |  |   70|      0|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   71|      0|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  193|      0|      throw Stream_IO_Error("ASN1::maybe_BER: Source was empty");
  194|      0|   }
  195|       |
  196|  17.3k|   const auto cons_seq = static_cast<uint8_t>(ASN1_Class::Constructed) | static_cast<uint8_t>(ASN1_Type::Sequence);
  197|  17.3k|   if(first_u8 == cons_seq) {
  ------------------
  |  Branch (197:7): [True: 5.77k, False: 11.5k]
  ------------------
  198|  5.77k|      return true;
  199|  5.77k|   }
  200|  11.5k|   return false;
  201|  17.3k|}

_ZN5Botan3OID11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   72|  57.4k|OID OID::from_string(std::string_view str) {
   73|  57.4k|   if(str.empty()) {
  ------------------
  |  Branch (73:7): [True: 0, False: 57.4k]
  ------------------
   74|      0|      throw Invalid_Argument("OID::from_string argument must be non-empty");
   75|      0|   }
   76|       |
   77|  57.4k|   OID o = OID_Map::global_registry().str2oid(str);
   78|  57.4k|   if(o.has_value()) {
  ------------------
  |  Branch (78:7): [True: 57.4k, False: 0]
  ------------------
   79|  57.4k|      return o;
   80|  57.4k|   }
   81|       |
   82|      0|   std::vector<uint32_t> raw = parse_oid_str(str);
   83|       |
   84|      0|   if(!raw.empty()) {
  ------------------
  |  Branch (84:7): [True: 0, False: 0]
  ------------------
   85|      0|      return OID(std::move(raw));
   86|      0|   }
   87|       |
   88|      0|   throw Lookup_Error(fmt("No OID associated with name '{}'", str));
   89|      0|}
_ZN5Botan3OIDC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   94|  63.5k|OID::OID(std::string_view oid_str) {
   95|  63.5k|   if(!oid_str.empty()) {
  ------------------
  |  Branch (95:7): [True: 63.5k, False: 0]
  ------------------
   96|  63.5k|      m_id = parse_oid_str(oid_str);
   97|  63.5k|      if(m_id.size() < 2 || m_id[0] > 2 || (m_id[0] < 2 && m_id[1] > 39)) {
  ------------------
  |  Branch (97:10): [True: 0, False: 63.5k]
  |  Branch (97:29): [True: 0, False: 63.5k]
  |  Branch (97:45): [True: 5.77k, False: 57.7k]
  |  Branch (97:60): [True: 0, False: 5.77k]
  ------------------
   98|      0|         throw Decoding_Error(fmt("Invalid OID '{}'", oid_str));
   99|      0|      }
  100|  63.5k|   }
  101|  63.5k|}
_ZNK5Botan3OID9to_stringEv:
  106|  23.1k|std::string OID::to_string() const {
  107|  23.1k|   std::ostringstream out;
  108|  23.1k|   out << (*this);
  109|  23.1k|   return out.str();
  110|  23.1k|}
_ZNK5Botan3OID19to_formatted_stringEv:
  112|  17.3k|std::string OID::to_formatted_string() const {
  113|  17.3k|   std::string s = this->human_name_or_empty();
  114|  17.3k|   if(!s.empty()) {
  ------------------
  |  Branch (114:7): [True: 17.3k, False: 0]
  ------------------
  115|  17.3k|      return s;
  116|  17.3k|   }
  117|      0|   return this->to_string();
  118|  17.3k|}
_ZNK5Botan3OID19human_name_or_emptyEv:
  120|  23.1k|std::string OID::human_name_or_empty() const { return OID_Map::global_registry().oid2str(*this); }
_ZN5BotanltERKNS_3OIDES2_:
  127|  80.9k|bool operator<(const OID& a, const OID& b) {
  128|  80.9k|   const std::vector<uint32_t>& oid1 = a.get_components();
  129|  80.9k|   const std::vector<uint32_t>& oid2 = b.get_components();
  130|       |
  131|  80.9k|   return std::lexicographical_compare(oid1.begin(), oid1.end(), oid2.begin(), oid2.end());
  132|  80.9k|}
_ZN5BotanlsERNSt3__113basic_ostreamIcNS0_11char_traitsIcEEEERKNS_3OIDE:
  134|  23.1k|std::ostream& operator<<(std::ostream& out, const OID& oid) {
  135|  23.1k|   const auto& val = oid.get_components();
  136|       |
  137|   184k|   for(size_t i = 0; i != val.size(); ++i) {
  ------------------
  |  Branch (137:22): [True: 161k, False: 23.1k]
  ------------------
  138|       |      // avoid locale issues with integer formatting
  139|   161k|      out << std::to_string(val[i]);
  140|   161k|      if(i != val.size() - 1) {
  ------------------
  |  Branch (140:10): [True: 138k, False: 23.1k]
  ------------------
  141|   138k|         out << ".";
  142|   138k|      }
  143|   161k|   }
  144|       |
  145|  23.1k|   return out;
  146|  23.1k|}
_ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE:
  151|  23.4k|void OID::encode_into(DER_Encoder& der) const {
  152|  23.4k|   if(m_id.size() < 2) {
  ------------------
  |  Branch (152:7): [True: 0, False: 23.4k]
  ------------------
  153|      0|      throw Invalid_Argument("OID::encode_into: OID is invalid");
  154|      0|   }
  155|       |
  156|  23.4k|   std::vector<uint8_t> encoding;
  157|       |
  158|  23.4k|   if(m_id[0] > 2 || m_id[1] >= 40) {
  ------------------
  |  Branch (158:7): [True: 0, False: 23.4k]
  |  Branch (158:22): [True: 0, False: 23.4k]
  ------------------
  159|      0|      throw Encoding_Error("Invalid OID prefix, cannot encode");
  160|      0|   }
  161|       |
  162|  23.4k|   encoding.push_back(static_cast<uint8_t>(40 * m_id[0] + m_id[1]));
  163|       |
  164|   164k|   for(size_t i = 2; i != m_id.size(); ++i) {
  ------------------
  |  Branch (164:22): [True: 140k, False: 23.4k]
  ------------------
  165|   140k|      if(m_id[i] == 0) {
  ------------------
  |  Branch (165:10): [True: 0, False: 140k]
  ------------------
  166|      0|         encoding.push_back(0);
  167|   140k|      } else {
  168|   140k|         size_t blocks = high_bit(m_id[i]) + 6;
  169|   140k|         blocks = (blocks - (blocks % 7)) / 7;
  170|       |
  171|   140k|         BOTAN_ASSERT(blocks > 0, "Math works");
  ------------------
  |  |   51|   140k|   do {                                                                                 \
  |  |   52|   140k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 140k]
  |  |  ------------------
  |  |   53|   140k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   140k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  172|       |
  173|   187k|         for(size_t j = 0; j != blocks - 1; ++j) {
  ------------------
  |  Branch (173:28): [True: 47.0k, False: 140k]
  ------------------
  174|  47.0k|            encoding.push_back(0x80 | ((m_id[i] >> 7 * (blocks - j - 1)) & 0x7F));
  175|  47.0k|         }
  176|   140k|         encoding.push_back(m_id[i] & 0x7F);
  177|   140k|      }
  178|   140k|   }
  179|  23.4k|   der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding);
  180|  23.4k|}
_ZN5Botan3OID11decode_fromERNS_11BER_DecoderE:
  185|  86.9k|void OID::decode_from(BER_Decoder& decoder) {
  186|  86.9k|   BER_Object obj = decoder.get_next_object();
  187|  86.9k|   if(obj.tagging() != (ASN1_Class::Universal | ASN1_Type::ObjectId)) {
  ------------------
  |  Branch (187:7): [True: 42, False: 86.9k]
  ------------------
  188|     42|      throw BER_Bad_Tag("Error decoding OID, unknown tag", obj.tagging());
  189|     42|   }
  190|       |
  191|  86.9k|   const size_t length = obj.length();
  192|  86.9k|   const uint8_t* bits = obj.bits();
  193|       |
  194|  86.9k|   if(length < 2 && !(length == 1 && bits[0] == 0)) {
  ------------------
  |  Branch (194:7): [True: 21, False: 86.8k]
  |  Branch (194:23): [True: 20, False: 1]
  |  Branch (194:38): [True: 15, False: 5]
  ------------------
  195|      6|      throw BER_Decoding_Error("OID encoding is too short");
  196|      6|   }
  197|       |
  198|  86.9k|   m_id.clear();
  199|  86.9k|   m_id.push_back(bits[0] / 40);
  200|  86.9k|   m_id.push_back(bits[0] % 40);
  201|       |
  202|  86.9k|   size_t i = 0;
  203|   347k|   while(i != length - 1) {
  ------------------
  |  Branch (203:10): [True: 260k, False: 86.8k]
  ------------------
  204|   260k|      uint32_t component = 0;
  205|   347k|      while(i != length - 1) {
  ------------------
  |  Branch (205:13): [True: 347k, False: 85]
  ------------------
  206|   347k|         ++i;
  207|       |
  208|   347k|         if(component >> (32 - 7)) {
  ------------------
  |  Branch (208:13): [True: 11, False: 347k]
  ------------------
  209|     11|            throw Decoding_Error("OID component overflow");
  210|     11|         }
  211|       |
  212|   347k|         component = (component << 7) + (bits[i] & 0x7F);
  213|       |
  214|   347k|         if(!(bits[i] & 0x80)) {
  ------------------
  |  Branch (214:13): [True: 260k, False: 86.8k]
  ------------------
  215|   260k|            break;
  216|   260k|         }
  217|   347k|      }
  218|   260k|      m_id.push_back(component);
  219|   260k|   }
  220|  86.9k|}
asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_113parse_oid_strENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   24|  63.5k|std::vector<uint32_t> parse_oid_str(std::string_view oid) {
   25|  63.5k|   try {
   26|  63.5k|      std::string elem;
   27|  63.5k|      std::vector<uint32_t> oid_elems;
   28|       |
   29|   618k|      for(char c : oid) {
  ------------------
  |  Branch (29:18): [True: 618k, False: 63.5k]
  ------------------
   30|   618k|         if(c == '.') {
  ------------------
  |  Branch (30:13): [True: 219k, False: 398k]
  ------------------
   31|   219k|            if(elem.empty()) {
  ------------------
  |  Branch (31:16): [True: 0, False: 219k]
  ------------------
   32|      0|               return std::vector<uint32_t>();
   33|      0|            }
   34|   219k|            oid_elems.push_back(to_u32bit(elem));
   35|   219k|            elem.clear();
   36|   398k|         } else {
   37|   398k|            elem += c;
   38|   398k|         }
   39|   618k|      }
   40|       |
   41|  63.5k|      if(!elem.empty()) {
  ------------------
  |  Branch (41:10): [True: 63.5k, False: 0]
  ------------------
   42|  63.5k|         oid_elems.push_back(to_u32bit(elem));
   43|  63.5k|      }
   44|       |
   45|  63.5k|      return oid_elems;
   46|  63.5k|   } catch(Invalid_Argument&)  // thrown by to_u32bit
   47|  63.5k|   {
   48|      0|      return std::vector<uint32_t>();
   49|      0|   }
   50|  63.5k|}

_ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE:
   62|  58.1k|ASN1_String::ASN1_String(std::string_view str, ASN1_Type t) : m_utf8_str(str), m_tag(t) {
   63|  58.1k|   if(!is_utf8_subset_string_type(m_tag)) {
  ------------------
  |  Branch (63:7): [True: 0, False: 58.1k]
  ------------------
   64|      0|      throw Invalid_Argument("ASN1_String only supports encoding to UTF-8 or a UTF-8 subset");
   65|      0|   }
   66|  58.1k|}
_ZN5Botan11ASN1_StringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   68|  58.1k|ASN1_String::ASN1_String(std::string_view str) : ASN1_String(str, choose_encoding(str)) {}
_ZN5Botan11ASN1_String11decode_fromERNS_11BER_DecoderE:
   86|  58.0k|void ASN1_String::decode_from(BER_Decoder& source) {
   87|  58.0k|   BER_Object obj = source.get_next_object();
   88|       |
   89|  58.0k|   if(!is_asn1_string_type(obj.type())) {
  ------------------
  |  Branch (89:7): [True: 42, False: 57.9k]
  ------------------
   90|     42|      auto typ = static_cast<uint32_t>(obj.type());
   91|     42|      throw Decoding_Error(fmt("ASN1_String: Unknown string type {}", typ));
   92|     42|   }
   93|       |
   94|  57.9k|   m_tag = obj.type();
   95|  57.9k|   m_data.assign(obj.bits(), obj.bits() + obj.length());
   96|       |
   97|  57.9k|   if(m_tag == ASN1_Type::BmpString) {
  ------------------
  |  Branch (97:7): [True: 42, False: 57.9k]
  ------------------
   98|     42|      m_utf8_str = ucs2_to_utf8(m_data.data(), m_data.size());
   99|  57.9k|   } else if(m_tag == ASN1_Type::UniversalString) {
  ------------------
  |  Branch (99:14): [True: 67, False: 57.8k]
  ------------------
  100|     67|      m_utf8_str = ucs4_to_utf8(m_data.data(), m_data.size());
  101|  57.8k|   } else if(m_tag == ASN1_Type::TeletexString) {
  ------------------
  |  Branch (101:14): [True: 24, False: 57.8k]
  ------------------
  102|       |      /*
  103|       |      TeletexString is nominally ITU T.61 not ISO-8859-1 but it seems
  104|       |      the majority of implementations actually used that charset here.
  105|       |      */
  106|     24|      m_utf8_str = latin1_to_utf8(m_data.data(), m_data.size());
  107|  57.8k|   } else {
  108|       |      // All other supported string types are UTF-8 or some subset thereof
  109|  57.8k|      m_utf8_str = ASN1::to_string(obj);
  110|  57.8k|   }
  111|  57.9k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_119is_asn1_string_typeENS_9ASN1_TypeE:
   52|  57.9k|bool is_asn1_string_type(ASN1_Type tag) {
   53|  57.9k|   return (is_utf8_subset_string_type(tag) || tag == ASN1_Type::TeletexString || tag == ASN1_Type::BmpString ||
  ------------------
  |  Branch (53:12): [True: 57.8k, False: 175]
  |  Branch (53:47): [True: 24, False: 151]
  |  Branch (53:82): [True: 42, False: 109]
  ------------------
   54|  57.9k|           tag == ASN1_Type::UniversalString);
  ------------------
  |  Branch (54:12): [True: 67, False: 42]
  ------------------
   55|  57.9k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_126is_utf8_subset_string_typeENS_9ASN1_TypeE:
   47|   116k|bool is_utf8_subset_string_type(ASN1_Type tag) {
   48|   116k|   return (tag == ASN1_Type::NumericString || tag == ASN1_Type::PrintableString || tag == ASN1_Type::VisibleString ||
  ------------------
  |  Branch (48:12): [True: 10, False: 116k]
  |  Branch (48:47): [True: 69.6k, False: 46.4k]
  |  Branch (48:84): [True: 8, False: 46.4k]
  ------------------
   49|   116k|           tag == ASN1_Type::Ia5String || tag == ASN1_Type::Utf8String);
  ------------------
  |  Branch (49:12): [True: 6, False: 46.4k]
  |  Branch (49:43): [True: 46.2k, False: 175]
  ------------------
   50|   116k|}
asn1_str.cpp:_ZN5Botan12_GLOBAL__N_115choose_encodingENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   23|  58.1k|ASN1_Type choose_encoding(std::string_view str) {
   24|  58.1k|   auto all_printable = CT::Mask<uint8_t>::set();
   25|       |
   26|  58.1k|   for(size_t i = 0; i != str.size(); ++i) {
  ------------------
  |  Branch (26:22): [True: 0, False: 58.1k]
  ------------------
   27|      0|      const uint8_t c = static_cast<uint8_t>(str[i]);
   28|       |
   29|      0|      auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, 'a', 'z');
   30|      0|      auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, 'A', 'Z');
   31|      0|      auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, '0', '9');
   32|       |
   33|      0|      auto is_print_punc = CT::Mask<uint8_t>::is_any_of(c, {' ', '(', ')', '+', ',', '-', '.', '/', ':', '=', '?'});
   34|       |
   35|      0|      auto is_printable = is_alpha_lower | is_alpha_upper | is_decimal | is_print_punc;
   36|       |
   37|      0|      all_printable &= is_printable;
   38|      0|   }
   39|       |
   40|  58.1k|   if(all_printable.is_set()) {
  ------------------
  |  Branch (40:7): [True: 58.1k, False: 0]
  ------------------
   41|  58.1k|      return ASN1_Type::PrintableString;
   42|  58.1k|   } else {
   43|      0|      return ASN1_Type::Utf8String;
   44|      0|   }
   45|  58.1k|}

_ZN5Botan9ASN1_Time11decode_fromERNS_11BER_DecoderE:
   51|  11.5k|void ASN1_Time::decode_from(BER_Decoder& source) {
   52|  11.5k|   BER_Object ber_time = source.get_next_object();
   53|       |
   54|  11.5k|   set_to(ASN1::to_string(ber_time), ber_time.type());
   55|  11.5k|}
_ZN5Botan9ASN1_Time6set_toENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_9ASN1_TypeE:
  153|  11.5k|void ASN1_Time::set_to(std::string_view t_spec, ASN1_Type spec_tag) {
  154|  11.5k|   BOTAN_ARG_CHECK(spec_tag == ASN1_Type::UtcTime || spec_tag == ASN1_Type::GeneralizedTime,
  ------------------
  |  |   30|  11.5k|   do {                                                          \
  |  |   31|  11.5k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 11.5k, False: 0]
  |  |  |  Branch (31:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|  11.5k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  11.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  155|  11.5k|                   "Invalid tag for ASN1_Time");
  156|       |
  157|  11.5k|   if(spec_tag == ASN1_Type::GeneralizedTime) {
  ------------------
  |  Branch (157:7): [True: 0, False: 11.5k]
  ------------------
  158|      0|      BOTAN_ARG_CHECK(t_spec.size() == 15, "Invalid GeneralizedTime input string");
  ------------------
  |  |   30|      0|   do {                                                          \
  |  |   31|      0|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  159|  11.5k|   } else if(spec_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (159:14): [True: 11.5k, False: 0]
  ------------------
  160|  11.5k|      BOTAN_ARG_CHECK(t_spec.size() == 13, "Invalid UTCTime input string");
  ------------------
  |  |   30|  11.5k|   do {                                                          \
  |  |   31|  11.5k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 11.5k]
  |  |  ------------------
  |  |   32|  11.5k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  11.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  161|  11.5k|   }
  162|       |
  163|  11.5k|   BOTAN_ARG_CHECK(t_spec.back() == 'Z', "Botan does not support ASN1 times with timezones other than Z");
  ------------------
  |  |   30|  11.5k|   do {                                                          \
  |  |   31|  11.5k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 11.5k]
  |  |  ------------------
  |  |   32|  11.5k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  11.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  164|       |
  165|  11.5k|   const size_t field_len = 2;
  166|       |
  167|  11.5k|   const size_t year_start = 0;
  168|  11.5k|   const size_t year_len = (spec_tag == ASN1_Type::UtcTime) ? 2 : 4;
  ------------------
  |  Branch (168:28): [True: 11.5k, False: 0]
  ------------------
  169|  11.5k|   const size_t month_start = year_start + year_len;
  170|  11.5k|   const size_t day_start = month_start + field_len;
  171|  11.5k|   const size_t hour_start = day_start + field_len;
  172|  11.5k|   const size_t min_start = hour_start + field_len;
  173|  11.5k|   const size_t sec_start = min_start + field_len;
  174|       |
  175|  11.5k|   m_year = to_u32bit(t_spec.substr(year_start, year_len));
  176|  11.5k|   m_month = to_u32bit(t_spec.substr(month_start, field_len));
  177|  11.5k|   m_day = to_u32bit(t_spec.substr(day_start, field_len));
  178|  11.5k|   m_hour = to_u32bit(t_spec.substr(hour_start, field_len));
  179|  11.5k|   m_minute = to_u32bit(t_spec.substr(min_start, field_len));
  180|  11.5k|   m_second = to_u32bit(t_spec.substr(sec_start, field_len));
  181|  11.5k|   m_tag = spec_tag;
  182|       |
  183|  11.5k|   if(spec_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (183:7): [True: 11.5k, False: 0]
  ------------------
  184|  11.5k|      if(m_year >= 50) {
  ------------------
  |  Branch (184:10): [True: 0, False: 11.5k]
  ------------------
  185|      0|         m_year += 1900;
  186|  11.5k|      } else {
  187|  11.5k|         m_year += 2000;
  188|  11.5k|      }
  189|  11.5k|   }
  190|       |
  191|  11.5k|   if(!passes_sanity_check()) {
  ------------------
  |  Branch (191:7): [True: 0, False: 11.5k]
  ------------------
  192|      0|      throw Invalid_Argument(fmt("ASN1_Time string '{}' does not seem to be valid", t_spec));
  193|      0|   }
  194|  11.5k|}
_ZNK5Botan9ASN1_Time19passes_sanity_checkEv:
  199|  11.5k|bool ASN1_Time::passes_sanity_check() const {
  200|       |   // AppVeyor's trust store includes a cert with expiration date in 3016 ...
  201|  11.5k|   if(m_year < 1950 || m_year > 3100) {
  ------------------
  |  Branch (201:7): [True: 0, False: 11.5k]
  |  Branch (201:24): [True: 0, False: 11.5k]
  ------------------
  202|      0|      return false;
  203|      0|   }
  204|  11.5k|   if(m_month == 0 || m_month > 12) {
  ------------------
  |  Branch (204:7): [True: 0, False: 11.5k]
  |  Branch (204:23): [True: 0, False: 11.5k]
  ------------------
  205|      0|      return false;
  206|      0|   }
  207|       |
  208|  11.5k|   const uint32_t days_in_month[12] = {31, 28 + 1, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
  209|       |
  210|  11.5k|   if(m_day == 0 || m_day > days_in_month[m_month - 1]) {
  ------------------
  |  Branch (210:7): [True: 0, False: 11.5k]
  |  Branch (210:21): [True: 0, False: 11.5k]
  ------------------
  211|      0|      return false;
  212|      0|   }
  213|       |
  214|  11.5k|   if(m_month == 2 && m_day == 29) {
  ------------------
  |  Branch (214:7): [True: 0, False: 11.5k]
  |  Branch (214:23): [True: 0, False: 0]
  ------------------
  215|      0|      if(m_year % 4 != 0) {
  ------------------
  |  Branch (215:10): [True: 0, False: 0]
  ------------------
  216|      0|         return false;  // not a leap year
  217|      0|      }
  218|       |
  219|      0|      if(m_year % 100 == 0 && m_year % 400 != 0) {
  ------------------
  |  Branch (219:10): [True: 0, False: 0]
  |  Branch (219:31): [True: 0, False: 0]
  ------------------
  220|      0|         return false;
  221|      0|      }
  222|      0|   }
  223|       |
  224|  11.5k|   if(m_hour >= 24 || m_minute >= 60 || m_second > 60) {
  ------------------
  |  Branch (224:7): [True: 0, False: 11.5k]
  |  Branch (224:23): [True: 0, False: 11.5k]
  |  Branch (224:41): [True: 0, False: 11.5k]
  ------------------
  225|      0|      return false;
  226|      0|   }
  227|       |
  228|  11.5k|   if(m_tag == ASN1_Type::UtcTime) {
  ------------------
  |  Branch (228:7): [True: 11.5k, False: 0]
  ------------------
  229|       |      /*
  230|       |      UTCTime limits the value of components such that leap seconds
  231|       |      are not covered. See "UNIVERSAL 23" in "Information technology
  232|       |      Abstract Syntax Notation One (ASN.1): Specification of basic notation"
  233|       |
  234|       |      http://www.itu.int/ITU-T/studygroups/com17/languages/
  235|       |      */
  236|  11.5k|      if(m_second > 59) {
  ------------------
  |  Branch (236:10): [True: 0, False: 11.5k]
  ------------------
  237|      0|         return false;
  238|      0|      }
  239|  11.5k|   }
  240|       |
  241|  11.5k|   return true;
  242|  11.5k|}

_ZNK5Botan11BER_Decoder10more_itemsEv:
  195|   185k|bool BER_Decoder::more_items() const {
  196|   185k|   if(m_source->end_of_data() && !m_pushed.is_set()) {
  ------------------
  |  Branch (196:7): [True: 69.4k, False: 116k]
  |  Branch (196:34): [True: 69.4k, False: 0]
  ------------------
  197|  69.4k|      return false;
  198|  69.4k|   }
  199|   116k|   return true;
  200|   185k|}
_ZN5Botan11BER_Decoder10verify_endENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  210|  5.77k|BER_Decoder& BER_Decoder::verify_end(std::string_view err) {
  211|  5.77k|   if(!m_source->end_of_data() || m_pushed.is_set()) {
  ------------------
  |  Branch (211:7): [True: 0, False: 5.77k]
  |  Branch (211:35): [True: 0, False: 5.77k]
  ------------------
  212|      0|      throw Decoding_Error(err);
  213|      0|   }
  214|  5.77k|   return (*this);
  215|  5.77k|}
_ZN5Botan11BER_Decoder17discard_remainingEv:
  220|  5.77k|BER_Decoder& BER_Decoder::discard_remaining() {
  221|  5.77k|   uint8_t buf;
  222|  5.77k|   while(m_source->read_byte(buf)) {}
  ------------------
  |  Branch (222:10): [True: 0, False: 5.77k]
  ------------------
  223|  5.77k|   return (*this);
  224|  5.77k|}
_ZN5Botan11BER_Decoder15get_next_objectEv:
  229|   481k|BER_Object BER_Decoder::get_next_object() {
  230|   481k|   BER_Object next;
  231|       |
  232|   481k|   if(m_pushed.is_set()) {
  ------------------
  |  Branch (232:7): [True: 5.77k, False: 475k]
  ------------------
  233|  5.77k|      std::swap(next, m_pushed);
  234|  5.77k|      return next;
  235|  5.77k|   }
  236|       |
  237|   475k|   for(;;) {
  238|   475k|      ASN1_Type type_tag;
  239|   475k|      ASN1_Class class_tag;
  240|   475k|      decode_tag(m_source, type_tag, class_tag);
  241|   475k|      next.set_tagging(type_tag, class_tag);
  242|   475k|      if(next.is_set() == false) {  // no more objects
  ------------------
  |  Branch (242:10): [True: 17.3k, False: 458k]
  ------------------
  243|  17.3k|         return next;
  244|  17.3k|      }
  245|       |
  246|   458k|      size_t field_size;
  247|   458k|      const size_t length = decode_length(m_source, field_size, ALLOWED_EOC_NESTINGS);
  248|   458k|      if(!m_source->check_available(length)) {
  ------------------
  |  Branch (248:10): [True: 63, False: 458k]
  ------------------
  249|     63|         throw BER_Decoding_Error("Value truncated");
  250|     63|      }
  251|       |
  252|   458k|      uint8_t* out = next.mutable_bits(length);
  253|   458k|      if(m_source->read(out, length) != length) {
  ------------------
  |  Branch (253:10): [True: 0, False: 458k]
  ------------------
  254|      0|         throw BER_Decoding_Error("Value truncated");
  255|      0|      }
  256|       |
  257|   458k|      if(next.tagging() == static_cast<uint32_t>(ASN1_Type::Eoc)) {
  ------------------
  |  Branch (257:10): [True: 461, False: 458k]
  ------------------
  258|    461|         continue;
  259|   458k|      } else {
  260|   458k|         break;
  261|   458k|      }
  262|   458k|   }
  263|       |
  264|   458k|   return next;
  265|   475k|}
_ZN5Botan11BER_Decoder9push_backEONS_10BER_ObjectE:
  277|  17.3k|void BER_Decoder::push_back(BER_Object&& obj) {
  278|  17.3k|   if(m_pushed.is_set()) {
  ------------------
  |  Branch (278:7): [True: 0, False: 17.3k]
  ------------------
  279|      0|      throw Invalid_State("BER_Decoder: Only one push back is allowed");
  280|      0|   }
  281|  17.3k|   m_pushed = std::move(obj);
  282|  17.3k|}
_ZN5Botan11BER_Decoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE:
  284|   197k|BER_Decoder BER_Decoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) {
  285|   197k|   BER_Object obj = get_next_object();
  286|   197k|   obj.assert_is_a(type_tag, class_tag | ASN1_Class::Constructed);
  287|   197k|   return BER_Decoder(std::move(obj), this);
  288|   197k|}
_ZN5Botan11BER_Decoder8end_consEv:
  293|   139k|BER_Decoder& BER_Decoder::end_cons() {
  294|   139k|   if(!m_parent) {
  ------------------
  |  Branch (294:7): [True: 0, False: 139k]
  ------------------
  295|      0|      throw Invalid_State("BER_Decoder::end_cons called with null parent");
  296|      0|   }
  297|   139k|   if(!m_source->end_of_data()) {
  ------------------
  |  Branch (297:7): [True: 14, False: 139k]
  ------------------
  298|     14|      throw Decoding_Error("BER_Decoder::end_cons called with data left");
  299|     14|   }
  300|   139k|   return (*m_parent);
  301|   139k|}
_ZN5Botan11BER_DecoderC2EONS_10BER_ObjectEPS0_:
  303|   197k|BER_Decoder::BER_Decoder(BER_Object&& obj, BER_Decoder* parent) {
  304|   197k|   m_data_src = std::make_unique<DataSource_BERObject>(std::move(obj));
  305|   197k|   m_source = m_data_src.get();
  306|   197k|   m_parent = parent;
  307|   197k|}
_ZN5Botan11BER_DecoderC2ERNS_10DataSourceE:
  312|  11.5k|BER_Decoder::BER_Decoder(DataSource& src) { m_source = &src; }
_ZN5Botan11BER_DecoderC2EPKhm:
  317|  11.9k|BER_Decoder::BER_Decoder(const uint8_t data[], size_t length) {
  318|  11.9k|   m_data_src = std::make_unique<DataSource_Memory>(data, length);
  319|  11.9k|   m_source = m_data_src.get();
  320|  11.9k|}
_ZN5Botan11BER_DecoderC2ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  325|  5.77k|BER_Decoder::BER_Decoder(const secure_vector<uint8_t>& data) {
  326|  5.77k|   m_data_src = std::make_unique<DataSource_Memory>(data);
  327|  5.77k|   m_source = m_data_src.get();
  328|  5.77k|}
_ZN5Botan11BER_DecoderC2ERKNSt3__16vectorIhNS1_9allocatorIhEEEE:
  333|  23.4k|BER_Decoder::BER_Decoder(const std::vector<uint8_t>& data) {
  334|  23.4k|   m_data_src = std::make_unique<DataSource_Memory>(data.data(), data.size());
  335|  23.4k|   m_source = m_data_src.get();
  336|  23.4k|}
_ZN5Botan11BER_Decoder6decodeERNS_11ASN1_ObjectENS_9ASN1_TypeENS_10ASN1_ClassE:
  352|   197k|BER_Decoder& BER_Decoder::decode(ASN1_Object& obj, ASN1_Type /*unused*/, ASN1_Class /*unused*/) {
  353|   197k|   obj.decode_from(*this);
  354|   197k|   return (*this);
  355|   197k|}
_ZN5Botan11BER_Decoder6decodeERmNS_9ASN1_TypeENS_10ASN1_ClassE:
  394|  11.5k|BER_Decoder& BER_Decoder::decode(size_t& out, ASN1_Type type_tag, ASN1_Class class_tag) {
  395|  11.5k|   BigInt integer;
  396|  11.5k|   decode(integer, type_tag, class_tag);
  397|       |
  398|  11.5k|   if(integer.is_negative()) {
  ------------------
  |  Branch (398:7): [True: 0, False: 11.5k]
  ------------------
  399|      0|      throw BER_Decoding_Error("Decoded small integer value was negative");
  400|      0|   }
  401|       |
  402|  11.5k|   if(integer.bits() > 32) {
  ------------------
  |  Branch (402:7): [True: 0, False: 11.5k]
  ------------------
  403|      0|      throw BER_Decoding_Error("Decoded integer value larger than expected");
  404|      0|   }
  405|       |
  406|  11.5k|   out = 0;
  407|  57.7k|   for(size_t i = 0; i != 4; ++i) {
  ------------------
  |  Branch (407:22): [True: 46.2k, False: 11.5k]
  ------------------
  408|  46.2k|      out = (out << 8) | integer.byte_at(3 - i);
  409|  46.2k|   }
  410|       |
  411|  11.5k|   return (*this);
  412|  11.5k|}
_ZN5Botan11BER_Decoder6decodeERNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE:
  440|  75.1k|BER_Decoder& BER_Decoder::decode(BigInt& out, ASN1_Type type_tag, ASN1_Class class_tag) {
  441|  75.1k|   BER_Object obj = get_next_object();
  442|  75.1k|   obj.assert_is_a(type_tag, class_tag);
  443|       |
  444|  75.1k|   if(obj.length() == 0) {
  ------------------
  |  Branch (444:7): [True: 0, False: 75.1k]
  ------------------
  445|      0|      out.clear();
  446|  75.1k|   } else {
  447|  75.1k|      const bool negative = (obj.bits()[0] & 0x80) ? true : false;
  ------------------
  |  Branch (447:29): [True: 0, False: 75.1k]
  ------------------
  448|       |
  449|  75.1k|      if(negative) {
  ------------------
  |  Branch (449:10): [True: 0, False: 75.1k]
  ------------------
  450|      0|         secure_vector<uint8_t> vec(obj.bits(), obj.bits() + obj.length());
  451|      0|         for(size_t i = obj.length(); i > 0; --i) {
  ------------------
  |  Branch (451:39): [True: 0, False: 0]
  ------------------
  452|      0|            if(vec[i - 1]--) {
  ------------------
  |  Branch (452:16): [True: 0, False: 0]
  ------------------
  453|      0|               break;
  454|      0|            }
  455|      0|         }
  456|      0|         for(size_t i = 0; i != obj.length(); ++i) {
  ------------------
  |  Branch (456:28): [True: 0, False: 0]
  ------------------
  457|      0|            vec[i] = ~vec[i];
  458|      0|         }
  459|      0|         out = BigInt(vec.data(), vec.size());
  460|      0|         out.flip_sign();
  461|  75.1k|      } else {
  462|  75.1k|         out = BigInt(obj.bits(), obj.length());
  463|  75.1k|      }
  464|  75.1k|   }
  465|       |
  466|  75.1k|   return (*this);
  467|  75.1k|}
_ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE:
  505|  5.77k|                                 ASN1_Class class_tag) {
  506|  5.77k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (506:7): [True: 0, False: 5.77k]
  |  Branch (506:46): [True: 0, False: 0]
  ------------------
  507|      0|      throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast<uint32_t>(real_type));
  508|      0|   }
  509|       |
  510|  5.77k|   asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag);
  511|  5.77k|   return (*this);
  512|  5.77k|}
_ZN5Botan11BER_Decoder6decodeERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeES7_NS_10ASN1_ClassE:
  517|  17.3k|                                 ASN1_Class class_tag) {
  518|  17.3k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (518:7): [True: 17.3k, False: 0]
  |  Branch (518:46): [True: 0, False: 17.3k]
  ------------------
  519|      0|      throw BER_Bad_Tag("Bad tag for {BIT,OCTET} STRING", static_cast<uint32_t>(real_type));
  520|      0|   }
  521|       |
  522|  17.3k|   asn1_decode_binary_string(buffer, get_next_object(), real_type, type_tag, class_tag);
  523|  17.3k|   return (*this);
  524|  17.3k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_110decode_tagEPNS_10DataSourceERNS_9ASN1_TypeERNS_10ASN1_ClassE:
   29|   478k|size_t decode_tag(DataSource* ber, ASN1_Type& type_tag, ASN1_Class& class_tag) {
   30|   478k|   uint8_t b;
   31|   478k|   if(!ber->read_byte(b)) {
  ------------------
  |  Branch (31:7): [True: 17.8k, False: 460k]
  ------------------
   32|  17.8k|      type_tag = ASN1_Type::NoObject;
   33|  17.8k|      class_tag = ASN1_Class::NoObject;
   34|  17.8k|      return 0;
   35|  17.8k|   }
   36|       |
   37|   460k|   if((b & 0x1F) != 0x1F) {
  ------------------
  |  Branch (37:7): [True: 459k, False: 301]
  ------------------
   38|   459k|      type_tag = ASN1_Type(b & 0x1F);
   39|   459k|      class_tag = ASN1_Class(b & 0xE0);
   40|   459k|      return 1;
   41|   459k|   }
   42|       |
   43|    301|   size_t tag_bytes = 1;
   44|    301|   class_tag = ASN1_Class(b & 0xE0);
   45|       |
   46|    301|   size_t tag_buf = 0;
   47|  1.71k|   while(true) {
  ------------------
  |  Branch (47:10): [Folded - Ignored]
  ------------------
   48|  1.71k|      if(!ber->read_byte(b)) {
  ------------------
  |  Branch (48:10): [True: 4, False: 1.70k]
  ------------------
   49|      4|         throw BER_Decoding_Error("Long-form tag truncated");
   50|      4|      }
   51|  1.70k|      if(tag_buf & 0xFF000000) {
  ------------------
  |  Branch (51:10): [True: 3, False: 1.70k]
  ------------------
   52|      3|         throw BER_Decoding_Error("Long-form tag overflowed 32 bits");
   53|      3|      }
   54|  1.70k|      ++tag_bytes;
   55|  1.70k|      tag_buf = (tag_buf << 7) | (b & 0x7F);
   56|  1.70k|      if((b & 0x80) == 0) {
  ------------------
  |  Branch (56:10): [True: 294, False: 1.41k]
  ------------------
   57|    294|         break;
   58|    294|      }
   59|  1.70k|   }
   60|    294|   type_tag = ASN1_Type(tag_buf);
   61|    294|   return tag_bytes;
   62|    301|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_113decode_lengthEPNS_10DataSourceERmm:
   72|   460k|size_t decode_length(DataSource* ber, size_t& field_size, size_t allow_indef) {
   73|   460k|   uint8_t b;
   74|   460k|   if(!ber->read_byte(b)) {
  ------------------
  |  Branch (74:7): [True: 9, False: 460k]
  ------------------
   75|      9|      throw BER_Decoding_Error("Length field not found");
   76|      9|   }
   77|   460k|   field_size = 1;
   78|   460k|   if((b & 0x80) == 0) {
  ------------------
  |  Branch (78:7): [True: 349k, False: 110k]
  ------------------
   79|   349k|      return b;
   80|   349k|   }
   81|       |
   82|   110k|   field_size += (b & 0x7F);
   83|   110k|   if(field_size > 5) {
  ------------------
  |  Branch (83:7): [True: 26, False: 110k]
  ------------------
   84|     26|      throw BER_Decoding_Error("Length field is too large");
   85|     26|   }
   86|       |
   87|   110k|   if(field_size == 1) {
  ------------------
  |  Branch (87:7): [True: 988, False: 109k]
  ------------------
   88|    988|      if(allow_indef == 0) {
  ------------------
  |  Branch (88:10): [True: 1, False: 987]
  ------------------
   89|      1|         throw BER_Decoding_Error("Nested EOC markers too deep, rejecting to avoid stack exhaustion");
   90|    987|      } else {
   91|    987|         return find_eoc(ber, allow_indef - 1);
   92|    987|      }
   93|    988|   }
   94|       |
   95|   109k|   size_t length = 0;
   96|       |
   97|   300k|   for(size_t i = 0; i != field_size - 1; ++i) {
  ------------------
  |  Branch (97:22): [True: 190k, False: 109k]
  ------------------
   98|   190k|      if(get_byte<0>(length) != 0) {
  ------------------
  |  Branch (98:10): [True: 0, False: 190k]
  ------------------
   99|      0|         throw BER_Decoding_Error("Field length overflow");
  100|      0|      }
  101|   190k|      if(!ber->read_byte(b)) {
  ------------------
  |  Branch (101:10): [True: 2, False: 190k]
  ------------------
  102|      2|         throw BER_Decoding_Error("Corrupted length field");
  103|      2|      }
  104|   190k|      length = (length << 8) | b;
  105|   190k|   }
  106|   109k|   return length;
  107|   109k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_18find_eocEPNS_10DataSourceEm:
  112|    987|size_t find_eoc(DataSource* ber, size_t allow_indef) {
  113|    987|   secure_vector<uint8_t> buffer(BOTAN_DEFAULT_BUFFER_SIZE), data;
  ------------------
  |  |  372|    987|#define BOTAN_DEFAULT_BUFFER_SIZE 4096
  ------------------
  114|       |
  115|  1.89k|   while(true) {
  ------------------
  |  Branch (115:10): [Folded - Ignored]
  ------------------
  116|  1.89k|      const size_t got = ber->peek(buffer.data(), buffer.size(), data.size());
  117|  1.89k|      if(got == 0) {
  ------------------
  |  Branch (117:10): [True: 987, False: 912]
  ------------------
  118|    987|         break;
  119|    987|      }
  120|       |
  121|    912|      data += std::make_pair(buffer.data(), got);
  122|    912|   }
  123|       |
  124|    987|   DataSource_Memory source(data);
  125|    987|   data.clear();
  126|       |
  127|    987|   size_t length = 0;
  128|  2.21k|   while(true) {
  ------------------
  |  Branch (128:10): [Folded - Ignored]
  ------------------
  129|  2.13k|      ASN1_Type type_tag;
  130|  2.13k|      ASN1_Class class_tag;
  131|  2.13k|      size_t tag_size = decode_tag(&source, type_tag, class_tag);
  132|  2.13k|      if(type_tag == ASN1_Type::NoObject) {
  ------------------
  |  Branch (132:10): [True: 520, False: 1.61k]
  ------------------
  133|    520|         break;
  134|    520|      }
  135|       |
  136|  1.61k|      size_t length_size = 0;
  137|  1.61k|      size_t item_size = decode_length(&source, length_size, allow_indef);
  138|  1.61k|      source.discard_next(item_size);
  139|       |
  140|  1.61k|      length = BOTAN_CHECKED_ADD(length, item_size);
  ------------------
  |  |   72|  1.61k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  141|  1.61k|      length = BOTAN_CHECKED_ADD(length, tag_size);
  ------------------
  |  |   72|  1.61k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  142|  1.61k|      length = BOTAN_CHECKED_ADD(length, length_size);
  ------------------
  |  |   72|  1.61k|#define BOTAN_CHECKED_ADD(x, y) checked_add(x, y, __FILE__, __LINE__)
  ------------------
  143|       |
  144|  1.61k|      if(type_tag == ASN1_Type::Eoc && class_tag == ASN1_Class::Universal) {
  ------------------
  |  Branch (144:10): [True: 763, False: 855]
  |  Branch (144:40): [True: 395, False: 368]
  ------------------
  145|    395|         break;
  146|    395|      }
  147|  1.61k|   }
  148|    987|   return length;
  149|    987|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObjectC2EONS_10BER_ObjectE:
  183|   197k|      explicit DataSource_BERObject(BER_Object&& obj) : m_obj(std::move(obj)), m_offset(0) {}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject4readEPhm:
  153|  5.71M|      size_t read(uint8_t out[], size_t length) override {
  154|  5.71M|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|  5.71M|   do {                                                                     \
  |  |   61|  5.71M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 5.71M]
  |  |  ------------------
  |  |   62|  5.71M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  5.71M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  155|  5.71M|         const size_t got = std::min<size_t>(m_obj.length() - m_offset, length);
  156|  5.71M|         copy_mem(out, m_obj.bits() + m_offset, got);
  157|  5.71M|         m_offset += got;
  158|  5.71M|         return got;
  159|  5.71M|      }
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_120DataSource_BERObject15check_availableEm:
  174|   324k|      bool check_available(size_t n) override {
  175|   324k|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|   324k|   do {                                                                     \
  |  |   61|   324k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 324k]
  |  |  ------------------
  |  |   62|   324k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   324k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  176|   324k|         return (n <= (m_obj.length() - m_offset));
  177|   324k|      }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject4peekEPhmm:
  161|    105|      size_t peek(uint8_t out[], size_t length, size_t peek_offset) const override {
  162|    105|         BOTAN_ASSERT_NOMSG(m_offset <= m_obj.length());
  ------------------
  |  |   60|    105|   do {                                                                     \
  |  |   61|    105|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 105]
  |  |  ------------------
  |  |   62|    105|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    105|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|    105|         const size_t bytes_left = m_obj.length() - m_offset;
  164|       |
  165|    105|         if(peek_offset >= bytes_left) {
  ------------------
  |  Branch (165:13): [True: 55, False: 50]
  ------------------
  166|     55|            return 0;
  167|     55|         }
  168|       |
  169|     50|         const size_t got = std::min(bytes_left - peek_offset, length);
  170|     50|         copy_mem(out, m_obj.bits() + m_offset + peek_offset, got);
  171|     50|         return got;
  172|    105|      }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject11end_of_dataEv:
  179|   255k|      bool end_of_data() const override { return get_bytes_read() == m_obj.length(); }
ber_dec.cpp:_ZNK5Botan12_GLOBAL__N_120DataSource_BERObject14get_bytes_readEv:
  181|   255k|      size_t get_bytes_read() const override { return m_offset; }
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINS_16secure_allocatorIhEEEEvRNSt3__16vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassE:
  476|  5.77k|                               ASN1_Class class_tag) {
  477|  5.77k|   obj.assert_is_a(type_tag, class_tag);
  478|       |
  479|  5.77k|   if(real_type == ASN1_Type::OctetString) {
  ------------------
  |  Branch (479:7): [True: 5.77k, False: 0]
  ------------------
  480|  5.77k|      buffer.assign(obj.bits(), obj.bits() + obj.length());
  481|  5.77k|   } else {
  482|      0|      if(obj.length() == 0) {
  ------------------
  |  Branch (482:10): [True: 0, False: 0]
  ------------------
  483|      0|         throw BER_Decoding_Error("Invalid BIT STRING");
  484|      0|      }
  485|      0|      if(obj.bits()[0] >= 8) {
  ------------------
  |  Branch (485:10): [True: 0, False: 0]
  ------------------
  486|      0|         throw BER_Decoding_Error("Bad number of unused bits in BIT STRING");
  487|      0|      }
  488|       |
  489|      0|      buffer.resize(obj.length() - 1);
  490|       |
  491|      0|      if(obj.length() > 1) {
  ------------------
  |  Branch (491:10): [True: 0, False: 0]
  ------------------
  492|      0|         copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1);
  493|      0|      }
  494|      0|   }
  495|  5.77k|}
ber_dec.cpp:_ZN5Botan12_GLOBAL__N_125asn1_decode_binary_stringINSt3__19allocatorIhEEEEvRNS2_6vectorIhT_EERKNS_10BER_ObjectENS_9ASN1_TypeESC_NS_10ASN1_ClassE:
  476|  17.3k|                               ASN1_Class class_tag) {
  477|  17.3k|   obj.assert_is_a(type_tag, class_tag);
  478|       |
  479|  17.3k|   if(real_type == ASN1_Type::OctetString) {
  ------------------
  |  Branch (479:7): [True: 0, False: 17.3k]
  ------------------
  480|      0|      buffer.assign(obj.bits(), obj.bits() + obj.length());
  481|  17.3k|   } else {
  482|  17.3k|      if(obj.length() == 0) {
  ------------------
  |  Branch (482:10): [True: 0, False: 17.3k]
  ------------------
  483|      0|         throw BER_Decoding_Error("Invalid BIT STRING");
  484|      0|      }
  485|  17.3k|      if(obj.bits()[0] >= 8) {
  ------------------
  |  Branch (485:10): [True: 0, False: 17.3k]
  ------------------
  486|      0|         throw BER_Decoding_Error("Bad number of unused bits in BIT STRING");
  487|      0|      }
  488|       |
  489|  17.3k|      buffer.resize(obj.length() - 1);
  490|       |
  491|  17.3k|      if(obj.length() > 1) {
  ------------------
  |  Branch (491:10): [True: 17.3k, False: 0]
  ------------------
  492|  17.3k|         copy_mem(buffer.data(), obj.bits() + 1, obj.length() - 1);
  493|  17.3k|      }
  494|  17.3k|   }
  495|  17.3k|}

_ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE:
   71|  40.7k|DER_Encoder::DER_Encoder(std::vector<uint8_t>& vec) {
   72|  40.7k|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };
   73|  40.7k|}
_ZN5Botan11DER_Encoder12DER_Sequence13push_contentsERS0_:
   78|  87.7k|void DER_Encoder::DER_Sequence::push_contents(DER_Encoder& der) {
   79|  87.7k|   const auto real_class_tag = m_class_tag | ASN1_Class::Constructed;
   80|       |
   81|  87.7k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (81:7): [True: 0, False: 87.7k]
  ------------------
   82|      0|      std::sort(m_set_contents.begin(), m_set_contents.end());
   83|      0|      for(const auto& set_elem : m_set_contents) {
  ------------------
  |  Branch (83:32): [True: 0, False: 0]
  ------------------
   84|      0|         m_contents += set_elem;
   85|      0|      }
   86|      0|      m_set_contents.clear();
   87|      0|   }
   88|       |
   89|  87.7k|   der.add_object(m_type_tag, real_class_tag, m_contents.data(), m_contents.size());
   90|  87.7k|   m_contents.clear();
   91|  87.7k|}
_ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhm:
   96|  52.5k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t data[], size_t length) {
   97|  52.5k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (97:7): [True: 0, False: 52.5k]
  ------------------
   98|      0|      m_set_contents.push_back(secure_vector<uint8_t>(data, data + length));
   99|  52.5k|   } else {
  100|  52.5k|      m_contents += std::make_pair(data, length);
  101|  52.5k|   }
  102|  52.5k|}
_ZN5Botan11DER_Encoder12DER_Sequence9add_bytesEPKhmS3_m:
  104|  88.0k|void DER_Encoder::DER_Sequence::add_bytes(const uint8_t hdr[], size_t hdr_len, const uint8_t val[], size_t val_len) {
  105|  88.0k|   if(m_type_tag == ASN1_Type::Set) {
  ------------------
  |  Branch (105:7): [True: 0, False: 88.0k]
  ------------------
  106|      0|      secure_vector<uint8_t> m;
  107|      0|      m.reserve(hdr_len + val_len);
  108|      0|      m += std::make_pair(hdr, hdr_len);
  109|      0|      m += std::make_pair(val, val_len);
  110|      0|      m_set_contents.push_back(std::move(m));
  111|  88.0k|   } else {
  112|  88.0k|      m_contents += std::make_pair(hdr, hdr_len);
  113|  88.0k|      m_contents += std::make_pair(val, val_len);
  114|  88.0k|   }
  115|  88.0k|}
_ZN5Botan11DER_Encoder12DER_SequenceC2ENS_9ASN1_TypeENS_10ASN1_ClassE:
  125|  87.7k|DER_Encoder::DER_Sequence::DER_Sequence(ASN1_Type t1, ASN1_Class t2) : m_type_tag(t1), m_class_tag(t2) {}
_ZN5Botan11DER_Encoder10start_consENS_9ASN1_TypeENS_10ASN1_ClassE:
  161|  87.7k|DER_Encoder& DER_Encoder::start_cons(ASN1_Type type_tag, ASN1_Class class_tag) {
  162|  87.7k|   m_subsequences.push_back(DER_Sequence(type_tag, class_tag));
  163|  87.7k|   return (*this);
  164|  87.7k|}
_ZN5Botan11DER_Encoder8end_consEv:
  169|  87.7k|DER_Encoder& DER_Encoder::end_cons() {
  170|  87.7k|   if(m_subsequences.empty()) {
  ------------------
  |  Branch (170:7): [True: 0, False: 87.7k]
  ------------------
  171|      0|      throw Invalid_State("DER_Encoder::end_cons: No such sequence");
  172|      0|   }
  173|       |
  174|  87.7k|   DER_Sequence last_seq = std::move(m_subsequences[m_subsequences.size() - 1]);
  175|  87.7k|   m_subsequences.pop_back();
  176|  87.7k|   last_seq.push_contents(*this);
  177|       |
  178|  87.7k|   return (*this);
  179|  87.7k|}
_ZN5Botan11DER_Encoder9raw_bytesEPKhm:
  203|  52.5k|DER_Encoder& DER_Encoder::raw_bytes(const uint8_t bytes[], size_t length) {
  204|  52.5k|   if(!m_subsequences.empty()) {
  ------------------
  |  Branch (204:7): [True: 52.5k, False: 0]
  ------------------
  205|  52.5k|      m_subsequences[m_subsequences.size() - 1].add_bytes(bytes, length);
  206|  52.5k|   } else if(m_append_output) {
  ------------------
  |  Branch (206:14): [True: 0, False: 0]
  ------------------
  207|      0|      m_append_output(bytes, length);
  208|      0|   } else {
  209|      0|      m_default_outbuf += std::make_pair(bytes, length);
  210|      0|   }
  211|       |
  212|  52.5k|   return (*this);
  213|  52.5k|}
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm:
  218|   128k|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) {
  219|   128k|   std::vector<uint8_t> hdr;
  220|   128k|   encode_tag(hdr, type_tag, class_tag);
  221|   128k|   encode_length(hdr, length);
  222|       |
  223|   128k|   if(!m_subsequences.empty()) {
  ------------------
  |  Branch (223:7): [True: 88.0k, False: 40.7k]
  ------------------
  224|  88.0k|      m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length);
  225|  88.0k|   } else if(m_append_output) {
  ------------------
  |  Branch (225:14): [True: 40.7k, False: 0]
  ------------------
  226|  40.7k|      m_append_output(hdr.data(), hdr.size());
  227|  40.7k|      m_append_output(rep, length);
  228|  40.7k|   } else {
  229|      0|      m_default_outbuf += hdr;
  230|      0|      m_default_outbuf += std::make_pair(rep, length);
  231|      0|   }
  232|       |
  233|   128k|   return (*this);
  234|   128k|}
_ZN5Botan11DER_Encoder6encodeEm:
  249|  11.6k|DER_Encoder& DER_Encoder::encode(size_t n) {
  250|  11.6k|   return encode(BigInt::from_u64(n), ASN1_Type::Integer, ASN1_Class::Universal);
  251|  11.6k|}
_ZN5Botan11DER_Encoder6encodeEPKhmNS_9ASN1_TypeE:
  261|  5.95k|DER_Encoder& DER_Encoder::encode(const uint8_t bytes[], size_t length, ASN1_Type real_type) {
  262|  5.95k|   return encode(bytes, length, real_type, real_type, ASN1_Class::Universal);
  263|  5.95k|}
_ZN5Botan11DER_Encoder6encodeERKNS_6BigIntENS_9ASN1_TypeENS_10ASN1_ClassE:
  283|  11.6k|DER_Encoder& DER_Encoder::encode(const BigInt& n, ASN1_Type type_tag, ASN1_Class class_tag) {
  284|  11.6k|   if(n == 0) {
  ------------------
  |  Branch (284:7): [True: 0, False: 11.6k]
  ------------------
  285|      0|      return add_object(type_tag, class_tag, 0);
  286|      0|   }
  287|       |
  288|  11.6k|   const size_t extra_zero = (n.bits() % 8 == 0) ? 1 : 0;
  ------------------
  |  Branch (288:30): [True: 0, False: 11.6k]
  ------------------
  289|  11.6k|   secure_vector<uint8_t> contents(extra_zero + n.bytes());
  290|  11.6k|   n.binary_encode(&contents[extra_zero]);
  291|  11.6k|   if(n < 0) {
  ------------------
  |  Branch (291:7): [True: 0, False: 11.6k]
  ------------------
  292|      0|      for(unsigned char& content : contents) {
  ------------------
  |  Branch (292:34): [True: 0, False: 0]
  ------------------
  293|      0|         content = ~content;
  294|      0|      }
  295|      0|      for(size_t i = contents.size(); i > 0; --i) {
  ------------------
  |  Branch (295:39): [True: 0, False: 0]
  ------------------
  296|      0|         if(++contents[i - 1]) {
  ------------------
  |  Branch (296:13): [True: 0, False: 0]
  ------------------
  297|      0|            break;
  298|      0|         }
  299|      0|      }
  300|      0|   }
  301|       |
  302|  11.6k|   return add_object(type_tag, class_tag, contents);
  303|  11.6k|}
_ZN5Botan11DER_Encoder6encodeEPKhmNS_9ASN1_TypeES3_NS_10ASN1_ClassE:
  309|  5.95k|   const uint8_t bytes[], size_t length, ASN1_Type real_type, ASN1_Type type_tag, ASN1_Class class_tag) {
  310|  5.95k|   if(real_type != ASN1_Type::OctetString && real_type != ASN1_Type::BitString) {
  ------------------
  |  Branch (310:7): [True: 5.95k, False: 0]
  |  Branch (310:46): [True: 0, False: 5.95k]
  ------------------
  311|      0|      throw Invalid_Argument("DER_Encoder: Invalid tag for byte/bit string");
  312|      0|   }
  313|       |
  314|  5.95k|   if(real_type == ASN1_Type::BitString) {
  ------------------
  |  Branch (314:7): [True: 5.95k, False: 0]
  ------------------
  315|  5.95k|      secure_vector<uint8_t> encoded;
  316|  5.95k|      encoded.push_back(0);
  317|  5.95k|      encoded += std::make_pair(bytes, length);
  318|  5.95k|      return add_object(type_tag, class_tag, encoded);
  319|  5.95k|   } else {
  320|      0|      return add_object(type_tag, class_tag, bytes, length);
  321|      0|   }
  322|  5.95k|}
_ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE:
  324|  46.9k|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) {
  325|  46.9k|   obj.encode_into(*this);
  326|  46.9k|   return (*this);
  327|  46.9k|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE:
   24|   128k|void encode_tag(std::vector<uint8_t>& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) {
   25|   128k|   const uint32_t type_tag = static_cast<uint32_t>(type_tag_e);
   26|   128k|   const uint32_t class_tag = static_cast<uint32_t>(class_tag_e);
   27|       |
   28|   128k|   if((class_tag | 0xE0) != 0xE0) {
  ------------------
  |  Branch (28:7): [True: 0, False: 128k]
  ------------------
   29|      0|      throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag)));
   30|      0|   }
   31|       |
   32|   128k|   if(type_tag <= 30) {
  ------------------
  |  Branch (32:7): [True: 128k, False: 0]
  ------------------
   33|   128k|      encoded_tag.push_back(static_cast<uint8_t>(type_tag | class_tag));
   34|   128k|   } else {
   35|      0|      size_t blocks = high_bit(static_cast<uint32_t>(type_tag)) + 6;
   36|      0|      blocks = (blocks - (blocks % 7)) / 7;
   37|       |
   38|      0|      BOTAN_ASSERT_NOMSG(blocks > 0);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   39|       |
   40|      0|      encoded_tag.push_back(static_cast<uint8_t>(class_tag | 0x1F));
   41|      0|      for(size_t i = 0; i != blocks - 1; ++i) {
  ------------------
  |  Branch (41:25): [True: 0, False: 0]
  ------------------
   42|      0|         encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F));
   43|      0|      }
   44|      0|      encoded_tag.push_back(type_tag & 0x7F);
   45|      0|   }
   46|   128k|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm:
   51|   128k|void encode_length(std::vector<uint8_t>& encoded_length, size_t length) {
   52|   128k|   if(length <= 127) {
  ------------------
  |  Branch (52:7): [True: 99.3k, False: 29.4k]
  ------------------
   53|  99.3k|      encoded_length.push_back(static_cast<uint8_t>(length));
   54|  99.3k|   } else {
   55|  29.4k|      const size_t bytes_needed = significant_bytes(length);
   56|       |
   57|  29.4k|      encoded_length.push_back(static_cast<uint8_t>(0x80 | bytes_needed));
   58|       |
   59|  88.2k|      for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) {
  ------------------
  |  Branch (59:53): [True: 58.8k, False: 29.4k]
  ------------------
   60|  58.8k|         encoded_length.push_back(get_byte_var(i, length));
   61|  58.8k|      }
   62|  29.4k|   }
   63|   128k|}
der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_1clEPKhm:
   72|  81.4k|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };

_ZN5Botan7OID_MapC2Ev:
   11|      1|OID_Map::OID_Map() {
   12|      1|   m_str2oid = OID_Map::load_str2oid_map();
   13|      1|   m_oid2str = OID_Map::load_oid2str_map();
   14|      1|}
_ZN5Botan7OID_Map15global_registryEv:
   16|  80.5k|OID_Map& OID_Map::global_registry() {
   17|  80.5k|   static OID_Map g_map;
   18|  80.5k|   return g_map;
   19|  80.5k|}
_ZN5Botan7OID_Map7oid2strERKNS_3OIDE:
   56|  23.1k|std::string OID_Map::oid2str(const OID& oid) {
   57|  23.1k|   const std::string oid_str = oid.to_string();
   58|       |
   59|  23.1k|   lock_guard_type<mutex_type> lock(m_mutex);
   60|       |
   61|  23.1k|   auto i = m_oid2str.find(oid_str);
   62|  23.1k|   if(i != m_oid2str.end()) {
  ------------------
  |  Branch (62:7): [True: 23.1k, False: 0]
  ------------------
   63|  23.1k|      return i->second;
   64|  23.1k|   }
   65|       |
   66|      0|   return "";
   67|  23.1k|}
_ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   69|  57.4k|OID OID_Map::str2oid(std::string_view str) {
   70|  57.4k|   lock_guard_type<mutex_type> lock(m_mutex);
   71|  57.4k|   auto i = m_str2oid.find(std::string(str));
   72|  57.4k|   if(i != m_str2oid.end()) {
  ------------------
  |  Branch (72:7): [True: 57.4k, False: 0]
  ------------------
   73|  57.4k|      return i->second;
   74|  57.4k|   }
   75|       |
   76|      0|   return OID();
   77|  57.4k|}

_ZN5Botan7OID_Map16load_oid2str_mapEv:
   17|      1|std::unordered_map<std::string, std::string> OID_Map::load_oid2str_map() {
   18|      1|   return std::unordered_map<std::string, std::string>{
   19|       |
   20|      1|      {"0.3.4401.5.3.1.9.26", "Camellia-192/GCM"},
   21|      1|      {"0.3.4401.5.3.1.9.46", "Camellia-256/GCM"},
   22|      1|      {"0.3.4401.5.3.1.9.6", "Camellia-128/GCM"},
   23|      1|      {"0.4.0.127.0.15.1.1.13.0", "XMSS"},
   24|      1|      {"1.0.14888.3.0.5", "ECKCDSA"},
   25|      1|      {"1.2.156.10197.1.104.100", "SM4/OCB"},
   26|      1|      {"1.2.156.10197.1.104.2", "SM4/CBC"},
   27|      1|      {"1.2.156.10197.1.104.8", "SM4/GCM"},
   28|      1|      {"1.2.156.10197.1.301", "sm2p256v1"},
   29|      1|      {"1.2.156.10197.1.301.1", "SM2"},
   30|      1|      {"1.2.156.10197.1.301.2", "SM2_Kex"},
   31|      1|      {"1.2.156.10197.1.301.3", "SM2_Enc"},
   32|      1|      {"1.2.156.10197.1.401", "SM3"},
   33|      1|      {"1.2.156.10197.1.501", "SM2_Sig/SM3"},
   34|      1|      {"1.2.156.10197.1.504", "RSA/EMSA3(SM3)"},
   35|      1|      {"1.2.250.1.223.101.256.1", "frp256v1"},
   36|      1|      {"1.2.392.200011.61.1.1.1.2", "Camellia-128/CBC"},
   37|      1|      {"1.2.392.200011.61.1.1.1.3", "Camellia-192/CBC"},
   38|      1|      {"1.2.392.200011.61.1.1.1.4", "Camellia-256/CBC"},
   39|      1|      {"1.2.410.200004.1.100.4.3", "ECKCDSA/SHA-1"},
   40|      1|      {"1.2.410.200004.1.100.4.4", "ECKCDSA/SHA-224"},
   41|      1|      {"1.2.410.200004.1.100.4.5", "ECKCDSA/SHA-256"},
   42|      1|      {"1.2.410.200004.1.4", "SEED/CBC"},
   43|      1|      {"1.2.643.100.1", "GOST.OGRN"},
   44|      1|      {"1.2.643.100.111", "GOST.SubjectSigningTool"},
   45|      1|      {"1.2.643.100.112", "GOST.IssuerSigningTool"},
   46|      1|      {"1.2.643.2.2.19", "GOST-34.10"},
   47|      1|      {"1.2.643.2.2.3", "GOST-34.10/GOST-R-34.11-94"},
   48|      1|      {"1.2.643.2.2.35.1", "gost_256A"},
   49|      1|      {"1.2.643.2.2.36.0", "gost_256A"},
   50|      1|      {"1.2.643.3.131.1.1", "GOST.INN"},
   51|      1|      {"1.2.643.7.1.1.1.1", "GOST-34.10-2012-256"},
   52|      1|      {"1.2.643.7.1.1.1.2", "GOST-34.10-2012-512"},
   53|      1|      {"1.2.643.7.1.1.2.2", "Streebog-256"},
   54|      1|      {"1.2.643.7.1.1.2.3", "Streebog-512"},
   55|      1|      {"1.2.643.7.1.1.3.2", "GOST-34.10-2012-256/Streebog-256"},
   56|      1|      {"1.2.643.7.1.1.3.3", "GOST-34.10-2012-512/Streebog-512"},
   57|      1|      {"1.2.643.7.1.2.1.1.1", "gost_256A"},
   58|      1|      {"1.2.643.7.1.2.1.1.2", "gost_256B"},
   59|      1|      {"1.2.643.7.1.2.1.2.1", "gost_512A"},
   60|      1|      {"1.2.643.7.1.2.1.2.2", "gost_512B"},
   61|      1|      {"1.2.840.10040.4.1", "DSA"},
   62|      1|      {"1.2.840.10040.4.3", "DSA/SHA-1"},
   63|      1|      {"1.2.840.10045.2.1", "ECDSA"},
   64|      1|      {"1.2.840.10045.3.1.1", "secp192r1"},
   65|      1|      {"1.2.840.10045.3.1.2", "x962_p192v2"},
   66|      1|      {"1.2.840.10045.3.1.3", "x962_p192v3"},
   67|      1|      {"1.2.840.10045.3.1.4", "x962_p239v1"},
   68|      1|      {"1.2.840.10045.3.1.5", "x962_p239v2"},
   69|      1|      {"1.2.840.10045.3.1.6", "x962_p239v3"},
   70|      1|      {"1.2.840.10045.3.1.7", "secp256r1"},
   71|      1|      {"1.2.840.10045.4.1", "ECDSA/SHA-1"},
   72|      1|      {"1.2.840.10045.4.3.1", "ECDSA/SHA-224"},
   73|      1|      {"1.2.840.10045.4.3.2", "ECDSA/SHA-256"},
   74|      1|      {"1.2.840.10045.4.3.3", "ECDSA/SHA-384"},
   75|      1|      {"1.2.840.10045.4.3.4", "ECDSA/SHA-512"},
   76|      1|      {"1.2.840.10046.2.1", "DH"},
   77|      1|      {"1.2.840.113533.7.66.10", "CAST-128/CBC"},
   78|      1|      {"1.2.840.113533.7.66.15", "KeyWrap.CAST-128"},
   79|      1|      {"1.2.840.113549.1.1.1", "RSA"},
   80|      1|      {"1.2.840.113549.1.1.10", "RSA/EMSA4"},
   81|      1|      {"1.2.840.113549.1.1.11", "RSA/EMSA3(SHA-256)"},
   82|      1|      {"1.2.840.113549.1.1.12", "RSA/EMSA3(SHA-384)"},
   83|      1|      {"1.2.840.113549.1.1.13", "RSA/EMSA3(SHA-512)"},
   84|      1|      {"1.2.840.113549.1.1.14", "RSA/EMSA3(SHA-224)"},
   85|      1|      {"1.2.840.113549.1.1.16", "RSA/EMSA3(SHA-512-256)"},
   86|      1|      {"1.2.840.113549.1.1.4", "RSA/EMSA3(MD5)"},
   87|      1|      {"1.2.840.113549.1.1.5", "RSA/EMSA3(SHA-1)"},
   88|      1|      {"1.2.840.113549.1.1.7", "RSA/OAEP"},
   89|      1|      {"1.2.840.113549.1.1.8", "MGF1"},
   90|      1|      {"1.2.840.113549.1.5.12", "PKCS5.PBKDF2"},
   91|      1|      {"1.2.840.113549.1.5.13", "PBE-PKCS5v20"},
   92|      1|      {"1.2.840.113549.1.9.1", "PKCS9.EmailAddress"},
   93|      1|      {"1.2.840.113549.1.9.14", "PKCS9.ExtensionRequest"},
   94|      1|      {"1.2.840.113549.1.9.16.3.18", "ChaCha20Poly1305"},
   95|      1|      {"1.2.840.113549.1.9.16.3.6", "KeyWrap.TripleDES"},
   96|      1|      {"1.2.840.113549.1.9.16.3.8", "Compression.Zlib"},
   97|      1|      {"1.2.840.113549.1.9.2", "PKCS9.UnstructuredName"},
   98|      1|      {"1.2.840.113549.1.9.3", "PKCS9.ContentType"},
   99|      1|      {"1.2.840.113549.1.9.4", "PKCS9.MessageDigest"},
  100|      1|      {"1.2.840.113549.1.9.7", "PKCS9.ChallengePassword"},
  101|      1|      {"1.2.840.113549.2.10", "HMAC(SHA-384)"},
  102|      1|      {"1.2.840.113549.2.11", "HMAC(SHA-512)"},
  103|      1|      {"1.2.840.113549.2.13", "HMAC(SHA-512-256)"},
  104|      1|      {"1.2.840.113549.2.5", "MD5"},
  105|      1|      {"1.2.840.113549.2.7", "HMAC(SHA-1)"},
  106|      1|      {"1.2.840.113549.2.8", "HMAC(SHA-224)"},
  107|      1|      {"1.2.840.113549.2.9", "HMAC(SHA-256)"},
  108|      1|      {"1.2.840.113549.3.7", "TripleDES/CBC"},
  109|      1|      {"1.3.101.110", "Curve25519"},
  110|      1|      {"1.3.101.112", "Ed25519"},
  111|      1|      {"1.3.132.0.10", "secp256k1"},
  112|      1|      {"1.3.132.0.30", "secp160r2"},
  113|      1|      {"1.3.132.0.31", "secp192k1"},
  114|      1|      {"1.3.132.0.32", "secp224k1"},
  115|      1|      {"1.3.132.0.33", "secp224r1"},
  116|      1|      {"1.3.132.0.34", "secp384r1"},
  117|      1|      {"1.3.132.0.35", "secp521r1"},
  118|      1|      {"1.3.132.0.8", "secp160r1"},
  119|      1|      {"1.3.132.0.9", "secp160k1"},
  120|      1|      {"1.3.132.1.12", "ECDH"},
  121|      1|      {"1.3.14.3.2.26", "SHA-1"},
  122|      1|      {"1.3.14.3.2.7", "DES/CBC"},
  123|      1|      {"1.3.36.3.2.1", "RIPEMD-160"},
  124|      1|      {"1.3.36.3.3.1.2", "RSA/EMSA3(RIPEMD-160)"},
  125|      1|      {"1.3.36.3.3.2.5.2.1", "ECGDSA"},
  126|      1|      {"1.3.36.3.3.2.5.4.1", "ECGDSA/RIPEMD-160"},
  127|      1|      {"1.3.36.3.3.2.5.4.2", "ECGDSA/SHA-1"},
  128|      1|      {"1.3.36.3.3.2.5.4.3", "ECGDSA/SHA-224"},
  129|      1|      {"1.3.36.3.3.2.5.4.4", "ECGDSA/SHA-256"},
  130|      1|      {"1.3.36.3.3.2.5.4.5", "ECGDSA/SHA-384"},
  131|      1|      {"1.3.36.3.3.2.5.4.6", "ECGDSA/SHA-512"},
  132|      1|      {"1.3.36.3.3.2.8.1.1.1", "brainpool160r1"},
  133|      1|      {"1.3.36.3.3.2.8.1.1.11", "brainpool384r1"},
  134|      1|      {"1.3.36.3.3.2.8.1.1.13", "brainpool512r1"},
  135|      1|      {"1.3.36.3.3.2.8.1.1.3", "brainpool192r1"},
  136|      1|      {"1.3.36.3.3.2.8.1.1.5", "brainpool224r1"},
  137|      1|      {"1.3.36.3.3.2.8.1.1.7", "brainpool256r1"},
  138|      1|      {"1.3.36.3.3.2.8.1.1.9", "brainpool320r1"},
  139|      1|      {"1.3.6.1.4.1.11591.15.1", "OpenPGP.Ed25519"},
  140|      1|      {"1.3.6.1.4.1.11591.4.11", "Scrypt"},
  141|      1|      {"1.3.6.1.4.1.25258.1.10.1", "Dilithium-4x4-AES-r3"},
  142|      1|      {"1.3.6.1.4.1.25258.1.10.2", "Dilithium-6x5-AES-r3"},
  143|      1|      {"1.3.6.1.4.1.25258.1.10.3", "Dilithium-8x7-AES-r3"},
  144|      1|      {"1.3.6.1.4.1.25258.1.11.1", "Kyber-512-90s-r3"},
  145|      1|      {"1.3.6.1.4.1.25258.1.11.2", "Kyber-768-90s-r3"},
  146|      1|      {"1.3.6.1.4.1.25258.1.11.3", "Kyber-1024-90s-r3"},
  147|      1|      {"1.3.6.1.4.1.25258.1.3", "McEliece"},
  148|      1|      {"1.3.6.1.4.1.25258.1.5", "XMSS-draft6"},
  149|      1|      {"1.3.6.1.4.1.25258.1.6.1", "GOST-34.10-2012-256/SHA-256"},
  150|      1|      {"1.3.6.1.4.1.25258.1.7.1", "Kyber-512-r3"},
  151|      1|      {"1.3.6.1.4.1.25258.1.7.2", "Kyber-768-r3"},
  152|      1|      {"1.3.6.1.4.1.25258.1.7.3", "Kyber-1024-r3"},
  153|      1|      {"1.3.6.1.4.1.25258.1.8", "XMSS-draft12"},
  154|      1|      {"1.3.6.1.4.1.25258.1.9.1", "Dilithium-4x4-r3"},
  155|      1|      {"1.3.6.1.4.1.25258.1.9.2", "Dilithium-6x5-r3"},
  156|      1|      {"1.3.6.1.4.1.25258.1.9.3", "Dilithium-8x7-r3"},
  157|      1|      {"1.3.6.1.4.1.25258.3.1", "Serpent/CBC"},
  158|      1|      {"1.3.6.1.4.1.25258.3.101", "Serpent/GCM"},
  159|      1|      {"1.3.6.1.4.1.25258.3.102", "Twofish/GCM"},
  160|      1|      {"1.3.6.1.4.1.25258.3.2", "Threefish-512/CBC"},
  161|      1|      {"1.3.6.1.4.1.25258.3.2.1", "AES-128/OCB"},
  162|      1|      {"1.3.6.1.4.1.25258.3.2.2", "AES-192/OCB"},
  163|      1|      {"1.3.6.1.4.1.25258.3.2.3", "AES-256/OCB"},
  164|      1|      {"1.3.6.1.4.1.25258.3.2.4", "Serpent/OCB"},
  165|      1|      {"1.3.6.1.4.1.25258.3.2.5", "Twofish/OCB"},
  166|      1|      {"1.3.6.1.4.1.25258.3.2.6", "Camellia-128/OCB"},
  167|      1|      {"1.3.6.1.4.1.25258.3.2.7", "Camellia-192/OCB"},
  168|      1|      {"1.3.6.1.4.1.25258.3.2.8", "Camellia-256/OCB"},
  169|      1|      {"1.3.6.1.4.1.25258.3.3", "Twofish/CBC"},
  170|      1|      {"1.3.6.1.4.1.25258.3.4.1", "AES-128/SIV"},
  171|      1|      {"1.3.6.1.4.1.25258.3.4.2", "AES-192/SIV"},
  172|      1|      {"1.3.6.1.4.1.25258.3.4.3", "AES-256/SIV"},
  173|      1|      {"1.3.6.1.4.1.25258.3.4.4", "Serpent/SIV"},
  174|      1|      {"1.3.6.1.4.1.25258.3.4.5", "Twofish/SIV"},
  175|      1|      {"1.3.6.1.4.1.25258.3.4.6", "Camellia-128/SIV"},
  176|      1|      {"1.3.6.1.4.1.25258.3.4.7", "Camellia-192/SIV"},
  177|      1|      {"1.3.6.1.4.1.25258.3.4.8", "Camellia-256/SIV"},
  178|      1|      {"1.3.6.1.4.1.25258.3.4.9", "SM4/SIV"},
  179|      1|      {"1.3.6.1.4.1.3029.1.2.1", "ElGamal"},
  180|      1|      {"1.3.6.1.4.1.3029.1.5.1", "OpenPGP.Curve25519"},
  181|      1|      {"1.3.6.1.4.1.311.20.2.2", "Microsoft SmartcardLogon"},
  182|      1|      {"1.3.6.1.4.1.311.20.2.3", "Microsoft UPN"},
  183|      1|      {"1.3.6.1.4.1.8301.3.1.2.9.0.38", "secp521r1"},
  184|      1|      {"1.3.6.1.5.5.7.1.1", "PKIX.AuthorityInformationAccess"},
  185|      1|      {"1.3.6.1.5.5.7.3.1", "PKIX.ServerAuth"},
  186|      1|      {"1.3.6.1.5.5.7.3.2", "PKIX.ClientAuth"},
  187|      1|      {"1.3.6.1.5.5.7.3.3", "PKIX.CodeSigning"},
  188|      1|      {"1.3.6.1.5.5.7.3.4", "PKIX.EmailProtection"},
  189|      1|      {"1.3.6.1.5.5.7.3.5", "PKIX.IPsecEndSystem"},
  190|      1|      {"1.3.6.1.5.5.7.3.6", "PKIX.IPsecTunnel"},
  191|      1|      {"1.3.6.1.5.5.7.3.7", "PKIX.IPsecUser"},
  192|      1|      {"1.3.6.1.5.5.7.3.8", "PKIX.TimeStamping"},
  193|      1|      {"1.3.6.1.5.5.7.3.9", "PKIX.OCSPSigning"},
  194|      1|      {"1.3.6.1.5.5.7.48.1", "PKIX.OCSP"},
  195|      1|      {"1.3.6.1.5.5.7.48.1.1", "PKIX.OCSP.BasicResponse"},
  196|      1|      {"1.3.6.1.5.5.7.48.1.5", "PKIX.OCSP.NoCheck"},
  197|      1|      {"1.3.6.1.5.5.7.48.2", "PKIX.CertificateAuthorityIssuers"},
  198|      1|      {"1.3.6.1.5.5.7.8.5", "PKIX.XMPPAddr"},
  199|      1|      {"2.16.840.1.101.3.4.1.2", "AES-128/CBC"},
  200|      1|      {"2.16.840.1.101.3.4.1.22", "AES-192/CBC"},
  201|      1|      {"2.16.840.1.101.3.4.1.25", "KeyWrap.AES-192"},
  202|      1|      {"2.16.840.1.101.3.4.1.26", "AES-192/GCM"},
  203|      1|      {"2.16.840.1.101.3.4.1.27", "AES-192/CCM"},
  204|      1|      {"2.16.840.1.101.3.4.1.42", "AES-256/CBC"},
  205|      1|      {"2.16.840.1.101.3.4.1.45", "KeyWrap.AES-256"},
  206|      1|      {"2.16.840.1.101.3.4.1.46", "AES-256/GCM"},
  207|      1|      {"2.16.840.1.101.3.4.1.47", "AES-256/CCM"},
  208|      1|      {"2.16.840.1.101.3.4.1.5", "KeyWrap.AES-128"},
  209|      1|      {"2.16.840.1.101.3.4.1.6", "AES-128/GCM"},
  210|      1|      {"2.16.840.1.101.3.4.1.7", "AES-128/CCM"},
  211|      1|      {"2.16.840.1.101.3.4.2.1", "SHA-256"},
  212|      1|      {"2.16.840.1.101.3.4.2.10", "SHA-3(512)"},
  213|      1|      {"2.16.840.1.101.3.4.2.11", "SHAKE-128"},
  214|      1|      {"2.16.840.1.101.3.4.2.12", "SHAKE-256"},
  215|      1|      {"2.16.840.1.101.3.4.2.2", "SHA-384"},
  216|      1|      {"2.16.840.1.101.3.4.2.3", "SHA-512"},
  217|      1|      {"2.16.840.1.101.3.4.2.4", "SHA-224"},
  218|      1|      {"2.16.840.1.101.3.4.2.6", "SHA-512-256"},
  219|      1|      {"2.16.840.1.101.3.4.2.7", "SHA-3(224)"},
  220|      1|      {"2.16.840.1.101.3.4.2.8", "SHA-3(256)"},
  221|      1|      {"2.16.840.1.101.3.4.2.9", "SHA-3(384)"},
  222|      1|      {"2.16.840.1.101.3.4.3.1", "DSA/SHA-224"},
  223|      1|      {"2.16.840.1.101.3.4.3.10", "ECDSA/SHA-3(256)"},
  224|      1|      {"2.16.840.1.101.3.4.3.11", "ECDSA/SHA-3(384)"},
  225|      1|      {"2.16.840.1.101.3.4.3.12", "ECDSA/SHA-3(512)"},
  226|      1|      {"2.16.840.1.101.3.4.3.13", "RSA/EMSA3(SHA-3(224))"},
  227|      1|      {"2.16.840.1.101.3.4.3.14", "RSA/EMSA3(SHA-3(256))"},
  228|      1|      {"2.16.840.1.101.3.4.3.15", "RSA/EMSA3(SHA-3(384))"},
  229|      1|      {"2.16.840.1.101.3.4.3.16", "RSA/EMSA3(SHA-3(512))"},
  230|      1|      {"2.16.840.1.101.3.4.3.2", "DSA/SHA-256"},
  231|      1|      {"2.16.840.1.101.3.4.3.3", "DSA/SHA-384"},
  232|      1|      {"2.16.840.1.101.3.4.3.4", "DSA/SHA-512"},
  233|      1|      {"2.16.840.1.101.3.4.3.5", "DSA/SHA-3(224)"},
  234|      1|      {"2.16.840.1.101.3.4.3.6", "DSA/SHA-3(256)"},
  235|      1|      {"2.16.840.1.101.3.4.3.7", "DSA/SHA-3(384)"},
  236|      1|      {"2.16.840.1.101.3.4.3.8", "DSA/SHA-3(512)"},
  237|      1|      {"2.16.840.1.101.3.4.3.9", "ECDSA/SHA-3(224)"},
  238|      1|      {"2.16.840.1.113730.1.13", "Certificate Comment"},
  239|      1|      {"2.5.29.14", "X509v3.SubjectKeyIdentifier"},
  240|      1|      {"2.5.29.15", "X509v3.KeyUsage"},
  241|      1|      {"2.5.29.16", "X509v3.PrivateKeyUsagePeriod"},
  242|      1|      {"2.5.29.17", "X509v3.SubjectAlternativeName"},
  243|      1|      {"2.5.29.18", "X509v3.IssuerAlternativeName"},
  244|      1|      {"2.5.29.19", "X509v3.BasicConstraints"},
  245|      1|      {"2.5.29.20", "X509v3.CRLNumber"},
  246|      1|      {"2.5.29.21", "X509v3.ReasonCode"},
  247|      1|      {"2.5.29.23", "X509v3.HoldInstructionCode"},
  248|      1|      {"2.5.29.24", "X509v3.InvalidityDate"},
  249|      1|      {"2.5.29.28", "X509v3.CRLIssuingDistributionPoint"},
  250|      1|      {"2.5.29.30", "X509v3.NameConstraints"},
  251|      1|      {"2.5.29.31", "X509v3.CRLDistributionPoints"},
  252|      1|      {"2.5.29.32", "X509v3.CertificatePolicies"},
  253|      1|      {"2.5.29.32.0", "X509v3.AnyPolicy"},
  254|      1|      {"2.5.29.35", "X509v3.AuthorityKeyIdentifier"},
  255|      1|      {"2.5.29.36", "X509v3.PolicyConstraints"},
  256|      1|      {"2.5.29.37", "X509v3.ExtendedKeyUsage"},
  257|      1|      {"2.5.4.10", "X520.Organization"},
  258|      1|      {"2.5.4.11", "X520.OrganizationalUnit"},
  259|      1|      {"2.5.4.12", "X520.Title"},
  260|      1|      {"2.5.4.3", "X520.CommonName"},
  261|      1|      {"2.5.4.4", "X520.Surname"},
  262|      1|      {"2.5.4.42", "X520.GivenName"},
  263|      1|      {"2.5.4.43", "X520.Initials"},
  264|      1|      {"2.5.4.44", "X520.GenerationalQualifier"},
  265|      1|      {"2.5.4.46", "X520.DNQualifier"},
  266|      1|      {"2.5.4.5", "X520.SerialNumber"},
  267|      1|      {"2.5.4.6", "X520.Country"},
  268|      1|      {"2.5.4.65", "X520.Pseudonym"},
  269|      1|      {"2.5.4.7", "X520.Locality"},
  270|      1|      {"2.5.4.8", "X520.State"},
  271|      1|      {"2.5.4.9", "X520.StreetAddress"},
  272|      1|      {"2.5.8.1.1", "RSA"}};
  273|      1|}
_ZN5Botan7OID_Map16load_str2oid_mapEv:
  275|      1|std::unordered_map<std::string, OID> OID_Map::load_str2oid_map() {
  276|      1|   return std::unordered_map<std::string, OID>{
  277|       |
  278|      1|      {"AES-128/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 2})},
  279|      1|      {"AES-128/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 7})},
  280|      1|      {"AES-128/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 6})},
  281|      1|      {"AES-128/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 1})},
  282|      1|      {"AES-128/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 1})},
  283|      1|      {"AES-192/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 22})},
  284|      1|      {"AES-192/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 27})},
  285|      1|      {"AES-192/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 26})},
  286|      1|      {"AES-192/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 2})},
  287|      1|      {"AES-192/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 2})},
  288|      1|      {"AES-256/CBC", OID({2, 16, 840, 1, 101, 3, 4, 1, 42})},
  289|      1|      {"AES-256/CCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 47})},
  290|      1|      {"AES-256/GCM", OID({2, 16, 840, 1, 101, 3, 4, 1, 46})},
  291|      1|      {"AES-256/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 3})},
  292|      1|      {"AES-256/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 3})},
  293|      1|      {"CAST-128/CBC", OID({1, 2, 840, 113533, 7, 66, 10})},
  294|      1|      {"Camellia-128/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 2})},
  295|      1|      {"Camellia-128/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 6})},
  296|      1|      {"Camellia-128/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 6})},
  297|      1|      {"Camellia-128/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 6})},
  298|      1|      {"Camellia-192/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 3})},
  299|      1|      {"Camellia-192/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 26})},
  300|      1|      {"Camellia-192/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 7})},
  301|      1|      {"Camellia-192/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 7})},
  302|      1|      {"Camellia-256/CBC", OID({1, 2, 392, 200011, 61, 1, 1, 1, 4})},
  303|      1|      {"Camellia-256/GCM", OID({0, 3, 4401, 5, 3, 1, 9, 46})},
  304|      1|      {"Camellia-256/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 8})},
  305|      1|      {"Camellia-256/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 8})},
  306|      1|      {"Certificate Comment", OID({2, 16, 840, 1, 113730, 1, 13})},
  307|      1|      {"ChaCha20Poly1305", OID({1, 2, 840, 113549, 1, 9, 16, 3, 18})},
  308|      1|      {"Compression.Zlib", OID({1, 2, 840, 113549, 1, 9, 16, 3, 8})},
  309|      1|      {"Curve25519", OID({1, 3, 101, 110})},
  310|      1|      {"DES/CBC", OID({1, 3, 14, 3, 2, 7})},
  311|      1|      {"DH", OID({1, 2, 840, 10046, 2, 1})},
  312|      1|      {"DSA", OID({1, 2, 840, 10040, 4, 1})},
  313|      1|      {"DSA/SHA-1", OID({1, 2, 840, 10040, 4, 3})},
  314|      1|      {"DSA/SHA-224", OID({2, 16, 840, 1, 101, 3, 4, 3, 1})},
  315|      1|      {"DSA/SHA-256", OID({2, 16, 840, 1, 101, 3, 4, 3, 2})},
  316|      1|      {"DSA/SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 3, 5})},
  317|      1|      {"DSA/SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 3, 6})},
  318|      1|      {"DSA/SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 3, 7})},
  319|      1|      {"DSA/SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 3, 8})},
  320|      1|      {"DSA/SHA-384", OID({2, 16, 840, 1, 101, 3, 4, 3, 3})},
  321|      1|      {"DSA/SHA-512", OID({2, 16, 840, 1, 101, 3, 4, 3, 4})},
  322|      1|      {"Dilithium-4x4-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 1})},
  323|      1|      {"Dilithium-4x4-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 1})},
  324|      1|      {"Dilithium-6x5-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 2})},
  325|      1|      {"Dilithium-6x5-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 2})},
  326|      1|      {"Dilithium-8x7-AES-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 10, 3})},
  327|      1|      {"Dilithium-8x7-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 9, 3})},
  328|      1|      {"ECDH", OID({1, 3, 132, 1, 12})},
  329|      1|      {"ECDSA", OID({1, 2, 840, 10045, 2, 1})},
  330|      1|      {"ECDSA/SHA-1", OID({1, 2, 840, 10045, 4, 1})},
  331|      1|      {"ECDSA/SHA-224", OID({1, 2, 840, 10045, 4, 3, 1})},
  332|      1|      {"ECDSA/SHA-256", OID({1, 2, 840, 10045, 4, 3, 2})},
  333|      1|      {"ECDSA/SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 3, 9})},
  334|      1|      {"ECDSA/SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 3, 10})},
  335|      1|      {"ECDSA/SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 3, 11})},
  336|      1|      {"ECDSA/SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 3, 12})},
  337|      1|      {"ECDSA/SHA-384", OID({1, 2, 840, 10045, 4, 3, 3})},
  338|      1|      {"ECDSA/SHA-512", OID({1, 2, 840, 10045, 4, 3, 4})},
  339|      1|      {"ECGDSA", OID({1, 3, 36, 3, 3, 2, 5, 2, 1})},
  340|      1|      {"ECGDSA/RIPEMD-160", OID({1, 3, 36, 3, 3, 2, 5, 4, 1})},
  341|      1|      {"ECGDSA/SHA-1", OID({1, 3, 36, 3, 3, 2, 5, 4, 2})},
  342|      1|      {"ECGDSA/SHA-224", OID({1, 3, 36, 3, 3, 2, 5, 4, 3})},
  343|      1|      {"ECGDSA/SHA-256", OID({1, 3, 36, 3, 3, 2, 5, 4, 4})},
  344|      1|      {"ECGDSA/SHA-384", OID({1, 3, 36, 3, 3, 2, 5, 4, 5})},
  345|      1|      {"ECGDSA/SHA-512", OID({1, 3, 36, 3, 3, 2, 5, 4, 6})},
  346|      1|      {"ECKCDSA", OID({1, 0, 14888, 3, 0, 5})},
  347|      1|      {"ECKCDSA/SHA-1", OID({1, 2, 410, 200004, 1, 100, 4, 3})},
  348|      1|      {"ECKCDSA/SHA-224", OID({1, 2, 410, 200004, 1, 100, 4, 4})},
  349|      1|      {"ECKCDSA/SHA-256", OID({1, 2, 410, 200004, 1, 100, 4, 5})},
  350|      1|      {"Ed25519", OID({1, 3, 101, 112})},
  351|      1|      {"ElGamal", OID({1, 3, 6, 1, 4, 1, 3029, 1, 2, 1})},
  352|      1|      {"GOST-34.10", OID({1, 2, 643, 2, 2, 19})},
  353|      1|      {"GOST-34.10-2012-256", OID({1, 2, 643, 7, 1, 1, 1, 1})},
  354|      1|      {"GOST-34.10-2012-256/SHA-256", OID({1, 3, 6, 1, 4, 1, 25258, 1, 6, 1})},
  355|      1|      {"GOST-34.10-2012-256/Streebog-256", OID({1, 2, 643, 7, 1, 1, 3, 2})},
  356|      1|      {"GOST-34.10-2012-512", OID({1, 2, 643, 7, 1, 1, 1, 2})},
  357|      1|      {"GOST-34.10-2012-512/Streebog-512", OID({1, 2, 643, 7, 1, 1, 3, 3})},
  358|      1|      {"GOST-34.10/GOST-R-34.11-94", OID({1, 2, 643, 2, 2, 3})},
  359|      1|      {"GOST.INN", OID({1, 2, 643, 3, 131, 1, 1})},
  360|      1|      {"GOST.IssuerSigningTool", OID({1, 2, 643, 100, 112})},
  361|      1|      {"GOST.OGRN", OID({1, 2, 643, 100, 1})},
  362|      1|      {"GOST.SubjectSigningTool", OID({1, 2, 643, 100, 111})},
  363|      1|      {"HMAC(SHA-1)", OID({1, 2, 840, 113549, 2, 7})},
  364|      1|      {"HMAC(SHA-224)", OID({1, 2, 840, 113549, 2, 8})},
  365|      1|      {"HMAC(SHA-256)", OID({1, 2, 840, 113549, 2, 9})},
  366|      1|      {"HMAC(SHA-384)", OID({1, 2, 840, 113549, 2, 10})},
  367|      1|      {"HMAC(SHA-512)", OID({1, 2, 840, 113549, 2, 11})},
  368|      1|      {"HMAC(SHA-512-256)", OID({1, 2, 840, 113549, 2, 13})},
  369|      1|      {"KeyWrap.AES-128", OID({2, 16, 840, 1, 101, 3, 4, 1, 5})},
  370|      1|      {"KeyWrap.AES-192", OID({2, 16, 840, 1, 101, 3, 4, 1, 25})},
  371|      1|      {"KeyWrap.AES-256", OID({2, 16, 840, 1, 101, 3, 4, 1, 45})},
  372|      1|      {"KeyWrap.CAST-128", OID({1, 2, 840, 113533, 7, 66, 15})},
  373|      1|      {"KeyWrap.TripleDES", OID({1, 2, 840, 113549, 1, 9, 16, 3, 6})},
  374|      1|      {"Kyber-1024-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 3})},
  375|      1|      {"Kyber-1024-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 3})},
  376|      1|      {"Kyber-512-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 1})},
  377|      1|      {"Kyber-512-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 1})},
  378|      1|      {"Kyber-768-90s-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 11, 2})},
  379|      1|      {"Kyber-768-r3", OID({1, 3, 6, 1, 4, 1, 25258, 1, 7, 2})},
  380|      1|      {"MD5", OID({1, 2, 840, 113549, 2, 5})},
  381|      1|      {"MGF1", OID({1, 2, 840, 113549, 1, 1, 8})},
  382|      1|      {"McEliece", OID({1, 3, 6, 1, 4, 1, 25258, 1, 3})},
  383|      1|      {"Microsoft SmartcardLogon", OID({1, 3, 6, 1, 4, 1, 311, 20, 2, 2})},
  384|      1|      {"Microsoft UPN", OID({1, 3, 6, 1, 4, 1, 311, 20, 2, 3})},
  385|      1|      {"OpenPGP.Curve25519", OID({1, 3, 6, 1, 4, 1, 3029, 1, 5, 1})},
  386|      1|      {"OpenPGP.Ed25519", OID({1, 3, 6, 1, 4, 1, 11591, 15, 1})},
  387|      1|      {"PBE-PKCS5v20", OID({1, 2, 840, 113549, 1, 5, 13})},
  388|      1|      {"PBES2", OID({1, 2, 840, 113549, 1, 5, 13})},
  389|      1|      {"PKCS5.PBKDF2", OID({1, 2, 840, 113549, 1, 5, 12})},
  390|      1|      {"PKCS9.ChallengePassword", OID({1, 2, 840, 113549, 1, 9, 7})},
  391|      1|      {"PKCS9.ContentType", OID({1, 2, 840, 113549, 1, 9, 3})},
  392|      1|      {"PKCS9.EmailAddress", OID({1, 2, 840, 113549, 1, 9, 1})},
  393|      1|      {"PKCS9.ExtensionRequest", OID({1, 2, 840, 113549, 1, 9, 14})},
  394|      1|      {"PKCS9.MessageDigest", OID({1, 2, 840, 113549, 1, 9, 4})},
  395|      1|      {"PKCS9.UnstructuredName", OID({1, 2, 840, 113549, 1, 9, 2})},
  396|      1|      {"PKIX.AuthorityInformationAccess", OID({1, 3, 6, 1, 5, 5, 7, 1, 1})},
  397|      1|      {"PKIX.CertificateAuthorityIssuers", OID({1, 3, 6, 1, 5, 5, 7, 48, 2})},
  398|      1|      {"PKIX.ClientAuth", OID({1, 3, 6, 1, 5, 5, 7, 3, 2})},
  399|      1|      {"PKIX.CodeSigning", OID({1, 3, 6, 1, 5, 5, 7, 3, 3})},
  400|      1|      {"PKIX.EmailProtection", OID({1, 3, 6, 1, 5, 5, 7, 3, 4})},
  401|      1|      {"PKIX.IPsecEndSystem", OID({1, 3, 6, 1, 5, 5, 7, 3, 5})},
  402|      1|      {"PKIX.IPsecTunnel", OID({1, 3, 6, 1, 5, 5, 7, 3, 6})},
  403|      1|      {"PKIX.IPsecUser", OID({1, 3, 6, 1, 5, 5, 7, 3, 7})},
  404|      1|      {"PKIX.OCSP", OID({1, 3, 6, 1, 5, 5, 7, 48, 1})},
  405|      1|      {"PKIX.OCSP.BasicResponse", OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 1})},
  406|      1|      {"PKIX.OCSP.NoCheck", OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 5})},
  407|      1|      {"PKIX.OCSPSigning", OID({1, 3, 6, 1, 5, 5, 7, 3, 9})},
  408|      1|      {"PKIX.ServerAuth", OID({1, 3, 6, 1, 5, 5, 7, 3, 1})},
  409|      1|      {"PKIX.TimeStamping", OID({1, 3, 6, 1, 5, 5, 7, 3, 8})},
  410|      1|      {"PKIX.XMPPAddr", OID({1, 3, 6, 1, 5, 5, 7, 8, 5})},
  411|      1|      {"RIPEMD-160", OID({1, 3, 36, 3, 2, 1})},
  412|      1|      {"RSA", OID({1, 2, 840, 113549, 1, 1, 1})},
  413|      1|      {"RSA/EMSA3(MD5)", OID({1, 2, 840, 113549, 1, 1, 4})},
  414|      1|      {"RSA/EMSA3(RIPEMD-160)", OID({1, 3, 36, 3, 3, 1, 2})},
  415|      1|      {"RSA/EMSA3(SHA-1)", OID({1, 2, 840, 113549, 1, 1, 5})},
  416|      1|      {"RSA/EMSA3(SHA-224)", OID({1, 2, 840, 113549, 1, 1, 14})},
  417|      1|      {"RSA/EMSA3(SHA-256)", OID({1, 2, 840, 113549, 1, 1, 11})},
  418|      1|      {"RSA/EMSA3(SHA-3(224))", OID({2, 16, 840, 1, 101, 3, 4, 3, 13})},
  419|      1|      {"RSA/EMSA3(SHA-3(256))", OID({2, 16, 840, 1, 101, 3, 4, 3, 14})},
  420|      1|      {"RSA/EMSA3(SHA-3(384))", OID({2, 16, 840, 1, 101, 3, 4, 3, 15})},
  421|      1|      {"RSA/EMSA3(SHA-3(512))", OID({2, 16, 840, 1, 101, 3, 4, 3, 16})},
  422|      1|      {"RSA/EMSA3(SHA-384)", OID({1, 2, 840, 113549, 1, 1, 12})},
  423|      1|      {"RSA/EMSA3(SHA-512)", OID({1, 2, 840, 113549, 1, 1, 13})},
  424|      1|      {"RSA/EMSA3(SHA-512-256)", OID({1, 2, 840, 113549, 1, 1, 16})},
  425|      1|      {"RSA/EMSA3(SM3)", OID({1, 2, 156, 10197, 1, 504})},
  426|      1|      {"RSA/EMSA4", OID({1, 2, 840, 113549, 1, 1, 10})},
  427|      1|      {"RSA/OAEP", OID({1, 2, 840, 113549, 1, 1, 7})},
  428|      1|      {"SEED/CBC", OID({1, 2, 410, 200004, 1, 4})},
  429|      1|      {"SHA-1", OID({1, 3, 14, 3, 2, 26})},
  430|      1|      {"SHA-224", OID({2, 16, 840, 1, 101, 3, 4, 2, 4})},
  431|      1|      {"SHA-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 1})},
  432|      1|      {"SHA-3(224)", OID({2, 16, 840, 1, 101, 3, 4, 2, 7})},
  433|      1|      {"SHA-3(256)", OID({2, 16, 840, 1, 101, 3, 4, 2, 8})},
  434|      1|      {"SHA-3(384)", OID({2, 16, 840, 1, 101, 3, 4, 2, 9})},
  435|      1|      {"SHA-3(512)", OID({2, 16, 840, 1, 101, 3, 4, 2, 10})},
  436|      1|      {"SHA-384", OID({2, 16, 840, 1, 101, 3, 4, 2, 2})},
  437|      1|      {"SHA-512", OID({2, 16, 840, 1, 101, 3, 4, 2, 3})},
  438|      1|      {"SHA-512-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 6})},
  439|      1|      {"SHAKE-128", OID({2, 16, 840, 1, 101, 3, 4, 2, 11})},
  440|      1|      {"SHAKE-256", OID({2, 16, 840, 1, 101, 3, 4, 2, 12})},
  441|      1|      {"SM2", OID({1, 2, 156, 10197, 1, 301, 1})},
  442|      1|      {"SM2_Enc", OID({1, 2, 156, 10197, 1, 301, 3})},
  443|      1|      {"SM2_Kex", OID({1, 2, 156, 10197, 1, 301, 2})},
  444|      1|      {"SM2_Sig", OID({1, 2, 156, 10197, 1, 301, 1})},
  445|      1|      {"SM2_Sig/SM3", OID({1, 2, 156, 10197, 1, 501})},
  446|      1|      {"SM3", OID({1, 2, 156, 10197, 1, 401})},
  447|      1|      {"SM4/CBC", OID({1, 2, 156, 10197, 1, 104, 2})},
  448|      1|      {"SM4/GCM", OID({1, 2, 156, 10197, 1, 104, 8})},
  449|      1|      {"SM4/OCB", OID({1, 2, 156, 10197, 1, 104, 100})},
  450|      1|      {"SM4/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 9})},
  451|      1|      {"Scrypt", OID({1, 3, 6, 1, 4, 1, 11591, 4, 11})},
  452|      1|      {"Serpent/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 1})},
  453|      1|      {"Serpent/GCM", OID({1, 3, 6, 1, 4, 1, 25258, 3, 101})},
  454|      1|      {"Serpent/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 4})},
  455|      1|      {"Serpent/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 4})},
  456|      1|      {"Streebog-256", OID({1, 2, 643, 7, 1, 1, 2, 2})},
  457|      1|      {"Streebog-512", OID({1, 2, 643, 7, 1, 1, 2, 3})},
  458|      1|      {"Threefish-512/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2})},
  459|      1|      {"TripleDES/CBC", OID({1, 2, 840, 113549, 3, 7})},
  460|      1|      {"Twofish/CBC", OID({1, 3, 6, 1, 4, 1, 25258, 3, 3})},
  461|      1|      {"Twofish/GCM", OID({1, 3, 6, 1, 4, 1, 25258, 3, 102})},
  462|      1|      {"Twofish/OCB", OID({1, 3, 6, 1, 4, 1, 25258, 3, 2, 5})},
  463|      1|      {"Twofish/SIV", OID({1, 3, 6, 1, 4, 1, 25258, 3, 4, 5})},
  464|      1|      {"X509v3.AnyPolicy", OID({2, 5, 29, 32, 0})},
  465|      1|      {"X509v3.AuthorityKeyIdentifier", OID({2, 5, 29, 35})},
  466|      1|      {"X509v3.BasicConstraints", OID({2, 5, 29, 19})},
  467|      1|      {"X509v3.CRLDistributionPoints", OID({2, 5, 29, 31})},
  468|      1|      {"X509v3.CRLIssuingDistributionPoint", OID({2, 5, 29, 28})},
  469|      1|      {"X509v3.CRLNumber", OID({2, 5, 29, 20})},
  470|      1|      {"X509v3.CertificatePolicies", OID({2, 5, 29, 32})},
  471|      1|      {"X509v3.ExtendedKeyUsage", OID({2, 5, 29, 37})},
  472|      1|      {"X509v3.HoldInstructionCode", OID({2, 5, 29, 23})},
  473|      1|      {"X509v3.InvalidityDate", OID({2, 5, 29, 24})},
  474|      1|      {"X509v3.IssuerAlternativeName", OID({2, 5, 29, 18})},
  475|      1|      {"X509v3.KeyUsage", OID({2, 5, 29, 15})},
  476|      1|      {"X509v3.NameConstraints", OID({2, 5, 29, 30})},
  477|      1|      {"X509v3.PolicyConstraints", OID({2, 5, 29, 36})},
  478|      1|      {"X509v3.PrivateKeyUsagePeriod", OID({2, 5, 29, 16})},
  479|      1|      {"X509v3.ReasonCode", OID({2, 5, 29, 21})},
  480|      1|      {"X509v3.SubjectAlternativeName", OID({2, 5, 29, 17})},
  481|      1|      {"X509v3.SubjectKeyIdentifier", OID({2, 5, 29, 14})},
  482|      1|      {"X520.CommonName", OID({2, 5, 4, 3})},
  483|      1|      {"X520.Country", OID({2, 5, 4, 6})},
  484|      1|      {"X520.DNQualifier", OID({2, 5, 4, 46})},
  485|      1|      {"X520.GenerationalQualifier", OID({2, 5, 4, 44})},
  486|      1|      {"X520.GivenName", OID({2, 5, 4, 42})},
  487|      1|      {"X520.Initials", OID({2, 5, 4, 43})},
  488|      1|      {"X520.Locality", OID({2, 5, 4, 7})},
  489|      1|      {"X520.Organization", OID({2, 5, 4, 10})},
  490|      1|      {"X520.OrganizationalUnit", OID({2, 5, 4, 11})},
  491|      1|      {"X520.Pseudonym", OID({2, 5, 4, 65})},
  492|      1|      {"X520.SerialNumber", OID({2, 5, 4, 5})},
  493|      1|      {"X520.State", OID({2, 5, 4, 8})},
  494|      1|      {"X520.StreetAddress", OID({2, 5, 4, 9})},
  495|      1|      {"X520.Surname", OID({2, 5, 4, 4})},
  496|      1|      {"X520.Title", OID({2, 5, 4, 12})},
  497|      1|      {"XMSS", OID({0, 4, 0, 127, 0, 15, 1, 1, 13, 0})},
  498|      1|      {"XMSS-draft12", OID({1, 3, 6, 1, 4, 1, 25258, 1, 8})},
  499|      1|      {"XMSS-draft6", OID({1, 3, 6, 1, 4, 1, 25258, 1, 5})},
  500|      1|      {"brainpool160r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 1})},
  501|      1|      {"brainpool192r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 3})},
  502|      1|      {"brainpool224r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 5})},
  503|      1|      {"brainpool256r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 7})},
  504|      1|      {"brainpool320r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 9})},
  505|      1|      {"brainpool384r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 11})},
  506|      1|      {"brainpool512r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 13})},
  507|      1|      {"frp256v1", OID({1, 2, 250, 1, 223, 101, 256, 1})},
  508|      1|      {"gost_256A", OID({1, 2, 643, 7, 1, 2, 1, 1, 1})},
  509|      1|      {"gost_256B", OID({1, 2, 643, 7, 1, 2, 1, 1, 2})},
  510|      1|      {"gost_512A", OID({1, 2, 643, 7, 1, 2, 1, 2, 1})},
  511|      1|      {"gost_512B", OID({1, 2, 643, 7, 1, 2, 1, 2, 2})},
  512|      1|      {"secp160k1", OID({1, 3, 132, 0, 9})},
  513|      1|      {"secp160r1", OID({1, 3, 132, 0, 8})},
  514|      1|      {"secp160r2", OID({1, 3, 132, 0, 30})},
  515|      1|      {"secp192k1", OID({1, 3, 132, 0, 31})},
  516|      1|      {"secp192r1", OID({1, 2, 840, 10045, 3, 1, 1})},
  517|      1|      {"secp224k1", OID({1, 3, 132, 0, 32})},
  518|      1|      {"secp224r1", OID({1, 3, 132, 0, 33})},
  519|      1|      {"secp256k1", OID({1, 3, 132, 0, 10})},
  520|      1|      {"secp256r1", OID({1, 2, 840, 10045, 3, 1, 7})},
  521|      1|      {"secp384r1", OID({1, 3, 132, 0, 34})},
  522|      1|      {"secp521r1", OID({1, 3, 132, 0, 35})},
  523|      1|      {"sm2p256v1", OID({1, 2, 156, 10197, 1, 301})},
  524|      1|      {"x962_p192v2", OID({1, 2, 840, 10045, 3, 1, 2})},
  525|      1|      {"x962_p192v3", OID({1, 2, 840, 10045, 3, 1, 3})},
  526|      1|      {"x962_p239v1", OID({1, 2, 840, 10045, 3, 1, 4})},
  527|      1|      {"x962_p239v2", OID({1, 2, 840, 10045, 3, 1, 5})},
  528|      1|      {"x962_p239v3", OID({1, 2, 840, 10045, 3, 1, 6})}};
  529|      1|}

_ZN5Botan10PSS_ParamsC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm:
   35|  5.84k|      m_salt_len(salt_len) {}
_ZNK5Botan10PSS_Params9serializeEv:
   42|  5.84k|std::vector<uint8_t> PSS_Params::serialize() const {
   43|  5.84k|   std::vector<uint8_t> output;
   44|  5.84k|   DER_Encoder(output).encode(*this);
   45|  5.84k|   return output;
   46|  5.84k|}
_ZNK5Botan10PSS_Params11encode_intoERNS_11DER_EncoderE:
   48|  5.84k|void PSS_Params::encode_into(DER_Encoder& to) const {
   49|  5.84k|   const size_t trailer_field = 1;
   50|       |
   51|  5.84k|   to.start_sequence()
   52|  5.84k|      .start_context_specific(0)
   53|  5.84k|      .encode(m_hash)
   54|  5.84k|      .end_cons()
   55|  5.84k|      .start_context_specific(1)
   56|  5.84k|      .encode(m_mgf)
   57|  5.84k|      .end_cons()
   58|  5.84k|      .start_context_specific(2)
   59|  5.84k|      .encode(m_salt_len)
   60|  5.84k|      .end_cons()
   61|  5.84k|      .start_context_specific(3)
   62|  5.84k|      .encode(trailer_field)
   63|  5.84k|      .end_cons()
   64|  5.84k|      .end_cons();
   65|  5.84k|}

_ZN5Botan20Buffered_Computation9update_beEm:
   25|  7.61k|void Buffered_Computation::update_be(uint64_t val) {
   26|  7.61k|   uint8_t inb[sizeof(val)];
   27|  7.61k|   store_be(val, inb);
   28|  7.61k|   add_data(inb, sizeof(inb));
   29|  7.61k|}

_ZN5Botan18SymmetricAlgorithm7set_keyEPKhm:
   15|  36.1k|void SymmetricAlgorithm::set_key(const uint8_t key[], size_t length) {
   16|  36.1k|   if(!valid_keylength(length)) {
  ------------------
  |  Branch (16:7): [True: 0, False: 36.1k]
  ------------------
   17|      0|      throw Invalid_Key_Length(name(), length);
   18|      0|   }
   19|  36.1k|   key_schedule(key, length);
   20|  36.1k|}

_ZN5Botan11OctetStringC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   24|  38.4k|OctetString::OctetString(std::string_view hex_string) {
   25|  38.4k|   if(!hex_string.empty()) {
  ------------------
  |  Branch (25:7): [True: 19.2k, False: 19.2k]
  ------------------
   26|  19.2k|      m_data.resize(1 + hex_string.length() / 2);
   27|  19.2k|      m_data.resize(hex_decode(m_data.data(), hex_string));
   28|  19.2k|   }
   29|  38.4k|}

_ZNK5Botan7AES_12811parallelismEv:
  782|     84|size_t AES_128::parallelism() const { return aes_parallelism(); }
_ZNK5Botan7AES_25611parallelismEv:
  786|    562|size_t AES_256::parallelism() const { return aes_parallelism(); }
_ZNK5Botan7AES_12819has_keying_materialEv:
  788|  3.33k|bool AES_128::has_keying_material() const { return !m_EK.empty(); }
_ZNK5Botan7AES_25619has_keying_materialEv:
  792|  3.21k|bool AES_256::has_keying_material() const { return !m_EK.empty(); }
_ZNK5Botan7AES_1289encrypt_nEPKhPhm:
  794|  3.11k|void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  795|  3.11k|   assert_key_material_set();
  796|       |
  797|  3.11k|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  798|  3.11k|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (798:7): [True: 3.11k, False: 0]
  ------------------
  799|  3.11k|      return hw_aes_encrypt_n(in, out, blocks);
  800|  3.11k|   }
  801|      0|#endif
  802|       |
  803|      0|#if defined(BOTAN_HAS_AES_VPERM)
  804|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (804:7): [True: 0, False: 0]
  ------------------
  805|      0|      return vperm_encrypt_n(in, out, blocks);
  806|      0|   }
  807|      0|#endif
  808|       |
  809|      0|   aes_encrypt_n(in, out, blocks, m_EK);
  810|      0|}
_ZNK5Botan7AES_1289decrypt_nEPKhPhm:
  812|    104|void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  813|    104|   assert_key_material_set();
  814|       |
  815|    104|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  816|    104|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (816:7): [True: 104, False: 0]
  ------------------
  817|    104|      return hw_aes_decrypt_n(in, out, blocks);
  818|    104|   }
  819|      0|#endif
  820|       |
  821|      0|#if defined(BOTAN_HAS_AES_VPERM)
  822|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (822:7): [True: 0, False: 0]
  ------------------
  823|      0|      return vperm_decrypt_n(in, out, blocks);
  824|      0|   }
  825|      0|#endif
  826|       |
  827|      0|   aes_decrypt_n(in, out, blocks, m_DK);
  828|      0|}
_ZN5Botan7AES_12812key_scheduleEPKhm:
  830|    118|void AES_128::key_schedule(const uint8_t key[], size_t length) {
  831|    118|#if defined(BOTAN_HAS_AES_NI)
  832|    118|   if(CPUID::has_aes_ni()) {
  ------------------
  |  Branch (832:7): [True: 118, False: 0]
  ------------------
  833|    118|      return aesni_key_schedule(key, length);
  834|    118|   }
  835|      0|#endif
  836|       |
  837|      0|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  838|      0|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (838:7): [True: 0, False: 0]
  ------------------
  839|      0|      return aes_key_schedule(key, length, m_EK, m_DK, CPUID::is_little_endian());
  840|      0|   }
  841|      0|#endif
  842|       |
  843|      0|#if defined(BOTAN_HAS_AES_VPERM)
  844|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (844:7): [True: 0, False: 0]
  ------------------
  845|      0|      return vperm_key_schedule(key, length);
  846|      0|   }
  847|      0|#endif
  848|       |
  849|      0|   aes_key_schedule(key, length, m_EK, m_DK);
  850|      0|}
_ZNK5Botan7AES_2569encrypt_nEPKhPhm:
  920|  2.07k|void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  921|  2.07k|   assert_key_material_set();
  922|       |
  923|  2.07k|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  924|  2.07k|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (924:7): [True: 2.07k, False: 0]
  ------------------
  925|  2.07k|      return hw_aes_encrypt_n(in, out, blocks);
  926|  2.07k|   }
  927|      0|#endif
  928|       |
  929|      0|#if defined(BOTAN_HAS_AES_VPERM)
  930|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (930:7): [True: 0, False: 0]
  ------------------
  931|      0|      return vperm_encrypt_n(in, out, blocks);
  932|      0|   }
  933|      0|#endif
  934|       |
  935|      0|   aes_encrypt_n(in, out, blocks, m_EK);
  936|      0|}
_ZNK5Botan7AES_2569decrypt_nEPKhPhm:
  938|    420|void AES_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  939|    420|   assert_key_material_set();
  940|       |
  941|    420|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  942|    420|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (942:7): [True: 420, False: 0]
  ------------------
  943|    420|      return hw_aes_decrypt_n(in, out, blocks);
  944|    420|   }
  945|      0|#endif
  946|       |
  947|      0|#if defined(BOTAN_HAS_AES_VPERM)
  948|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (948:7): [True: 0, False: 0]
  ------------------
  949|      0|      return vperm_decrypt_n(in, out, blocks);
  950|      0|   }
  951|      0|#endif
  952|       |
  953|      0|   aes_decrypt_n(in, out, blocks, m_DK);
  954|      0|}
_ZN5Botan7AES_25612key_scheduleEPKhm:
  956|    330|void AES_256::key_schedule(const uint8_t key[], size_t length) {
  957|    330|#if defined(BOTAN_HAS_AES_NI)
  958|    330|   if(CPUID::has_aes_ni()) {
  ------------------
  |  Branch (958:7): [True: 330, False: 0]
  ------------------
  959|    330|      return aesni_key_schedule(key, length);
  960|    330|   }
  961|      0|#endif
  962|       |
  963|      0|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  964|      0|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (964:7): [True: 0, False: 0]
  ------------------
  965|      0|      return aes_key_schedule(key, length, m_EK, m_DK, CPUID::is_little_endian());
  966|      0|   }
  967|      0|#endif
  968|       |
  969|      0|#if defined(BOTAN_HAS_AES_VPERM)
  970|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (970:7): [True: 0, False: 0]
  ------------------
  971|      0|      return vperm_key_schedule(key, length);
  972|      0|   }
  973|      0|#endif
  974|       |
  975|      0|   aes_key_schedule(key, length, m_EK, m_DK);
  976|      0|}
aes.cpp:_ZN5Botan12_GLOBAL__N_115aes_parallelismEv:
  741|    646|size_t aes_parallelism() {
  742|    646|#if defined(BOTAN_HAS_HW_AES_SUPPORT)
  743|    646|   if(CPUID::has_hw_aes()) {
  ------------------
  |  Branch (743:7): [True: 646, False: 0]
  ------------------
  744|    646|      return 4;  // pipelined
  745|    646|   }
  746|      0|#endif
  747|       |
  748|      0|#if defined(BOTAN_HAS_AES_VPERM)
  749|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (749:7): [True: 0, False: 0]
  ------------------
  750|      0|      return 2;  // pipelined
  751|      0|   }
  752|      0|#endif
  753|       |
  754|       |   // bitsliced:
  755|      0|   return 2;
  756|      0|}

_ZNK5Botan7AES_12816hw_aes_encrypt_nEPKhPhm:
  129|  3.11k|BOTAN_FUNC_ISA("ssse3,aes") void AES_128::hw_aes_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  130|  3.11k|   const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_EK[4 * 0]);
  131|  3.11k|   const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_EK[4 * 1]);
  132|  3.11k|   const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_EK[4 * 2]);
  133|  3.11k|   const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_EK[4 * 3]);
  134|  3.11k|   const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_EK[4 * 4]);
  135|  3.11k|   const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_EK[4 * 5]);
  136|  3.11k|   const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_EK[4 * 6]);
  137|  3.11k|   const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_EK[4 * 7]);
  138|  3.11k|   const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_EK[4 * 8]);
  139|  3.11k|   const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_EK[4 * 9]);
  140|  3.11k|   const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_EK[4 * 10]);
  141|       |
  142|  3.73k|   while(blocks >= 4) {
  ------------------
  |  Branch (142:10): [True: 616, False: 3.11k]
  ------------------
  143|    616|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0);
  144|    616|      SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1);
  145|    616|      SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2);
  146|    616|      SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3);
  147|       |
  148|    616|      keyxor(K0, B0, B1, B2, B3);
  149|    616|      aesenc(K1, B0, B1, B2, B3);
  150|    616|      aesenc(K2, B0, B1, B2, B3);
  151|    616|      aesenc(K3, B0, B1, B2, B3);
  152|    616|      aesenc(K4, B0, B1, B2, B3);
  153|    616|      aesenc(K5, B0, B1, B2, B3);
  154|    616|      aesenc(K6, B0, B1, B2, B3);
  155|    616|      aesenc(K7, B0, B1, B2, B3);
  156|    616|      aesenc(K8, B0, B1, B2, B3);
  157|    616|      aesenc(K9, B0, B1, B2, B3);
  158|    616|      aesenclast(K10, B0, B1, B2, B3);
  159|       |
  160|    616|      B0.store_le(out + 16 * 0);
  161|    616|      B1.store_le(out + 16 * 1);
  162|    616|      B2.store_le(out + 16 * 2);
  163|    616|      B3.store_le(out + 16 * 3);
  164|       |
  165|    616|      blocks -= 4;
  166|    616|      in += 4 * 16;
  167|    616|      out += 4 * 16;
  168|    616|   }
  169|       |
  170|  6.07k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (170:22): [True: 2.96k, False: 3.11k]
  ------------------
  171|  2.96k|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i);
  172|       |
  173|  2.96k|      B0 ^= K0;
  174|  2.96k|      aesenc(K1, B0);
  175|  2.96k|      aesenc(K2, B0);
  176|  2.96k|      aesenc(K3, B0);
  177|  2.96k|      aesenc(K4, B0);
  178|  2.96k|      aesenc(K5, B0);
  179|  2.96k|      aesenc(K6, B0);
  180|  2.96k|      aesenc(K7, B0);
  181|  2.96k|      aesenc(K8, B0);
  182|  2.96k|      aesenc(K9, B0);
  183|  2.96k|      aesenclast(K10, B0);
  184|       |
  185|  2.96k|      B0.store_le(out + 16 * i);
  186|  2.96k|   }
  187|  3.11k|}
_ZNK5Botan7AES_12816hw_aes_decrypt_nEPKhPhm:
  192|    104|BOTAN_FUNC_ISA("ssse3,aes") void AES_128::hw_aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  193|    104|   const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_DK[4 * 0]);
  194|    104|   const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_DK[4 * 1]);
  195|    104|   const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_DK[4 * 2]);
  196|    104|   const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_DK[4 * 3]);
  197|    104|   const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_DK[4 * 4]);
  198|    104|   const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_DK[4 * 5]);
  199|    104|   const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_DK[4 * 6]);
  200|    104|   const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_DK[4 * 7]);
  201|    104|   const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_DK[4 * 8]);
  202|    104|   const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_DK[4 * 9]);
  203|    104|   const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_DK[4 * 10]);
  204|       |
  205|    471|   while(blocks >= 4) {
  ------------------
  |  Branch (205:10): [True: 367, False: 104]
  ------------------
  206|    367|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0);
  207|    367|      SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1);
  208|    367|      SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2);
  209|    367|      SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3);
  210|       |
  211|    367|      keyxor(K0, B0, B1, B2, B3);
  212|    367|      aesdec(K1, B0, B1, B2, B3);
  213|    367|      aesdec(K2, B0, B1, B2, B3);
  214|    367|      aesdec(K3, B0, B1, B2, B3);
  215|    367|      aesdec(K4, B0, B1, B2, B3);
  216|    367|      aesdec(K5, B0, B1, B2, B3);
  217|    367|      aesdec(K6, B0, B1, B2, B3);
  218|    367|      aesdec(K7, B0, B1, B2, B3);
  219|    367|      aesdec(K8, B0, B1, B2, B3);
  220|    367|      aesdec(K9, B0, B1, B2, B3);
  221|    367|      aesdeclast(K10, B0, B1, B2, B3);
  222|       |
  223|    367|      B0.store_le(out + 16 * 0);
  224|    367|      B1.store_le(out + 16 * 1);
  225|    367|      B2.store_le(out + 16 * 2);
  226|    367|      B3.store_le(out + 16 * 3);
  227|       |
  228|    367|      blocks -= 4;
  229|    367|      in += 4 * 16;
  230|    367|      out += 4 * 16;
  231|    367|   }
  232|       |
  233|    136|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (233:22): [True: 32, False: 104]
  ------------------
  234|     32|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i);
  235|       |
  236|     32|      B0 ^= K0;
  237|     32|      aesdec(K1, B0);
  238|     32|      aesdec(K2, B0);
  239|     32|      aesdec(K3, B0);
  240|     32|      aesdec(K4, B0);
  241|     32|      aesdec(K5, B0);
  242|     32|      aesdec(K6, B0);
  243|     32|      aesdec(K7, B0);
  244|     32|      aesdec(K8, B0);
  245|     32|      aesdec(K9, B0);
  246|     32|      aesdeclast(K10, B0);
  247|       |
  248|     32|      B0.store_le(out + 16 * i);
  249|     32|   }
  250|    104|}
_ZN5Botan7AES_12818aesni_key_scheduleEPKhm:
  255|    118|BOTAN_FUNC_ISA("ssse3,aes") void AES_128::aesni_key_schedule(const uint8_t key[], size_t /*length*/) {
  256|    118|   m_EK.resize(44);
  257|    118|   m_DK.resize(44);
  258|       |
  259|    118|   const __m128i K0 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(key));
  260|    118|   const __m128i K1 = aes_128_key_expansion<0x01>(K0, K0);
  261|    118|   const __m128i K2 = aes_128_key_expansion<0x02>(K1, K1);
  262|    118|   const __m128i K3 = aes_128_key_expansion<0x04>(K2, K2);
  263|    118|   const __m128i K4 = aes_128_key_expansion<0x08>(K3, K3);
  264|    118|   const __m128i K5 = aes_128_key_expansion<0x10>(K4, K4);
  265|    118|   const __m128i K6 = aes_128_key_expansion<0x20>(K5, K5);
  266|    118|   const __m128i K7 = aes_128_key_expansion<0x40>(K6, K6);
  267|    118|   const __m128i K8 = aes_128_key_expansion<0x80>(K7, K7);
  268|    118|   const __m128i K9 = aes_128_key_expansion<0x1B>(K8, K8);
  269|    118|   const __m128i K10 = aes_128_key_expansion<0x36>(K9, K9);
  270|       |
  271|    118|   __m128i* EK_mm = reinterpret_cast<__m128i*>(m_EK.data());
  272|    118|   _mm_storeu_si128(EK_mm, K0);
  273|    118|   _mm_storeu_si128(EK_mm + 1, K1);
  274|    118|   _mm_storeu_si128(EK_mm + 2, K2);
  275|    118|   _mm_storeu_si128(EK_mm + 3, K3);
  276|    118|   _mm_storeu_si128(EK_mm + 4, K4);
  277|    118|   _mm_storeu_si128(EK_mm + 5, K5);
  278|    118|   _mm_storeu_si128(EK_mm + 6, K6);
  279|    118|   _mm_storeu_si128(EK_mm + 7, K7);
  280|    118|   _mm_storeu_si128(EK_mm + 8, K8);
  281|    118|   _mm_storeu_si128(EK_mm + 9, K9);
  282|    118|   _mm_storeu_si128(EK_mm + 10, K10);
  283|       |
  284|       |   // Now generate decryption keys
  285|       |
  286|    118|   __m128i* DK_mm = reinterpret_cast<__m128i*>(m_DK.data());
  287|    118|   _mm_storeu_si128(DK_mm, K10);
  288|    118|   _mm_storeu_si128(DK_mm + 1, _mm_aesimc_si128(K9));
  289|    118|   _mm_storeu_si128(DK_mm + 2, _mm_aesimc_si128(K8));
  290|    118|   _mm_storeu_si128(DK_mm + 3, _mm_aesimc_si128(K7));
  291|    118|   _mm_storeu_si128(DK_mm + 4, _mm_aesimc_si128(K6));
  292|    118|   _mm_storeu_si128(DK_mm + 5, _mm_aesimc_si128(K5));
  293|    118|   _mm_storeu_si128(DK_mm + 6, _mm_aesimc_si128(K4));
  294|    118|   _mm_storeu_si128(DK_mm + 7, _mm_aesimc_si128(K3));
  295|    118|   _mm_storeu_si128(DK_mm + 8, _mm_aesimc_si128(K2));
  296|    118|   _mm_storeu_si128(DK_mm + 9, _mm_aesimc_si128(K1));
  297|    118|   _mm_storeu_si128(DK_mm + 10, K0);
  298|    118|}
_ZNK5Botan7AES_25616hw_aes_encrypt_nEPKhPhm:
  484|  2.07k|BOTAN_FUNC_ISA("ssse3,aes") void AES_256::hw_aes_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  485|  2.07k|   const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_EK[4 * 0]);
  486|  2.07k|   const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_EK[4 * 1]);
  487|  2.07k|   const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_EK[4 * 2]);
  488|  2.07k|   const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_EK[4 * 3]);
  489|  2.07k|   const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_EK[4 * 4]);
  490|  2.07k|   const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_EK[4 * 5]);
  491|  2.07k|   const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_EK[4 * 6]);
  492|  2.07k|   const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_EK[4 * 7]);
  493|  2.07k|   const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_EK[4 * 8]);
  494|  2.07k|   const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_EK[4 * 9]);
  495|  2.07k|   const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_EK[4 * 10]);
  496|  2.07k|   const SIMD_4x32 K11 = SIMD_4x32::load_le(&m_EK[4 * 11]);
  497|  2.07k|   const SIMD_4x32 K12 = SIMD_4x32::load_le(&m_EK[4 * 12]);
  498|  2.07k|   const SIMD_4x32 K13 = SIMD_4x32::load_le(&m_EK[4 * 13]);
  499|  2.07k|   const SIMD_4x32 K14 = SIMD_4x32::load_le(&m_EK[4 * 14]);
  500|       |
  501|  2.75k|   while(blocks >= 4) {
  ------------------
  |  Branch (501:10): [True: 680, False: 2.07k]
  ------------------
  502|    680|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0);
  503|    680|      SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1);
  504|    680|      SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2);
  505|    680|      SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3);
  506|       |
  507|    680|      keyxor(K0, B0, B1, B2, B3);
  508|    680|      aesenc(K1, B0, B1, B2, B3);
  509|    680|      aesenc(K2, B0, B1, B2, B3);
  510|    680|      aesenc(K3, B0, B1, B2, B3);
  511|    680|      aesenc(K4, B0, B1, B2, B3);
  512|    680|      aesenc(K5, B0, B1, B2, B3);
  513|    680|      aesenc(K6, B0, B1, B2, B3);
  514|    680|      aesenc(K7, B0, B1, B2, B3);
  515|    680|      aesenc(K8, B0, B1, B2, B3);
  516|    680|      aesenc(K9, B0, B1, B2, B3);
  517|    680|      aesenc(K10, B0, B1, B2, B3);
  518|    680|      aesenc(K11, B0, B1, B2, B3);
  519|    680|      aesenc(K12, B0, B1, B2, B3);
  520|    680|      aesenc(K13, B0, B1, B2, B3);
  521|    680|      aesenclast(K14, B0, B1, B2, B3);
  522|       |
  523|    680|      B0.store_le(out + 16 * 0);
  524|    680|      B1.store_le(out + 16 * 1);
  525|    680|      B2.store_le(out + 16 * 2);
  526|    680|      B3.store_le(out + 16 * 3);
  527|       |
  528|    680|      blocks -= 4;
  529|    680|      in += 4 * 16;
  530|    680|      out += 4 * 16;
  531|    680|   }
  532|       |
  533|  3.97k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (533:22): [True: 1.90k, False: 2.07k]
  ------------------
  534|  1.90k|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i);
  535|       |
  536|  1.90k|      B0 ^= K0;
  537|       |
  538|  1.90k|      aesenc(K1, B0);
  539|  1.90k|      aesenc(K2, B0);
  540|  1.90k|      aesenc(K3, B0);
  541|  1.90k|      aesenc(K4, B0);
  542|  1.90k|      aesenc(K5, B0);
  543|  1.90k|      aesenc(K6, B0);
  544|  1.90k|      aesenc(K7, B0);
  545|  1.90k|      aesenc(K8, B0);
  546|  1.90k|      aesenc(K9, B0);
  547|  1.90k|      aesenc(K10, B0);
  548|  1.90k|      aesenc(K11, B0);
  549|  1.90k|      aesenc(K12, B0);
  550|  1.90k|      aesenc(K13, B0);
  551|  1.90k|      aesenclast(K14, B0);
  552|       |
  553|  1.90k|      B0.store_le(out + 16 * i);
  554|  1.90k|   }
  555|  2.07k|}
_ZNK5Botan7AES_25616hw_aes_decrypt_nEPKhPhm:
  560|    420|BOTAN_FUNC_ISA("ssse3,aes") void AES_256::hw_aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  561|    420|   const SIMD_4x32 K0 = SIMD_4x32::load_le(&m_DK[4 * 0]);
  562|    420|   const SIMD_4x32 K1 = SIMD_4x32::load_le(&m_DK[4 * 1]);
  563|    420|   const SIMD_4x32 K2 = SIMD_4x32::load_le(&m_DK[4 * 2]);
  564|    420|   const SIMD_4x32 K3 = SIMD_4x32::load_le(&m_DK[4 * 3]);
  565|    420|   const SIMD_4x32 K4 = SIMD_4x32::load_le(&m_DK[4 * 4]);
  566|    420|   const SIMD_4x32 K5 = SIMD_4x32::load_le(&m_DK[4 * 5]);
  567|    420|   const SIMD_4x32 K6 = SIMD_4x32::load_le(&m_DK[4 * 6]);
  568|    420|   const SIMD_4x32 K7 = SIMD_4x32::load_le(&m_DK[4 * 7]);
  569|    420|   const SIMD_4x32 K8 = SIMD_4x32::load_le(&m_DK[4 * 8]);
  570|    420|   const SIMD_4x32 K9 = SIMD_4x32::load_le(&m_DK[4 * 9]);
  571|    420|   const SIMD_4x32 K10 = SIMD_4x32::load_le(&m_DK[4 * 10]);
  572|    420|   const SIMD_4x32 K11 = SIMD_4x32::load_le(&m_DK[4 * 11]);
  573|    420|   const SIMD_4x32 K12 = SIMD_4x32::load_le(&m_DK[4 * 12]);
  574|    420|   const SIMD_4x32 K13 = SIMD_4x32::load_le(&m_DK[4 * 13]);
  575|    420|   const SIMD_4x32 K14 = SIMD_4x32::load_le(&m_DK[4 * 14]);
  576|       |
  577|  1.93k|   while(blocks >= 4) {
  ------------------
  |  Branch (577:10): [True: 1.51k, False: 420]
  ------------------
  578|  1.51k|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * 0);
  579|  1.51k|      SIMD_4x32 B1 = SIMD_4x32::load_le(in + 16 * 1);
  580|  1.51k|      SIMD_4x32 B2 = SIMD_4x32::load_le(in + 16 * 2);
  581|  1.51k|      SIMD_4x32 B3 = SIMD_4x32::load_le(in + 16 * 3);
  582|       |
  583|  1.51k|      keyxor(K0, B0, B1, B2, B3);
  584|  1.51k|      aesdec(K1, B0, B1, B2, B3);
  585|  1.51k|      aesdec(K2, B0, B1, B2, B3);
  586|  1.51k|      aesdec(K3, B0, B1, B2, B3);
  587|  1.51k|      aesdec(K4, B0, B1, B2, B3);
  588|  1.51k|      aesdec(K5, B0, B1, B2, B3);
  589|  1.51k|      aesdec(K6, B0, B1, B2, B3);
  590|  1.51k|      aesdec(K7, B0, B1, B2, B3);
  591|  1.51k|      aesdec(K8, B0, B1, B2, B3);
  592|  1.51k|      aesdec(K9, B0, B1, B2, B3);
  593|  1.51k|      aesdec(K10, B0, B1, B2, B3);
  594|  1.51k|      aesdec(K11, B0, B1, B2, B3);
  595|  1.51k|      aesdec(K12, B0, B1, B2, B3);
  596|  1.51k|      aesdec(K13, B0, B1, B2, B3);
  597|  1.51k|      aesdeclast(K14, B0, B1, B2, B3);
  598|       |
  599|  1.51k|      B0.store_le(out + 16 * 0);
  600|  1.51k|      B1.store_le(out + 16 * 1);
  601|  1.51k|      B2.store_le(out + 16 * 2);
  602|  1.51k|      B3.store_le(out + 16 * 3);
  603|       |
  604|  1.51k|      blocks -= 4;
  605|  1.51k|      in += 4 * 16;
  606|  1.51k|      out += 4 * 16;
  607|  1.51k|   }
  608|       |
  609|    530|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (609:22): [True: 110, False: 420]
  ------------------
  610|    110|      SIMD_4x32 B0 = SIMD_4x32::load_le(in + 16 * i);
  611|       |
  612|    110|      B0 ^= K0;
  613|       |
  614|    110|      aesdec(K1, B0);
  615|    110|      aesdec(K2, B0);
  616|    110|      aesdec(K3, B0);
  617|    110|      aesdec(K4, B0);
  618|    110|      aesdec(K5, B0);
  619|    110|      aesdec(K6, B0);
  620|    110|      aesdec(K7, B0);
  621|    110|      aesdec(K8, B0);
  622|    110|      aesdec(K9, B0);
  623|    110|      aesdec(K10, B0);
  624|    110|      aesdec(K11, B0);
  625|    110|      aesdec(K12, B0);
  626|    110|      aesdec(K13, B0);
  627|    110|      aesdeclast(K14, B0);
  628|       |
  629|    110|      B0.store_le(out + 16 * i);
  630|    110|   }
  631|    420|}
_ZN5Botan7AES_25618aesni_key_scheduleEPKhm:
  636|    330|BOTAN_FUNC_ISA("ssse3,aes") void AES_256::aesni_key_schedule(const uint8_t key[], size_t /*length*/) {
  637|    330|   m_EK.resize(60);
  638|    330|   m_DK.resize(60);
  639|       |
  640|    330|   const __m128i K0 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(key));
  641|    330|   const __m128i K1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(key + 16));
  642|       |
  643|    330|   const __m128i K2 = aes_128_key_expansion<0x01>(K0, K1);
  644|    330|   const __m128i K3 = aes_256_key_expansion(K1, K2);
  645|       |
  646|    330|   const __m128i K4 = aes_128_key_expansion<0x02>(K2, K3);
  647|    330|   const __m128i K5 = aes_256_key_expansion(K3, K4);
  648|       |
  649|    330|   const __m128i K6 = aes_128_key_expansion<0x04>(K4, K5);
  650|    330|   const __m128i K7 = aes_256_key_expansion(K5, K6);
  651|       |
  652|    330|   const __m128i K8 = aes_128_key_expansion<0x08>(K6, K7);
  653|    330|   const __m128i K9 = aes_256_key_expansion(K7, K8);
  654|       |
  655|    330|   const __m128i K10 = aes_128_key_expansion<0x10>(K8, K9);
  656|    330|   const __m128i K11 = aes_256_key_expansion(K9, K10);
  657|       |
  658|    330|   const __m128i K12 = aes_128_key_expansion<0x20>(K10, K11);
  659|    330|   const __m128i K13 = aes_256_key_expansion(K11, K12);
  660|       |
  661|    330|   const __m128i K14 = aes_128_key_expansion<0x40>(K12, K13);
  662|       |
  663|    330|   __m128i* EK_mm = reinterpret_cast<__m128i*>(m_EK.data());
  664|    330|   _mm_storeu_si128(EK_mm, K0);
  665|    330|   _mm_storeu_si128(EK_mm + 1, K1);
  666|    330|   _mm_storeu_si128(EK_mm + 2, K2);
  667|    330|   _mm_storeu_si128(EK_mm + 3, K3);
  668|    330|   _mm_storeu_si128(EK_mm + 4, K4);
  669|    330|   _mm_storeu_si128(EK_mm + 5, K5);
  670|    330|   _mm_storeu_si128(EK_mm + 6, K6);
  671|    330|   _mm_storeu_si128(EK_mm + 7, K7);
  672|    330|   _mm_storeu_si128(EK_mm + 8, K8);
  673|    330|   _mm_storeu_si128(EK_mm + 9, K9);
  674|    330|   _mm_storeu_si128(EK_mm + 10, K10);
  675|    330|   _mm_storeu_si128(EK_mm + 11, K11);
  676|    330|   _mm_storeu_si128(EK_mm + 12, K12);
  677|    330|   _mm_storeu_si128(EK_mm + 13, K13);
  678|    330|   _mm_storeu_si128(EK_mm + 14, K14);
  679|       |
  680|       |   // Now generate decryption keys
  681|    330|   __m128i* DK_mm = reinterpret_cast<__m128i*>(m_DK.data());
  682|    330|   _mm_storeu_si128(DK_mm, K14);
  683|    330|   _mm_storeu_si128(DK_mm + 1, _mm_aesimc_si128(K13));
  684|    330|   _mm_storeu_si128(DK_mm + 2, _mm_aesimc_si128(K12));
  685|    330|   _mm_storeu_si128(DK_mm + 3, _mm_aesimc_si128(K11));
  686|    330|   _mm_storeu_si128(DK_mm + 4, _mm_aesimc_si128(K10));
  687|    330|   _mm_storeu_si128(DK_mm + 5, _mm_aesimc_si128(K9));
  688|    330|   _mm_storeu_si128(DK_mm + 6, _mm_aesimc_si128(K8));
  689|    330|   _mm_storeu_si128(DK_mm + 7, _mm_aesimc_si128(K7));
  690|    330|   _mm_storeu_si128(DK_mm + 8, _mm_aesimc_si128(K6));
  691|    330|   _mm_storeu_si128(DK_mm + 9, _mm_aesimc_si128(K5));
  692|    330|   _mm_storeu_si128(DK_mm + 10, _mm_aesimc_si128(K4));
  693|    330|   _mm_storeu_si128(DK_mm + 11, _mm_aesimc_si128(K3));
  694|    330|   _mm_storeu_si128(DK_mm + 12, _mm_aesimc_si128(K2));
  695|    330|   _mm_storeu_si128(DK_mm + 13, _mm_aesimc_si128(K1));
  696|    330|   _mm_storeu_si128(DK_mm + 14, K0);
  697|    330|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16keyxorENS_9SIMD_4x32ERS1_S2_S2_S2_:
   69|  3.17k|BOTAN_FORCE_INLINE void keyxor(SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) {
   70|  3.17k|   B0 ^= K;
   71|  3.17k|   B1 ^= K;
   72|  3.17k|   B2 ^= K;
   73|  3.17k|   B3 ^= K;
   74|  3.17k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesencENS_9SIMD_4x32ERS1_S2_S2_S2_:
   81|  14.3k|BOTAN_FORCE_INLINE void aesenc(SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) {
   82|  14.3k|   B0 = SIMD_4x32(_mm_aesenc_si128(B0.raw(), K.raw()));
   83|  14.3k|   B1 = SIMD_4x32(_mm_aesenc_si128(B1.raw(), K.raw()));
   84|  14.3k|   B2 = SIMD_4x32(_mm_aesenc_si128(B2.raw(), K.raw()));
   85|  14.3k|   B3 = SIMD_4x32(_mm_aesenc_si128(B3.raw(), K.raw()));
   86|  14.3k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesenclastENS_9SIMD_4x32ERS1_S2_S2_S2_:
   93|  1.29k|BOTAN_FORCE_INLINE void aesenclast(SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) {
   94|  1.29k|   B0 = SIMD_4x32(_mm_aesenclast_si128(B0.raw(), K.raw()));
   95|  1.29k|   B1 = SIMD_4x32(_mm_aesenclast_si128(B1.raw(), K.raw()));
   96|  1.29k|   B2 = SIMD_4x32(_mm_aesenclast_si128(B2.raw(), K.raw()));
   97|  1.29k|   B3 = SIMD_4x32(_mm_aesenclast_si128(B3.raw(), K.raw()));
   98|  1.29k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesencENS_9SIMD_4x32ERS1_:
   76|  51.3k|BOTAN_FUNC_ISA("aes") BOTAN_FORCE_INLINE void aesenc(SIMD_4x32 K, SIMD_4x32& B) {
   77|  51.3k|   B = SIMD_4x32(_mm_aesenc_si128(B.raw(), K.raw()));
   78|  51.3k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesenclastENS_9SIMD_4x32ERS1_:
   88|  4.86k|BOTAN_FUNC_ISA("aes") BOTAN_FORCE_INLINE void aesenclast(SIMD_4x32 K, SIMD_4x32& B) {
   89|  4.86k|   B = SIMD_4x32(_mm_aesenclast_si128(B.raw(), K.raw()));
   90|  4.86k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesdecENS_9SIMD_4x32ERS1_S2_S2_S2_:
  105|  22.9k|BOTAN_FORCE_INLINE void aesdec(SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) {
  106|  22.9k|   B0 = SIMD_4x32(_mm_aesdec_si128(B0.raw(), K.raw()));
  107|  22.9k|   B1 = SIMD_4x32(_mm_aesdec_si128(B1.raw(), K.raw()));
  108|  22.9k|   B2 = SIMD_4x32(_mm_aesdec_si128(B2.raw(), K.raw()));
  109|  22.9k|   B3 = SIMD_4x32(_mm_aesdec_si128(B3.raw(), K.raw()));
  110|  22.9k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesdeclastENS_9SIMD_4x32ERS1_S2_S2_S2_:
  117|  1.88k|BOTAN_FORCE_INLINE void aesdeclast(SIMD_4x32 K, SIMD_4x32& B0, SIMD_4x32& B1, SIMD_4x32& B2, SIMD_4x32& B3) {
  118|  1.88k|   B0 = SIMD_4x32(_mm_aesdeclast_si128(B0.raw(), K.raw()));
  119|  1.88k|   B1 = SIMD_4x32(_mm_aesdeclast_si128(B1.raw(), K.raw()));
  120|  1.88k|   B2 = SIMD_4x32(_mm_aesdeclast_si128(B2.raw(), K.raw()));
  121|  1.88k|   B3 = SIMD_4x32(_mm_aesdeclast_si128(B3.raw(), K.raw()));
  122|  1.88k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_16aesdecENS_9SIMD_4x32ERS1_:
  100|  1.71k|BOTAN_FUNC_ISA("aes") BOTAN_FORCE_INLINE void aesdec(SIMD_4x32 K, SIMD_4x32& B) {
  101|  1.71k|   B = SIMD_4x32(_mm_aesdec_si128(B.raw(), K.raw()));
  102|  1.71k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_110aesdeclastENS_9SIMD_4x32ERS1_:
  112|    142|BOTAN_FUNC_ISA("aes") BOTAN_FORCE_INLINE void aesdeclast(SIMD_4x32 K, SIMD_4x32& B) {
  113|    142|   B = SIMD_4x32(_mm_aesdeclast_si128(B.raw(), K.raw()));
  114|    142|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_256_key_expansionEDv2_xS1_:
   59|  1.98k|BOTAN_FUNC_ISA("ssse3,aes") __m128i aes_256_key_expansion(__m128i key, __m128i key2) {
   60|  1.98k|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key2, 0x00);
   61|  1.98k|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(2, 2, 2, 2));
   62|       |
   63|  1.98k|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   64|  1.98k|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   65|  1.98k|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   66|  1.98k|   return _mm_xor_si128(key, key_with_rcon);
   67|  1.98k|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh1EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh2EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh4EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh8EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh16EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh32EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh64EEEDv2_xS2_S2_:
   20|    448|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    448|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    448|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    448|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    448|   return _mm_xor_si128(key, key_with_rcon);
   27|    448|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh128EEEDv2_xS2_S2_:
   20|    118|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    118|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    118|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    118|   return _mm_xor_si128(key, key_with_rcon);
   27|    118|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh27EEEDv2_xS2_S2_:
   20|    118|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    118|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    118|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    118|   return _mm_xor_si128(key, key_with_rcon);
   27|    118|}
aes_ni.cpp:_ZN5Botan12_GLOBAL__N_121aes_128_key_expansionILh54EEEDv2_xS2_S2_:
   20|    118|inline __m128i aes_128_key_expansion(__m128i key, __m128i key_getting_rcon) {
   21|    118|   __m128i key_with_rcon = _mm_aeskeygenassist_si128(key_getting_rcon, RC);
   22|    118|   key_with_rcon = _mm_shuffle_epi32(key_with_rcon, _MM_SHUFFLE(3, 3, 3, 3));
   23|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   24|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   25|    118|   key = _mm_xor_si128(key, _mm_slli_si128(key, 4));
   26|    118|   return _mm_xor_si128(key, key_with_rcon);
   27|    118|}

_ZNK5Botan8ARIA_1289encrypt_nEPKhPhm:
  362|    160|void ARIA_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  363|    160|   assert_key_material_set();
  364|    160|   ARIA_F::transform(in, out, blocks, m_ERK);
  365|    160|}
_ZNK5Botan8ARIA_2569encrypt_nEPKhPhm:
  372|    343|void ARIA_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  373|    343|   assert_key_material_set();
  374|    343|   ARIA_F::transform(in, out, blocks, m_ERK);
  375|    343|}
_ZNK5Botan8ARIA_12819has_keying_materialEv:
  392|    315|bool ARIA_128::has_keying_material() const { return !m_ERK.empty(); }
_ZNK5Botan8ARIA_25619has_keying_materialEv:
  396|    552|bool ARIA_256::has_keying_material() const { return !m_ERK.empty(); }
_ZN5Botan8ARIA_12812key_scheduleEPKhm:
  398|     25|void ARIA_128::key_schedule(const uint8_t key[], size_t length) { ARIA_F::key_schedule(m_ERK, m_DRK, key, length); }
_ZN5Botan8ARIA_25612key_scheduleEPKhm:
  402|     38|void ARIA_256::key_schedule(const uint8_t key[], size_t length) { ARIA_F::key_schedule(m_ERK, m_DRK, key, length); }
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F9transformEPKhPhmRKNSt3__16vectorIjNS_16secure_allocatorIjEEEE:
  166|    503|void transform(const uint8_t in[], uint8_t out[], size_t blocks, const secure_vector<uint32_t>& KS) {
  167|    503|   prefetch_arrays(S1, S2, X1, X2);
  168|       |
  169|    503|   const size_t ROUNDS = (KS.size() / 4) - 1;
  170|       |
  171|  2.51k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (171:22): [True: 2.01k, False: 503]
  ------------------
  172|  2.01k|      uint32_t t0, t1, t2, t3;
  173|  2.01k|      load_be(in + 16 * i, t0, t1, t2, t3);
  174|       |
  175|  16.8k|      for(size_t r = 0; r < ROUNDS; r += 2) {
  ------------------
  |  Branch (175:25): [True: 14.8k, False: 2.01k]
  ------------------
  176|  14.8k|         t0 ^= KS[4 * r];
  177|  14.8k|         t1 ^= KS[4 * r + 1];
  178|  14.8k|         t2 ^= KS[4 * r + 2];
  179|  14.8k|         t3 ^= KS[4 * r + 3];
  180|  14.8k|         ARIA_FO(t0, t1, t2, t3);
  181|       |
  182|  14.8k|         t0 ^= KS[4 * r + 4];
  183|  14.8k|         t1 ^= KS[4 * r + 5];
  184|  14.8k|         t2 ^= KS[4 * r + 6];
  185|  14.8k|         t3 ^= KS[4 * r + 7];
  186|       |
  187|  14.8k|         if(r != ROUNDS - 2) {
  ------------------
  |  Branch (187:13): [True: 12.8k, False: 2.01k]
  ------------------
  188|  12.8k|            ARIA_FE(t0, t1, t2, t3);
  189|  12.8k|         }
  190|  14.8k|      }
  191|       |
  192|  2.01k|      out[16 * i + 0] = X1[get_byte<0>(t0)] ^ get_byte<0>(KS[4 * ROUNDS]);
  193|  2.01k|      out[16 * i + 1] = X2[get_byte<1>(t0)] ^ get_byte<1>(KS[4 * ROUNDS]);
  194|  2.01k|      out[16 * i + 2] = S1[get_byte<2>(t0)] ^ get_byte<2>(KS[4 * ROUNDS]);
  195|  2.01k|      out[16 * i + 3] = S2[get_byte<3>(t0)] ^ get_byte<3>(KS[4 * ROUNDS]);
  196|  2.01k|      out[16 * i + 4] = X1[get_byte<0>(t1)] ^ get_byte<0>(KS[4 * ROUNDS + 1]);
  197|  2.01k|      out[16 * i + 5] = X2[get_byte<1>(t1)] ^ get_byte<1>(KS[4 * ROUNDS + 1]);
  198|  2.01k|      out[16 * i + 6] = S1[get_byte<2>(t1)] ^ get_byte<2>(KS[4 * ROUNDS + 1]);
  199|  2.01k|      out[16 * i + 7] = S2[get_byte<3>(t1)] ^ get_byte<3>(KS[4 * ROUNDS + 1]);
  200|  2.01k|      out[16 * i + 8] = X1[get_byte<0>(t2)] ^ get_byte<0>(KS[4 * ROUNDS + 2]);
  201|  2.01k|      out[16 * i + 9] = X2[get_byte<1>(t2)] ^ get_byte<1>(KS[4 * ROUNDS + 2]);
  202|  2.01k|      out[16 * i + 10] = S1[get_byte<2>(t2)] ^ get_byte<2>(KS[4 * ROUNDS + 2]);
  203|  2.01k|      out[16 * i + 11] = S2[get_byte<3>(t2)] ^ get_byte<3>(KS[4 * ROUNDS + 2]);
  204|  2.01k|      out[16 * i + 12] = X1[get_byte<0>(t3)] ^ get_byte<0>(KS[4 * ROUNDS + 3]);
  205|  2.01k|      out[16 * i + 13] = X2[get_byte<1>(t3)] ^ get_byte<1>(KS[4 * ROUNDS + 3]);
  206|  2.01k|      out[16 * i + 14] = S1[get_byte<2>(t3)] ^ get_byte<2>(KS[4 * ROUNDS + 3]);
  207|  2.01k|      out[16 * i + 15] = S2[get_byte<3>(t3)] ^ get_byte<3>(KS[4 * ROUNDS + 3]);
  208|  2.01k|   }
  209|    503|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_FOERjS2_S2_S2_:
  113|  14.9k|inline void ARIA_FO(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3) {
  114|  14.9k|   T0 = ARIA_F1(T0);
  115|  14.9k|   T1 = ARIA_F1(T1);
  116|  14.9k|   T2 = ARIA_F1(T2);
  117|  14.9k|   T3 = ARIA_F1(T3);
  118|       |
  119|  14.9k|   T1 ^= T2;
  120|  14.9k|   T2 ^= T3;
  121|  14.9k|   T0 ^= T1;
  122|  14.9k|   T3 ^= T1;
  123|  14.9k|   T2 ^= T0;
  124|  14.9k|   T1 ^= T2;
  125|       |
  126|  14.9k|   T1 = ((T1 << 8) & 0xFF00FF00) | ((T1 >> 8) & 0x00FF00FF);
  127|  14.9k|   T2 = rotr<16>(T2);
  128|  14.9k|   T3 = reverse_bytes(T3);
  129|       |
  130|  14.9k|   T1 ^= T2;
  131|  14.9k|   T2 ^= T3;
  132|  14.9k|   T0 ^= T1;
  133|  14.9k|   T3 ^= T1;
  134|  14.9k|   T2 ^= T0;
  135|  14.9k|   T1 ^= T2;
  136|  14.9k|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_F1Ej:
   95|  59.7k|inline uint32_t ARIA_F1(uint32_t X) {
   96|  59.7k|   const uint32_t M1 = 0x00010101;
   97|  59.7k|   const uint32_t M2 = 0x01000101;
   98|  59.7k|   const uint32_t M3 = 0x01010001;
   99|  59.7k|   const uint32_t M4 = 0x01010100;
  100|       |
  101|  59.7k|   return (S1[get_byte<0>(X)] * M1) ^ (S2[get_byte<1>(X)] * M2) ^ (X1[get_byte<2>(X)] * M3) ^ (X2[get_byte<3>(X)] * M4);
  102|  59.7k|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_FEERjS2_S2_S2_:
  138|  12.8k|inline void ARIA_FE(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3) {
  139|  12.8k|   T0 = ARIA_F2(T0);
  140|  12.8k|   T1 = ARIA_F2(T1);
  141|  12.8k|   T2 = ARIA_F2(T2);
  142|  12.8k|   T3 = ARIA_F2(T3);
  143|       |
  144|  12.8k|   T1 ^= T2;
  145|  12.8k|   T2 ^= T3;
  146|  12.8k|   T0 ^= T1;
  147|  12.8k|   T3 ^= T1;
  148|  12.8k|   T2 ^= T0;
  149|  12.8k|   T1 ^= T2;
  150|       |
  151|  12.8k|   T3 = ((T3 << 8) & 0xFF00FF00) | ((T3 >> 8) & 0x00FF00FF);
  152|  12.8k|   T0 = rotr<16>(T0);
  153|  12.8k|   T1 = reverse_bytes(T1);
  154|       |
  155|  12.8k|   T1 ^= T2;
  156|  12.8k|   T2 ^= T3;
  157|  12.8k|   T0 ^= T1;
  158|  12.8k|   T3 ^= T1;
  159|  12.8k|   T2 ^= T0;
  160|  12.8k|   T1 ^= T2;
  161|  12.8k|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F7ARIA_F2Ej:
  104|  51.4k|inline uint32_t ARIA_F2(uint32_t X) {
  105|  51.4k|   const uint32_t M1 = 0x00010101;
  106|  51.4k|   const uint32_t M2 = 0x01000101;
  107|  51.4k|   const uint32_t M3 = 0x01010001;
  108|  51.4k|   const uint32_t M4 = 0x01010100;
  109|       |
  110|  51.4k|   return (X1[get_byte<0>(X)] * M3) ^ (X2[get_byte<1>(X)] * M4) ^ (S1[get_byte<2>(X)] * M1) ^ (S2[get_byte<3>(X)] * M2);
  111|  51.4k|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F12key_scheduleERNSt3__16vectorIjNS_16secure_allocatorIjEEEES7_PKhm:
  252|     63|void key_schedule(secure_vector<uint32_t>& ERK, secure_vector<uint32_t>& DRK, const uint8_t key[], size_t length) {
  253|     63|   const uint32_t KRK[3][4] = {{0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0},
  254|     63|                               {0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0},
  255|     63|                               {0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e}};
  256|       |
  257|     63|   const size_t CK0 = (length / 8) - 2;
  258|     63|   const size_t CK1 = (CK0 + 1) % 3;
  259|     63|   const size_t CK2 = (CK1 + 1) % 3;
  260|       |
  261|     63|   uint32_t w0[4];
  262|     63|   uint32_t w1[4];
  263|     63|   uint32_t w2[4];
  264|     63|   uint32_t w3[4];
  265|       |
  266|     63|   w0[0] = load_be<uint32_t>(key, 0);
  267|     63|   w0[1] = load_be<uint32_t>(key, 1);
  268|     63|   w0[2] = load_be<uint32_t>(key, 2);
  269|     63|   w0[3] = load_be<uint32_t>(key, 3);
  270|       |
  271|     63|   w1[0] = w0[0] ^ KRK[CK0][0];
  272|     63|   w1[1] = w0[1] ^ KRK[CK0][1];
  273|     63|   w1[2] = w0[2] ^ KRK[CK0][2];
  274|     63|   w1[3] = w0[3] ^ KRK[CK0][3];
  275|       |
  276|     63|   ARIA_FO(w1[0], w1[1], w1[2], w1[3]);
  277|       |
  278|     63|   if(length == 24 || length == 32) {
  ------------------
  |  Branch (278:7): [True: 0, False: 63]
  |  Branch (278:23): [True: 38, False: 25]
  ------------------
  279|     38|      w1[0] ^= load_be<uint32_t>(key, 4);
  280|     38|      w1[1] ^= load_be<uint32_t>(key, 5);
  281|     38|   }
  282|     63|   if(length == 32) {
  ------------------
  |  Branch (282:7): [True: 38, False: 25]
  ------------------
  283|     38|      w1[2] ^= load_be<uint32_t>(key, 6);
  284|     38|      w1[3] ^= load_be<uint32_t>(key, 7);
  285|     38|   }
  286|       |
  287|     63|   w2[0] = w1[0] ^ KRK[CK1][0];
  288|     63|   w2[1] = w1[1] ^ KRK[CK1][1];
  289|     63|   w2[2] = w1[2] ^ KRK[CK1][2];
  290|     63|   w2[3] = w1[3] ^ KRK[CK1][3];
  291|       |
  292|     63|   ARIA_FE(w2[0], w2[1], w2[2], w2[3]);
  293|       |
  294|     63|   w2[0] ^= w0[0];
  295|     63|   w2[1] ^= w0[1];
  296|     63|   w2[2] ^= w0[2];
  297|     63|   w2[3] ^= w0[3];
  298|       |
  299|     63|   w3[0] = w2[0] ^ KRK[CK2][0];
  300|     63|   w3[1] = w2[1] ^ KRK[CK2][1];
  301|     63|   w3[2] = w2[2] ^ KRK[CK2][2];
  302|     63|   w3[3] = w2[3] ^ KRK[CK2][3];
  303|       |
  304|     63|   ARIA_FO(w3[0], w3[1], w3[2], w3[3]);
  305|       |
  306|     63|   w3[0] ^= w1[0];
  307|     63|   w3[1] ^= w1[1];
  308|     63|   w3[2] ^= w1[2];
  309|     63|   w3[3] ^= w1[3];
  310|       |
  311|     63|   if(length == 16) {
  ------------------
  |  Branch (311:7): [True: 25, False: 38]
  ------------------
  312|     25|      ERK.resize(4 * 13);
  313|     38|   } else if(length == 24) {
  ------------------
  |  Branch (313:14): [True: 0, False: 38]
  ------------------
  314|      0|      ERK.resize(4 * 15);
  315|     38|   } else if(length == 32) {
  ------------------
  |  Branch (315:14): [True: 38, False: 0]
  ------------------
  316|     38|      ERK.resize(4 * 17);
  317|     38|   }
  318|       |
  319|     63|   ARIA_ROL128<19>(w0, w1, &ERK[0]);
  320|     63|   ARIA_ROL128<19>(w1, w2, &ERK[4]);
  321|     63|   ARIA_ROL128<19>(w2, w3, &ERK[8]);
  322|     63|   ARIA_ROL128<19>(w3, w0, &ERK[12]);
  323|     63|   ARIA_ROL128<31>(w0, w1, &ERK[16]);
  324|     63|   ARIA_ROL128<31>(w1, w2, &ERK[20]);
  325|     63|   ARIA_ROL128<31>(w2, w3, &ERK[24]);
  326|     63|   ARIA_ROL128<31>(w3, w0, &ERK[28]);
  327|     63|   ARIA_ROL128<67>(w0, w1, &ERK[32]);
  328|     63|   ARIA_ROL128<67>(w1, w2, &ERK[36]);
  329|     63|   ARIA_ROL128<67>(w2, w3, &ERK[40]);
  330|     63|   ARIA_ROL128<67>(w3, w0, &ERK[44]);
  331|     63|   ARIA_ROL128<97>(w0, w1, &ERK[48]);
  332|       |
  333|     63|   if(length == 24 || length == 32) {
  ------------------
  |  Branch (333:7): [True: 0, False: 63]
  |  Branch (333:23): [True: 38, False: 25]
  ------------------
  334|     38|      ARIA_ROL128<97>(w1, w2, &ERK[52]);
  335|     38|      ARIA_ROL128<97>(w2, w3, &ERK[56]);
  336|       |
  337|     38|      if(length == 32) {
  ------------------
  |  Branch (337:10): [True: 38, False: 0]
  ------------------
  338|     38|         ARIA_ROL128<97>(w3, w0, &ERK[60]);
  339|     38|         ARIA_ROL128<109>(w0, w1, &ERK[64]);
  340|     38|      }
  341|     38|   }
  342|       |
  343|       |   // Now create the decryption key schedule
  344|     63|   DRK.resize(ERK.size());
  345|       |
  346|  1.03k|   for(size_t i = 0; i != DRK.size(); i += 4) {
  ------------------
  |  Branch (346:22): [True: 971, False: 63]
  ------------------
  347|    971|      DRK[i] = ERK[ERK.size() - 4 - i];
  348|    971|      DRK[i + 1] = ERK[ERK.size() - 3 - i];
  349|    971|      DRK[i + 2] = ERK[ERK.size() - 2 - i];
  350|    971|      DRK[i + 3] = ERK[ERK.size() - 1 - i];
  351|    971|   }
  352|       |
  353|    908|   for(size_t i = 4; i != DRK.size() - 4; i += 4) {
  ------------------
  |  Branch (353:22): [True: 845, False: 63]
  ------------------
  354|    845|      aria_ks_dk_transform(DRK[i + 0], DRK[i + 1], DRK[i + 2], DRK[i + 3]);
  355|    845|   }
  356|     63|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm19EEEvPKjS4_Pj:
  213|    252|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) {
  214|       |   // MSVC is not generating a "rotate immediate". Constify to help it along.
  215|    252|   static const size_t Q = 4 - (N / 32);
  216|    252|   static const size_t R = N % 32;
  217|    252|   static_assert(R > 0 && R < 32, "Rotation in range for type");
  218|    252|   KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R));
  219|    252|   KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R));
  220|    252|   KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R));
  221|    252|   KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R));
  222|    252|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm31EEEvPKjS4_Pj:
  213|    252|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) {
  214|       |   // MSVC is not generating a "rotate immediate". Constify to help it along.
  215|    252|   static const size_t Q = 4 - (N / 32);
  216|    252|   static const size_t R = N % 32;
  217|    252|   static_assert(R > 0 && R < 32, "Rotation in range for type");
  218|    252|   KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R));
  219|    252|   KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R));
  220|    252|   KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R));
  221|    252|   KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R));
  222|    252|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm67EEEvPKjS4_Pj:
  213|    252|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) {
  214|       |   // MSVC is not generating a "rotate immediate". Constify to help it along.
  215|    252|   static const size_t Q = 4 - (N / 32);
  216|    252|   static const size_t R = N % 32;
  217|    252|   static_assert(R > 0 && R < 32, "Rotation in range for type");
  218|    252|   KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R));
  219|    252|   KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R));
  220|    252|   KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R));
  221|    252|   KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R));
  222|    252|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm97EEEvPKjS4_Pj:
  213|    177|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) {
  214|       |   // MSVC is not generating a "rotate immediate". Constify to help it along.
  215|    177|   static const size_t Q = 4 - (N / 32);
  216|    177|   static const size_t R = N % 32;
  217|    177|   static_assert(R > 0 && R < 32, "Rotation in range for type");
  218|    177|   KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R));
  219|    177|   KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R));
  220|    177|   KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R));
  221|    177|   KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R));
  222|    177|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F11ARIA_ROL128ILm109EEEvPKjS4_Pj:
  213|     38|inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4]) {
  214|       |   // MSVC is not generating a "rotate immediate". Constify to help it along.
  215|     38|   static const size_t Q = 4 - (N / 32);
  216|     38|   static const size_t R = N % 32;
  217|     38|   static_assert(R > 0 && R < 32, "Rotation in range for type");
  218|     38|   KS[0] = (X[0]) ^ ((Y[(Q) % 4]) >> R) ^ ((Y[(Q + 3) % 4]) << (32 - R));
  219|     38|   KS[1] = (X[1]) ^ ((Y[(Q + 1) % 4]) >> R) ^ ((Y[(Q) % 4]) << (32 - R));
  220|     38|   KS[2] = (X[2]) ^ ((Y[(Q + 2) % 4]) >> R) ^ ((Y[(Q + 1) % 4]) << (32 - R));
  221|     38|   KS[3] = (X[3]) ^ ((Y[(Q + 3) % 4]) >> R) ^ ((Y[(Q + 2) % 4]) << (32 - R));
  222|     38|}
aria.cpp:_ZN5Botan12_GLOBAL__N_16ARIA_F20aria_ks_dk_transformERjS2_S2_S2_:
  224|    845|void aria_ks_dk_transform(uint32_t& K0, uint32_t& K1, uint32_t& K2, uint32_t& K3) {
  225|    845|   K0 = rotr<8>(K0) ^ rotr<16>(K0) ^ rotr<24>(K0);
  226|    845|   K1 = rotr<8>(K1) ^ rotr<16>(K1) ^ rotr<24>(K1);
  227|    845|   K2 = rotr<8>(K2) ^ rotr<16>(K2) ^ rotr<24>(K2);
  228|    845|   K3 = rotr<8>(K3) ^ rotr<16>(K3) ^ rotr<24>(K3);
  229|       |
  230|    845|   K1 ^= K2;
  231|    845|   K2 ^= K3;
  232|    845|   K0 ^= K1;
  233|    845|   K3 ^= K1;
  234|    845|   K2 ^= K0;
  235|    845|   K1 ^= K2;
  236|       |
  237|    845|   K1 = ((K1 << 8) & 0xFF00FF00) | ((K1 >> 8) & 0x00FF00FF);
  238|    845|   K2 = rotr<16>(K2);
  239|    845|   K3 = reverse_bytes(K3);
  240|       |
  241|    845|   K1 ^= K2;
  242|    845|   K2 ^= K3;
  243|    845|   K0 ^= K1;
  244|    845|   K3 ^= K1;
  245|    845|   K2 ^= K0;
  246|    845|   K1 ^= K2;
  247|    845|}

_ZN5Botan11BlockCipher6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   87|    836|std::unique_ptr<BlockCipher> BlockCipher::create(std::string_view algo, std::string_view provider) {
   88|       |#if defined(BOTAN_HAS_COMMONCRYPTO)
   89|       |   if(provider.empty() || provider == "commoncrypto") {
   90|       |      if(auto bc = make_commoncrypto_block_cipher(algo))
   91|       |         return bc;
   92|       |
   93|       |      if(!provider.empty())
   94|       |         return nullptr;
   95|       |   }
   96|       |#endif
   97|       |
   98|       |   // TODO: CryptoAPI
   99|       |   // TODO: /dev/crypto
  100|       |
  101|       |   // Only base providers from here on out
  102|    836|   if(provider.empty() == false && provider != "base") {
  ------------------
  |  Branch (102:7): [True: 176, False: 660]
  |  Branch (102:36): [True: 88, False: 88]
  ------------------
  103|     88|      return nullptr;
  104|     88|   }
  105|       |
  106|    748|#if defined(BOTAN_HAS_AES)
  107|    748|   if(algo == "AES-128") {
  ------------------
  |  Branch (107:7): [True: 149, False: 599]
  ------------------
  108|    149|      return std::make_unique<AES_128>();
  109|    149|   }
  110|       |
  111|    599|   if(algo == "AES-192") {
  ------------------
  |  Branch (111:7): [True: 0, False: 599]
  ------------------
  112|      0|      return std::make_unique<AES_192>();
  113|      0|   }
  114|       |
  115|    599|   if(algo == "AES-256") {
  ------------------
  |  Branch (115:7): [True: 361, False: 238]
  ------------------
  116|    361|      return std::make_unique<AES_256>();
  117|    361|   }
  118|    238|#endif
  119|       |
  120|    238|#if defined(BOTAN_HAS_ARIA)
  121|    238|   if(algo == "ARIA-128") {
  ------------------
  |  Branch (121:7): [True: 30, False: 208]
  ------------------
  122|     30|      return std::make_unique<ARIA_128>();
  123|     30|   }
  124|       |
  125|    208|   if(algo == "ARIA-192") {
  ------------------
  |  Branch (125:7): [True: 0, False: 208]
  ------------------
  126|      0|      return std::make_unique<ARIA_192>();
  127|      0|   }
  128|       |
  129|    208|   if(algo == "ARIA-256") {
  ------------------
  |  Branch (129:7): [True: 43, False: 165]
  ------------------
  130|     43|      return std::make_unique<ARIA_256>();
  131|     43|   }
  132|    165|#endif
  133|       |
  134|    165|#if defined(BOTAN_HAS_SERPENT)
  135|    165|   if(algo == "Serpent") {
  ------------------
  |  Branch (135:7): [True: 0, False: 165]
  ------------------
  136|      0|      return std::make_unique<Serpent>();
  137|      0|   }
  138|    165|#endif
  139|       |
  140|    165|#if defined(BOTAN_HAS_SHACAL2)
  141|    165|   if(algo == "SHACAL2") {
  ------------------
  |  Branch (141:7): [True: 0, False: 165]
  ------------------
  142|      0|      return std::make_unique<SHACAL2>();
  143|      0|   }
  144|    165|#endif
  145|       |
  146|    165|#if defined(BOTAN_HAS_TWOFISH)
  147|    165|   if(algo == "Twofish") {
  ------------------
  |  Branch (147:7): [True: 0, False: 165]
  ------------------
  148|      0|      return std::make_unique<Twofish>();
  149|      0|   }
  150|    165|#endif
  151|       |
  152|    165|#if defined(BOTAN_HAS_THREEFISH_512)
  153|    165|   if(algo == "Threefish-512") {
  ------------------
  |  Branch (153:7): [True: 0, False: 165]
  ------------------
  154|      0|      return std::make_unique<Threefish_512>();
  155|      0|   }
  156|    165|#endif
  157|       |
  158|    165|#if defined(BOTAN_HAS_BLOWFISH)
  159|    165|   if(algo == "Blowfish") {
  ------------------
  |  Branch (159:7): [True: 0, False: 165]
  ------------------
  160|      0|      return std::make_unique<Blowfish>();
  161|      0|   }
  162|    165|#endif
  163|       |
  164|    165|#if defined(BOTAN_HAS_CAMELLIA)
  165|    165|   if(algo == "Camellia-128") {
  ------------------
  |  Branch (165:7): [True: 31, False: 134]
  ------------------
  166|     31|      return std::make_unique<Camellia_128>();
  167|     31|   }
  168|       |
  169|    134|   if(algo == "Camellia-192") {
  ------------------
  |  Branch (169:7): [True: 0, False: 134]
  ------------------
  170|      0|      return std::make_unique<Camellia_192>();
  171|      0|   }
  172|       |
  173|    134|   if(algo == "Camellia-256") {
  ------------------
  |  Branch (173:7): [True: 41, False: 93]
  ------------------
  174|     41|      return std::make_unique<Camellia_256>();
  175|     41|   }
  176|     93|#endif
  177|       |
  178|     93|#if defined(BOTAN_HAS_DES)
  179|     93|   if(algo == "DES") {
  ------------------
  |  Branch (179:7): [True: 0, False: 93]
  ------------------
  180|      0|      return std::make_unique<DES>();
  181|      0|   }
  182|       |
  183|     93|   if(algo == "TripleDES" || algo == "3DES" || algo == "DES-EDE") {
  ------------------
  |  Branch (183:7): [True: 0, False: 93]
  |  Branch (183:30): [True: 93, False: 0]
  |  Branch (183:48): [True: 0, False: 0]
  ------------------
  184|     93|      return std::make_unique<TripleDES>();
  185|     93|   }
  186|      0|#endif
  187|       |
  188|      0|#if defined(BOTAN_HAS_NOEKEON)
  189|      0|   if(algo == "Noekeon") {
  ------------------
  |  Branch (189:7): [True: 0, False: 0]
  ------------------
  190|      0|      return std::make_unique<Noekeon>();
  191|      0|   }
  192|      0|#endif
  193|       |
  194|      0|#if defined(BOTAN_HAS_CAST_128)
  195|      0|   if(algo == "CAST-128" || algo == "CAST5") {
  ------------------
  |  Branch (195:7): [True: 0, False: 0]
  |  Branch (195:29): [True: 0, False: 0]
  ------------------
  196|      0|      return std::make_unique<CAST_128>();
  197|      0|   }
  198|      0|#endif
  199|       |
  200|      0|#if defined(BOTAN_HAS_IDEA)
  201|      0|   if(algo == "IDEA") {
  ------------------
  |  Branch (201:7): [True: 0, False: 0]
  ------------------
  202|      0|      return std::make_unique<IDEA>();
  203|      0|   }
  204|      0|#endif
  205|       |
  206|      0|#if defined(BOTAN_HAS_SEED)
  207|      0|   if(algo == "SEED") {
  ------------------
  |  Branch (207:7): [True: 0, False: 0]
  ------------------
  208|      0|      return std::make_unique<SEED>();
  209|      0|   }
  210|      0|#endif
  211|       |
  212|      0|#if defined(BOTAN_HAS_SM4)
  213|      0|   if(algo == "SM4") {
  ------------------
  |  Branch (213:7): [True: 0, False: 0]
  ------------------
  214|      0|      return std::make_unique<SM4>();
  215|      0|   }
  216|      0|#endif
  217|       |
  218|      0|   const SCAN_Name req(algo);
  219|       |
  220|      0|#if defined(BOTAN_HAS_GOST_28147_89)
  221|      0|   if(req.algo_name() == "GOST-28147-89") {
  ------------------
  |  Branch (221:7): [True: 0, False: 0]
  ------------------
  222|      0|      return std::make_unique<GOST_28147_89>(req.arg(0, "R3411_94_TestParam"));
  223|      0|   }
  224|      0|#endif
  225|       |
  226|      0|#if defined(BOTAN_HAS_CASCADE)
  227|      0|   if(req.algo_name() == "Cascade" && req.arg_count() == 2) {
  ------------------
  |  Branch (227:7): [True: 0, False: 0]
  |  Branch (227:7): [True: 0, False: 0]
  |  Branch (227:39): [True: 0, False: 0]
  ------------------
  228|      0|      auto c1 = BlockCipher::create(req.arg(0));
  229|      0|      auto c2 = BlockCipher::create(req.arg(1));
  230|       |
  231|      0|      if(c1 && c2) {
  ------------------
  |  Branch (231:10): [True: 0, False: 0]
  |  Branch (231:16): [True: 0, False: 0]
  ------------------
  232|      0|         return std::make_unique<Cascade_Cipher>(std::move(c1), std::move(c2));
  233|      0|      }
  234|      0|   }
  235|      0|#endif
  236|       |
  237|      0|#if defined(BOTAN_HAS_LION)
  238|      0|   if(req.algo_name() == "Lion" && req.arg_count_between(2, 3)) {
  ------------------
  |  Branch (238:7): [True: 0, False: 0]
  |  Branch (238:7): [True: 0, False: 0]
  |  Branch (238:36): [True: 0, False: 0]
  ------------------
  239|      0|      auto hash = HashFunction::create(req.arg(0));
  240|      0|      auto stream = StreamCipher::create(req.arg(1));
  241|       |
  242|      0|      if(hash && stream) {
  ------------------
  |  Branch (242:10): [True: 0, False: 0]
  |  Branch (242:18): [True: 0, False: 0]
  ------------------
  243|      0|         const size_t block_size = req.arg_as_integer(2, 1024);
  244|      0|         return std::make_unique<Lion>(std::move(hash), std::move(stream), block_size);
  245|      0|      }
  246|      0|   }
  247|      0|#endif
  248|       |
  249|      0|   BOTAN_UNUSED(req);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  250|      0|   BOTAN_UNUSED(provider);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  251|       |
  252|      0|   return nullptr;
  253|      0|}
_ZN5Botan11BlockCipher15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  256|    287|std::unique_ptr<BlockCipher> BlockCipher::create_or_throw(std::string_view algo, std::string_view provider) {
  257|    287|   if(auto bc = BlockCipher::create(algo, provider)) {
  ------------------
  |  Branch (257:12): [True: 287, False: 0]
  ------------------
  258|    287|      return bc;
  259|    287|   }
  260|      0|   throw Lookup_Error("Block cipher", algo, provider);
  261|    287|}
_ZN5Botan11BlockCipher9providersENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  263|     88|std::vector<std::string> BlockCipher::providers(std::string_view algo) {
  264|     88|   return probe_providers_of<BlockCipher>(algo, {"base", "commoncrypto"});
  265|     88|}

_ZNK5Botan12Camellia_1289encrypt_nEPKhPhm:
  343|    224|void Camellia_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  344|    224|   assert_key_material_set();
  345|    224|   Camellia_F::encrypt(in, out, blocks, m_SK, 9);
  346|    224|}
_ZNK5Botan12Camellia_2569encrypt_nEPKhPhm:
  353|    594|void Camellia_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  354|    594|   assert_key_material_set();
  355|    594|   Camellia_F::encrypt(in, out, blocks, m_SK, 12);
  356|    594|}
_ZNK5Botan12Camellia_12819has_keying_materialEv:
  373|    388|bool Camellia_128::has_keying_material() const { return !m_SK.empty(); }
_ZNK5Botan12Camellia_25619has_keying_materialEv:
  377|    833|bool Camellia_256::has_keying_material() const { return !m_SK.empty(); }
_ZN5Botan12Camellia_12812key_scheduleEPKhm:
  379|     26|void Camellia_128::key_schedule(const uint8_t key[], size_t length) { Camellia_F::key_schedule(m_SK, key, length); }
_ZN5Botan12Camellia_25612key_scheduleEPKhm:
  383|     36|void Camellia_256::key_schedule(const uint8_t key[], size_t length) { Camellia_F::key_schedule(m_SK, key, length); }
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F7encryptEPKhPhmRKNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  140|    818|void encrypt(const uint8_t in[], uint8_t out[], size_t blocks, const secure_vector<uint64_t>& SK, const size_t rounds) {
  141|    818|   prefetch_arrays(SBOX1, SBOX2, SBOX3, SBOX4);
  142|       |
  143|  4.09k|   for(size_t i = 0; i < blocks; ++i) {
  ------------------
  |  Branch (143:22): [True: 3.27k, False: 818]
  ------------------
  144|  3.27k|      uint64_t D1, D2;
  145|  3.27k|      load_be(in + 16 * i, D1, D2);
  146|       |
  147|  3.27k|      const uint64_t* K = SK.data();
  148|       |
  149|  3.27k|      D1 ^= *K++;
  150|  3.27k|      D2 ^= *K++;
  151|       |
  152|  3.27k|      D2 ^= F(D1, *K++);
  153|  3.27k|      D1 ^= F(D2, *K++);
  154|       |
  155|  33.3k|      for(size_t r = 1; r != rounds - 1; ++r) {
  ------------------
  |  Branch (155:25): [True: 30.0k, False: 3.27k]
  ------------------
  156|  30.0k|         if(r % 3 == 0) {
  ------------------
  |  Branch (156:13): [True: 8.92k, False: 21.1k]
  ------------------
  157|  8.92k|            D1 = FL(D1, *K++);
  158|  8.92k|            D2 = FLINV(D2, *K++);
  159|  8.92k|         }
  160|       |
  161|  30.0k|         D2 ^= F(D1, *K++);
  162|  30.0k|         D1 ^= F(D2, *K++);
  163|  30.0k|      }
  164|       |
  165|  3.27k|      D2 ^= F(D1, *K++);
  166|  3.27k|      D1 ^= F(D2, *K++);
  167|       |
  168|  3.27k|      D2 ^= *K++;
  169|  3.27k|      D1 ^= *K++;
  170|       |
  171|  3.27k|      store_be(out + 16 * i, D2, D1);
  172|  3.27k|   }
  173|    818|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F1FEmm:
   87|  73.5k|uint64_t F(uint64_t v, uint64_t K) {
   88|  73.5k|   const uint64_t M1 = 0x0101010001000001;
   89|  73.5k|   const uint64_t M2 = 0x0001010101010000;
   90|  73.5k|   const uint64_t M3 = 0x0100010100010100;
   91|  73.5k|   const uint64_t M4 = 0x0101000100000101;
   92|  73.5k|   const uint64_t M5 = 0x0001010100010101;
   93|  73.5k|   const uint64_t M6 = 0x0100010101000101;
   94|  73.5k|   const uint64_t M7 = 0x0101000101010001;
   95|  73.5k|   const uint64_t M8 = 0x0101010001010100;
   96|       |
   97|  73.5k|   const uint64_t x = v ^ K;
   98|       |
   99|  73.5k|   const uint64_t Z1 = M1 * SBOX1[get_byte<0>(x)];
  100|  73.5k|   const uint64_t Z2 = M2 * SBOX2[get_byte<1>(x)];
  101|  73.5k|   const uint64_t Z3 = M3 * SBOX3[get_byte<2>(x)];
  102|  73.5k|   const uint64_t Z4 = M4 * SBOX4[get_byte<3>(x)];
  103|  73.5k|   const uint64_t Z5 = M5 * SBOX2[get_byte<4>(x)];
  104|  73.5k|   const uint64_t Z6 = M6 * SBOX3[get_byte<5>(x)];
  105|  73.5k|   const uint64_t Z7 = M7 * SBOX4[get_byte<6>(x)];
  106|  73.5k|   const uint64_t Z8 = M8 * SBOX1[get_byte<7>(x)];
  107|       |
  108|  73.5k|   return Z1 ^ Z2 ^ Z3 ^ Z4 ^ Z5 ^ Z6 ^ Z7 ^ Z8;
  109|  73.5k|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F2FLEmm:
  111|  8.92k|inline uint64_t FL(uint64_t v, uint64_t K) {
  112|  8.92k|   uint32_t x1 = static_cast<uint32_t>(v >> 32);
  113|  8.92k|   uint32_t x2 = static_cast<uint32_t>(v & 0xFFFFFFFF);
  114|       |
  115|  8.92k|   const uint32_t k1 = static_cast<uint32_t>(K >> 32);
  116|  8.92k|   const uint32_t k2 = static_cast<uint32_t>(K & 0xFFFFFFFF);
  117|       |
  118|  8.92k|   x2 ^= rotl<1>(x1 & k1);
  119|  8.92k|   x1 ^= (x2 | k2);
  120|       |
  121|  8.92k|   return ((static_cast<uint64_t>(x1) << 32) | x2);
  122|  8.92k|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F5FLINVEmm:
  124|  8.92k|inline uint64_t FLINV(uint64_t v, uint64_t K) {
  125|  8.92k|   uint32_t x1 = static_cast<uint32_t>(v >> 32);
  126|  8.92k|   uint32_t x2 = static_cast<uint32_t>(v & 0xFFFFFFFF);
  127|       |
  128|  8.92k|   const uint32_t k1 = static_cast<uint32_t>(K >> 32);
  129|  8.92k|   const uint32_t k2 = static_cast<uint32_t>(K & 0xFFFFFFFF);
  130|       |
  131|  8.92k|   x1 ^= (x2 | k2);
  132|  8.92k|   x2 ^= rotl<1>(x1 & k1);
  133|       |
  134|  8.92k|   return ((static_cast<uint64_t>(x1) << 32) | x2);
  135|  8.92k|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F12key_scheduleERNSt3__16vectorImNS_16secure_allocatorImEEEEPKhm:
  230|     62|void key_schedule(secure_vector<uint64_t>& SK, const uint8_t key[], size_t length) {
  231|     62|   const uint64_t Sigma1 = 0xA09E667F3BCC908B;
  232|     62|   const uint64_t Sigma2 = 0xB67AE8584CAA73B2;
  233|     62|   const uint64_t Sigma3 = 0xC6EF372FE94F82BE;
  234|     62|   const uint64_t Sigma4 = 0x54FF53A5F1D36F1C;
  235|     62|   const uint64_t Sigma5 = 0x10E527FADE682D1D;
  236|     62|   const uint64_t Sigma6 = 0xB05688C2B3E6C1FD;
  237|       |
  238|     62|   const uint64_t KL_H = load_be<uint64_t>(key, 0);
  239|     62|   const uint64_t KL_L = load_be<uint64_t>(key, 1);
  240|       |
  241|     62|   const uint64_t KR_H = (length >= 24) ? load_be<uint64_t>(key, 2) : 0;
  ------------------
  |  Branch (241:26): [True: 36, False: 26]
  ------------------
  242|     62|   const uint64_t KR_L = (length == 32) ? load_be<uint64_t>(key, 3) : ((length == 24) ? ~KR_H : 0);
  ------------------
  |  Branch (242:26): [True: 36, False: 26]
  |  Branch (242:72): [True: 0, False: 26]
  ------------------
  243|       |
  244|     62|   uint64_t D1 = KL_H ^ KR_H;
  245|     62|   uint64_t D2 = KL_L ^ KR_L;
  246|     62|   D2 ^= F(D1, Sigma1);
  247|     62|   D1 ^= F(D2, Sigma2);
  248|     62|   D1 ^= KL_H;
  249|     62|   D2 ^= KL_L;
  250|     62|   D2 ^= F(D1, Sigma3);
  251|     62|   D1 ^= F(D2, Sigma4);
  252|       |
  253|     62|   const uint64_t KA_H = D1;
  254|     62|   const uint64_t KA_L = D2;
  255|       |
  256|     62|   D1 = KA_H ^ KR_H;
  257|     62|   D2 = KA_L ^ KR_L;
  258|     62|   D2 ^= F(D1, Sigma5);
  259|     62|   D1 ^= F(D2, Sigma6);
  260|       |
  261|     62|   const uint64_t KB_H = D1;
  262|     62|   const uint64_t KB_L = D2;
  263|       |
  264|     62|   if(length == 16) {
  ------------------
  |  Branch (264:7): [True: 26, False: 36]
  ------------------
  265|     26|      SK.resize(26);
  266|       |
  267|     26|      SK[0] = KL_H;
  268|     26|      SK[1] = KL_L;
  269|     26|      SK[2] = KA_H;
  270|     26|      SK[3] = KA_L;
  271|     26|      SK[4] = left_rot_hi(KL_H, KL_L, 15);
  272|     26|      SK[5] = left_rot_lo(KL_H, KL_L, 15);
  273|     26|      SK[6] = left_rot_hi(KA_H, KA_L, 15);
  274|     26|      SK[7] = left_rot_lo(KA_H, KA_L, 15);
  275|     26|      SK[8] = left_rot_hi(KA_H, KA_L, 30);
  276|     26|      SK[9] = left_rot_lo(KA_H, KA_L, 30);
  277|     26|      SK[10] = left_rot_hi(KL_H, KL_L, 45);
  278|     26|      SK[11] = left_rot_lo(KL_H, KL_L, 45);
  279|     26|      SK[12] = left_rot_hi(KA_H, KA_L, 45);
  280|     26|      SK[13] = left_rot_lo(KL_H, KL_L, 60);
  281|     26|      SK[14] = left_rot_hi(KA_H, KA_L, 60);
  282|     26|      SK[15] = left_rot_lo(KA_H, KA_L, 60);
  283|     26|      SK[16] = left_rot_lo(KL_H, KL_L, 77);
  284|     26|      SK[17] = left_rot_hi(KL_H, KL_L, 77);
  285|     26|      SK[18] = left_rot_lo(KL_H, KL_L, 94);
  286|     26|      SK[19] = left_rot_hi(KL_H, KL_L, 94);
  287|     26|      SK[20] = left_rot_lo(KA_H, KA_L, 94);
  288|     26|      SK[21] = left_rot_hi(KA_H, KA_L, 94);
  289|     26|      SK[22] = left_rot_lo(KL_H, KL_L, 111);
  290|     26|      SK[23] = left_rot_hi(KL_H, KL_L, 111);
  291|     26|      SK[24] = left_rot_lo(KA_H, KA_L, 111);
  292|     26|      SK[25] = left_rot_hi(KA_H, KA_L, 111);
  293|     36|   } else {
  294|     36|      SK.resize(34);
  295|       |
  296|     36|      SK[0] = KL_H;
  297|     36|      SK[1] = KL_L;
  298|     36|      SK[2] = KB_H;
  299|     36|      SK[3] = KB_L;
  300|       |
  301|     36|      SK[4] = left_rot_hi(KR_H, KR_L, 15);
  302|     36|      SK[5] = left_rot_lo(KR_H, KR_L, 15);
  303|     36|      SK[6] = left_rot_hi(KA_H, KA_L, 15);
  304|     36|      SK[7] = left_rot_lo(KA_H, KA_L, 15);
  305|       |
  306|     36|      SK[8] = left_rot_hi(KR_H, KR_L, 30);
  307|     36|      SK[9] = left_rot_lo(KR_H, KR_L, 30);
  308|     36|      SK[10] = left_rot_hi(KB_H, KB_L, 30);
  309|     36|      SK[11] = left_rot_lo(KB_H, KB_L, 30);
  310|       |
  311|     36|      SK[12] = left_rot_hi(KL_H, KL_L, 45);
  312|     36|      SK[13] = left_rot_lo(KL_H, KL_L, 45);
  313|     36|      SK[14] = left_rot_hi(KA_H, KA_L, 45);
  314|     36|      SK[15] = left_rot_lo(KA_H, KA_L, 45);
  315|       |
  316|     36|      SK[16] = left_rot_hi(KL_H, KL_L, 60);
  317|     36|      SK[17] = left_rot_lo(KL_H, KL_L, 60);
  318|     36|      SK[18] = left_rot_hi(KR_H, KR_L, 60);
  319|     36|      SK[19] = left_rot_lo(KR_H, KR_L, 60);
  320|     36|      SK[20] = left_rot_hi(KB_H, KB_L, 60);
  321|     36|      SK[21] = left_rot_lo(KB_H, KB_L, 60);
  322|       |
  323|     36|      SK[22] = left_rot_lo(KL_H, KL_L, 77);
  324|     36|      SK[23] = left_rot_hi(KL_H, KL_L, 77);
  325|     36|      SK[24] = left_rot_lo(KA_H, KA_L, 77);
  326|     36|      SK[25] = left_rot_hi(KA_H, KA_L, 77);
  327|       |
  328|     36|      SK[26] = left_rot_lo(KR_H, KR_L, 94);
  329|     36|      SK[27] = left_rot_hi(KR_H, KR_L, 94);
  330|     36|      SK[28] = left_rot_lo(KA_H, KA_L, 94);
  331|     36|      SK[29] = left_rot_hi(KA_H, KA_L, 94);
  332|     36|      SK[30] = left_rot_lo(KL_H, KL_L, 111);
  333|     36|      SK[31] = left_rot_hi(KL_H, KL_L, 111);
  334|     36|      SK[32] = left_rot_lo(KB_H, KB_L, 111);
  335|     36|      SK[33] = left_rot_hi(KB_H, KB_L, 111);
  336|     36|   }
  337|     62|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F11left_rot_hiEmmm:
  213|    826|inline uint64_t left_rot_hi(uint64_t h, uint64_t l, size_t shift) {
  214|    826|   if(shift >= 64) {
  ------------------
  |  Branch (214:7): [True: 346, False: 480]
  ------------------
  215|    346|      shift -= 64;
  216|    346|   }
  217|    826|   return (h << shift) | (l >> (64 - shift));
  218|    826|}
camellia.cpp:_ZN5Botan12_GLOBAL__N_110Camellia_F11left_rot_loEmmm:
  220|    826|inline uint64_t left_rot_lo(uint64_t h, uint64_t l, size_t shift) {
  221|    826|   if(shift >= 64) {
  ------------------
  |  Branch (221:7): [True: 346, False: 480]
  ------------------
  222|    346|      shift -= 64;
  223|    346|   }
  224|    826|   return (h >> (64 - shift)) | (l << shift);
  225|    826|}

_ZNK5Botan9TripleDES9encrypt_nEPKhPhm:
  343|    109|void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  344|    109|   assert_key_material_set();
  345|       |
  346|    109|   while(blocks >= 2) {
  ------------------
  |  Branch (346:10): [True: 0, False: 109]
  ------------------
  347|      0|      uint32_t L0 = load_be<uint32_t>(in, 0);
  348|      0|      uint32_t R0 = load_be<uint32_t>(in, 1);
  349|      0|      uint32_t L1 = load_be<uint32_t>(in, 2);
  350|      0|      uint32_t R1 = load_be<uint32_t>(in, 3);
  351|       |
  352|      0|      des_IP(L0, R0);
  353|      0|      des_IP(L1, R1);
  354|       |
  355|      0|      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
  356|      0|      des_decrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
  357|      0|      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
  358|       |
  359|      0|      des_FP(L0, R0);
  360|      0|      des_FP(L1, R1);
  361|       |
  362|      0|      store_be(out, R0, L0, R1, L1);
  363|       |
  364|      0|      in += 2 * BLOCK_SIZE;
  365|      0|      out += 2 * BLOCK_SIZE;
  366|      0|      blocks -= 2;
  367|      0|   }
  368|       |
  369|    218|   while(blocks > 0) {
  ------------------
  |  Branch (369:10): [True: 109, False: 109]
  ------------------
  370|    109|      uint32_t L0 = load_be<uint32_t>(in, 0);
  371|    109|      uint32_t R0 = load_be<uint32_t>(in, 1);
  372|       |
  373|    109|      des_IP(L0, R0);
  374|    109|      des_encrypt(L0, R0, &m_round_key[0]);
  375|    109|      des_decrypt(R0, L0, &m_round_key[32]);
  376|    109|      des_encrypt(L0, R0, &m_round_key[64]);
  377|    109|      des_FP(L0, R0);
  378|       |
  379|    109|      store_be(out, R0, L0);
  380|       |
  381|    109|      in += BLOCK_SIZE;
  382|    109|      out += BLOCK_SIZE;
  383|    109|      blocks -= 1;
  384|    109|   }
  385|    109|}
_ZNK5Botan9TripleDES9decrypt_nEPKhPhm:
  390|  1.19k|void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {
  391|  1.19k|   assert_key_material_set();
  392|       |
  393|  3.54k|   while(blocks >= 2) {
  ------------------
  |  Branch (393:10): [True: 2.35k, False: 1.19k]
  ------------------
  394|  2.35k|      uint32_t L0 = load_be<uint32_t>(in, 0);
  395|  2.35k|      uint32_t R0 = load_be<uint32_t>(in, 1);
  396|  2.35k|      uint32_t L1 = load_be<uint32_t>(in, 2);
  397|  2.35k|      uint32_t R1 = load_be<uint32_t>(in, 3);
  398|       |
  399|  2.35k|      des_IP(L0, R0);
  400|  2.35k|      des_IP(L1, R1);
  401|       |
  402|  2.35k|      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
  403|  2.35k|      des_encrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
  404|  2.35k|      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
  405|       |
  406|  2.35k|      des_FP(L0, R0);
  407|  2.35k|      des_FP(L1, R1);
  408|       |
  409|  2.35k|      store_be(out, R0, L0, R1, L1);
  410|       |
  411|  2.35k|      in += 2 * BLOCK_SIZE;
  412|  2.35k|      out += 2 * BLOCK_SIZE;
  413|  2.35k|      blocks -= 2;
  414|  2.35k|   }
  415|       |
  416|  1.22k|   while(blocks > 0) {
  ------------------
  |  Branch (416:10): [True: 27, False: 1.19k]
  ------------------
  417|     27|      uint32_t L0 = load_be<uint32_t>(in, 0);
  418|     27|      uint32_t R0 = load_be<uint32_t>(in, 1);
  419|       |
  420|     27|      des_IP(L0, R0);
  421|     27|      des_decrypt(L0, R0, &m_round_key[64]);
  422|     27|      des_encrypt(R0, L0, &m_round_key[32]);
  423|     27|      des_decrypt(L0, R0, &m_round_key[0]);
  424|     27|      des_FP(L0, R0);
  425|       |
  426|     27|      store_be(out, R0, L0);
  427|       |
  428|     27|      in += BLOCK_SIZE;
  429|     27|      out += BLOCK_SIZE;
  430|     27|      blocks -= 1;
  431|     27|   }
  432|  1.19k|}
_ZNK5Botan9TripleDES19has_keying_materialEv:
  434|  1.30k|bool TripleDES::has_keying_material() const { return !m_round_key.empty(); }
_ZN5Botan9TripleDES12key_scheduleEPKhm:
  439|     87|void TripleDES::key_schedule(const uint8_t key[], size_t length) {
  440|     87|   m_round_key.resize(3 * 32);
  441|     87|   des_key_schedule(&m_round_key[0], key);
  442|     87|   des_key_schedule(&m_round_key[32], key + 8);
  443|       |
  444|     87|   if(length == 24) {
  ------------------
  |  Branch (444:7): [True: 87, False: 0]
  ------------------
  445|     87|      des_key_schedule(&m_round_key[64], key + 16);
  446|     87|   } else {
  447|      0|      copy_mem(&m_round_key[64], &m_round_key[0], 32);
  448|      0|   }
  449|     87|}
des.cpp:_ZN5Botan12_GLOBAL__N_16des_IPERjS1_:
  201|  4.83k|inline void des_IP(uint32_t& L, uint32_t& R) {
  202|       |   // IP sequence by Wei Dai, taken from public domain Crypto++
  203|  4.83k|   uint32_t T;
  204|  4.83k|   R = rotl<4>(R);
  205|  4.83k|   T = (L ^ R) & 0xF0F0F0F0;
  206|  4.83k|   L ^= T;
  207|  4.83k|   R = rotr<20>(R ^ T);
  208|  4.83k|   T = (L ^ R) & 0xFFFF0000;
  209|  4.83k|   L ^= T;
  210|  4.83k|   R = rotr<18>(R ^ T);
  211|  4.83k|   T = (L ^ R) & 0x33333333;
  212|  4.83k|   L ^= T;
  213|  4.83k|   R = rotr<6>(R ^ T);
  214|  4.83k|   T = (L ^ R) & 0x00FF00FF;
  215|  4.83k|   L ^= T;
  216|  4.83k|   R = rotl<9>(R ^ T);
  217|  4.83k|   T = (L ^ R) & 0xAAAAAAAA;
  218|  4.83k|   L = rotl<1>(L ^ T);
  219|  4.83k|   R ^= T;
  220|  4.83k|}
des.cpp:_ZN5Botan12_GLOBAL__N_114des_encrypt_x2ERjS1_S1_S1_PKj:
  147|  2.35k|inline void des_encrypt_x2(uint32_t& L0r, uint32_t& R0r, uint32_t& L1r, uint32_t& R1r, const uint32_t round_key[32]) {
  148|  2.35k|   uint32_t L0 = L0r;
  149|  2.35k|   uint32_t R0 = R0r;
  150|  2.35k|   uint32_t L1 = L1r;
  151|  2.35k|   uint32_t R1 = R1r;
  152|       |
  153|  21.1k|   for(size_t i = 0; i != 16; i += 2) {
  ------------------
  |  Branch (153:22): [True: 18.8k, False: 2.35k]
  ------------------
  154|  18.8k|      L0 ^= spbox(rotr<4>(R0) ^ round_key[2 * i], R0 ^ round_key[2 * i + 1]);
  155|  18.8k|      L1 ^= spbox(rotr<4>(R1) ^ round_key[2 * i], R1 ^ round_key[2 * i + 1]);
  156|       |
  157|  18.8k|      R0 ^= spbox(rotr<4>(L0) ^ round_key[2 * i + 2], L0 ^ round_key[2 * i + 3]);
  158|  18.8k|      R1 ^= spbox(rotr<4>(L1) ^ round_key[2 * i + 2], L1 ^ round_key[2 * i + 3]);
  159|  18.8k|   }
  160|       |
  161|  2.35k|   L0r = L0;
  162|  2.35k|   R0r = R0;
  163|  2.35k|   L1r = L1;
  164|  2.35k|   R1r = R1;
  165|  2.35k|}
des.cpp:_ZN5Botan12_GLOBAL__N_15spboxEjj:
  121|   232k|inline uint32_t spbox(uint32_t T0, uint32_t T1) {
  122|   232k|   return ((SPBOX_CATS[0 * 64 + ((T0 >> 24) & 0x3F)] * SPBOX_CAT_0_MUL) & SPBOX_CAT_0_MASK) ^
  123|   232k|          ((SPBOX_CATS[1 * 64 + ((T1 >> 24) & 0x3F)] * SPBOX_CAT_1_MUL) & SPBOX_CAT_1_MASK) ^
  124|   232k|          ((SPBOX_CATS[2 * 64 + ((T0 >> 16) & 0x3F)] * SPBOX_CAT_2_MUL) & SPBOX_CAT_2_MASK) ^
  125|   232k|          ((SPBOX_CATS[3 * 64 + ((T1 >> 16) & 0x3F)] * SPBOX_CAT_3_MUL) & SPBOX_CAT_3_MASK) ^
  126|   232k|          ((SPBOX_CATS[4 * 64 + ((T0 >> 8) & 0x3F)] * SPBOX_CAT_4_MUL) & SPBOX_CAT_4_MASK) ^
  127|   232k|          ((SPBOX_CATS[5 * 64 + ((T1 >> 8) & 0x3F)] * SPBOX_CAT_5_MUL) & SPBOX_CAT_5_MASK) ^
  128|   232k|          ((SPBOX_CATS[6 * 64 + ((T0 >> 0) & 0x3F)] * SPBOX_CAT_6_MUL) & SPBOX_CAT_6_MASK) ^
  129|   232k|          ((SPBOX_CATS[7 * 64 + ((T1 >> 0) & 0x3F)] * SPBOX_CAT_7_MUL) & SPBOX_CAT_7_MASK);
  130|   232k|}
des.cpp:_ZN5Botan12_GLOBAL__N_16des_FPERjS1_:
  222|  4.83k|inline void des_FP(uint32_t& L, uint32_t& R) {
  223|       |   // FP sequence by Wei Dai, taken from public domain Crypto++
  224|  4.83k|   uint32_t T;
  225|       |
  226|  4.83k|   R = rotr<1>(R);
  227|  4.83k|   T = (L ^ R) & 0xAAAAAAAA;
  228|  4.83k|   R ^= T;
  229|  4.83k|   L = rotr<9>(L ^ T);
  230|  4.83k|   T = (L ^ R) & 0x00FF00FF;
  231|  4.83k|   R ^= T;
  232|  4.83k|   L = rotl<6>(L ^ T);
  233|  4.83k|   T = (L ^ R) & 0x33333333;
  234|  4.83k|   R ^= T;
  235|  4.83k|   L = rotl<18>(L ^ T);
  236|  4.83k|   T = (L ^ R) & 0xFFFF0000;
  237|  4.83k|   R ^= T;
  238|  4.83k|   L = rotl<20>(L ^ T);
  239|  4.83k|   T = (L ^ R) & 0xF0F0F0F0;
  240|  4.83k|   R ^= T;
  241|  4.83k|   L = rotr<4>(L ^ T);
  242|  4.83k|}
des.cpp:_ZN5Botan12_GLOBAL__N_111des_encryptERjS1_PKj:
  135|    245|inline void des_encrypt(uint32_t& Lr, uint32_t& Rr, const uint32_t round_key[32]) {
  136|    245|   uint32_t L = Lr;
  137|    245|   uint32_t R = Rr;
  138|  2.20k|   for(size_t i = 0; i != 16; i += 2) {
  ------------------
  |  Branch (138:22): [True: 1.96k, False: 245]
  ------------------
  139|  1.96k|      L ^= spbox(rotr<4>(R) ^ round_key[2 * i], R ^ round_key[2 * i + 1]);
  140|  1.96k|      R ^= spbox(rotr<4>(L) ^ round_key[2 * i + 2], L ^ round_key[2 * i + 3]);
  141|  1.96k|   }
  142|       |
  143|    245|   Lr = L;
  144|    245|   Rr = R;
  145|    245|}
des.cpp:_ZN5Botan12_GLOBAL__N_114des_decrypt_x2ERjS1_S1_S1_PKj:
  181|  4.70k|inline void des_decrypt_x2(uint32_t& L0r, uint32_t& R0r, uint32_t& L1r, uint32_t& R1r, const uint32_t round_key[32]) {
  182|  4.70k|   uint32_t L0 = L0r;
  183|  4.70k|   uint32_t R0 = R0r;
  184|  4.70k|   uint32_t L1 = L1r;
  185|  4.70k|   uint32_t R1 = R1r;
  186|       |
  187|  42.3k|   for(size_t i = 16; i != 0; i -= 2) {
  ------------------
  |  Branch (187:23): [True: 37.6k, False: 4.70k]
  ------------------
  188|  37.6k|      L0 ^= spbox(rotr<4>(R0) ^ round_key[2 * i - 2], R0 ^ round_key[2 * i - 1]);
  189|  37.6k|      L1 ^= spbox(rotr<4>(R1) ^ round_key[2 * i - 2], R1 ^ round_key[2 * i - 1]);
  190|       |
  191|  37.6k|      R0 ^= spbox(rotr<4>(L0) ^ round_key[2 * i - 4], L0 ^ round_key[2 * i - 3]);
  192|  37.6k|      R1 ^= spbox(rotr<4>(L1) ^ round_key[2 * i - 4], L1 ^ round_key[2 * i - 3]);
  193|  37.6k|   }
  194|       |
  195|  4.70k|   L0r = L0;
  196|  4.70k|   R0r = R0;
  197|  4.70k|   L1r = L1;
  198|  4.70k|   R1r = R1;
  199|  4.70k|}
des.cpp:_ZN5Botan12_GLOBAL__N_111des_decryptERjS1_PKj:
  170|    163|inline void des_decrypt(uint32_t& Lr, uint32_t& Rr, const uint32_t round_key[32]) {
  171|    163|   uint32_t L = Lr;
  172|    163|   uint32_t R = Rr;
  173|  1.46k|   for(size_t i = 16; i != 0; i -= 2) {
  ------------------
  |  Branch (173:23): [True: 1.30k, False: 163]
  ------------------
  174|  1.30k|      L ^= spbox(rotr<4>(R) ^ round_key[2 * i - 2], R ^ round_key[2 * i - 1]);
  175|  1.30k|      R ^= spbox(rotr<4>(L) ^ round_key[2 * i - 4], L ^ round_key[2 * i - 3]);
  176|  1.30k|   }
  177|    163|   Lr = L;
  178|    163|   Rr = R;
  179|    163|}
des.cpp:_ZN5Botan12_GLOBAL__N_116des_key_scheduleEPjPKh:
   83|    261|void des_key_schedule(uint32_t round_key[32], const uint8_t key[8]) {
   84|    261|   static const uint8_t ROT[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1};
   85|       |
   86|    261|   uint32_t C = ((key[7] & 0x80) << 20) | ((key[6] & 0x80) << 19) | ((key[5] & 0x80) << 18) | ((key[4] & 0x80) << 17) |
   87|    261|                ((key[3] & 0x80) << 16) | ((key[2] & 0x80) << 15) | ((key[1] & 0x80) << 14) | ((key[0] & 0x80) << 13) |
   88|    261|                ((key[7] & 0x40) << 13) | ((key[6] & 0x40) << 12) | ((key[5] & 0x40) << 11) | ((key[4] & 0x40) << 10) |
   89|    261|                ((key[3] & 0x40) << 9) | ((key[2] & 0x40) << 8) | ((key[1] & 0x40) << 7) | ((key[0] & 0x40) << 6) |
   90|    261|                ((key[7] & 0x20) << 6) | ((key[6] & 0x20) << 5) | ((key[5] & 0x20) << 4) | ((key[4] & 0x20) << 3) |
   91|    261|                ((key[3] & 0x20) << 2) | ((key[2] & 0x20) << 1) | ((key[1] & 0x20)) | ((key[0] & 0x20) >> 1) |
   92|    261|                ((key[7] & 0x10) >> 1) | ((key[6] & 0x10) >> 2) | ((key[5] & 0x10) >> 3) | ((key[4] & 0x10) >> 4);
   93|    261|   uint32_t D = ((key[7] & 0x02) << 26) | ((key[6] & 0x02) << 25) | ((key[5] & 0x02) << 24) | ((key[4] & 0x02) << 23) |
   94|    261|                ((key[3] & 0x02) << 22) | ((key[2] & 0x02) << 21) | ((key[1] & 0x02) << 20) | ((key[0] & 0x02) << 19) |
   95|    261|                ((key[7] & 0x04) << 17) | ((key[6] & 0x04) << 16) | ((key[5] & 0x04) << 15) | ((key[4] & 0x04) << 14) |
   96|    261|                ((key[3] & 0x04) << 13) | ((key[2] & 0x04) << 12) | ((key[1] & 0x04) << 11) | ((key[0] & 0x04) << 10) |
   97|    261|                ((key[7] & 0x08) << 8) | ((key[6] & 0x08) << 7) | ((key[5] & 0x08) << 6) | ((key[4] & 0x08) << 5) |
   98|    261|                ((key[3] & 0x08) << 4) | ((key[2] & 0x08) << 3) | ((key[1] & 0x08) << 2) | ((key[0] & 0x08) << 1) |
   99|    261|                ((key[3] & 0x10) >> 1) | ((key[2] & 0x10) >> 2) | ((key[1] & 0x10) >> 3) | ((key[0] & 0x10) >> 4);
  100|       |
  101|  4.43k|   for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (101:22): [True: 4.17k, False: 261]
  ------------------
  102|  4.17k|      C = ((C << ROT[i]) | (C >> (28 - ROT[i]))) & 0x0FFFFFFF;
  103|  4.17k|      D = ((D << ROT[i]) | (D >> (28 - ROT[i]))) & 0x0FFFFFFF;
  104|  4.17k|      round_key[2 * i] = ((C & 0x00000010) << 22) | ((C & 0x00000800) << 17) | ((C & 0x00000020) << 16) |
  105|  4.17k|                         ((C & 0x00004004) << 15) | ((C & 0x00000200) << 11) | ((C & 0x00020000) << 10) |
  106|  4.17k|                         ((C & 0x01000000) >> 6) | ((C & 0x00100000) >> 4) | ((C & 0x00010000) << 3) |
  107|  4.17k|                         ((C & 0x08000000) >> 2) | ((C & 0x00800000) << 1) | ((D & 0x00000010) << 8) |
  108|  4.17k|                         ((D & 0x00000002) << 7) | ((D & 0x00000001) << 2) | ((D & 0x00000200)) |
  109|  4.17k|                         ((D & 0x00008000) >> 2) | ((D & 0x00000088) >> 3) | ((D & 0x00001000) >> 7) |
  110|  4.17k|                         ((D & 0x00080000) >> 9) | ((D & 0x02020000) >> 14) | ((D & 0x00400000) >> 21);
  111|  4.17k|      round_key[2 * i + 1] =
  112|  4.17k|         ((C & 0x00000001) << 28) | ((C & 0x00000082) << 18) | ((C & 0x00002000) << 14) | ((C & 0x00000100) << 10) |
  113|  4.17k|         ((C & 0x00001000) << 9) | ((C & 0x00040000) << 6) | ((C & 0x02400000) << 4) | ((C & 0x00008000) << 2) |
  114|  4.17k|         ((C & 0x00200000) >> 1) | ((C & 0x04000000) >> 10) | ((D & 0x00000020) << 6) | ((D & 0x00000100)) |
  115|  4.17k|         ((D & 0x00000800) >> 1) | ((D & 0x00000040) >> 3) | ((D & 0x00010000) >> 4) | ((D & 0x00000400) >> 5) |
  116|  4.17k|         ((D & 0x00004000) >> 10) | ((D & 0x04000000) >> 13) | ((D & 0x00800000) >> 14) | ((D & 0x00100000) >> 18) |
  117|  4.17k|         ((D & 0x01000000) >> 24) | ((D & 0x08000000) >> 26);
  118|  4.17k|   }
  119|    261|}

_ZN5Botan13base64_decodeEPKcmb:
  174|  11.5k|secure_vector<uint8_t> base64_decode(const char input[], size_t input_length, bool ignore_ws) {
  175|  11.5k|   return base_decode_to_vec<secure_vector<uint8_t>>(Base64(), input, input_length, ignore_ws);
  176|  11.5k|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decode_max_outputEm:
   41|  23.1k|      static inline size_t decode_max_output(size_t input_length) {
   42|  23.1k|         return (round_up(input_length, m_encoding_bytes_out) * m_encoding_bytes_in) / m_encoding_bytes_out;
   43|  23.1k|      }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6417decoding_bytes_inEv:
   29|  11.5k|      static inline size_t decoding_bytes_in() noexcept { return m_encoding_bytes_out; }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6418decoding_bytes_outEv:
   31|  11.5k|      static inline size_t decoding_bytes_out() noexcept { return m_encoding_bytes_in; }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6419lookup_binary_valueEc:
  103|  16.2M|uint8_t Base64::lookup_binary_value(char input) noexcept {
  104|  16.2M|   const uint8_t c = static_cast<uint8_t>(input);
  105|       |
  106|  16.2M|   const auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, uint8_t('A'), uint8_t('Z'));
  107|  16.2M|   const auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, uint8_t('a'), uint8_t('z'));
  108|  16.2M|   const auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, uint8_t('0'), uint8_t('9'));
  109|       |
  110|  16.2M|   const auto is_plus = CT::Mask<uint8_t>::is_equal(c, uint8_t('+'));
  111|  16.2M|   const auto is_slash = CT::Mask<uint8_t>::is_equal(c, uint8_t('/'));
  112|  16.2M|   const auto is_equal = CT::Mask<uint8_t>::is_equal(c, uint8_t('='));
  113|       |
  114|  16.2M|   const auto is_whitespace =
  115|  16.2M|      CT::Mask<uint8_t>::is_any_of(c, {uint8_t(' '), uint8_t('\t'), uint8_t('\n'), uint8_t('\r')});
  116|       |
  117|  16.2M|   const uint8_t c_upper = c - uint8_t('A');
  118|  16.2M|   const uint8_t c_lower = c - uint8_t('a') + 26;
  119|  16.2M|   const uint8_t c_decim = c - uint8_t('0') + 2 * 26;
  120|       |
  121|  16.2M|   uint8_t ret = 0xFF;  // default value
  122|       |
  123|  16.2M|   ret = is_alpha_upper.select(c_upper, ret);
  124|  16.2M|   ret = is_alpha_lower.select(c_lower, ret);
  125|  16.2M|   ret = is_decimal.select(c_decim, ret);
  126|  16.2M|   ret = is_plus.select(62, ret);
  127|  16.2M|   ret = is_slash.select(63, ret);
  128|  16.2M|   ret = is_equal.select(0x81, ret);
  129|  16.2M|   ret = is_whitespace.select(0x80, ret);
  130|       |
  131|  16.2M|   return ret;
  132|  16.2M|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6414check_bad_charEhcb:
  135|  16.2M|bool Base64::check_bad_char(uint8_t bin, char input, bool ignore_ws) {
  136|  16.2M|   if(bin <= 0x3F) {
  ------------------
  |  Branch (136:7): [True: 15.9M, False: 265k]
  ------------------
  137|  15.9M|      return true;
  138|  15.9M|   } else if(!(bin == 0x81 || (bin == 0x80 && ignore_ws))) {
  ------------------
  |  Branch (138:16): [True: 0, False: 265k]
  |  Branch (138:32): [True: 265k, False: 0]
  |  Branch (138:47): [True: 265k, False: 0]
  ------------------
  139|      0|      throw Invalid_Argument(fmt("base64_decode: invalid character '{}'", format_char_for_display(input)));
  140|      0|   }
  141|   265k|   return false;
  142|  16.2M|}
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base646decodeEPhPKh:
   51|  3.98M|      static void decode(uint8_t* out_ptr, const uint8_t decode_buf[4]) {
   52|  3.98M|         out_ptr[0] = (decode_buf[0] << 2) | (decode_buf[1] >> 4);
   53|  3.98M|         out_ptr[1] = (decode_buf[1] << 4) | (decode_buf[2] >> 2);
   54|  3.98M|         out_ptr[2] = (decode_buf[2] << 6) | decode_buf[3];
   55|  3.98M|      }
base64.cpp:_ZN5Botan12_GLOBAL__N_16Base6415bytes_to_removeEm:
   57|  11.5k|      static inline size_t bytes_to_remove(size_t final_truncate) { return final_truncate; }

_ZN5Botan10hex_encodeEPcPKhmb:
   33|  11.5k|void hex_encode(char output[], const uint8_t input[], size_t input_length, bool uppercase) {
   34|   312k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (34:22): [True: 300k, False: 11.5k]
  ------------------
   35|   300k|      const uint8_t n0 = (input[i] >> 4) & 0xF;
   36|   300k|      const uint8_t n1 = (input[i]) & 0xF;
   37|       |
   38|   300k|      output[2 * i] = hex_encode_nibble(n0, uppercase);
   39|   300k|      output[2 * i + 1] = hex_encode_nibble(n1, uppercase);
   40|   300k|   }
   41|  11.5k|}
_ZN5Botan10hex_encodeEPKhmb:
   43|  11.5k|std::string hex_encode(const uint8_t input[], size_t input_length, bool uppercase) {
   44|  11.5k|   std::string output(2 * input_length, 0);
   45|       |
   46|  11.5k|   if(input_length) {
  ------------------
  |  Branch (46:7): [True: 11.5k, False: 0]
  ------------------
   47|  11.5k|      hex_encode(&output.front(), input, input_length, uppercase);
   48|  11.5k|   }
   49|       |
   50|  11.5k|   return output;
   51|  11.5k|}
_ZN5Botan10hex_decodeEPhPKcmRmb:
   81|  19.2k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) {
   82|  19.2k|   uint8_t* out_ptr = output;
   83|  19.2k|   bool top_nibble = true;
   84|       |
   85|  19.2k|   clear_mem(output, input_length / 2);
   86|       |
   87|   637k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (87:22): [True: 618k, False: 19.2k]
  ------------------
   88|   618k|      const uint8_t bin = hex_char_to_bin(input[i]);
   89|       |
   90|   618k|      if(bin >= 0x10) {
  ------------------
  |  Branch (90:10): [True: 0, False: 618k]
  ------------------
   91|      0|         if(bin == 0x80 && ignore_ws) {
  ------------------
  |  Branch (91:13): [True: 0, False: 0]
  |  Branch (91:28): [True: 0, False: 0]
  ------------------
   92|      0|            continue;
   93|      0|         }
   94|       |
   95|      0|         throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i])));
   96|      0|      }
   97|       |
   98|   618k|      if(top_nibble) {
  ------------------
  |  Branch (98:10): [True: 309k, False: 309k]
  ------------------
   99|   309k|         *out_ptr |= bin << 4;
  100|   309k|      } else {
  101|   309k|         *out_ptr |= bin;
  102|   309k|      }
  103|       |
  104|   618k|      top_nibble = !top_nibble;
  105|   618k|      if(top_nibble) {
  ------------------
  |  Branch (105:10): [True: 309k, False: 309k]
  ------------------
  106|   309k|         ++out_ptr;
  107|   309k|      }
  108|   618k|   }
  109|       |
  110|  19.2k|   input_consumed = input_length;
  111|  19.2k|   size_t written = (out_ptr - output);
  112|       |
  113|       |   /*
  114|       |   * We only got half of a uint8_t at the end; zap the half-written
  115|       |   * output and mark it as unread
  116|       |   */
  117|  19.2k|   if(!top_nibble) {
  ------------------
  |  Branch (117:7): [True: 0, False: 19.2k]
  ------------------
  118|      0|      *out_ptr = 0;
  119|      0|      input_consumed -= 1;
  120|      0|   }
  121|       |
  122|  19.2k|   return written;
  123|  19.2k|}
_ZN5Botan10hex_decodeEPhPKcmb:
  125|  19.2k|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) {
  126|  19.2k|   size_t consumed = 0;
  127|  19.2k|   size_t written = hex_decode(output, input, input_length, consumed, ignore_ws);
  128|       |
  129|  19.2k|   if(consumed != input_length) {
  ------------------
  |  Branch (129:7): [True: 0, False: 19.2k]
  ------------------
  130|      0|      throw Invalid_Argument("hex_decode: input did not have full bytes");
  131|      0|   }
  132|       |
  133|  19.2k|   return written;
  134|  19.2k|}
_ZN5Botan10hex_decodeEPhNSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEb:
  136|  19.2k|size_t hex_decode(uint8_t output[], std::string_view input, bool ignore_ws) {
  137|  19.2k|   return hex_decode(output, input.data(), input.length(), ignore_ws);
  138|  19.2k|}
_ZN5Botan17hex_decode_lockedEPKcmb:
  144|     47|secure_vector<uint8_t> hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) {
  145|     47|   secure_vector<uint8_t> bin(1 + input_length / 2);
  146|       |
  147|     47|   size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
  148|       |
  149|     47|   bin.resize(written);
  150|     47|   return bin;
  151|     47|}
hex.cpp:_ZN5Botan12_GLOBAL__N_117hex_encode_nibbleEhb:
   20|   600k|char hex_encode_nibble(uint8_t n, bool uppercase) {
   21|   600k|   BOTAN_DEBUG_ASSERT(n <= 15);
  ------------------
  |  |   99|   600k|      do {                          \
  |  |  100|   600k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   22|       |
   23|   600k|   const auto in_09 = CT::Mask<uint8_t>::is_lt(n, 10);
   24|       |
   25|   600k|   const char c_09 = n + '0';
   26|   600k|   const char c_af = n + (uppercase ? 'A' : 'a') - 10;
  ------------------
  |  Branch (26:27): [True: 600k, False: 0]
  ------------------
   27|       |
   28|   600k|   return in_09.select(c_09, c_af);
   29|   600k|}
hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc:
   55|   618k|uint8_t hex_char_to_bin(char input) {
   56|   618k|   const uint8_t c = static_cast<uint8_t>(input);
   57|       |
   58|   618k|   const auto is_alpha_upper = CT::Mask<uint8_t>::is_within_range(c, uint8_t('A'), uint8_t('F'));
   59|   618k|   const auto is_alpha_lower = CT::Mask<uint8_t>::is_within_range(c, uint8_t('a'), uint8_t('f'));
   60|   618k|   const auto is_decimal = CT::Mask<uint8_t>::is_within_range(c, uint8_t('0'), uint8_t('9'));
   61|       |
   62|   618k|   const auto is_whitespace =
   63|   618k|      CT::Mask<uint8_t>::is_any_of(c, {uint8_t(' '), uint8_t('\t'), uint8_t('\n'), uint8_t('\r')});
   64|       |
   65|   618k|   const uint8_t c_upper = c - uint8_t('A') + 10;
   66|   618k|   const uint8_t c_lower = c - uint8_t('a') + 10;
   67|   618k|   const uint8_t c_decim = c - uint8_t('0');
   68|       |
   69|   618k|   uint8_t ret = 0xFF;  // default value
   70|       |
   71|   618k|   ret = is_alpha_upper.select(c_upper, ret);
   72|   618k|   ret = is_alpha_lower.select(c_lower, ret);
   73|   618k|   ret = is_decimal.select(c_decim, ret);
   74|   618k|   ret = is_whitespace.select(0x80, ret);
   75|       |
   76|   618k|   return ret;
   77|   618k|}

_ZN5Botan12HashFunction6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  103|  96.0k|std::unique_ptr<HashFunction> HashFunction::create(std::string_view algo_spec, std::string_view provider) {
  104|       |#if defined(BOTAN_HAS_COMMONCRYPTO)
  105|       |   if(provider.empty() || provider == "commoncrypto") {
  106|       |      if(auto hash = make_commoncrypto_hash(algo_spec))
  107|       |         return hash;
  108|       |
  109|       |      if(!provider.empty())
  110|       |         return nullptr;
  111|       |   }
  112|       |#endif
  113|       |
  114|  96.0k|   if(provider.empty() == false && provider != "base") {
  ------------------
  |  Branch (114:7): [True: 248, False: 95.8k]
  |  Branch (114:36): [True: 124, False: 124]
  ------------------
  115|    124|      return nullptr;  // unknown provider
  116|    124|   }
  117|       |
  118|  95.9k|#if defined(BOTAN_HAS_SHA1)
  119|  95.9k|   if(algo_spec == "SHA-1") {
  ------------------
  |  Branch (119:7): [True: 11.7k, False: 84.1k]
  ------------------
  120|  11.7k|      return std::make_unique<SHA_1>();
  121|  11.7k|   }
  122|  84.1k|#endif
  123|       |
  124|  84.1k|#if defined(BOTAN_HAS_SHA2_32)
  125|  84.1k|   if(algo_spec == "SHA-224") {
  ------------------
  |  Branch (125:7): [True: 0, False: 84.1k]
  ------------------
  126|      0|      return std::make_unique<SHA_224>();
  127|      0|   }
  128|       |
  129|  84.1k|   if(algo_spec == "SHA-256") {
  ------------------
  |  Branch (129:7): [True: 81.0k, False: 3.17k]
  ------------------
  130|  81.0k|      return std::make_unique<SHA_256>();
  131|  81.0k|   }
  132|  3.17k|#endif
  133|       |
  134|  3.17k|#if defined(BOTAN_HAS_SHA2_64)
  135|  3.17k|   if(algo_spec == "SHA-384") {
  ------------------
  |  Branch (135:7): [True: 3.17k, False: 0]
  ------------------
  136|  3.17k|      return std::make_unique<SHA_384>();
  137|  3.17k|   }
  138|       |
  139|      0|   if(algo_spec == "SHA-512") {
  ------------------
  |  Branch (139:7): [True: 0, False: 0]
  ------------------
  140|      0|      return std::make_unique<SHA_512>();
  141|      0|   }
  142|       |
  143|      0|   if(algo_spec == "SHA-512-256") {
  ------------------
  |  Branch (143:7): [True: 0, False: 0]
  ------------------
  144|      0|      return std::make_unique<SHA_512_256>();
  145|      0|   }
  146|      0|#endif
  147|       |
  148|      0|#if defined(BOTAN_HAS_RIPEMD_160)
  149|      0|   if(algo_spec == "RIPEMD-160") {
  ------------------
  |  Branch (149:7): [True: 0, False: 0]
  ------------------
  150|      0|      return std::make_unique<RIPEMD_160>();
  151|      0|   }
  152|      0|#endif
  153|       |
  154|      0|#if defined(BOTAN_HAS_WHIRLPOOL)
  155|      0|   if(algo_spec == "Whirlpool") {
  ------------------
  |  Branch (155:7): [True: 0, False: 0]
  ------------------
  156|      0|      return std::make_unique<Whirlpool>();
  157|      0|   }
  158|      0|#endif
  159|       |
  160|      0|#if defined(BOTAN_HAS_MD5)
  161|      0|   if(algo_spec == "MD5") {
  ------------------
  |  Branch (161:7): [True: 0, False: 0]
  ------------------
  162|      0|      return std::make_unique<MD5>();
  163|      0|   }
  164|      0|#endif
  165|       |
  166|      0|#if defined(BOTAN_HAS_MD4)
  167|      0|   if(algo_spec == "MD4") {
  ------------------
  |  Branch (167:7): [True: 0, False: 0]
  ------------------
  168|      0|      return std::make_unique<MD4>();
  169|      0|   }
  170|      0|#endif
  171|       |
  172|      0|#if defined(BOTAN_HAS_GOST_34_11)
  173|      0|   if(algo_spec == "GOST-R-34.11-94" || algo_spec == "GOST-34.11") {
  ------------------
  |  Branch (173:7): [True: 0, False: 0]
  |  Branch (173:41): [True: 0, False: 0]
  ------------------
  174|      0|      return std::make_unique<GOST_34_11>();
  175|      0|   }
  176|      0|#endif
  177|       |
  178|      0|#if defined(BOTAN_HAS_ADLER32)
  179|      0|   if(algo_spec == "Adler32") {
  ------------------
  |  Branch (179:7): [True: 0, False: 0]
  ------------------
  180|      0|      return std::make_unique<Adler32>();
  181|      0|   }
  182|      0|#endif
  183|       |
  184|      0|#if defined(BOTAN_HAS_CRC24)
  185|      0|   if(algo_spec == "CRC24") {
  ------------------
  |  Branch (185:7): [True: 0, False: 0]
  ------------------
  186|      0|      return std::make_unique<CRC24>();
  187|      0|   }
  188|      0|#endif
  189|       |
  190|      0|#if defined(BOTAN_HAS_CRC32)
  191|      0|   if(algo_spec == "CRC32") {
  ------------------
  |  Branch (191:7): [True: 0, False: 0]
  ------------------
  192|      0|      return std::make_unique<CRC32>();
  193|      0|   }
  194|      0|#endif
  195|       |
  196|      0|#if defined(BOTAN_HAS_STREEBOG)
  197|      0|   if(algo_spec == "Streebog-256") {
  ------------------
  |  Branch (197:7): [True: 0, False: 0]
  ------------------
  198|      0|      return std::make_unique<Streebog>(256);
  199|      0|   }
  200|      0|   if(algo_spec == "Streebog-512") {
  ------------------
  |  Branch (200:7): [True: 0, False: 0]
  ------------------
  201|      0|      return std::make_unique<Streebog>(512);
  202|      0|   }
  203|      0|#endif
  204|       |
  205|      0|#if defined(BOTAN_HAS_SM3)
  206|      0|   if(algo_spec == "SM3") {
  ------------------
  |  Branch (206:7): [True: 0, False: 0]
  ------------------
  207|      0|      return std::make_unique<SM3>();
  208|      0|   }
  209|      0|#endif
  210|       |
  211|      0|   const SCAN_Name req(algo_spec);
  212|       |
  213|      0|#if defined(BOTAN_HAS_SKEIN_512)
  214|      0|   if(req.algo_name() == "Skein-512") {
  ------------------
  |  Branch (214:7): [True: 0, False: 0]
  ------------------
  215|      0|      return std::make_unique<Skein_512>(req.arg_as_integer(0, 512), req.arg(1, ""));
  216|      0|   }
  217|      0|#endif
  218|       |
  219|      0|#if defined(BOTAN_HAS_BLAKE2B)
  220|      0|   if(req.algo_name() == "Blake2b" || req.algo_name() == "BLAKE2b") {
  ------------------
  |  Branch (220:7): [True: 0, False: 0]
  |  Branch (220:7): [True: 0, False: 0]
  |  Branch (220:39): [True: 0, False: 0]
  ------------------
  221|      0|      return std::make_unique<BLAKE2b>(req.arg_as_integer(0, 512));
  222|      0|   }
  223|      0|#endif
  224|       |
  225|      0|#if defined(BOTAN_HAS_KECCAK)
  226|      0|   if(req.algo_name() == "Keccak-1600") {
  ------------------
  |  Branch (226:7): [True: 0, False: 0]
  ------------------
  227|      0|      return std::make_unique<Keccak_1600>(req.arg_as_integer(0, 512));
  228|      0|   }
  229|      0|#endif
  230|       |
  231|      0|#if defined(BOTAN_HAS_SHA3)
  232|      0|   if(req.algo_name() == "SHA-3") {
  ------------------
  |  Branch (232:7): [True: 0, False: 0]
  ------------------
  233|      0|      return std::make_unique<SHA_3>(req.arg_as_integer(0, 512));
  234|      0|   }
  235|      0|#endif
  236|       |
  237|      0|#if defined(BOTAN_HAS_SHAKE)
  238|      0|   if(req.algo_name() == "SHAKE-128" && req.arg_count() == 1) {
  ------------------
  |  Branch (238:7): [True: 0, False: 0]
  |  Branch (238:7): [True: 0, False: 0]
  |  Branch (238:41): [True: 0, False: 0]
  ------------------
  239|      0|      return std::make_unique<SHAKE_128>(req.arg_as_integer(0));
  240|      0|   }
  241|      0|   if(req.algo_name() == "SHAKE-256" && req.arg_count() == 1) {
  ------------------
  |  Branch (241:7): [True: 0, False: 0]
  |  Branch (241:7): [True: 0, False: 0]
  |  Branch (241:41): [True: 0, False: 0]
  ------------------
  242|      0|      return std::make_unique<SHAKE_256>(req.arg_as_integer(0));
  243|      0|   }
  244|      0|#endif
  245|       |
  246|      0|#if defined(BOTAN_HAS_PARALLEL_HASH)
  247|      0|   if(req.algo_name() == "Parallel") {
  ------------------
  |  Branch (247:7): [True: 0, False: 0]
  ------------------
  248|      0|      std::vector<std::unique_ptr<HashFunction>> hashes;
  249|       |
  250|      0|      for(size_t i = 0; i != req.arg_count(); ++i) {
  ------------------
  |  Branch (250:25): [True: 0, False: 0]
  ------------------
  251|      0|         auto h = HashFunction::create(req.arg(i));
  252|      0|         if(!h) {
  ------------------
  |  Branch (252:13): [True: 0, False: 0]
  ------------------
  253|      0|            return nullptr;
  254|      0|         }
  255|      0|         hashes.push_back(std::move(h));
  256|      0|      }
  257|       |
  258|      0|      return std::make_unique<Parallel>(hashes);
  259|      0|   }
  260|      0|#endif
  261|       |
  262|      0|#if defined(BOTAN_HAS_TRUNCATED_HASH)
  263|      0|   if(req.algo_name() == "Truncated" && req.arg_count() == 2) {
  ------------------
  |  Branch (263:7): [True: 0, False: 0]
  |  Branch (263:7): [True: 0, False: 0]
  |  Branch (263:41): [True: 0, False: 0]
  ------------------
  264|      0|      auto hash = HashFunction::create(req.arg(0));
  265|      0|      if(!hash) {
  ------------------
  |  Branch (265:10): [True: 0, False: 0]
  ------------------
  266|      0|         return nullptr;
  267|      0|      }
  268|       |
  269|      0|      return std::make_unique<Truncated_Hash>(std::move(hash), req.arg_as_integer(1));
  270|      0|   }
  271|      0|#endif
  272|       |
  273|      0|#if defined(BOTAN_HAS_COMB4P)
  274|      0|   if(req.algo_name() == "Comb4P" && req.arg_count() == 2) {
  ------------------
  |  Branch (274:7): [True: 0, False: 0]
  |  Branch (274:7): [True: 0, False: 0]
  |  Branch (274:38): [True: 0, False: 0]
  ------------------
  275|      0|      auto h1 = HashFunction::create(req.arg(0));
  276|      0|      auto h2 = HashFunction::create(req.arg(1));
  277|       |
  278|      0|      if(h1 && h2) {
  ------------------
  |  Branch (278:10): [True: 0, False: 0]
  |  Branch (278:16): [True: 0, False: 0]
  ------------------
  279|      0|         return std::make_unique<Comb4P>(std::move(h1), std::move(h2));
  280|      0|      }
  281|      0|   }
  282|      0|#endif
  283|       |
  284|      0|   return nullptr;
  285|      0|}
_ZN5Botan12HashFunction15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  288|  59.2k|std::unique_ptr<HashFunction> HashFunction::create_or_throw(std::string_view algo, std::string_view provider) {
  289|  59.2k|   if(auto hash = HashFunction::create(algo, provider)) {
  ------------------
  |  Branch (289:12): [True: 59.2k, False: 0]
  ------------------
  290|  59.2k|      return hash;
  291|  59.2k|   }
  292|      0|   throw Lookup_Error("Hash", algo, provider);
  293|  59.2k|}
_ZN5Botan12HashFunction9providersENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  295|    124|std::vector<std::string> HashFunction::providers(std::string_view algo_spec) {
  296|    124|   return probe_providers_of<HashFunction>(algo_spec, {"base", "commoncrypto"});
  297|    124|}

_ZN5Botan16MDx_HashFunctionC2Embbh:
   26|  95.9k|      m_position(0) {
   27|  95.9k|   if(!is_power_of_2(block_len)) {
  ------------------
  |  Branch (27:7): [True: 0, False: 95.9k]
  ------------------
   28|      0|      throw Invalid_Argument("MDx_HashFunction block length must be a power of 2");
   29|      0|   }
   30|  95.9k|   if(m_block_bits < 3 || m_block_bits > 16) {
  ------------------
  |  Branch (30:7): [True: 0, False: 95.9k]
  |  Branch (30:27): [True: 0, False: 95.9k]
  ------------------
   31|      0|      throw Invalid_Argument("MDx_HashFunction block size too large or too small");
   32|      0|   }
   33|  95.9k|   if(m_counter_size < 8 || m_counter_size > block_len) {
  ------------------
  |  Branch (33:7): [True: 0, False: 95.9k]
  |  Branch (33:29): [True: 0, False: 95.9k]
  ------------------
   34|      0|      throw Invalid_State("MDx_HashFunction invalid counter length");
   35|      0|   }
   36|  95.9k|}
_ZN5Botan16MDx_HashFunction5clearEv:
   41|   589k|void MDx_HashFunction::clear() {
   42|   589k|   zeroise(m_buffer);
   43|   589k|   m_count = m_position = 0;
   44|   589k|}
_ZN5Botan16MDx_HashFunction8add_dataEPKhm:
   49|   963k|void MDx_HashFunction::add_data(const uint8_t input[], size_t length) {
   50|   963k|   const size_t block_len = static_cast<size_t>(1) << m_block_bits;
   51|       |
   52|   963k|   m_count += length;
   53|       |
   54|   963k|   if(m_position) {
  ------------------
  |  Branch (54:7): [True: 105k, False: 858k]
  ------------------
   55|   105k|      buffer_insert(m_buffer, m_position, input, length);
   56|       |
   57|   105k|      if(m_position + length >= block_len) {
  ------------------
  |  Branch (57:10): [True: 80.2k, False: 24.8k]
  ------------------
   58|  80.2k|         compress_n(m_buffer.data(), 1);
   59|  80.2k|         input += (block_len - m_position);
   60|  80.2k|         length -= (block_len - m_position);
   61|  80.2k|         m_position = 0;
   62|  80.2k|      }
   63|   105k|   }
   64|       |
   65|       |   // Just in case the compiler can't figure out block_len is a power of 2
   66|   963k|   const size_t full_blocks = length >> m_block_bits;
   67|   963k|   const size_t remaining = length & (block_len - 1);
   68|       |
   69|   963k|   if(full_blocks > 0) {
  ------------------
  |  Branch (69:7): [True: 472k, False: 491k]
  ------------------
   70|   472k|      compress_n(input, full_blocks);
   71|   472k|   }
   72|       |
   73|   963k|   buffer_insert(m_buffer, m_position, input + full_blocks * block_len, remaining);
   74|   963k|   m_position += remaining;
   75|   963k|}
_ZN5Botan16MDx_HashFunction12final_resultEPh:
   80|   459k|void MDx_HashFunction::final_result(uint8_t output[]) {
   81|   459k|   const size_t block_len = static_cast<size_t>(1) << m_block_bits;
   82|       |
   83|   459k|   clear_mem(&m_buffer[m_position], block_len - m_position);
   84|   459k|   m_buffer[m_position] = m_pad_char;
   85|       |
   86|   459k|   if(m_position >= block_len - m_counter_size) {
  ------------------
  |  Branch (86:7): [True: 16.5k, False: 442k]
  ------------------
   87|  16.5k|      compress_n(m_buffer.data(), 1);
   88|  16.5k|      zeroise(m_buffer);
   89|  16.5k|   }
   90|       |
   91|   459k|   BOTAN_ASSERT_NOMSG(m_counter_size <= output_length());
  ------------------
  |  |   60|   459k|   do {                                                                     \
  |  |   61|   459k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 459k]
  |  |  ------------------
  |  |   62|   459k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   459k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   92|   459k|   BOTAN_ASSERT_NOMSG(m_counter_size >= 8);
  ------------------
  |  |   60|   459k|   do {                                                                     \
  |  |   61|   459k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 459k]
  |  |  ------------------
  |  |   62|   459k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   459k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   93|       |
   94|   459k|   const uint64_t bit_count = m_count * 8;
   95|       |
   96|   459k|   if(m_count_big_endian) {
  ------------------
  |  Branch (96:7): [True: 459k, False: 0]
  ------------------
   97|   459k|      store_be(bit_count, &m_buffer[block_len - 8]);
   98|   459k|   } else {
   99|      0|      store_le(bit_count, &m_buffer[block_len - 8]);
  100|      0|   }
  101|       |
  102|   459k|   compress_n(m_buffer.data(), 1);
  103|   459k|   copy_out(output);
  104|   459k|   clear();
  105|   459k|}

_ZN5Botan5SHA_110compress_nEPKhm:
   62|  23.9k|void SHA_1::compress_n(const uint8_t input[], size_t blocks) {
   63|  23.9k|   using namespace SHA1_F;
   64|       |
   65|  23.9k|#if defined(BOTAN_HAS_SHA1_X86_SHA_NI)
   66|  23.9k|   if(CPUID::has_intel_sha()) {
  ------------------
  |  Branch (66:7): [True: 0, False: 23.9k]
  ------------------
   67|      0|      return sha1_compress_x86(m_digest, input, blocks);
   68|      0|   }
   69|  23.9k|#endif
   70|       |
   71|       |#if defined(BOTAN_HAS_SHA1_ARMV8)
   72|       |   if(CPUID::has_arm_sha1()) {
   73|       |      return sha1_armv8_compress_n(m_digest, input, blocks);
   74|       |   }
   75|       |#endif
   76|       |
   77|  23.9k|#if defined(BOTAN_HAS_SHA1_SSE2)
   78|  23.9k|   if(CPUID::has_sse2()) {
  ------------------
  |  Branch (78:7): [True: 23.9k, False: 0]
  ------------------
   79|  23.9k|      return sse2_compress_n(m_digest, input, blocks);
   80|  23.9k|   }
   81|       |
   82|      0|#endif
   83|       |
   84|      0|   uint32_t A = m_digest[0], B = m_digest[1], C = m_digest[2], D = m_digest[3], E = m_digest[4];
   85|       |
   86|      0|   m_W.resize(80);
   87|       |
   88|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (88:22): [True: 0, False: 0]
  ------------------
   89|      0|      load_be(m_W.data(), input, 16);
   90|       |
   91|      0|      for(size_t j = 16; j != 80; j += 8) {
  ------------------
  |  Branch (91:26): [True: 0, False: 0]
  ------------------
   92|      0|         m_W[j] = rotl<1>(m_W[j - 3] ^ m_W[j - 8] ^ m_W[j - 14] ^ m_W[j - 16]);
   93|      0|         m_W[j + 1] = rotl<1>(m_W[j - 2] ^ m_W[j - 7] ^ m_W[j - 13] ^ m_W[j - 15]);
   94|      0|         m_W[j + 2] = rotl<1>(m_W[j - 1] ^ m_W[j - 6] ^ m_W[j - 12] ^ m_W[j - 14]);
   95|      0|         m_W[j + 3] = rotl<1>(m_W[j] ^ m_W[j - 5] ^ m_W[j - 11] ^ m_W[j - 13]);
   96|      0|         m_W[j + 4] = rotl<1>(m_W[j + 1] ^ m_W[j - 4] ^ m_W[j - 10] ^ m_W[j - 12]);
   97|      0|         m_W[j + 5] = rotl<1>(m_W[j + 2] ^ m_W[j - 3] ^ m_W[j - 9] ^ m_W[j - 11]);
   98|      0|         m_W[j + 6] = rotl<1>(m_W[j + 3] ^ m_W[j - 2] ^ m_W[j - 8] ^ m_W[j - 10]);
   99|      0|         m_W[j + 7] = rotl<1>(m_W[j + 4] ^ m_W[j - 1] ^ m_W[j - 7] ^ m_W[j - 9]);
  100|      0|      }
  101|       |
  102|      0|      F1(A, B, C, D, E, m_W[0]);
  103|      0|      F1(E, A, B, C, D, m_W[1]);
  104|      0|      F1(D, E, A, B, C, m_W[2]);
  105|      0|      F1(C, D, E, A, B, m_W[3]);
  106|      0|      F1(B, C, D, E, A, m_W[4]);
  107|      0|      F1(A, B, C, D, E, m_W[5]);
  108|      0|      F1(E, A, B, C, D, m_W[6]);
  109|      0|      F1(D, E, A, B, C, m_W[7]);
  110|      0|      F1(C, D, E, A, B, m_W[8]);
  111|      0|      F1(B, C, D, E, A, m_W[9]);
  112|      0|      F1(A, B, C, D, E, m_W[10]);
  113|      0|      F1(E, A, B, C, D, m_W[11]);
  114|      0|      F1(D, E, A, B, C, m_W[12]);
  115|      0|      F1(C, D, E, A, B, m_W[13]);
  116|      0|      F1(B, C, D, E, A, m_W[14]);
  117|      0|      F1(A, B, C, D, E, m_W[15]);
  118|      0|      F1(E, A, B, C, D, m_W[16]);
  119|      0|      F1(D, E, A, B, C, m_W[17]);
  120|      0|      F1(C, D, E, A, B, m_W[18]);
  121|      0|      F1(B, C, D, E, A, m_W[19]);
  122|       |
  123|      0|      F2(A, B, C, D, E, m_W[20]);
  124|      0|      F2(E, A, B, C, D, m_W[21]);
  125|      0|      F2(D, E, A, B, C, m_W[22]);
  126|      0|      F2(C, D, E, A, B, m_W[23]);
  127|      0|      F2(B, C, D, E, A, m_W[24]);
  128|      0|      F2(A, B, C, D, E, m_W[25]);
  129|      0|      F2(E, A, B, C, D, m_W[26]);
  130|      0|      F2(D, E, A, B, C, m_W[27]);
  131|      0|      F2(C, D, E, A, B, m_W[28]);
  132|      0|      F2(B, C, D, E, A, m_W[29]);
  133|      0|      F2(A, B, C, D, E, m_W[30]);
  134|      0|      F2(E, A, B, C, D, m_W[31]);
  135|      0|      F2(D, E, A, B, C, m_W[32]);
  136|      0|      F2(C, D, E, A, B, m_W[33]);
  137|      0|      F2(B, C, D, E, A, m_W[34]);
  138|      0|      F2(A, B, C, D, E, m_W[35]);
  139|      0|      F2(E, A, B, C, D, m_W[36]);
  140|      0|      F2(D, E, A, B, C, m_W[37]);
  141|      0|      F2(C, D, E, A, B, m_W[38]);
  142|      0|      F2(B, C, D, E, A, m_W[39]);
  143|       |
  144|      0|      F3(A, B, C, D, E, m_W[40]);
  145|      0|      F3(E, A, B, C, D, m_W[41]);
  146|      0|      F3(D, E, A, B, C, m_W[42]);
  147|      0|      F3(C, D, E, A, B, m_W[43]);
  148|      0|      F3(B, C, D, E, A, m_W[44]);
  149|      0|      F3(A, B, C, D, E, m_W[45]);
  150|      0|      F3(E, A, B, C, D, m_W[46]);
  151|      0|      F3(D, E, A, B, C, m_W[47]);
  152|      0|      F3(C, D, E, A, B, m_W[48]);
  153|      0|      F3(B, C, D, E, A, m_W[49]);
  154|      0|      F3(A, B, C, D, E, m_W[50]);
  155|      0|      F3(E, A, B, C, D, m_W[51]);
  156|      0|      F3(D, E, A, B, C, m_W[52]);
  157|      0|      F3(C, D, E, A, B, m_W[53]);
  158|      0|      F3(B, C, D, E, A, m_W[54]);
  159|      0|      F3(A, B, C, D, E, m_W[55]);
  160|      0|      F3(E, A, B, C, D, m_W[56]);
  161|      0|      F3(D, E, A, B, C, m_W[57]);
  162|      0|      F3(C, D, E, A, B, m_W[58]);
  163|      0|      F3(B, C, D, E, A, m_W[59]);
  164|       |
  165|      0|      F4(A, B, C, D, E, m_W[60]);
  166|      0|      F4(E, A, B, C, D, m_W[61]);
  167|      0|      F4(D, E, A, B, C, m_W[62]);
  168|      0|      F4(C, D, E, A, B, m_W[63]);
  169|      0|      F4(B, C, D, E, A, m_W[64]);
  170|      0|      F4(A, B, C, D, E, m_W[65]);
  171|      0|      F4(E, A, B, C, D, m_W[66]);
  172|      0|      F4(D, E, A, B, C, m_W[67]);
  173|      0|      F4(C, D, E, A, B, m_W[68]);
  174|      0|      F4(B, C, D, E, A, m_W[69]);
  175|      0|      F4(A, B, C, D, E, m_W[70]);
  176|      0|      F4(E, A, B, C, D, m_W[71]);
  177|      0|      F4(D, E, A, B, C, m_W[72]);
  178|      0|      F4(C, D, E, A, B, m_W[73]);
  179|      0|      F4(B, C, D, E, A, m_W[74]);
  180|      0|      F4(A, B, C, D, E, m_W[75]);
  181|      0|      F4(E, A, B, C, D, m_W[76]);
  182|      0|      F4(D, E, A, B, C, m_W[77]);
  183|      0|      F4(C, D, E, A, B, m_W[78]);
  184|      0|      F4(B, C, D, E, A, m_W[79]);
  185|       |
  186|      0|      A = (m_digest[0] += A);
  187|      0|      B = (m_digest[1] += B);
  188|      0|      C = (m_digest[2] += C);
  189|      0|      D = (m_digest[3] += D);
  190|      0|      E = (m_digest[4] += E);
  191|       |
  192|      0|      input += hash_block_size();
  193|      0|   }
  194|      0|}
_ZN5Botan5SHA_18copy_outEPh:
  199|  11.8k|void SHA_1::copy_out(uint8_t output[]) { copy_out_vec_be(output, output_length(), m_digest); }
_ZN5Botan5SHA_15clearEv:
  204|  23.7k|void SHA_1::clear() {
  205|  23.7k|   MDx_HashFunction::clear();
  206|  23.7k|   zeroise(m_W);
  207|  23.7k|   m_digest[0] = 0x67452301;
  208|  23.7k|   m_digest[1] = 0xEFCDAB89;
  209|  23.7k|   m_digest[2] = 0x98BADCFE;
  210|  23.7k|   m_digest[3] = 0x10325476;
  211|  23.7k|   m_digest[4] = 0xC3D2E1F0;
  212|  23.7k|}

_ZN5Botan5SHA_115sse2_compress_nERNSt3__16vectorIjNS_16secure_allocatorIjEEEEPKhm:
  115|  23.9k|void SHA_1::sse2_compress_n(secure_vector<uint32_t>& digest, const uint8_t input[], size_t blocks) {
  116|  23.9k|   using namespace SHA1_SSE2_F;
  117|       |
  118|  23.9k|   const SIMD_4x32 K00_19 = SIMD_4x32::splat(0x5A827999);
  119|  23.9k|   const SIMD_4x32 K20_39 = SIMD_4x32::splat(0x6ED9EBA1);
  120|  23.9k|   const SIMD_4x32 K40_59 = SIMD_4x32::splat(0x8F1BBCDC);
  121|  23.9k|   const SIMD_4x32 K60_79 = SIMD_4x32::splat(0xCA62C1D6);
  122|       |
  123|  23.9k|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4];
  124|       |
  125|   135k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (125:22): [True: 111k, False: 23.9k]
  ------------------
  126|   111k|      uint32_t PT[4];
  127|       |
  128|   111k|      SIMD_4x32 W0 = SIMD_4x32::load_be(&input[0]);
  129|   111k|      SIMD_4x32 W1 = SIMD_4x32::load_be(&input[16]);
  130|   111k|      SIMD_4x32 W2 = SIMD_4x32::load_be(&input[32]);
  131|   111k|      SIMD_4x32 W3 = SIMD_4x32::load_be(&input[48]);
  132|       |
  133|   111k|      SIMD_4x32 P0 = W0 + K00_19;
  134|   111k|      SIMD_4x32 P1 = W1 + K00_19;
  135|   111k|      SIMD_4x32 P2 = W2 + K00_19;
  136|   111k|      SIMD_4x32 P3 = W3 + K00_19;
  137|       |
  138|   111k|      SIMD_4x32(P0).store_le(PT);
  139|   111k|      F1(A, B, C, D, E, PT[0]);
  140|   111k|      F1(E, A, B, C, D, PT[1]);
  141|   111k|      F1(D, E, A, B, C, PT[2]);
  142|   111k|      F1(C, D, E, A, B, PT[3]);
  143|   111k|      P0 = prep(W0, W1, W2, W3, K00_19);
  144|       |
  145|   111k|      SIMD_4x32(P1).store_le(PT);
  146|   111k|      F1(B, C, D, E, A, PT[0]);
  147|   111k|      F1(A, B, C, D, E, PT[1]);
  148|   111k|      F1(E, A, B, C, D, PT[2]);
  149|   111k|      F1(D, E, A, B, C, PT[3]);
  150|   111k|      P1 = prep(W1, W2, W3, W0, K20_39);
  151|       |
  152|   111k|      SIMD_4x32(P2).store_le(PT);
  153|   111k|      F1(C, D, E, A, B, PT[0]);
  154|   111k|      F1(B, C, D, E, A, PT[1]);
  155|   111k|      F1(A, B, C, D, E, PT[2]);
  156|   111k|      F1(E, A, B, C, D, PT[3]);
  157|   111k|      P2 = prep(W2, W3, W0, W1, K20_39);
  158|       |
  159|   111k|      SIMD_4x32(P3).store_le(PT);
  160|   111k|      F1(D, E, A, B, C, PT[0]);
  161|   111k|      F1(C, D, E, A, B, PT[1]);
  162|   111k|      F1(B, C, D, E, A, PT[2]);
  163|   111k|      F1(A, B, C, D, E, PT[3]);
  164|   111k|      P3 = prep(W3, W0, W1, W2, K20_39);
  165|       |
  166|   111k|      SIMD_4x32(P0).store_le(PT);
  167|   111k|      F1(E, A, B, C, D, PT[0]);
  168|   111k|      F1(D, E, A, B, C, PT[1]);
  169|   111k|      F1(C, D, E, A, B, PT[2]);
  170|   111k|      F1(B, C, D, E, A, PT[3]);
  171|   111k|      P0 = prep(W0, W1, W2, W3, K20_39);
  172|       |
  173|   111k|      SIMD_4x32(P1).store_le(PT);
  174|   111k|      F2(A, B, C, D, E, PT[0]);
  175|   111k|      F2(E, A, B, C, D, PT[1]);
  176|   111k|      F2(D, E, A, B, C, PT[2]);
  177|   111k|      F2(C, D, E, A, B, PT[3]);
  178|   111k|      P1 = prep(W1, W2, W3, W0, K20_39);
  179|       |
  180|   111k|      SIMD_4x32(P2).store_le(PT);
  181|   111k|      F2(B, C, D, E, A, PT[0]);
  182|   111k|      F2(A, B, C, D, E, PT[1]);
  183|   111k|      F2(E, A, B, C, D, PT[2]);
  184|   111k|      F2(D, E, A, B, C, PT[3]);
  185|   111k|      P2 = prep(W2, W3, W0, W1, K40_59);
  186|       |
  187|   111k|      SIMD_4x32(P3).store_le(PT);
  188|   111k|      F2(C, D, E, A, B, PT[0]);
  189|   111k|      F2(B, C, D, E, A, PT[1]);
  190|   111k|      F2(A, B, C, D, E, PT[2]);
  191|   111k|      F2(E, A, B, C, D, PT[3]);
  192|   111k|      P3 = prep(W3, W0, W1, W2, K40_59);
  193|       |
  194|   111k|      SIMD_4x32(P0).store_le(PT);
  195|   111k|      F2(D, E, A, B, C, PT[0]);
  196|   111k|      F2(C, D, E, A, B, PT[1]);
  197|   111k|      F2(B, C, D, E, A, PT[2]);
  198|   111k|      F2(A, B, C, D, E, PT[3]);
  199|   111k|      P0 = prep(W0, W1, W2, W3, K40_59);
  200|       |
  201|   111k|      SIMD_4x32(P1).store_le(PT);
  202|   111k|      F2(E, A, B, C, D, PT[0]);
  203|   111k|      F2(D, E, A, B, C, PT[1]);
  204|   111k|      F2(C, D, E, A, B, PT[2]);
  205|   111k|      F2(B, C, D, E, A, PT[3]);
  206|   111k|      P1 = prep(W1, W2, W3, W0, K40_59);
  207|       |
  208|   111k|      SIMD_4x32(P2).store_le(PT);
  209|   111k|      F3(A, B, C, D, E, PT[0]);
  210|   111k|      F3(E, A, B, C, D, PT[1]);
  211|   111k|      F3(D, E, A, B, C, PT[2]);
  212|   111k|      F3(C, D, E, A, B, PT[3]);
  213|   111k|      P2 = prep(W2, W3, W0, W1, K40_59);
  214|       |
  215|   111k|      SIMD_4x32(P3).store_le(PT);
  216|   111k|      F3(B, C, D, E, A, PT[0]);
  217|   111k|      F3(A, B, C, D, E, PT[1]);
  218|   111k|      F3(E, A, B, C, D, PT[2]);
  219|   111k|      F3(D, E, A, B, C, PT[3]);
  220|   111k|      P3 = prep(W3, W0, W1, W2, K60_79);
  221|       |
  222|   111k|      SIMD_4x32(P0).store_le(PT);
  223|   111k|      F3(C, D, E, A, B, PT[0]);
  224|   111k|      F3(B, C, D, E, A, PT[1]);
  225|   111k|      F3(A, B, C, D, E, PT[2]);
  226|   111k|      F3(E, A, B, C, D, PT[3]);
  227|   111k|      P0 = prep(W0, W1, W2, W3, K60_79);
  228|       |
  229|   111k|      SIMD_4x32(P1).store_le(PT);
  230|   111k|      F3(D, E, A, B, C, PT[0]);
  231|   111k|      F3(C, D, E, A, B, PT[1]);
  232|   111k|      F3(B, C, D, E, A, PT[2]);
  233|   111k|      F3(A, B, C, D, E, PT[3]);
  234|   111k|      P1 = prep(W1, W2, W3, W0, K60_79);
  235|       |
  236|   111k|      SIMD_4x32(P2).store_le(PT);
  237|   111k|      F3(E, A, B, C, D, PT[0]);
  238|   111k|      F3(D, E, A, B, C, PT[1]);
  239|   111k|      F3(C, D, E, A, B, PT[2]);
  240|   111k|      F3(B, C, D, E, A, PT[3]);
  241|   111k|      P2 = prep(W2, W3, W0, W1, K60_79);
  242|       |
  243|   111k|      SIMD_4x32(P3).store_le(PT);
  244|   111k|      F4(A, B, C, D, E, PT[0]);
  245|   111k|      F4(E, A, B, C, D, PT[1]);
  246|   111k|      F4(D, E, A, B, C, PT[2]);
  247|   111k|      F4(C, D, E, A, B, PT[3]);
  248|   111k|      P3 = prep(W3, W0, W1, W2, K60_79);
  249|       |
  250|   111k|      SIMD_4x32(P0).store_le(PT);
  251|   111k|      F4(B, C, D, E, A, PT[0]);
  252|   111k|      F4(A, B, C, D, E, PT[1]);
  253|   111k|      F4(E, A, B, C, D, PT[2]);
  254|   111k|      F4(D, E, A, B, C, PT[3]);
  255|       |
  256|   111k|      SIMD_4x32(P1).store_le(PT);
  257|   111k|      F4(C, D, E, A, B, PT[0]);
  258|   111k|      F4(B, C, D, E, A, PT[1]);
  259|   111k|      F4(A, B, C, D, E, PT[2]);
  260|   111k|      F4(E, A, B, C, D, PT[3]);
  261|       |
  262|   111k|      SIMD_4x32(P2).store_le(PT);
  263|   111k|      F4(D, E, A, B, C, PT[0]);
  264|   111k|      F4(C, D, E, A, B, PT[1]);
  265|   111k|      F4(B, C, D, E, A, PT[2]);
  266|   111k|      F4(A, B, C, D, E, PT[3]);
  267|       |
  268|   111k|      SIMD_4x32(P3).store_le(PT);
  269|   111k|      F4(E, A, B, C, D, PT[0]);
  270|   111k|      F4(D, E, A, B, C, PT[1]);
  271|   111k|      F4(C, D, E, A, B, PT[2]);
  272|   111k|      F4(B, C, D, E, A, PT[3]);
  273|       |
  274|   111k|      A = (digest[0] += A);
  275|   111k|      B = (digest[1] += B);
  276|   111k|      C = (digest[2] += C);
  277|   111k|      D = (digest[3] += D);
  278|   111k|      E = (digest[4] += E);
  279|       |
  280|   111k|      input += 64;
  281|   111k|   }
  282|  23.9k|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F1EjRjjjS2_j:
   77|  2.22M|inline void F1(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   78|  2.22M|   E += choose(B, C, D) + msg + rotl<5>(A);
   79|  2.22M|   B = rotl<30>(B);
   80|  2.22M|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_14prepERNS_9SIMD_4x32ES2_S2_S2_S2_:
   50|  1.78M|BOTAN_FORCE_INLINE SIMD_4x32 prep(SIMD_4x32& XW0, SIMD_4x32 XW1, SIMD_4x32 XW2, SIMD_4x32 XW3, SIMD_4x32 K) {
   51|  1.78M|   SIMD_4x32 T0 = XW0;
   52|       |   /* load W[t-4] 16-byte aligned, and shift */
   53|  1.78M|   SIMD_4x32 T2 = XW3.shift_elems_right<1>();
   54|       |   /* get high 64-bits of XW0 into low 64-bits */
   55|  1.78M|   SIMD_4x32 T1 = SIMD_4x32(_mm_shuffle_epi32(XW0.raw(), _MM_SHUFFLE(1, 0, 3, 2)));
   56|       |   /* load high 64-bits of T1 */
   57|  1.78M|   T1 = SIMD_4x32(_mm_unpacklo_epi64(T1.raw(), XW1.raw()));
   58|       |
   59|  1.78M|   T0 ^= T1;
   60|  1.78M|   T2 ^= XW2;
   61|  1.78M|   T0 ^= T2;
   62|       |   /* unrotated W[t]..W[t+2] in T0 ... still need W[t+3] */
   63|       |
   64|  1.78M|   T2 = T0.shift_elems_left<3>();
   65|  1.78M|   T0 = T0.rotl<1>();
   66|  1.78M|   T2 = T2.rotl<2>();
   67|       |
   68|  1.78M|   T0 ^= T2; /* T0 now has W[t+3] */
   69|       |
   70|  1.78M|   XW0 = T0;
   71|  1.78M|   return T0 + K;
   72|  1.78M|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F2EjRjjjS2_j:
   85|  2.22M|inline void F2(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   86|  2.22M|   E += (B ^ C ^ D) + msg + rotl<5>(A);
   87|  2.22M|   B = rotl<30>(B);
   88|  2.22M|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F3EjRjjjS2_j:
   93|  2.22M|inline void F3(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   94|  2.22M|   E += majority(B, C, D) + msg + rotl<5>(A);
   95|  2.22M|   B = rotl<30>(B);
   96|  2.22M|}
sha1_sse2.cpp:_ZN5Botan11SHA1_SSE2_F12_GLOBAL__N_12F4EjRjjjS2_j:
  101|  2.22M|inline void F4(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
  102|  2.22M|   E += (B ^ C ^ D) + msg + rotl<5>(A);
  103|  2.22M|   B = rotl<30>(B);
  104|  2.22M|}

_ZN5Botan7SHA_25615compress_digestERNSt3__16vectorIjNS_16secure_allocatorIjEEEEPKhm:
   52|   911k|void SHA_256::compress_digest(secure_vector<uint32_t>& digest, const uint8_t input[], size_t blocks) {
   53|   911k|#if defined(BOTAN_HAS_SHA2_32_X86)
   54|   911k|   if(CPUID::has_intel_sha()) {
  ------------------
  |  Branch (54:7): [True: 0, False: 911k]
  ------------------
   55|      0|      return SHA_256::compress_digest_x86(digest, input, blocks);
   56|      0|   }
   57|   911k|#endif
   58|       |
   59|   911k|#if defined(BOTAN_HAS_SHA2_32_X86_BMI2)
   60|   911k|   if(CPUID::has_bmi2()) {
  ------------------
  |  Branch (60:7): [True: 911k, False: 0]
  ------------------
   61|   911k|      return SHA_256::compress_digest_x86_bmi2(digest, input, blocks);
   62|   911k|   }
   63|      0|#endif
   64|       |
   65|       |#if defined(BOTAN_HAS_SHA2_32_ARMV8)
   66|       |   if(CPUID::has_arm_sha2()) {
   67|       |      return SHA_256::compress_digest_armv8(digest, input, blocks);
   68|       |   }
   69|       |#endif
   70|       |
   71|      0|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   72|      0|            H = digest[7];
   73|       |
   74|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (74:22): [True: 0, False: 0]
  ------------------
   75|      0|      uint32_t W00 = load_be<uint32_t>(input, 0);
   76|      0|      uint32_t W01 = load_be<uint32_t>(input, 1);
   77|      0|      uint32_t W02 = load_be<uint32_t>(input, 2);
   78|      0|      uint32_t W03 = load_be<uint32_t>(input, 3);
   79|      0|      uint32_t W04 = load_be<uint32_t>(input, 4);
   80|      0|      uint32_t W05 = load_be<uint32_t>(input, 5);
   81|      0|      uint32_t W06 = load_be<uint32_t>(input, 6);
   82|      0|      uint32_t W07 = load_be<uint32_t>(input, 7);
   83|      0|      uint32_t W08 = load_be<uint32_t>(input, 8);
   84|      0|      uint32_t W09 = load_be<uint32_t>(input, 9);
   85|      0|      uint32_t W10 = load_be<uint32_t>(input, 10);
   86|      0|      uint32_t W11 = load_be<uint32_t>(input, 11);
   87|      0|      uint32_t W12 = load_be<uint32_t>(input, 12);
   88|      0|      uint32_t W13 = load_be<uint32_t>(input, 13);
   89|      0|      uint32_t W14 = load_be<uint32_t>(input, 14);
   90|      0|      uint32_t W15 = load_be<uint32_t>(input, 15);
   91|       |
   92|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98);
   93|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x71374491);
   94|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCF);
   95|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA5);
   96|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25B);
   97|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1);
   98|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4);
   99|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5);
  100|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98);
  101|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B01);
  102|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE);
  103|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3);
  104|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74);
  105|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE);
  106|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A7);
  107|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174);
  108|       |
  109|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C1);
  110|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786);
  111|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC6);
  112|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC);
  113|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F);
  114|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA);
  115|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DC);
  116|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA);
  117|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152);
  118|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D);
  119|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C8);
  120|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7);
  121|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF3);
  122|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147);
  123|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351);
  124|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x14292967);
  125|       |
  126|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A85);
  127|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B2138);
  128|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC);
  129|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D13);
  130|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A7354);
  131|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB);
  132|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E);
  133|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C85);
  134|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A1);
  135|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664B);
  136|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70);
  137|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A3);
  138|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819);
  139|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD6990624);
  140|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E3585);
  141|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA070);
  142|       |
  143|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116);
  144|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C08);
  145|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774C);
  146|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5);
  147|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3);
  148|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4A);
  149|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F);
  150|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3);
  151|      0|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE);
  152|      0|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F);
  153|      0|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814);
  154|      0|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC70208);
  155|      0|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA);
  156|      0|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEB);
  157|      0|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7);
  158|      0|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2);
  159|       |
  160|      0|      A = (digest[0] += A);
  161|      0|      B = (digest[1] += B);
  162|      0|      C = (digest[2] += C);
  163|      0|      D = (digest[3] += D);
  164|      0|      E = (digest[4] += E);
  165|      0|      F = (digest[5] += F);
  166|      0|      G = (digest[6] += G);
  167|      0|      H = (digest[7] += H);
  168|       |
  169|      0|      input += 64;
  170|      0|   }
  171|      0|}
_ZN5Botan7SHA_25610compress_nEPKhm:
  205|   911k|void SHA_256::compress_n(const uint8_t input[], size_t blocks) { SHA_256::compress_digest(m_digest, input, blocks); }
_ZN5Botan7SHA_2568copy_outEPh:
  210|   408k|void SHA_256::copy_out(uint8_t output[]) { copy_out_vec_be(output, output_length(), m_digest); }
_ZN5Botan7SHA_2565clearEv:
  215|   518k|void SHA_256::clear() {
  216|   518k|   MDx_HashFunction::clear();
  217|   518k|   m_digest[0] = 0x6A09E667;
  218|   518k|   m_digest[1] = 0xBB67AE85;
  219|   518k|   m_digest[2] = 0x3C6EF372;
  220|   518k|   m_digest[3] = 0xA54FF53A;
  221|   518k|   m_digest[4] = 0x510E527F;
  222|   518k|   m_digest[5] = 0x9B05688C;
  223|   518k|   m_digest[6] = 0x1F83D9AB;
  224|   518k|   m_digest[7] = 0x5BE0CD19;
  225|   518k|}

_ZN5Botan7SHA_25624compress_digest_x86_bmi2ERNSt3__16vectorIjNS_16secure_allocatorIjEEEEPKhm:
   23|   911k|void SHA_256::compress_digest_x86_bmi2(secure_vector<uint32_t>& digest, const uint8_t input[], size_t blocks) {
   24|   911k|   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   25|   911k|            H = digest[7];
   26|       |
   27|  1.93M|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (27:22): [True: 1.02M, False: 911k]
  ------------------
   28|  1.02M|      uint32_t W00 = load_be<uint32_t>(input, 0);
   29|  1.02M|      uint32_t W01 = load_be<uint32_t>(input, 1);
   30|  1.02M|      uint32_t W02 = load_be<uint32_t>(input, 2);
   31|  1.02M|      uint32_t W03 = load_be<uint32_t>(input, 3);
   32|  1.02M|      uint32_t W04 = load_be<uint32_t>(input, 4);
   33|  1.02M|      uint32_t W05 = load_be<uint32_t>(input, 5);
   34|  1.02M|      uint32_t W06 = load_be<uint32_t>(input, 6);
   35|  1.02M|      uint32_t W07 = load_be<uint32_t>(input, 7);
   36|  1.02M|      uint32_t W08 = load_be<uint32_t>(input, 8);
   37|  1.02M|      uint32_t W09 = load_be<uint32_t>(input, 9);
   38|  1.02M|      uint32_t W10 = load_be<uint32_t>(input, 10);
   39|  1.02M|      uint32_t W11 = load_be<uint32_t>(input, 11);
   40|  1.02M|      uint32_t W12 = load_be<uint32_t>(input, 12);
   41|  1.02M|      uint32_t W13 = load_be<uint32_t>(input, 13);
   42|  1.02M|      uint32_t W14 = load_be<uint32_t>(input, 14);
   43|  1.02M|      uint32_t W15 = load_be<uint32_t>(input, 15);
   44|       |
   45|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98);
   46|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x71374491);
   47|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCF);
   48|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA5);
   49|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25B);
   50|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1);
   51|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4);
   52|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5);
   53|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98);
   54|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B01);
   55|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE);
   56|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3);
   57|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74);
   58|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE);
   59|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A7);
   60|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174);
   61|       |
   62|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C1);
   63|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786);
   64|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC6);
   65|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC);
   66|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F);
   67|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA);
   68|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DC);
   69|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA);
   70|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152);
   71|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D);
   72|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C8);
   73|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7);
   74|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF3);
   75|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147);
   76|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351);
   77|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x14292967);
   78|       |
   79|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A85);
   80|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B2138);
   81|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC);
   82|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D13);
   83|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A7354);
   84|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB);
   85|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E);
   86|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C85);
   87|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A1);
   88|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664B);
   89|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70);
   90|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A3);
   91|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819);
   92|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD6990624);
   93|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E3585);
   94|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA070);
   95|       |
   96|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116);
   97|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C08);
   98|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774C);
   99|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5);
  100|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3);
  101|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4A);
  102|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F);
  103|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3);
  104|  1.02M|      SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE);
  105|  1.02M|      SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F);
  106|  1.02M|      SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814);
  107|  1.02M|      SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC70208);
  108|  1.02M|      SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA);
  109|  1.02M|      SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEB);
  110|  1.02M|      SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7);
  111|  1.02M|      SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2);
  112|       |
  113|  1.02M|      A = (digest[0] += A);
  114|  1.02M|      B = (digest[1] += B);
  115|  1.02M|      C = (digest[2] += C);
  116|  1.02M|      D = (digest[3] += D);
  117|  1.02M|      E = (digest[4] += E);
  118|  1.02M|      F = (digest[5] += F);
  119|  1.02M|      G = (digest[6] += G);
  120|  1.02M|      H = (digest[7] += H);
  121|       |
  122|  1.02M|      input += 64;
  123|  1.02M|   }
  124|   911k|}

_ZN5Botan7SHA_51215compress_digestERNSt3__16vectorImNS_16secure_allocatorImEEEEPKhm:
   42|  92.3k|void SHA_512::compress_digest(secure_vector<uint64_t>& digest, const uint8_t input[], size_t blocks) {
   43|  92.3k|#if defined(BOTAN_HAS_SHA2_64_BMI2)
   44|  92.3k|   if(CPUID::has_bmi2()) {
  ------------------
  |  Branch (44:7): [True: 92.3k, False: 0]
  ------------------
   45|  92.3k|      return compress_digest_bmi2(digest, input, blocks);
   46|  92.3k|   }
   47|      0|#endif
   48|       |
   49|      0|   uint64_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   50|      0|            H = digest[7];
   51|       |
   52|      0|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (52:22): [True: 0, False: 0]
  ------------------
   53|      0|      uint64_t W00 = load_be<uint64_t>(input, 0);
   54|      0|      uint64_t W01 = load_be<uint64_t>(input, 1);
   55|      0|      uint64_t W02 = load_be<uint64_t>(input, 2);
   56|      0|      uint64_t W03 = load_be<uint64_t>(input, 3);
   57|      0|      uint64_t W04 = load_be<uint64_t>(input, 4);
   58|      0|      uint64_t W05 = load_be<uint64_t>(input, 5);
   59|      0|      uint64_t W06 = load_be<uint64_t>(input, 6);
   60|      0|      uint64_t W07 = load_be<uint64_t>(input, 7);
   61|      0|      uint64_t W08 = load_be<uint64_t>(input, 8);
   62|      0|      uint64_t W09 = load_be<uint64_t>(input, 9);
   63|      0|      uint64_t W10 = load_be<uint64_t>(input, 10);
   64|      0|      uint64_t W11 = load_be<uint64_t>(input, 11);
   65|      0|      uint64_t W12 = load_be<uint64_t>(input, 12);
   66|      0|      uint64_t W13 = load_be<uint64_t>(input, 13);
   67|      0|      uint64_t W14 = load_be<uint64_t>(input, 14);
   68|      0|      uint64_t W15 = load_be<uint64_t>(input, 15);
   69|       |
   70|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98D728AE22);
   71|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x7137449123EF65CD);
   72|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCFEC4D3B2F);
   73|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA58189DBBC);
   74|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25BF348B538);
   75|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1B605D019);
   76|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4AF194F9B);
   77|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5DA6D8118);
   78|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98A3030242);
   79|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B0145706FBE);
   80|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE4EE4B28C);
   81|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3D5FFB4E2);
   82|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74F27B896F);
   83|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE3B1696B1);
   84|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A725C71235);
   85|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174CF692694);
   86|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C19EF14AD2);
   87|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786384F25E3);
   88|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC68B8CD5B5);
   89|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC77AC9C65);
   90|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F592B0275);
   91|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA6EA6E483);
   92|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DCBD41FBD4);
   93|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA831153B5);
   94|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152EE66DFAB);
   95|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D2DB43210);
   96|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C898FB213F);
   97|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7BEEF0EE4);
   98|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF33DA88FC2);
   99|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147930AA725);
  100|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351E003826F);
  101|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x142929670A0E6E70);
  102|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A8546D22FFC);
  103|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B21385C26C926);
  104|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC5AC42AED);
  105|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D139D95B3DF);
  106|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A73548BAF63DE);
  107|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB3C77B2A8);
  108|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E47EDAEE6);
  109|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C851482353B);
  110|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A14CF10364);
  111|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664BBC423001);
  112|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70D0F89791);
  113|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A30654BE30);
  114|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819D6EF5218);
  115|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD69906245565A910);
  116|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E35855771202A);
  117|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA07032BBD1B8);
  118|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116B8D2D0C8);
  119|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C085141AB53);
  120|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774CDF8EEB99);
  121|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5E19B48A8);
  122|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3C5C95A63);
  123|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4AE3418ACB);
  124|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F7763E373);
  125|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3D6B2B8A3);
  126|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE5DEFB2FC);
  127|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F43172F60);
  128|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814A1F0AB72);
  129|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC702081A6439EC);
  130|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA23631E28);
  131|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEBDE82BDE9);
  132|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7B2C67915);
  133|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2E372532B);
  134|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xCA273ECEEA26619C);
  135|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xD186B8C721C0C207);
  136|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xEADA7DD6CDE0EB1E);
  137|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xF57D4F7FEE6ED178);
  138|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x06F067AA72176FBA);
  139|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x0A637DC5A2C898A6);
  140|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x113F9804BEF90DAE);
  141|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x1B710B35131C471B);
  142|      0|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x28DB77F523047D84);
  143|      0|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x32CAAB7B40C72493);
  144|      0|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x3C9EBE0A15C9BEBC);
  145|      0|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x431D67C49C100D4C);
  146|      0|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x4CC5D4BECB3E42B6);
  147|      0|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x597F299CFC657E2A);
  148|      0|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x5FCB6FAB3AD6FAEC);
  149|      0|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x6C44198C4A475817);
  150|       |
  151|      0|      A = (digest[0] += A);
  152|      0|      B = (digest[1] += B);
  153|      0|      C = (digest[2] += C);
  154|      0|      D = (digest[3] += D);
  155|      0|      E = (digest[4] += E);
  156|      0|      F = (digest[5] += F);
  157|      0|      G = (digest[6] += G);
  158|      0|      H = (digest[7] += H);
  159|       |
  160|      0|      input += 128;
  161|      0|   }
  162|      0|}
_ZN5Botan7SHA_38410compress_nEPKhm:
  176|  92.3k|void SHA_384::compress_n(const uint8_t input[], size_t blocks) { SHA_512::compress_digest(m_digest, input, blocks); }
_ZN5Botan7SHA_3848copy_outEPh:
  182|  39.2k|void SHA_384::copy_out(uint8_t output[]) { copy_out_vec_be(output, output_length(), m_digest); }
_ZN5Botan7SHA_3845clearEv:
  198|  46.6k|void SHA_384::clear() {
  199|  46.6k|   MDx_HashFunction::clear();
  200|  46.6k|   m_digest[0] = 0xCBBB9D5DC1059ED8;
  201|  46.6k|   m_digest[1] = 0x629A292A367CD507;
  202|  46.6k|   m_digest[2] = 0x9159015A3070DD17;
  203|  46.6k|   m_digest[3] = 0x152FECD8F70E5939;
  204|  46.6k|   m_digest[4] = 0x67332667FFC00B31;
  205|  46.6k|   m_digest[5] = 0x8EB44A8768581511;
  206|  46.6k|   m_digest[6] = 0xDB0C2E0D64F98FA7;
  207|  46.6k|   m_digest[7] = 0x47B5481DBEFA4FA4;
  208|  46.6k|}

_ZN5Botan7SHA_51220compress_digest_bmi2ERNSt3__16vectorImNS_16secure_allocatorImEEEEPKhm:
   16|  92.3k|void SHA_512::compress_digest_bmi2(secure_vector<uint64_t>& digest, const uint8_t input[], size_t blocks) {
   17|  92.3k|   uint64_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4], F = digest[5], G = digest[6],
   18|  92.3k|            H = digest[7];
   19|       |
   20|   185k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (20:22): [True: 93.3k, False: 92.3k]
  ------------------
   21|  93.3k|      uint64_t W00 = load_be<uint64_t>(input, 0);
   22|  93.3k|      uint64_t W01 = load_be<uint64_t>(input, 1);
   23|  93.3k|      uint64_t W02 = load_be<uint64_t>(input, 2);
   24|  93.3k|      uint64_t W03 = load_be<uint64_t>(input, 3);
   25|  93.3k|      uint64_t W04 = load_be<uint64_t>(input, 4);
   26|  93.3k|      uint64_t W05 = load_be<uint64_t>(input, 5);
   27|  93.3k|      uint64_t W06 = load_be<uint64_t>(input, 6);
   28|  93.3k|      uint64_t W07 = load_be<uint64_t>(input, 7);
   29|  93.3k|      uint64_t W08 = load_be<uint64_t>(input, 8);
   30|  93.3k|      uint64_t W09 = load_be<uint64_t>(input, 9);
   31|  93.3k|      uint64_t W10 = load_be<uint64_t>(input, 10);
   32|  93.3k|      uint64_t W11 = load_be<uint64_t>(input, 11);
   33|  93.3k|      uint64_t W12 = load_be<uint64_t>(input, 12);
   34|  93.3k|      uint64_t W13 = load_be<uint64_t>(input, 13);
   35|  93.3k|      uint64_t W14 = load_be<uint64_t>(input, 14);
   36|  93.3k|      uint64_t W15 = load_be<uint64_t>(input, 15);
   37|       |
   38|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98D728AE22);
   39|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x7137449123EF65CD);
   40|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCFEC4D3B2F);
   41|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA58189DBBC);
   42|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25BF348B538);
   43|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1B605D019);
   44|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4AF194F9B);
   45|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5DA6D8118);
   46|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98A3030242);
   47|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B0145706FBE);
   48|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE4EE4B28C);
   49|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3D5FFB4E2);
   50|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74F27B896F);
   51|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE3B1696B1);
   52|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A725C71235);
   53|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174CF692694);
   54|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C19EF14AD2);
   55|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786384F25E3);
   56|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC68B8CD5B5);
   57|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC77AC9C65);
   58|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F592B0275);
   59|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA6EA6E483);
   60|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DCBD41FBD4);
   61|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA831153B5);
   62|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152EE66DFAB);
   63|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D2DB43210);
   64|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C898FB213F);
   65|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7BEEF0EE4);
   66|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF33DA88FC2);
   67|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147930AA725);
   68|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351E003826F);
   69|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x142929670A0E6E70);
   70|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A8546D22FFC);
   71|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B21385C26C926);
   72|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC5AC42AED);
   73|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D139D95B3DF);
   74|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A73548BAF63DE);
   75|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB3C77B2A8);
   76|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E47EDAEE6);
   77|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C851482353B);
   78|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A14CF10364);
   79|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664BBC423001);
   80|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70D0F89791);
   81|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A30654BE30);
   82|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819D6EF5218);
   83|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD69906245565A910);
   84|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E35855771202A);
   85|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA07032BBD1B8);
   86|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116B8D2D0C8);
   87|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C085141AB53);
   88|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774CDF8EEB99);
   89|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5E19B48A8);
   90|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3C5C95A63);
   91|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4AE3418ACB);
   92|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F7763E373);
   93|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3D6B2B8A3);
   94|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE5DEFB2FC);
   95|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F43172F60);
   96|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814A1F0AB72);
   97|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC702081A6439EC);
   98|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA23631E28);
   99|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEBDE82BDE9);
  100|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7B2C67915);
  101|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2E372532B);
  102|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xCA273ECEEA26619C);
  103|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xD186B8C721C0C207);
  104|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xEADA7DD6CDE0EB1E);
  105|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xF57D4F7FEE6ED178);
  106|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x06F067AA72176FBA);
  107|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x0A637DC5A2C898A6);
  108|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x113F9804BEF90DAE);
  109|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x1B710B35131C471B);
  110|  93.3k|      SHA2_64_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x28DB77F523047D84);
  111|  93.3k|      SHA2_64_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x32CAAB7B40C72493);
  112|  93.3k|      SHA2_64_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x3C9EBE0A15C9BEBC);
  113|  93.3k|      SHA2_64_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x431D67C49C100D4C);
  114|  93.3k|      SHA2_64_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x4CC5D4BECB3E42B6);
  115|  93.3k|      SHA2_64_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x597F299CFC657E2A);
  116|  93.3k|      SHA2_64_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x5FCB6FAB3AD6FAEC);
  117|  93.3k|      SHA2_64_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x6C44198C4A475817);
  118|       |
  119|  93.3k|      A = (digest[0] += A);
  120|  93.3k|      B = (digest[1] += B);
  121|  93.3k|      C = (digest[2] += C);
  122|  93.3k|      D = (digest[3] += D);
  123|  93.3k|      E = (digest[4] += E);
  124|  93.3k|      F = (digest[5] += F);
  125|  93.3k|      G = (digest[6] += G);
  126|  93.3k|      H = (digest[7] += H);
  127|       |
  128|  93.3k|      input += 128;
  129|  93.3k|   }
  130|  92.3k|}

_ZN5Botan3KDF6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   71|  15.1k|std::unique_ptr<KDF> KDF::create(std::string_view algo_spec, std::string_view provider) {
   72|  15.1k|   const SCAN_Name req(algo_spec);
   73|       |
   74|  15.1k|#if defined(BOTAN_HAS_HKDF)
   75|  15.1k|   if(req.algo_name() == "HKDF" && req.arg_count() == 1) {
  ------------------
  |  Branch (75:7): [True: 0, False: 15.1k]
  |  Branch (75:7): [True: 0, False: 15.1k]
  |  Branch (75:36): [True: 0, False: 0]
  ------------------
   76|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (76:10): [True: 0, False: 0]
  |  Branch (76:30): [True: 0, False: 0]
  ------------------
   77|      0|         return kdf_create_mac_or_hash<HKDF>(req.arg(0));
   78|      0|      }
   79|      0|   }
   80|       |
   81|  15.1k|   if(req.algo_name() == "HKDF-Extract" && req.arg_count() == 1) {
  ------------------
  |  Branch (81:7): [True: 0, False: 15.1k]
  |  Branch (81:7): [True: 0, False: 15.1k]
  |  Branch (81:44): [True: 0, False: 0]
  ------------------
   82|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (82:10): [True: 0, False: 0]
  |  Branch (82:30): [True: 0, False: 0]
  ------------------
   83|      0|         return kdf_create_mac_or_hash<HKDF_Extract>(req.arg(0));
   84|      0|      }
   85|      0|   }
   86|       |
   87|  15.1k|   if(req.algo_name() == "HKDF-Expand" && req.arg_count() == 1) {
  ------------------
  |  Branch (87:7): [True: 0, False: 15.1k]
  |  Branch (87:7): [True: 0, False: 15.1k]
  |  Branch (87:43): [True: 0, False: 0]
  ------------------
   88|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (88:10): [True: 0, False: 0]
  |  Branch (88:30): [True: 0, False: 0]
  ------------------
   89|      0|         return kdf_create_mac_or_hash<HKDF_Expand>(req.arg(0));
   90|      0|      }
   91|      0|   }
   92|  15.1k|#endif
   93|       |
   94|  15.1k|#if defined(BOTAN_HAS_KDF2)
   95|  15.1k|   if(req.algo_name() == "KDF2" && req.arg_count() == 1) {
  ------------------
  |  Branch (95:7): [True: 0, False: 15.1k]
  |  Branch (95:7): [True: 0, False: 15.1k]
  |  Branch (95:36): [True: 0, False: 0]
  ------------------
   96|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (96:10): [True: 0, False: 0]
  |  Branch (96:30): [True: 0, False: 0]
  ------------------
   97|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (97:18): [True: 0, False: 0]
  ------------------
   98|      0|            return std::make_unique<KDF2>(std::move(hash));
   99|      0|         }
  100|      0|      }
  101|      0|   }
  102|  15.1k|#endif
  103|       |
  104|  15.1k|#if defined(BOTAN_HAS_KDF1_18033)
  105|  15.1k|   if(req.algo_name() == "KDF1-18033" && req.arg_count() == 1) {
  ------------------
  |  Branch (105:7): [True: 0, False: 15.1k]
  |  Branch (105:7): [True: 0, False: 15.1k]
  |  Branch (105:42): [True: 0, False: 0]
  ------------------
  106|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (106:10): [True: 0, False: 0]
  |  Branch (106:30): [True: 0, False: 0]
  ------------------
  107|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (107:18): [True: 0, False: 0]
  ------------------
  108|      0|            return std::make_unique<KDF1_18033>(std::move(hash));
  109|      0|         }
  110|      0|      }
  111|      0|   }
  112|  15.1k|#endif
  113|       |
  114|  15.1k|#if defined(BOTAN_HAS_KDF1)
  115|  15.1k|   if(req.algo_name() == "KDF1" && req.arg_count() == 1) {
  ------------------
  |  Branch (115:7): [True: 0, False: 15.1k]
  |  Branch (115:7): [True: 0, False: 15.1k]
  |  Branch (115:36): [True: 0, False: 0]
  ------------------
  116|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (116:10): [True: 0, False: 0]
  |  Branch (116:30): [True: 0, False: 0]
  ------------------
  117|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (117:18): [True: 0, False: 0]
  ------------------
  118|      0|            return std::make_unique<KDF1>(std::move(hash));
  119|      0|         }
  120|      0|      }
  121|      0|   }
  122|  15.1k|#endif
  123|       |
  124|  15.1k|#if defined(BOTAN_HAS_TLS_V12_PRF)
  125|  15.1k|   if(req.algo_name() == "TLS-12-PRF" && req.arg_count() == 1) {
  ------------------
  |  Branch (125:7): [True: 15.1k, False: 0]
  |  Branch (125:7): [True: 15.1k, False: 0]
  |  Branch (125:42): [True: 15.1k, False: 0]
  ------------------
  126|  15.1k|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (126:10): [True: 15.1k, False: 0]
  |  Branch (126:30): [True: 0, False: 0]
  ------------------
  127|  15.1k|         return kdf_create_mac_or_hash<TLS_12_PRF>(req.arg(0));
  128|  15.1k|      }
  129|  15.1k|   }
  130|      0|#endif
  131|       |
  132|      0|#if defined(BOTAN_HAS_X942_PRF)
  133|      0|   if(req.algo_name() == "X9.42-PRF" && req.arg_count() == 1) {
  ------------------
  |  Branch (133:7): [True: 0, False: 0]
  |  Branch (133:7): [True: 0, False: 0]
  |  Branch (133:41): [True: 0, False: 0]
  ------------------
  134|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (134:10): [True: 0, False: 0]
  |  Branch (134:30): [True: 0, False: 0]
  ------------------
  135|      0|         return std::make_unique<X942_PRF>(req.arg(0));
  136|      0|      }
  137|      0|   }
  138|      0|#endif
  139|       |
  140|      0|#if defined(BOTAN_HAS_SP800_108)
  141|      0|   if(req.algo_name() == "SP800-108-Counter" && req.arg_count() == 1) {
  ------------------
  |  Branch (141:7): [True: 0, False: 0]
  |  Branch (141:7): [True: 0, False: 0]
  |  Branch (141:49): [True: 0, False: 0]
  ------------------
  142|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (142:10): [True: 0, False: 0]
  |  Branch (142:30): [True: 0, False: 0]
  ------------------
  143|      0|         return kdf_create_mac_or_hash<SP800_108_Counter>(req.arg(0));
  144|      0|      }
  145|      0|   }
  146|       |
  147|      0|   if(req.algo_name() == "SP800-108-Feedback" && req.arg_count() == 1) {
  ------------------
  |  Branch (147:7): [True: 0, False: 0]
  |  Branch (147:7): [True: 0, False: 0]
  |  Branch (147:50): [True: 0, False: 0]
  ------------------
  148|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (148:10): [True: 0, False: 0]
  |  Branch (148:30): [True: 0, False: 0]
  ------------------
  149|      0|         return kdf_create_mac_or_hash<SP800_108_Feedback>(req.arg(0));
  150|      0|      }
  151|      0|   }
  152|       |
  153|      0|   if(req.algo_name() == "SP800-108-Pipeline" && req.arg_count() == 1) {
  ------------------
  |  Branch (153:7): [True: 0, False: 0]
  |  Branch (153:7): [True: 0, False: 0]
  |  Branch (153:50): [True: 0, False: 0]
  ------------------
  154|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (154:10): [True: 0, False: 0]
  |  Branch (154:30): [True: 0, False: 0]
  ------------------
  155|      0|         return kdf_create_mac_or_hash<SP800_108_Pipeline>(req.arg(0));
  156|      0|      }
  157|      0|   }
  158|      0|#endif
  159|       |
  160|      0|#if defined(BOTAN_HAS_SP800_56A)
  161|      0|   if(req.algo_name() == "SP800-56A" && req.arg_count() == 1) {
  ------------------
  |  Branch (161:7): [True: 0, False: 0]
  |  Branch (161:7): [True: 0, False: 0]
  |  Branch (161:41): [True: 0, False: 0]
  ------------------
  162|      0|      if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (162:15): [True: 0, False: 0]
  ------------------
  163|      0|         return std::make_unique<SP800_56A_Hash>(std::move(hash));
  164|      0|      }
  165|      0|      if(auto mac = MessageAuthenticationCode::create(req.arg(0))) {
  ------------------
  |  Branch (165:15): [True: 0, False: 0]
  ------------------
  166|      0|         return std::make_unique<SP800_56A_HMAC>(std::move(mac));
  167|      0|      }
  168|      0|   }
  169|      0|#endif
  170|       |
  171|      0|#if defined(BOTAN_HAS_SP800_56C)
  172|      0|   if(req.algo_name() == "SP800-56C" && req.arg_count() == 1) {
  ------------------
  |  Branch (172:7): [True: 0, False: 0]
  |  Branch (172:7): [True: 0, False: 0]
  |  Branch (172:41): [True: 0, False: 0]
  ------------------
  173|      0|      std::unique_ptr<KDF> exp(kdf_create_mac_or_hash<SP800_108_Feedback>(req.arg(0)));
  174|      0|      if(exp) {
  ------------------
  |  Branch (174:10): [True: 0, False: 0]
  ------------------
  175|      0|         if(auto mac = MessageAuthenticationCode::create(req.arg(0))) {
  ------------------
  |  Branch (175:18): [True: 0, False: 0]
  ------------------
  176|      0|            return std::make_unique<SP800_56C>(std::move(mac), std::move(exp));
  177|      0|         }
  178|       |
  179|      0|         if(auto mac = MessageAuthenticationCode::create(fmt("HMAC({})", req.arg(0)))) {
  ------------------
  |  Branch (179:18): [True: 0, False: 0]
  ------------------
  180|      0|            return std::make_unique<SP800_56C>(std::move(mac), std::move(exp));
  181|      0|         }
  182|      0|      }
  183|      0|   }
  184|      0|#endif
  185|       |
  186|      0|   BOTAN_UNUSED(req);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  187|      0|   BOTAN_UNUSED(provider);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  188|       |
  189|      0|   return nullptr;
  190|      0|}
_ZN5Botan3KDF15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  193|  15.1k|std::unique_ptr<KDF> KDF::create_or_throw(std::string_view algo, std::string_view provider) {
  194|  15.1k|   if(auto kdf = KDF::create(algo, provider)) {
  ------------------
  |  Branch (194:12): [True: 15.1k, False: 0]
  ------------------
  195|  15.1k|      return kdf;
  196|  15.1k|   }
  197|      0|   throw Lookup_Error("KDF", algo, provider);
  198|  15.1k|}
kdf.cpp:_ZN5Botan12_GLOBAL__N_122kdf_create_mac_or_hashINS_10TLS_12_PRFEEENSt3__110unique_ptrINS_3KDFENS3_14default_deleteIS5_EEEENS3_17basic_string_viewIcNS3_11char_traitsIcEEEE:
   57|  15.1k|std::unique_ptr<KDF> kdf_create_mac_or_hash(std::string_view nm) {
   58|  15.1k|   if(auto mac = MessageAuthenticationCode::create(fmt("HMAC({})", nm))) {
  ------------------
  |  Branch (58:12): [True: 15.1k, False: 0]
  ------------------
   59|  15.1k|      return std::make_unique<KDF_Type>(std::move(mac));
   60|  15.1k|   }
   61|       |
   62|      0|   if(auto mac = MessageAuthenticationCode::create(nm)) {
  ------------------
  |  Branch (62:12): [True: 0, False: 0]
  ------------------
   63|      0|      return std::make_unique<KDF_Type>(std::move(mac));
   64|      0|   }
   65|       |
   66|      0|   return nullptr;
   67|      0|}

_ZNK5Botan10TLS_12_PRF3kdfEPhmPKhmS3_mS3_m:
   64|  29.7k|                     size_t label_len) const {
   65|  29.7k|   secure_vector<uint8_t> msg;
   66|       |
   67|  29.7k|   msg.reserve(label_len + salt_len);
   68|  29.7k|   msg += std::make_pair(label, label_len);
   69|  29.7k|   msg += std::make_pair(salt, salt_len);
   70|       |
   71|  29.7k|   P_hash(key, key_len, *m_mac, secret, secret_len, msg.data(), msg.size());
   72|  29.7k|}
prf_tls.cpp:_ZN5Botan12_GLOBAL__N_16P_hashEPhmRNS_25MessageAuthenticationCodeEPKhmS5_m:
   26|  29.7k|            size_t salt_len) {
   27|  29.7k|   try {
   28|  29.7k|      mac.set_key(secret, secret_len);
   29|  29.7k|   } catch(Invalid_Key_Length&) {
   30|      0|      throw Internal_Error(fmt("The premaster secret of {} bytes is too long for TLS-PRF", secret_len));
   31|      0|   }
   32|       |
   33|  29.7k|   secure_vector<uint8_t> A(salt, salt + salt_len);
   34|  29.7k|   secure_vector<uint8_t> h;
   35|       |
   36|  29.7k|   size_t offset = 0;
   37|       |
   38|   119k|   while(offset != out_len) {
  ------------------
  |  Branch (38:10): [True: 89.3k, False: 29.7k]
  ------------------
   39|  89.3k|      A = mac.process(A);
   40|       |
   41|  89.3k|      mac.update(A);
   42|  89.3k|      mac.update(salt, salt_len);
   43|  89.3k|      mac.final(h);
   44|       |
   45|  89.3k|      const size_t writing = std::min(h.size(), out_len - offset);
   46|  89.3k|      xor_buf(&out[offset], h.data(), writing);
   47|  89.3k|      offset += writing;
   48|  89.3k|   }
   49|  29.7k|}

_ZN5Botan4HMAC8add_dataEPKhm:
   19|   283k|void HMAC::add_data(const uint8_t input[], size_t length) {
   20|   283k|   assert_key_material_set();
   21|   283k|   m_hash->update(input, length);
   22|   283k|}
_ZN5Botan4HMAC12final_resultEPh:
   27|   182k|void HMAC::final_result(uint8_t mac[]) {
   28|   182k|   assert_key_material_set();
   29|   182k|   m_hash->final(mac);
   30|   182k|   m_hash->update(m_okey);
   31|   182k|   m_hash->update(mac, m_hash_output_length);
   32|   182k|   m_hash->final(mac);
   33|   182k|   m_hash->update(m_ikey);
   34|   182k|}
_ZNK5Botan4HMAC8key_specEv:
   36|  33.8k|Key_Length_Specification HMAC::key_spec() const {
   37|       |   // Support very long lengths for things like PBKDF2 and the TLS PRF
   38|  33.8k|   return Key_Length_Specification(0, 4096);
   39|  33.8k|}
_ZNK5Botan4HMAC13output_lengthEv:
   41|   182k|size_t HMAC::output_length() const { return m_hash_output_length; }
_ZNK5Botan4HMAC19has_keying_materialEv:
   43|   466k|bool HMAC::has_keying_material() const { return !m_okey.empty(); }
_ZN5Botan4HMAC12key_scheduleEPKhm:
   48|  33.8k|void HMAC::key_schedule(const uint8_t key[], size_t length) {
   49|  33.8k|   const uint8_t ipad = 0x36;
   50|  33.8k|   const uint8_t opad = 0x5C;
   51|       |
   52|  33.8k|   m_hash->clear();
   53|       |
   54|  33.8k|   m_ikey.resize(m_hash_block_size);
   55|  33.8k|   m_okey.resize(m_hash_block_size);
   56|       |
   57|  33.8k|   clear_mem(m_ikey.data(), m_ikey.size());
   58|  33.8k|   clear_mem(m_okey.data(), m_okey.size());
   59|       |
   60|       |   /*
   61|       |   * Sometimes the HMAC key length itself is sensitive, as with PBKDF2 where it
   62|       |   * reveals the length of the passphrase. Make some attempt to hide this to
   63|       |   * side channels. Clearly if the secret is longer than the block size then the
   64|       |   * branch to hash first reveals that. In addition, counting the number of
   65|       |   * compression functions executed reveals the size at the granularity of the
   66|       |   * hash function's block size.
   67|       |   *
   68|       |   * The greater concern is for smaller keys; being able to detect when a
   69|       |   * passphrase is say 4 bytes may assist choosing weaker targets. Even though
   70|       |   * the loop bounds are constant, we can only actually read key[0..length] so
   71|       |   * it doesn't seem possible to make this computation truly constant time.
   72|       |   *
   73|       |   * We don't mind leaking if the length is exactly zero since that's
   74|       |   * trivial to simply check.
   75|       |   */
   76|       |
   77|  33.8k|   if(length > m_hash_block_size) {
  ------------------
  |  Branch (77:7): [True: 11.5k, False: 22.2k]
  ------------------
   78|  11.5k|      m_hash->update(key, length);
   79|  11.5k|      m_hash->final(m_ikey.data());
   80|  22.2k|   } else if(length > 0) {
  ------------------
  |  Branch (80:14): [True: 22.2k, False: 0]
  ------------------
   81|  1.69M|      for(size_t i = 0, i_mod_length = 0; i != m_hash_block_size; ++i) {
  ------------------
  |  Branch (81:43): [True: 1.66M, False: 22.2k]
  ------------------
   82|       |         /*
   83|       |         access key[i % length] but avoiding division due to variable
   84|       |         time computation on some processors.
   85|       |         */
   86|  1.66M|         auto needs_reduction = CT::Mask<size_t>::is_lte(length, i_mod_length);
   87|  1.66M|         i_mod_length = needs_reduction.select(0, i_mod_length);
   88|  1.66M|         const uint8_t kb = key[i_mod_length];
   89|       |
   90|  1.66M|         auto in_range = CT::Mask<size_t>::is_lt(i, length);
   91|  1.66M|         m_ikey[i] = static_cast<uint8_t>(in_range.if_set_return(kb));
   92|  1.66M|         i_mod_length += 1;
   93|  1.66M|      }
   94|  22.2k|   }
   95|       |
   96|  2.46M|   for(size_t i = 0; i != m_hash_block_size; ++i) {
  ------------------
  |  Branch (96:22): [True: 2.43M, False: 33.8k]
  ------------------
   97|  2.43M|      m_ikey[i] ^= ipad;
   98|  2.43M|      m_okey[i] = m_ikey[i] ^ ipad ^ opad;
   99|  2.43M|   }
  100|       |
  101|  33.8k|   m_hash->update(m_ikey);
  102|  33.8k|}
_ZNK5Botan4HMAC4nameEv:
  116|    359|std::string HMAC::name() const { return fmt("HMAC({})", m_hash->name()); }
_ZN5Botan4HMACC2ENSt3__110unique_ptrINS_12HashFunctionENS1_14default_deleteIS3_EEEE:
  131|  19.2k|      m_hash_block_size(m_hash->hash_block_size()) {
  132|  19.2k|   BOTAN_ARG_CHECK(m_hash_block_size >= m_hash_output_length, "HMAC is not compatible with this hash function");
  ------------------
  |  |   30|  19.2k|   do {                                                          \
  |  |   31|  19.2k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 19.2k]
  |  |  ------------------
  |  |   32|  19.2k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  19.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  133|  19.2k|}

_ZN5Botan25MessageAuthenticationCode6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   47|  19.3k|                                                                             std::string_view provider) {
   48|  19.3k|   const SCAN_Name req(algo_spec);
   49|       |
   50|  19.3k|#if defined(BOTAN_HAS_BLAKE2BMAC)
   51|  19.3k|   if(req.algo_name() == "Blake2b" || req.algo_name() == "BLAKE2b") {
  ------------------
  |  Branch (51:7): [True: 0, False: 19.3k]
  |  Branch (51:7): [True: 0, False: 19.3k]
  |  Branch (51:39): [True: 0, False: 19.3k]
  ------------------
   52|      0|      return std::make_unique<BLAKE2bMAC>(req.arg_as_integer(0, 512));
   53|      0|   }
   54|  19.3k|#endif
   55|       |
   56|  19.3k|#if defined(BOTAN_HAS_GMAC)
   57|  19.3k|   if(req.algo_name() == "GMAC" && req.arg_count() == 1) {
  ------------------
  |  Branch (57:7): [True: 0, False: 19.3k]
  |  Branch (57:7): [True: 0, False: 19.3k]
  |  Branch (57:36): [True: 0, False: 0]
  ------------------
   58|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (58:10): [True: 0, False: 0]
  |  Branch (58:30): [True: 0, False: 0]
  ------------------
   59|      0|         if(auto bc = BlockCipher::create(req.arg(0))) {
  ------------------
  |  Branch (59:18): [True: 0, False: 0]
  ------------------
   60|      0|            return std::make_unique<GMAC>(std::move(bc));
   61|      0|         }
   62|      0|      }
   63|      0|   }
   64|  19.3k|#endif
   65|       |
   66|  19.3k|#if defined(BOTAN_HAS_HMAC)
   67|  19.3k|   if(req.algo_name() == "HMAC" && req.arg_count() == 1) {
  ------------------
  |  Branch (67:7): [True: 19.2k, False: 100]
  |  Branch (67:7): [True: 19.2k, False: 100]
  |  Branch (67:36): [True: 19.2k, False: 0]
  ------------------
   68|  19.2k|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (68:10): [True: 19.2k, False: 0]
  |  Branch (68:30): [True: 0, False: 0]
  ------------------
   69|  19.2k|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (69:18): [True: 19.2k, False: 0]
  ------------------
   70|  19.2k|            return std::make_unique<HMAC>(std::move(hash));
   71|  19.2k|         }
   72|  19.2k|      }
   73|  19.2k|   }
   74|    100|#endif
   75|       |
   76|    100|#if defined(BOTAN_HAS_POLY1305)
   77|    100|   if(req.algo_name() == "Poly1305" && req.arg_count() == 0) {
  ------------------
  |  Branch (77:7): [True: 100, False: 0]
  |  Branch (77:7): [True: 100, False: 0]
  |  Branch (77:40): [True: 100, False: 0]
  ------------------
   78|    100|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (78:10): [True: 100, False: 0]
  |  Branch (78:30): [True: 0, False: 0]
  ------------------
   79|    100|         return std::make_unique<Poly1305>();
   80|    100|      }
   81|    100|   }
   82|      0|#endif
   83|       |
   84|      0|#if defined(BOTAN_HAS_SIPHASH)
   85|      0|   if(req.algo_name() == "SipHash") {
  ------------------
  |  Branch (85:7): [True: 0, False: 0]
  ------------------
   86|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (86:10): [True: 0, False: 0]
  |  Branch (86:30): [True: 0, False: 0]
  ------------------
   87|      0|         return std::make_unique<SipHash>(req.arg_as_integer(0, 2), req.arg_as_integer(1, 4));
   88|      0|      }
   89|      0|   }
   90|      0|#endif
   91|       |
   92|      0|#if defined(BOTAN_HAS_CMAC)
   93|      0|   if((req.algo_name() == "CMAC" || req.algo_name() == "OMAC") && req.arg_count() == 1) {
  ------------------
  |  Branch (93:7): [True: 0, False: 0]
  |  Branch (93:8): [True: 0, False: 0]
  |  Branch (93:37): [True: 0, False: 0]
  |  Branch (93:67): [True: 0, False: 0]
  ------------------
   94|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (94:10): [True: 0, False: 0]
  |  Branch (94:30): [True: 0, False: 0]
  ------------------
   95|      0|         if(auto bc = BlockCipher::create(req.arg(0))) {
  ------------------
  |  Branch (95:18): [True: 0, False: 0]
  ------------------
   96|      0|            return std::make_unique<CMAC>(std::move(bc));
   97|      0|         }
   98|      0|      }
   99|      0|   }
  100|      0|#endif
  101|       |
  102|      0|#if defined(BOTAN_HAS_ANSI_X919_MAC)
  103|      0|   if(req.algo_name() == "X9.19-MAC") {
  ------------------
  |  Branch (103:7): [True: 0, False: 0]
  ------------------
  104|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (104:10): [True: 0, False: 0]
  |  Branch (104:30): [True: 0, False: 0]
  ------------------
  105|      0|         return std::make_unique<ANSI_X919_MAC>();
  106|      0|      }
  107|      0|   }
  108|      0|#endif
  109|       |
  110|      0|   BOTAN_UNUSED(req);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  111|      0|   BOTAN_UNUSED(provider);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  112|       |
  113|      0|   return nullptr;
  114|      0|}
_ZN5Botan25MessageAuthenticationCode15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  122|  4.09k|                                                                                      std::string_view provider) {
  123|  4.09k|   if(auto mac = MessageAuthenticationCode::create(algo, provider)) {
  ------------------
  |  Branch (123:12): [True: 4.09k, False: 0]
  ------------------
  124|  4.09k|      return mac;
  125|  4.09k|   }
  126|      0|   throw Lookup_Error("MAC", algo, provider);
  127|  4.09k|}

_ZNK5Botan8Poly130519has_keying_materialEv:
  170|    686|bool Poly1305::has_keying_material() const { return m_poly.size() == 8; }
_ZN5Botan8Poly130512key_scheduleEPKhm:
  172|    106|void Poly1305::key_schedule(const uint8_t key[], size_t /*length*/) {
  173|    106|   m_buf_pos = 0;
  174|    106|   m_buf.resize(16);
  175|    106|   m_poly.resize(8);
  176|       |
  177|    106|   poly1305_init(m_poly, key);
  178|    106|}
_ZN5Botan8Poly13058add_dataEPKhm:
  180|    580|void Poly1305::add_data(const uint8_t input[], size_t length) {
  181|    580|   assert_key_material_set();
  182|       |
  183|    580|   if(m_buf_pos) {
  ------------------
  |  Branch (183:7): [True: 267, False: 313]
  ------------------
  184|    267|      buffer_insert(m_buf, m_buf_pos, input, length);
  185|       |
  186|    267|      if(m_buf_pos + length >= m_buf.size()) {
  ------------------
  |  Branch (186:10): [True: 267, False: 0]
  ------------------
  187|    267|         poly1305_blocks(m_poly, m_buf.data(), 1);
  188|    267|         input += (m_buf.size() - m_buf_pos);
  189|    267|         length -= (m_buf.size() - m_buf_pos);
  190|    267|         m_buf_pos = 0;
  191|    267|      }
  192|    267|   }
  193|       |
  194|    580|   const size_t full_blocks = length / m_buf.size();
  195|    580|   const size_t remaining = length % m_buf.size();
  196|       |
  197|    580|   if(full_blocks) {
  ------------------
  |  Branch (197:7): [True: 69, False: 511]
  ------------------
  198|     69|      poly1305_blocks(m_poly, input, full_blocks);
  199|     69|   }
  200|       |
  201|    580|   buffer_insert(m_buf, m_buf_pos, input + full_blocks * m_buf.size(), remaining);
  202|    580|   m_buf_pos += remaining;
  203|    580|}
_ZN5Botan8Poly130512final_resultEPh:
  205|    106|void Poly1305::final_result(uint8_t out[]) {
  206|    106|   assert_key_material_set();
  207|       |
  208|    106|   if(m_buf_pos != 0) {
  ------------------
  |  Branch (208:7): [True: 0, False: 106]
  ------------------
  209|      0|      m_buf[m_buf_pos] = 1;
  210|      0|      const size_t len = m_buf.size() - m_buf_pos - 1;
  211|      0|      if(len > 0) {
  ------------------
  |  Branch (211:10): [True: 0, False: 0]
  ------------------
  212|      0|         clear_mem(&m_buf[m_buf_pos + 1], len);
  213|      0|      }
  214|      0|      poly1305_blocks(m_poly, m_buf.data(), 1, true);
  215|      0|   }
  216|       |
  217|    106|   poly1305_finish(m_poly, out);
  218|       |
  219|    106|   m_poly.clear();
  220|    106|   m_buf_pos = 0;
  221|    106|}
poly1305.cpp:_ZN5Botan12_GLOBAL__N_113poly1305_initERNSt3__16vectorImNS_16secure_allocatorImEEEEPKh:
   22|    106|void poly1305_init(secure_vector<uint64_t>& X, const uint8_t key[32]) {
   23|       |   /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
   24|    106|   const uint64_t t0 = load_le<uint64_t>(key, 0);
   25|    106|   const uint64_t t1 = load_le<uint64_t>(key, 1);
   26|       |
   27|    106|   X[0] = (t0)&0xffc0fffffff;
   28|    106|   X[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffff;
   29|    106|   X[2] = ((t1 >> 24)) & 0x00ffffffc0f;
   30|       |
   31|       |   /* h = 0 */
   32|    106|   X[3] = 0;
   33|    106|   X[4] = 0;
   34|    106|   X[5] = 0;
   35|       |
   36|       |   /* save pad for later */
   37|    106|   X[6] = load_le<uint64_t>(key, 2);
   38|    106|   X[7] = load_le<uint64_t>(key, 3);
   39|    106|}
poly1305.cpp:_ZN5Botan12_GLOBAL__N_115poly1305_blocksERNSt3__16vectorImNS_16secure_allocatorImEEEEPKhmb:
   41|    336|void poly1305_blocks(secure_vector<uint64_t>& X, const uint8_t* m, size_t blocks, bool is_final = false) {
   42|       |#if !defined(BOTAN_TARGET_HAS_NATIVE_UINT128)
   43|       |   typedef donna128 uint128_t;
   44|       |#endif
   45|       |
   46|    336|   const uint64_t hibit = is_final ? 0 : (static_cast<uint64_t>(1) << 40); /* 1 << 128 */
  ------------------
  |  Branch (46:27): [True: 0, False: 336]
  ------------------
   47|       |
   48|    336|   const uint64_t r0 = X[0];
   49|    336|   const uint64_t r1 = X[1];
   50|    336|   const uint64_t r2 = X[2];
   51|       |
   52|    336|   const uint64_t M44 = 0xFFFFFFFFFFF;
   53|    336|   const uint64_t M42 = 0x3FFFFFFFFFF;
   54|       |
   55|    336|   uint64_t h0 = X[3 + 0];
   56|    336|   uint64_t h1 = X[3 + 1];
   57|    336|   uint64_t h2 = X[3 + 2];
   58|       |
   59|    336|   const uint64_t s1 = r1 * 20;
   60|    336|   const uint64_t s2 = r2 * 20;
   61|       |
   62|  2.36k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (62:22): [True: 2.02k, False: 336]
  ------------------
   63|  2.02k|      const uint64_t t0 = load_le<uint64_t>(m, 0);
   64|  2.02k|      const uint64_t t1 = load_le<uint64_t>(m, 1);
   65|       |
   66|  2.02k|      h0 += ((t0)&M44);
   67|  2.02k|      h1 += (((t0 >> 44) | (t1 << 20)) & M44);
   68|  2.02k|      h2 += (((t1 >> 24)) & M42) | hibit;
   69|       |
   70|  2.02k|      const uint128_t d0 = uint128_t(h0) * r0 + uint128_t(h1) * s2 + uint128_t(h2) * s1;
   71|  2.02k|      const uint64_t c0 = carry_shift(d0, 44);
   72|       |
   73|  2.02k|      const uint128_t d1 = uint128_t(h0) * r1 + uint128_t(h1) * r0 + uint128_t(h2) * s2 + c0;
   74|  2.02k|      const uint64_t c1 = carry_shift(d1, 44);
   75|       |
   76|  2.02k|      const uint128_t d2 = uint128_t(h0) * r2 + uint128_t(h1) * r1 + uint128_t(h2) * r0 + c1;
   77|  2.02k|      const uint64_t c2 = carry_shift(d2, 42);
   78|       |
   79|  2.02k|      h0 = d0 & M44;
   80|  2.02k|      h1 = d1 & M44;
   81|  2.02k|      h2 = d2 & M42;
   82|       |
   83|  2.02k|      h0 += c2 * 5;
   84|  2.02k|      h1 += carry_shift(h0, 44);
   85|  2.02k|      h0 = h0 & M44;
   86|       |
   87|  2.02k|      m += 16;
   88|  2.02k|   }
   89|       |
   90|    336|   X[3 + 0] = h0;
   91|    336|   X[3 + 1] = h1;
   92|    336|   X[3 + 2] = h2;
   93|    336|}
poly1305.cpp:_ZN5Botan12_GLOBAL__N_115poly1305_finishERNSt3__16vectorImNS_16secure_allocatorImEEEEPh:
   95|    106|void poly1305_finish(secure_vector<uint64_t>& X, uint8_t mac[16]) {
   96|    106|   const uint64_t M44 = 0xFFFFFFFFFFF;
   97|    106|   const uint64_t M42 = 0x3FFFFFFFFFF;
   98|       |
   99|       |   /* fully carry h */
  100|    106|   uint64_t h0 = X[3 + 0];
  101|    106|   uint64_t h1 = X[3 + 1];
  102|    106|   uint64_t h2 = X[3 + 2];
  103|       |
  104|    106|   uint64_t c;
  105|    106|   c = (h1 >> 44);
  106|    106|   h1 &= M44;
  107|    106|   h2 += c;
  108|    106|   c = (h2 >> 42);
  109|    106|   h2 &= M42;
  110|    106|   h0 += c * 5;
  111|    106|   c = (h0 >> 44);
  112|    106|   h0 &= M44;
  113|    106|   h1 += c;
  114|    106|   c = (h1 >> 44);
  115|    106|   h1 &= M44;
  116|    106|   h2 += c;
  117|    106|   c = (h2 >> 42);
  118|    106|   h2 &= M42;
  119|    106|   h0 += c * 5;
  120|    106|   c = (h0 >> 44);
  121|    106|   h0 &= M44;
  122|    106|   h1 += c;
  123|       |
  124|       |   /* compute h + -p */
  125|    106|   uint64_t g0 = h0 + 5;
  126|    106|   c = (g0 >> 44);
  127|    106|   g0 &= M44;
  128|    106|   uint64_t g1 = h1 + c;
  129|    106|   c = (g1 >> 44);
  130|    106|   g1 &= M44;
  131|    106|   uint64_t g2 = h2 + c - (static_cast<uint64_t>(1) << 42);
  132|       |
  133|       |   /* select h if h < p, or h + -p if h >= p */
  134|    106|   const auto c_mask = CT::Mask<uint64_t>::expand(c);
  135|    106|   h0 = c_mask.select(g0, h0);
  136|    106|   h1 = c_mask.select(g1, h1);
  137|    106|   h2 = c_mask.select(g2, h2);
  138|       |
  139|       |   /* h = (h + pad) */
  140|    106|   const uint64_t t0 = X[6];
  141|    106|   const uint64_t t1 = X[7];
  142|       |
  143|    106|   h0 += ((t0)&M44);
  144|    106|   c = (h0 >> 44);
  145|    106|   h0 &= M44;
  146|    106|   h1 += (((t0 >> 44) | (t1 << 20)) & M44) + c;
  147|    106|   c = (h1 >> 44);
  148|    106|   h1 &= M44;
  149|    106|   h2 += (((t1 >> 24)) & M42) + c;
  150|    106|   h2 &= M42;
  151|       |
  152|       |   /* mac = h % (2^128) */
  153|    106|   h0 = ((h0) | (h1 << 44));
  154|    106|   h1 = ((h1 >> 20) | (h2 << 24));
  155|       |
  156|    106|   store_le(mac, h0, h1);
  157|       |
  158|       |   /* zero out the state */
  159|    106|   clear_mem(X.data(), X.size());
  160|    106|}

_ZN5Botan6BigInt11encode_1363ERKS0_m:
  105|  9.06k|secure_vector<uint8_t> BigInt::encode_1363(const BigInt& n, size_t bytes) {
  106|  9.06k|   if(n.bytes() > bytes) {
  ------------------
  |  Branch (106:7): [True: 0, False: 9.06k]
  ------------------
  107|      0|      throw Encoding_Error("encode_1363: n is too large to encode properly");
  108|      0|   }
  109|       |
  110|  9.06k|   secure_vector<uint8_t> output(bytes);
  111|  9.06k|   n.binary_encode(output.data(), output.size());
  112|  9.06k|   return output;
  113|  9.06k|}
_ZN5Botan6BigInt11encode_1363EPhmRKS0_:
  116|  66.8k|void BigInt::encode_1363(uint8_t output[], size_t bytes, const BigInt& n) {
  117|  66.8k|   if(n.bytes() > bytes) {
  ------------------
  |  Branch (117:7): [True: 0, False: 66.8k]
  ------------------
  118|      0|      throw Encoding_Error("encode_1363: n is too large to encode properly");
  119|      0|   }
  120|       |
  121|  66.8k|   n.binary_encode(output, bytes);
  122|  66.8k|}
_ZN5Botan6BigInt6decodeEPKhmNS0_4BaseE:
  143|     41|BigInt BigInt::decode(const uint8_t buf[], size_t length, Base base) {
  144|     41|   BigInt r;
  145|     41|   if(base == Binary) {
  ------------------
  |  Branch (145:7): [True: 0, False: 41]
  ------------------
  146|      0|      r.binary_decode(buf, length);
  147|     41|   } else if(base == Hexadecimal) {
  ------------------
  |  Branch (147:14): [True: 41, False: 0]
  ------------------
  148|     41|      secure_vector<uint8_t> binary;
  149|       |
  150|     41|      if(length % 2) {
  ------------------
  |  Branch (150:10): [True: 6, False: 35]
  ------------------
  151|       |         // Handle lack of leading 0
  152|      6|         const char buf0_with_leading_0[2] = {'0', static_cast<char>(buf[0])};
  153|       |
  154|      6|         binary = hex_decode_locked(buf0_with_leading_0, 2);
  155|       |
  156|      6|         binary += hex_decode_locked(cast_uint8_ptr_to_char(&buf[1]), length - 1, false);
  157|     35|      } else {
  158|     35|         binary = hex_decode_locked(cast_uint8_ptr_to_char(buf), length, false);
  159|     35|      }
  160|       |
  161|     41|      r.binary_decode(binary.data(), binary.size());
  162|     41|   } else if(base == Decimal) {
  ------------------
  |  Branch (162:14): [True: 0, False: 0]
  ------------------
  163|       |      // This could be made faster using the same trick as to_dec_string
  164|      0|      for(size_t i = 0; i != length; ++i) {
  ------------------
  |  Branch (164:25): [True: 0, False: 0]
  ------------------
  165|      0|         const char c = buf[i];
  166|       |
  167|      0|         if(c < '0' || c > '9') {
  ------------------
  |  Branch (167:13): [True: 0, False: 0]
  |  Branch (167:24): [True: 0, False: 0]
  ------------------
  168|      0|            throw Invalid_Argument("BigInt::decode: invalid decimal char");
  169|      0|         }
  170|       |
  171|      0|         const uint8_t x = c - '0';
  172|      0|         BOTAN_ASSERT_NOMSG(x < 10);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  173|       |
  174|      0|         r *= 10;
  175|      0|         r += x;
  176|      0|      }
  177|      0|   } else {
  178|      0|      throw Invalid_Argument("Unknown BigInt decoding method");
  179|      0|   }
  180|     41|   return r;
  181|     41|}

_ZN5Botan6BigInt3addEPKmmNS0_4SignE:
   16|  3.17M|BigInt& BigInt::add(const word y[], size_t y_words, Sign y_sign) {
   17|  3.17M|   const size_t x_sw = sig_words();
   18|       |
   19|  3.17M|   grow_to(std::max(x_sw, y_words) + 1);
   20|       |
   21|  3.17M|   if(sign() == y_sign) {
  ------------------
  |  Branch (21:7): [True: 1.67M, False: 1.50M]
  ------------------
   22|  1.67M|      bigint_add2(mutable_data(), size() - 1, y, y_words);
   23|  1.67M|   } else {
   24|  1.50M|      const int32_t relative_size = bigint_cmp(data(), x_sw, y, y_words);
   25|       |
   26|  1.50M|      if(relative_size >= 0) {
  ------------------
  |  Branch (26:10): [True: 1.50M, False: 226]
  ------------------
   27|       |         // *this >= y
   28|  1.50M|         bigint_sub2(mutable_data(), x_sw, y, y_words);
   29|  1.50M|      } else {
   30|       |         // *this < y
   31|    226|         bigint_sub2_rev(mutable_data(), y, y_words);
   32|    226|      }
   33|       |
   34|       |      //this->sign_fixup(relative_size, y_sign);
   35|  1.50M|      if(relative_size < 0) {
  ------------------
  |  Branch (35:10): [True: 226, False: 1.50M]
  ------------------
   36|    226|         set_sign(y_sign);
   37|  1.50M|      } else if(relative_size == 0) {
  ------------------
  |  Branch (37:17): [True: 0, False: 1.50M]
  ------------------
   38|      0|         set_sign(Positive);
   39|      0|      }
   40|  1.50M|   }
   41|       |
   42|  3.17M|   return (*this);
   43|  3.17M|}
_ZN5Botan6BigInt7mod_addERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   45|  6.09M|BigInt& BigInt::mod_add(const BigInt& s, const BigInt& mod, secure_vector<word>& ws) {
   46|  6.09M|   if(this->is_negative() || s.is_negative() || mod.is_negative()) {
  ------------------
  |  Branch (46:7): [True: 0, False: 6.09M]
  |  Branch (46:30): [True: 0, False: 6.09M]
  |  Branch (46:49): [True: 0, False: 6.09M]
  ------------------
   47|      0|      throw Invalid_Argument("BigInt::mod_add expects all arguments are positive");
   48|      0|   }
   49|       |
   50|  6.09M|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|  6.09M|      do {                          \
  |  |  100|  6.09M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   51|  6.09M|   BOTAN_DEBUG_ASSERT(s < mod);
  ------------------
  |  |   99|  6.09M|      do {                          \
  |  |  100|  6.09M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   52|       |
   53|       |   /*
   54|       |   t + s or t + s - p == t - (p - s)
   55|       |
   56|       |   So first compute ws = p - s
   57|       |
   58|       |   Then compute t + s and t - ws
   59|       |
   60|       |   If t - ws does not borrow, then that is the correct valued
   61|       |   */
   62|       |
   63|  6.09M|   const size_t mod_sw = mod.sig_words();
   64|  6.09M|   BOTAN_ARG_CHECK(mod_sw > 0, "BigInt::mod_add modulus must be positive");
  ------------------
  |  |   30|  6.09M|   do {                                                          \
  |  |   31|  6.09M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 6.09M]
  |  |  ------------------
  |  |   32|  6.09M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  6.09M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   65|       |
   66|  6.09M|   this->grow_to(mod_sw);
   67|  6.09M|   s.grow_to(mod_sw);
   68|       |
   69|       |   // First mod_sw for p - s, 2*mod_sw for bigint_addsub workspace
   70|  6.09M|   if(ws.size() < 3 * mod_sw) {
  ------------------
  |  Branch (70:7): [True: 3.25M, False: 2.83M]
  ------------------
   71|  3.25M|      ws.resize(3 * mod_sw);
   72|  3.25M|   }
   73|       |
   74|  6.09M|   word borrow = bigint_sub3(&ws[0], mod.data(), mod_sw, s.data(), mod_sw);
   75|  6.09M|   BOTAN_DEBUG_ASSERT(borrow == 0);
  ------------------
  |  |   99|  6.09M|      do {                          \
  |  |  100|  6.09M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   76|  6.09M|   BOTAN_UNUSED(borrow);
  ------------------
  |  |  118|  6.09M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   77|       |
   78|       |   // Compute t - ws
   79|  6.09M|   borrow = bigint_sub3(&ws[mod_sw], this->data(), mod_sw, &ws[0], mod_sw);
   80|       |
   81|       |   // Compute t + s
   82|  6.09M|   bigint_add3_nc(&ws[mod_sw * 2], this->data(), mod_sw, s.data(), mod_sw);
   83|       |
   84|  6.09M|   CT::conditional_copy_mem(borrow, &ws[0], &ws[mod_sw * 2], &ws[mod_sw], mod_sw);
   85|  6.09M|   set_words(&ws[0], mod_sw);
   86|       |
   87|  6.09M|   return (*this);
   88|  6.09M|}
_ZN5Botan6BigInt7mod_subERKS0_S2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   90|  62.5M|BigInt& BigInt::mod_sub(const BigInt& s, const BigInt& mod, secure_vector<word>& ws) {
   91|  62.5M|   if(this->is_negative() || s.is_negative() || mod.is_negative()) {
  ------------------
  |  Branch (91:7): [True: 0, False: 62.5M]
  |  Branch (91:30): [True: 0, False: 62.5M]
  |  Branch (91:49): [True: 0, False: 62.5M]
  ------------------
   92|      0|      throw Invalid_Argument("BigInt::mod_sub expects all arguments are positive");
   93|      0|   }
   94|       |
   95|       |   // We are assuming in this function that *this and s are no more than mod_sw words long
   96|  62.5M|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|  62.5M|      do {                          \
  |  |  100|  62.5M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   97|  62.5M|   BOTAN_DEBUG_ASSERT(s < mod);
  ------------------
  |  |   99|  62.5M|      do {                          \
  |  |  100|  62.5M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|       |
   99|  62.5M|   const size_t mod_sw = mod.sig_words();
  100|       |
  101|  62.5M|   this->grow_to(mod_sw);
  102|  62.5M|   s.grow_to(mod_sw);
  103|       |
  104|  62.5M|   if(ws.size() < mod_sw) {
  ------------------
  |  Branch (104:7): [True: 0, False: 62.5M]
  ------------------
  105|      0|      ws.resize(mod_sw);
  106|      0|   }
  107|       |
  108|  62.5M|   if(mod_sw == 4) {
  ------------------
  |  Branch (108:7): [True: 6.23M, False: 56.2M]
  ------------------
  109|  6.23M|      bigint_mod_sub_n<4>(mutable_data(), s.data(), mod.data(), ws.data());
  110|  56.2M|   } else if(mod_sw == 6) {
  ------------------
  |  Branch (110:14): [True: 13.9M, False: 42.3M]
  ------------------
  111|  13.9M|      bigint_mod_sub_n<6>(mutable_data(), s.data(), mod.data(), ws.data());
  112|  42.3M|   } else {
  113|  42.3M|      bigint_mod_sub(mutable_data(), s.data(), mod.data(), mod_sw, ws.data());
  114|  42.3M|   }
  115|       |
  116|  62.5M|   return (*this);
  117|  62.5M|}
_ZN5Botan6BigInt7mod_mulEhRKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  119|  24.3M|BigInt& BigInt::mod_mul(uint8_t y, const BigInt& mod, secure_vector<word>& ws) {
  120|  24.3M|   BOTAN_ARG_CHECK(this->is_negative() == false, "*this must be positive");
  ------------------
  |  |   30|  24.3M|   do {                                                          \
  |  |   31|  24.3M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 24.3M]
  |  |  ------------------
  |  |   32|  24.3M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  24.3M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  121|  24.3M|   BOTAN_ARG_CHECK(y < 16, "y too large");
  ------------------
  |  |   30|  24.3M|   do {                                                          \
  |  |   31|  24.3M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 24.3M]
  |  |  ------------------
  |  |   32|  24.3M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  24.3M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  122|       |
  123|  24.3M|   BOTAN_DEBUG_ASSERT(*this < mod);
  ------------------
  |  |   99|  24.3M|      do {                          \
  |  |  100|  24.3M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|  24.3M|   *this *= static_cast<word>(y);
  126|  24.3M|   this->reduce_below(mod, ws);
  127|  24.3M|   return (*this);
  128|  24.3M|}
_ZN5Botan6BigInt7rev_subEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  130|   118k|BigInt& BigInt::rev_sub(const word y[], size_t y_sw, secure_vector<word>& ws) {
  131|   118k|   if(this->sign() != BigInt::Positive) {
  ------------------
  |  Branch (131:7): [True: 0, False: 118k]
  ------------------
  132|      0|      throw Invalid_State("BigInt::sub_rev requires this is positive");
  133|      0|   }
  134|       |
  135|   118k|   const size_t x_sw = this->sig_words();
  136|       |
  137|   118k|   ws.resize(std::max(x_sw, y_sw));
  138|   118k|   clear_mem(ws.data(), ws.size());
  139|       |
  140|   118k|   const int32_t relative_size = bigint_sub_abs(ws.data(), data(), x_sw, y, y_sw);
  141|       |
  142|   118k|   this->cond_flip_sign(relative_size > 0);
  143|   118k|   this->swap_reg(ws);
  144|       |
  145|   118k|   return (*this);
  146|   118k|}
_ZN5Botan6BigInt3mulERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  156|   236k|BigInt& BigInt::mul(const BigInt& y, secure_vector<word>& ws) {
  157|   236k|   const size_t x_sw = sig_words();
  158|   236k|   const size_t y_sw = y.sig_words();
  159|   236k|   set_sign((sign() == y.sign()) ? Positive : Negative);
  ------------------
  |  Branch (159:13): [True: 236k, False: 0]
  ------------------
  160|       |
  161|   236k|   if(x_sw == 0 || y_sw == 0) {
  ------------------
  |  Branch (161:7): [True: 33.5k, False: 202k]
  |  Branch (161:20): [True: 0, False: 202k]
  ------------------
  162|  33.5k|      clear();
  163|  33.5k|      set_sign(Positive);
  164|   202k|   } else if(x_sw == 1 && y_sw) {
  ------------------
  |  Branch (164:14): [True: 53.1k, False: 149k]
  |  Branch (164:27): [True: 53.1k, False: 0]
  ------------------
  165|  53.1k|      grow_to(y_sw + 1);
  166|  53.1k|      bigint_linmul3(mutable_data(), y.data(), y_sw, word_at(0));
  167|   149k|   } else if(y_sw == 1 && x_sw) {
  ------------------
  |  Branch (167:14): [True: 0, False: 149k]
  |  Branch (167:27): [True: 0, False: 0]
  ------------------
  168|      0|      word carry = bigint_linmul2(mutable_data(), x_sw, y.word_at(0));
  169|      0|      set_word_at(x_sw, carry);
  170|   149k|   } else {
  171|   149k|      const size_t new_size = x_sw + y_sw + 1;
  172|   149k|      ws.resize(new_size);
  173|   149k|      secure_vector<word> z_reg(new_size);
  174|       |
  175|   149k|      bigint_mul(z_reg.data(), z_reg.size(), data(), size(), x_sw, y.data(), y.size(), y_sw, ws.data(), ws.size());
  176|       |
  177|   149k|      this->swap_reg(z_reg);
  178|   149k|   }
  179|       |
  180|   236k|   return (*this);
  181|   236k|}
_ZN5Botan6BigInt6squareERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  183|  33.1k|BigInt& BigInt::square(secure_vector<word>& ws) {
  184|  33.1k|   const size_t sw = sig_words();
  185|       |
  186|  33.1k|   secure_vector<word> z(2 * sw);
  187|  33.1k|   ws.resize(z.size());
  188|       |
  189|  33.1k|   bigint_sqr(z.data(), z.size(), data(), size(), sw, ws.data(), ws.size());
  190|       |
  191|  33.1k|   swap_reg(z);
  192|  33.1k|   set_sign(BigInt::Positive);
  193|       |
  194|  33.1k|   return (*this);
  195|  33.1k|}
_ZN5Botan6BigIntmLEm:
  197|   104M|BigInt& BigInt::operator*=(word y) {
  198|   104M|   if(y == 0) {
  ------------------
  |  Branch (198:7): [True: 0, False: 104M]
  ------------------
  199|      0|      clear();
  200|      0|      set_sign(Positive);
  201|      0|   }
  202|       |
  203|   104M|   const word carry = bigint_linmul2(mutable_data(), size(), y);
  204|   104M|   set_word_at(size(), carry);
  205|       |
  206|   104M|   return (*this);
  207|   104M|}
_ZN5Botan6BigIntrMERKS0_:
  224|  1.72M|BigInt& BigInt::operator%=(const BigInt& mod) { return (*this = (*this) % mod); }
_ZN5Botan6BigIntlSEm:
  258|  2.95M|BigInt& BigInt::operator<<=(size_t shift) {
  259|  2.95M|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  2.95M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  260|  2.95M|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  2.95M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  261|  2.95M|   const size_t size = sig_words();
  262|       |
  263|  2.95M|   const size_t bits_free = top_bits_free();
  264|       |
  265|  2.95M|   const size_t new_size = size + shift_words + (bits_free < shift_bits);
  266|       |
  267|  2.95M|   m_data.grow_to(new_size);
  268|       |
  269|  2.95M|   bigint_shl1(m_data.mutable_data(), new_size, size, shift_words, shift_bits);
  270|       |
  271|  2.95M|   return (*this);
  272|  2.95M|}
_ZN5Botan6BigIntrSEm:
  277|  4.94M|BigInt& BigInt::operator>>=(size_t shift) {
  278|  4.94M|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  4.94M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  279|  4.94M|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  4.94M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  280|       |
  281|  4.94M|   bigint_shr1(m_data.mutable_data(), m_data.size(), shift_words, shift_bits);
  282|       |
  283|  4.94M|   if(is_negative() && is_zero()) {
  ------------------
  |  Branch (283:7): [True: 0, False: 4.94M]
  |  Branch (283:24): [True: 0, False: 0]
  ------------------
  284|      0|      set_sign(Positive);
  285|      0|   }
  286|       |
  287|  4.94M|   return (*this);
  288|  4.94M|}

_ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE:
   19|   975k|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_words, BigInt::Sign y_sign) {
   20|   975k|   const size_t x_sw = x.sig_words();
   21|       |
   22|   975k|   BigInt z = BigInt::with_capacity(std::max(x_sw, y_words) + 1);
   23|       |
   24|   975k|   if(x.sign() == y_sign) {
  ------------------
  |  Branch (24:7): [True: 148k, False: 826k]
  ------------------
   25|   148k|      bigint_add3(z.mutable_data(), x.data(), x_sw, y, y_words);
   26|   148k|      z.set_sign(x.sign());
   27|   826k|   } else {
   28|   826k|      const int32_t relative_size = bigint_sub_abs(z.mutable_data(), x.data(), x_sw, y, y_words);
   29|       |
   30|       |      //z.sign_fixup(relative_size, y_sign);
   31|   826k|      if(relative_size < 0) {
  ------------------
  |  Branch (31:10): [True: 0, False: 826k]
  ------------------
   32|      0|         z.set_sign(y_sign);
   33|   826k|      } else if(relative_size == 0) {
  ------------------
  |  Branch (33:17): [True: 0, False: 826k]
  ------------------
   34|      0|         z.set_sign(BigInt::Positive);
   35|   826k|      } else {
   36|   826k|         z.set_sign(x.sign());
   37|   826k|      }
   38|   826k|   }
   39|       |
   40|   975k|   return z;
   41|   975k|}
_ZN5BotanmlERKNS_6BigIntES2_:
   46|   112k|BigInt operator*(const BigInt& x, const BigInt& y) {
   47|   112k|   const size_t x_sw = x.sig_words();
   48|   112k|   const size_t y_sw = y.sig_words();
   49|       |
   50|   112k|   BigInt z = BigInt::with_capacity(x.size() + y.size());
   51|       |
   52|   112k|   if(x_sw == 1 && y_sw) {
  ------------------
  |  Branch (52:7): [True: 14.9k, False: 97.6k]
  |  Branch (52:20): [True: 14.9k, False: 0]
  ------------------
   53|  14.9k|      bigint_linmul3(z.mutable_data(), y.data(), y_sw, x.word_at(0));
   54|  97.6k|   } else if(y_sw == 1 && x_sw) {
  ------------------
  |  Branch (54:14): [True: 1.79k, False: 95.8k]
  |  Branch (54:27): [True: 1.79k, False: 0]
  ------------------
   55|  1.79k|      bigint_linmul3(z.mutable_data(), x.data(), x_sw, y.word_at(0));
   56|  95.8k|   } else if(x_sw && y_sw) {
  ------------------
  |  Branch (56:14): [True: 95.4k, False: 440]
  |  Branch (56:22): [True: 95.2k, False: 220]
  ------------------
   57|  95.2k|      secure_vector<word> workspace(z.size());
   58|       |
   59|  95.2k|      bigint_mul(z.mutable_data(),
   60|  95.2k|                 z.size(),
   61|  95.2k|                 x.data(),
   62|  95.2k|                 x.size(),
   63|  95.2k|                 x_sw,
   64|  95.2k|                 y.data(),
   65|  95.2k|                 y.size(),
   66|  95.2k|                 y_sw,
   67|  95.2k|                 workspace.data(),
   68|  95.2k|                 workspace.size());
   69|  95.2k|   }
   70|       |
   71|   112k|   z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
  ------------------
  |  Branch (71:21): [True: 112k, False: 440]
  |  Branch (71:33): [True: 111k, False: 220]
  |  Branch (71:45): [True: 0, False: 111k]
  ------------------
   72|       |
   73|   112k|   return z;
   74|   112k|}
_ZN5BotanmlERKNS_6BigIntEm:
   79|  3.01M|BigInt operator*(const BigInt& x, word y) {
   80|  3.01M|   const size_t x_sw = x.sig_words();
   81|       |
   82|  3.01M|   BigInt z = BigInt::with_capacity(x_sw + 1);
   83|       |
   84|  3.01M|   if(x_sw && y) {
  ------------------
  |  Branch (84:7): [True: 3.01M, False: 0]
  |  Branch (84:15): [True: 1.50M, False: 1.50M]
  ------------------
   85|  1.50M|      bigint_linmul3(z.mutable_data(), x.data(), x_sw, y);
   86|  1.50M|      z.set_sign(x.sign());
   87|  1.50M|   }
   88|       |
   89|  3.01M|   return z;
   90|  3.01M|}
_ZN5BotandvERKNS_6BigIntEm:
  108|  1.72M|BigInt operator/(const BigInt& x, word y) {
  109|  1.72M|   if(y == 0) {
  ------------------
  |  Branch (109:7): [True: 0, False: 1.72M]
  ------------------
  110|      0|      throw Invalid_Argument("BigInt::operator/ divide by zero");
  111|      0|   }
  112|       |
  113|  1.72M|   BigInt q;
  114|  1.72M|   word r;
  115|  1.72M|   ct_divide_word(x, y, q, r);
  116|  1.72M|   return q;
  117|  1.72M|}
_ZN5BotanrmERKNS_6BigIntES2_:
  122|  1.75M|BigInt operator%(const BigInt& n, const BigInt& mod) {
  123|  1.75M|   if(mod.is_zero()) {
  ------------------
  |  Branch (123:7): [True: 0, False: 1.75M]
  ------------------
  124|      0|      throw Invalid_Argument("BigInt::operator% divide by zero");
  125|      0|   }
  126|  1.75M|   if(mod.is_negative()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1.75M]
  ------------------
  127|      0|      throw Invalid_Argument("BigInt::operator% modulus must be > 0");
  128|      0|   }
  129|  1.75M|   if(n.is_positive() && mod.is_positive() && n < mod) {
  ------------------
  |  Branch (129:7): [True: 1.75M, False: 0]
  |  Branch (129:26): [True: 1.75M, False: 0]
  |  Branch (129:47): [True: 27.6k, False: 1.72M]
  ------------------
  130|  27.6k|      return n;
  131|  27.6k|   }
  132|       |
  133|  1.72M|   if(mod.sig_words() == 1) {
  ------------------
  |  Branch (133:7): [True: 251k, False: 1.47M]
  ------------------
  134|   251k|      return BigInt::from_word(n % mod.word_at(0));
  135|   251k|   }
  136|       |
  137|  1.47M|   BigInt q, r;
  138|  1.47M|   vartime_divide(n, mod, q, r);
  139|  1.47M|   return r;
  140|  1.72M|}
_ZN5BotanrmERKNS_6BigIntEm:
  145|  4.22M|word operator%(const BigInt& n, word mod) {
  146|  4.22M|   if(mod == 0) {
  ------------------
  |  Branch (146:7): [True: 0, False: 4.22M]
  ------------------
  147|      0|      throw Invalid_Argument("BigInt::operator% divide by zero");
  148|      0|   }
  149|       |
  150|  4.22M|   if(mod == 1) {
  ------------------
  |  Branch (150:7): [True: 0, False: 4.22M]
  ------------------
  151|      0|      return 0;
  152|      0|   }
  153|       |
  154|  4.22M|   word remainder = 0;
  155|       |
  156|  4.22M|   if(is_power_of_2(mod)) {
  ------------------
  |  Branch (156:7): [True: 3.97M, False: 251k]
  ------------------
  157|  3.97M|      remainder = (n.word_at(0) & (mod - 1));
  158|  3.97M|   } else {
  159|   251k|      const size_t sw = n.sig_words();
  160|   517k|      for(size_t i = sw; i > 0; --i) {
  ------------------
  |  Branch (160:26): [True: 265k, False: 251k]
  ------------------
  161|   265k|         remainder = bigint_modop(remainder, n.word_at(i - 1), mod);
  162|   265k|      }
  163|   251k|   }
  164|       |
  165|  4.22M|   if(remainder && n.sign() == BigInt::Negative) {
  ------------------
  |  Branch (165:7): [True: 4.22M, False: 0]
  |  Branch (165:20): [True: 0, False: 4.22M]
  ------------------
  166|      0|      return mod - remainder;
  167|      0|   }
  168|  4.22M|   return remainder;
  169|  4.22M|}
_ZN5BotanlsERKNS_6BigIntEm:
  174|  1.47M|BigInt operator<<(const BigInt& x, size_t shift) {
  175|  1.47M|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS, shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  1.47M|#define BOTAN_MP_WORD_BITS 64
  ------------------
                 const size_t shift_words = shift / BOTAN_MP_WORD_BITS, shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  1.47M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  176|       |
  177|  1.47M|   const size_t x_sw = x.sig_words();
  178|       |
  179|  1.47M|   BigInt y = BigInt::with_capacity(x_sw + shift_words + (shift_bits ? 1 : 0));
  ------------------
  |  Branch (179:59): [True: 0, False: 1.47M]
  ------------------
  180|  1.47M|   bigint_shl2(y.mutable_data(), x.data(), x_sw, shift_words, shift_bits);
  181|  1.47M|   y.set_sign(x.sign());
  182|  1.47M|   return y;
  183|  1.47M|}
_ZN5BotanrsERKNS_6BigIntEm:
  188|  9.98k|BigInt operator>>(const BigInt& x, size_t shift) {
  189|  9.98k|   const size_t shift_words = shift / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  9.98k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  190|  9.98k|   const size_t shift_bits = shift % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  9.98k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  191|  9.98k|   const size_t x_sw = x.sig_words();
  192|       |
  193|  9.98k|   if(shift_words >= x_sw) {
  ------------------
  |  Branch (193:7): [True: 0, False: 9.98k]
  ------------------
  194|      0|      return BigInt::zero();
  195|      0|   }
  196|       |
  197|  9.98k|   BigInt y = BigInt::with_capacity(x_sw - shift_words);
  198|  9.98k|   bigint_shr2(y.mutable_data(), x.data(), x_sw, shift_words, shift_bits);
  199|       |
  200|  9.98k|   if(x.is_negative() && y.is_zero()) {
  ------------------
  |  Branch (200:7): [True: 0, False: 9.98k]
  |  Branch (200:26): [True: 0, False: 0]
  ------------------
  201|      0|      y.set_sign(BigInt::Positive);
  202|  9.98k|   } else {
  203|  9.98k|      y.set_sign(x.sign());
  204|  9.98k|   }
  205|       |
  206|  9.98k|   return y;
  207|  9.98k|}

_ZN5Botan6BigInt9randomizeERNS_21RandomNumberGeneratorEmb:
   18|   248k|void BigInt::randomize(RandomNumberGenerator& rng, size_t bitsize, bool set_high_bit) {
   19|   248k|   set_sign(Positive);
   20|       |
   21|   248k|   if(bitsize == 0) {
  ------------------
  |  Branch (21:7): [True: 0, False: 248k]
  ------------------
   22|      0|      clear();
   23|   248k|   } else {
   24|   248k|      secure_vector<uint8_t> array = rng.random_vec(round_up(bitsize, 8) / 8);
   25|       |
   26|       |      // Always cut unwanted bits
   27|   248k|      if(bitsize % 8) {
  ------------------
  |  Branch (27:10): [True: 123k, False: 124k]
  ------------------
   28|   123k|         array[0] &= 0xFF >> (8 - (bitsize % 8));
   29|   123k|      }
   30|       |
   31|       |      // Set the highest bit if wanted
   32|   248k|      if(set_high_bit) {
  ------------------
  |  Branch (32:10): [True: 18.6k, False: 229k]
  ------------------
   33|  18.6k|         array[0] |= 0x80 >> ((bitsize % 8) ? (8 - bitsize % 8) : 0);
  ------------------
  |  Branch (33:31): [True: 5.77k, False: 12.9k]
  ------------------
   34|  18.6k|      }
   35|       |
   36|   248k|      binary_decode(array);
   37|   248k|   }
   38|   248k|}
_ZN5Botan6BigInt14random_integerERNS_21RandomNumberGeneratorERKS0_S4_:
   43|  57.0k|BigInt BigInt::random_integer(RandomNumberGenerator& rng, const BigInt& min, const BigInt& max) {
   44|  57.0k|   if(min.is_negative() || max.is_negative() || max <= min) {
  ------------------
  |  Branch (44:7): [True: 0, False: 57.0k]
  |  Branch (44:28): [True: 0, False: 57.0k]
  |  Branch (44:49): [True: 0, False: 57.0k]
  ------------------
   45|      0|      throw Invalid_Argument("BigInt::random_integer invalid range");
   46|      0|   }
   47|       |
   48|  57.0k|   BigInt r;
   49|       |
   50|  57.0k|   const size_t bits = max.bits();
   51|       |
   52|  72.6k|   do {
   53|  72.6k|      r.randomize(rng, bits, false);
   54|  72.6k|   } while(r < min || r >= max);
  ------------------
  |  Branch (54:12): [True: 0, False: 72.6k]
  |  Branch (54:23): [True: 15.6k, False: 57.0k]
  ------------------
   55|       |
   56|  57.0k|   return r;
   57|  57.0k|}

_ZN5Botan6BigIntC2Em:
   18|   137k|BigInt::BigInt(uint64_t n) {
   19|   137k|#if BOTAN_MP_WORD_BITS == 64
   20|   137k|   m_data.set_word_at(0, n);
   21|       |#else
   22|       |   m_data.set_word_at(1, static_cast<word>(n >> 32));
   23|       |   m_data.set_word_at(0, static_cast<word>(n));
   24|       |#endif
   25|   137k|}
_ZN5Botan6BigInt8from_u64Em:
   28|  15.4k|BigInt BigInt::from_u64(uint64_t n) {
   29|  15.4k|   BigInt bn;
   30|       |
   31|  15.4k|#if BOTAN_MP_WORD_BITS == 64
   32|  15.4k|   bn.set_word_at(0, n);
   33|       |#else
   34|       |   bn.set_word_at(1, static_cast<word>(n >> 32));
   35|       |   bn.set_word_at(0, static_cast<word>(n));
   36|       |#endif
   37|       |
   38|  15.4k|   return bn;
   39|  15.4k|}
_ZN5Botan6BigInt9from_wordEm:
   42|   270k|BigInt BigInt::from_word(word n) {
   43|   270k|   BigInt bn;
   44|   270k|   bn.set_word_at(0, n);
   45|   270k|   return bn;
   46|   270k|}
_ZN5Botan6BigInt8from_s32Ei:
   49|  3.72k|BigInt BigInt::from_s32(int32_t n) {
   50|  3.72k|   if(n >= 0) {
  ------------------
  |  Branch (50:7): [True: 0, False: 3.72k]
  ------------------
   51|      0|      return BigInt::from_u64(static_cast<uint64_t>(n));
   52|  3.72k|   } else {
   53|  3.72k|      return -BigInt::from_u64(static_cast<uint64_t>(-n));
   54|  3.72k|   }
   55|  3.72k|}
_ZN5Botan6BigInt13with_capacityEm:
   58|  7.57M|BigInt BigInt::with_capacity(size_t size) {
   59|  7.57M|   BigInt bn;
   60|  7.57M|   bn.grow_to(size);
   61|  7.57M|   return bn;
   62|  7.57M|}
_ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   67|     41|BigInt::BigInt(std::string_view str) {
   68|     41|   Base base = Decimal;
   69|     41|   size_t markers = 0;
   70|     41|   bool negative = false;
   71|       |
   72|     41|   if(str.length() > 0 && str[0] == '-') {
  ------------------
  |  Branch (72:7): [True: 41, False: 0]
  |  Branch (72:27): [True: 0, False: 41]
  ------------------
   73|      0|      markers += 1;
   74|      0|      negative = true;
   75|      0|   }
   76|       |
   77|     41|   if(str.length() > markers + 2 && str[markers] == '0' && str[markers + 1] == 'x') {
  ------------------
  |  Branch (77:7): [True: 41, False: 0]
  |  Branch (77:37): [True: 41, False: 0]
  |  Branch (77:60): [True: 41, False: 0]
  ------------------
   78|     41|      markers += 2;
   79|     41|      base = Hexadecimal;
   80|     41|   }
   81|       |
   82|     41|   *this = decode(cast_char_ptr_to_uint8(str.data()) + markers, str.length() - markers, base);
   83|       |
   84|     41|   if(negative) {
  ------------------
  |  Branch (84:7): [True: 0, False: 41]
  ------------------
   85|      0|      set_sign(Negative);
   86|     41|   } else {
   87|     41|      set_sign(Positive);
   88|     41|   }
   89|     41|}
_ZN5Botan6BigIntC2EPKhm:
   91|   115k|BigInt::BigInt(const uint8_t input[], size_t length) { binary_decode(input, length); }
_ZN5Botan6BigIntC2ERNS_21RandomNumberGeneratorEmb:
  117|  28.5k|BigInt::BigInt(RandomNumberGenerator& rng, size_t bits, bool set_high_bit) { randomize(rng, bits, set_high_bit); }
_ZNK5Botan6BigInt7byte_atEm:
  119|  46.2k|uint8_t BigInt::byte_at(size_t n) const {
  120|  46.2k|   return get_byte_var(sizeof(word) - (n % sizeof(word)) - 1, word_at(n / sizeof(word)));
  121|  46.2k|}
_ZNK5Botan6BigInt8cmp_wordEm:
  123|  2.05M|int32_t BigInt::cmp_word(word other) const {
  124|  2.05M|   if(is_negative()) {
  ------------------
  |  Branch (124:7): [True: 3.72k, False: 2.05M]
  ------------------
  125|  3.72k|      return -1;  // other is positive ...
  126|  3.72k|   }
  127|       |
  128|  2.05M|   const size_t sw = this->sig_words();
  129|  2.05M|   if(sw > 1) {
  ------------------
  |  Branch (129:7): [True: 1.73M, False: 319k]
  ------------------
  130|  1.73M|      return 1;  // must be larger since other is just one word ...
  131|  1.73M|   }
  132|       |
  133|   319k|   return bigint_cmp(this->data(), sw, &other, 1);
  134|  2.05M|}
_ZNK5Botan6BigInt3cmpERKS0_b:
  139|   172k|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const {
  140|   172k|   if(check_signs) {
  ------------------
  |  Branch (140:7): [True: 172k, False: 0]
  ------------------
  141|   172k|      if(other.is_positive() && this->is_negative()) {
  ------------------
  |  Branch (141:10): [True: 172k, False: 0]
  |  Branch (141:33): [True: 0, False: 172k]
  ------------------
  142|      0|         return -1;
  143|      0|      }
  144|       |
  145|   172k|      if(other.is_negative() && this->is_positive()) {
  ------------------
  |  Branch (145:10): [True: 0, False: 172k]
  |  Branch (145:33): [True: 0, False: 0]
  ------------------
  146|      0|         return 1;
  147|      0|      }
  148|       |
  149|   172k|      if(other.is_negative() && this->is_negative()) {
  ------------------
  |  Branch (149:10): [True: 0, False: 172k]
  |  Branch (149:33): [True: 0, False: 0]
  ------------------
  150|      0|         return (-bigint_cmp(this->data(), this->size(), other.data(), other.size()));
  151|      0|      }
  152|   172k|   }
  153|       |
  154|   172k|   return bigint_cmp(this->data(), this->size(), other.data(), other.size());
  155|   172k|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  157|   145k|bool BigInt::is_equal(const BigInt& other) const {
  158|   145k|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (158:7): [True: 0, False: 145k]
  ------------------
  159|      0|      return false;
  160|      0|   }
  161|       |
  162|   145k|   return bigint_ct_is_eq(this->data(), this->sig_words(), other.data(), other.sig_words()).is_set();
  163|   145k|}
_ZNK5Botan6BigInt12is_less_thanERKS0_:
  165|  3.63M|bool BigInt::is_less_than(const BigInt& other) const {
  166|  3.63M|   if(this->is_negative() && other.is_positive()) {
  ------------------
  |  Branch (166:7): [True: 0, False: 3.63M]
  |  Branch (166:30): [True: 0, False: 0]
  ------------------
  167|      0|      return true;
  168|      0|   }
  169|       |
  170|  3.63M|   if(this->is_positive() && other.is_negative()) {
  ------------------
  |  Branch (170:7): [True: 3.63M, False: 0]
  |  Branch (170:30): [True: 0, False: 3.63M]
  ------------------
  171|      0|      return false;
  172|      0|   }
  173|       |
  174|  3.63M|   if(other.is_negative() && this->is_negative()) {
  ------------------
  |  Branch (174:7): [True: 0, False: 3.63M]
  |  Branch (174:30): [True: 0, False: 0]
  ------------------
  175|      0|      return bigint_ct_is_lt(other.data(), other.sig_words(), this->data(), this->sig_words()).is_set();
  176|      0|   }
  177|       |
  178|  3.63M|   return bigint_ct_is_lt(this->data(), this->sig_words(), other.data(), other.sig_words()).is_set();
  179|  3.63M|}
_ZNK5Botan6BigInt12encode_wordsEPmm:
  181|   487k|void BigInt::encode_words(word out[], size_t size) const {
  182|   487k|   const size_t words = sig_words();
  183|       |
  184|   487k|   if(words > size) {
  ------------------
  |  Branch (184:7): [True: 0, False: 487k]
  ------------------
  185|      0|      throw Encoding_Error("BigInt::encode_words value too large to encode");
  186|      0|   }
  187|       |
  188|   487k|   clear_mem(out, size);
  189|   487k|   copy_mem(out, data(), words);
  190|   487k|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  192|  41.1M|size_t BigInt::Data::calc_sig_words() const {
  193|  41.1M|   const size_t sz = m_reg.size();
  194|  41.1M|   size_t sig = sz;
  195|       |
  196|  41.1M|   word sub = 1;
  197|       |
  198|   675M|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (198:22): [True: 634M, False: 41.1M]
  ------------------
  199|   634M|      const word w = m_reg[sz - i - 1];
  200|   634M|      sub &= ct_is_zero(w);
  201|   634M|      sig -= sub;
  202|   634M|   }
  203|       |
  204|       |   /*
  205|       |   * This depends on the data so is poisoned, but unpoison it here as
  206|       |   * later conditionals are made on the size.
  207|       |   */
  208|  41.1M|   CT::unpoison(sig);
  209|       |
  210|  41.1M|   return sig;
  211|  41.1M|}
_ZNK5Botan6BigInt13get_substringEmm:
  216|  6.86M|uint32_t BigInt::get_substring(size_t offset, size_t length) const {
  217|  6.86M|   if(length == 0 || length > 32) {
  ------------------
  |  Branch (217:7): [True: 0, False: 6.86M]
  |  Branch (217:22): [True: 0, False: 6.86M]
  ------------------
  218|      0|      throw Invalid_Argument("BigInt::get_substring invalid substring length");
  219|      0|   }
  220|       |
  221|  6.86M|   const uint32_t mask = 0xFFFFFFFF >> (32 - length);
  222|       |
  223|  6.86M|   const size_t word_offset = offset / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  6.86M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  224|  6.86M|   const size_t wshift = (offset % BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|  6.86M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  225|       |
  226|       |   /*
  227|       |   * The substring is contained within one or at most two words. The
  228|       |   * offset and length are not secret, so we can perform conditional
  229|       |   * operations on those values.
  230|       |   */
  231|  6.86M|   const word w0 = word_at(word_offset);
  232|       |
  233|  6.86M|   if(wshift == 0 || (offset + length) / BOTAN_MP_WORD_BITS == word_offset) {
  ------------------
  |  |   50|  6.61M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (233:7): [True: 250k, False: 6.61M]
  |  Branch (233:22): [True: 6.25M, False: 357k]
  ------------------
  234|  6.50M|      return static_cast<uint32_t>(w0 >> wshift) & mask;
  235|  6.50M|   } else {
  236|   357k|      const word w1 = word_at(word_offset + 1);
  237|   357k|      return static_cast<uint32_t>((w0 >> wshift) | (w1 << (BOTAN_MP_WORD_BITS - wshift))) & mask;
  ------------------
  |  |   50|   357k|#define BOTAN_MP_WORD_BITS 64
  ------------------
  238|   357k|   }
  239|  6.86M|}
_ZNK5Botan6BigInt5bytesEv:
  271|   167k|size_t BigInt::bytes() const { return round_up(bits(), 8) / 8; }
_ZNK5Botan6BigInt13top_bits_freeEv:
  273|  6.58M|size_t BigInt::top_bits_free() const {
  274|  6.58M|   const size_t words = sig_words();
  275|       |
  276|  6.58M|   const word top_word = word_at(words - 1);
  277|  6.58M|   const size_t bits_used = high_bit(top_word);
  278|  6.58M|   CT::unpoison(bits_used);
  279|  6.58M|   return BOTAN_MP_WORD_BITS - bits_used;
  ------------------
  |  |   50|  6.58M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  280|  6.58M|}
_ZNK5Botan6BigInt4bitsEv:
  282|  2.17M|size_t BigInt::bits() const {
  283|  2.17M|   const size_t words = sig_words();
  284|       |
  285|  2.17M|   if(words == 0) {
  ------------------
  |  Branch (285:7): [True: 11.6k, False: 2.16M]
  ------------------
  286|  11.6k|      return 0;
  287|  11.6k|   }
  288|       |
  289|  2.16M|   const size_t full_words = (words - 1) * BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  2.16M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  290|  2.16M|   const size_t top_bits = BOTAN_MP_WORD_BITS - top_bits_free();
  ------------------
  |  |   50|  2.16M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  291|       |
  292|  2.16M|   return full_words + top_bits;
  293|  2.17M|}
_ZNK5Botan6BigIntngEv:
  298|  3.72k|BigInt BigInt::operator-() const {
  299|  3.72k|   BigInt x = (*this);
  300|  3.72k|   x.flip_sign();
  301|  3.72k|   return x;
  302|  3.72k|}
_ZN5Botan6BigInt12reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  304|  25.8M|size_t BigInt::reduce_below(const BigInt& p, secure_vector<word>& ws) {
  305|  25.8M|   if(p.is_negative() || this->is_negative()) {
  ------------------
  |  Branch (305:7): [True: 0, False: 25.8M]
  |  Branch (305:26): [True: 0, False: 25.8M]
  ------------------
  306|      0|      throw Invalid_Argument("BigInt::reduce_below both values must be positive");
  307|      0|   }
  308|       |
  309|  25.8M|   const size_t p_words = p.sig_words();
  310|       |
  311|  25.8M|   if(size() < p_words + 1) {
  ------------------
  |  Branch (311:7): [True: 55, False: 25.8M]
  ------------------
  312|     55|      grow_to(p_words + 1);
  313|     55|   }
  314|       |
  315|  25.8M|   if(ws.size() < p_words + 1) {
  ------------------
  |  Branch (315:7): [True: 1.47M, False: 24.3M]
  ------------------
  316|  1.47M|      ws.resize(p_words + 1);
  317|  1.47M|   }
  318|       |
  319|  25.8M|   clear_mem(ws.data(), ws.size());
  320|       |
  321|  25.8M|   size_t reductions = 0;
  322|       |
  323|  65.4M|   for(;;) {
  324|  65.4M|      word borrow = bigint_sub3(ws.data(), data(), p_words + 1, p.data(), p_words);
  325|  65.4M|      if(borrow) {
  ------------------
  |  Branch (325:10): [True: 25.8M, False: 39.5M]
  ------------------
  326|  25.8M|         break;
  327|  25.8M|      }
  328|       |
  329|  39.5M|      ++reductions;
  330|  39.5M|      swap_reg(ws);
  331|  39.5M|   }
  332|       |
  333|  25.8M|   return reductions;
  334|  25.8M|}
_ZN5Botan6BigInt15ct_reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  336|   118k|void BigInt::ct_reduce_below(const BigInt& mod, secure_vector<word>& ws, size_t bound) {
  337|   118k|   if(mod.is_negative() || this->is_negative()) {
  ------------------
  |  Branch (337:7): [True: 0, False: 118k]
  |  Branch (337:28): [True: 0, False: 118k]
  ------------------
  338|      0|      throw Invalid_Argument("BigInt::ct_reduce_below both values must be positive");
  339|      0|   }
  340|       |
  341|   118k|   const size_t mod_words = mod.sig_words();
  342|       |
  343|   118k|   grow_to(mod_words);
  344|       |
  345|   118k|   const size_t sz = size();
  346|       |
  347|   118k|   ws.resize(sz);
  348|       |
  349|   118k|   clear_mem(ws.data(), sz);
  350|       |
  351|   354k|   for(size_t i = 0; i != bound; ++i) {
  ------------------
  |  Branch (351:22): [True: 236k, False: 118k]
  ------------------
  352|   236k|      word borrow = bigint_sub3(ws.data(), data(), sz, mod.data(), mod_words);
  353|       |
  354|   236k|      CT::Mask<word>::is_zero(borrow).select_n(mutable_data(), ws.data(), data(), sz);
  355|   236k|   }
  356|   118k|}
_ZNK5Botan6BigInt13binary_encodeEPh:
  367|  23.2k|void BigInt::binary_encode(uint8_t buf[]) const { this->binary_encode(buf, bytes()); }
_ZNK5Botan6BigInt13binary_encodeEPhm:
  372|  99.1k|void BigInt::binary_encode(uint8_t output[], size_t len) const {
  373|  99.1k|   const size_t full_words = len / sizeof(word);
  374|  99.1k|   const size_t extra_bytes = len % sizeof(word);
  375|       |
  376|   795k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (376:22): [True: 696k, False: 99.1k]
  ------------------
  377|   696k|      const word w = word_at(i);
  378|   696k|      store_be(w, output + (len - (i + 1) * sizeof(word)));
  379|   696k|   }
  380|       |
  381|  99.1k|   if(extra_bytes > 0) {
  ------------------
  |  Branch (381:7): [True: 41.5k, False: 57.5k]
  ------------------
  382|  41.5k|      const word w = word_at(full_words);
  383|       |
  384|   141k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (384:25): [True: 100k, False: 41.5k]
  ------------------
  385|   100k|         output[extra_bytes - i - 1] = get_byte_var(sizeof(word) - i - 1, w);
  386|   100k|      }
  387|  41.5k|   }
  388|  99.1k|}
_ZN5Botan6BigInt13binary_decodeEPKhm:
  393|   363k|void BigInt::binary_decode(const uint8_t buf[], size_t length) {
  394|   363k|   clear();
  395|       |
  396|   363k|   const size_t full_words = length / sizeof(word);
  397|   363k|   const size_t extra_bytes = length % sizeof(word);
  398|       |
  399|   363k|   secure_vector<word> reg((round_up(full_words + (extra_bytes > 0 ? 1 : 0), 8)));
  ------------------
  |  Branch (399:52): [True: 162k, False: 200k]
  ------------------
  400|       |
  401|  3.33M|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (401:22): [True: 2.97M, False: 363k]
  ------------------
  402|  2.97M|      reg[i] = load_be<word>(buf + length - sizeof(word) * (i + 1), 0);
  403|  2.97M|   }
  404|       |
  405|   363k|   if(extra_bytes > 0) {
  ------------------
  |  Branch (405:7): [True: 162k, False: 200k]
  ------------------
  406|   436k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (406:25): [True: 273k, False: 162k]
  ------------------
  407|   273k|         reg[full_words] = (reg[full_words] << 8) | buf[i];
  408|   273k|      }
  409|   162k|   }
  410|       |
  411|   363k|   m_data.swap(reg);
  412|   363k|}
_ZN5Botan6BigInt12ct_cond_swapEbRS0_:
  423|  80.1M|void BigInt::ct_cond_swap(bool predicate, BigInt& other) {
  424|  80.1M|   const size_t max_words = std::max(size(), other.size());
  425|  80.1M|   grow_to(max_words);
  426|  80.1M|   other.grow_to(max_words);
  427|       |
  428|  80.1M|   bigint_cnd_swap(predicate, this->mutable_data(), other.mutable_data(), max_words);
  429|  80.1M|}
_ZN5Botan6BigInt14cond_flip_signEb:
  431|  1.85M|void BigInt::cond_flip_sign(bool predicate) {
  432|       |   // This code is assuming Negative == 0, Positive == 1
  433|       |
  434|  1.85M|   const auto mask = CT::Mask<uint8_t>::expand(predicate);
  435|       |
  436|  1.85M|   const uint8_t current_sign = static_cast<uint8_t>(sign());
  437|       |
  438|  1.85M|   const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign);
  439|       |
  440|  1.85M|   set_sign(static_cast<Sign>(new_sign));
  441|  1.85M|}

_ZN5Botan9ct_divideERKNS_6BigIntES2_RS0_S3_:
   48|  33.1k|void ct_divide(const BigInt& x, const BigInt& y, BigInt& q_out, BigInt& r_out) {
   49|  33.1k|   if(y.is_zero()) {
  ------------------
  |  Branch (49:7): [True: 0, False: 33.1k]
  ------------------
   50|      0|      throw Invalid_Argument("ct_divide: cannot divide by zero");
   51|      0|   }
   52|       |
   53|  33.1k|   const size_t x_words = x.sig_words();
   54|  33.1k|   const size_t y_words = y.sig_words();
   55|       |
   56|  33.1k|   const size_t x_bits = x.bits();
   57|       |
   58|  33.1k|   BigInt q = BigInt::with_capacity(x_words);
   59|  33.1k|   BigInt r = BigInt::with_capacity(y_words);
   60|  33.1k|   BigInt t = BigInt::with_capacity(y_words);  // a temporary
   61|       |
   62|  80.1M|   for(size_t i = 0; i != x_bits; ++i) {
  ------------------
  |  Branch (62:22): [True: 80.1M, False: 33.1k]
  ------------------
   63|  80.1M|      const size_t b = x_bits - 1 - i;
   64|  80.1M|      const bool x_b = x.get_bit(b);
   65|       |
   66|  80.1M|      r *= 2;
   67|  80.1M|      r.conditionally_set_bit(0, x_b);
   68|       |
   69|  80.1M|      const bool r_gte_y = bigint_sub3(t.mutable_data(), r.data(), r.size(), y.data(), y_words) == 0;
   70|       |
   71|  80.1M|      q.conditionally_set_bit(b, r_gte_y);
   72|  80.1M|      r.ct_cond_swap(r_gte_y, t);
   73|  80.1M|   }
   74|       |
   75|  33.1k|   sign_fixup(x, y, q, r);
   76|  33.1k|   r_out = r;
   77|  33.1k|   q_out = q;
   78|  33.1k|}
_ZN5Botan14ct_divide_wordERKNS_6BigIntEmRS0_Rm:
   80|  1.72M|void ct_divide_word(const BigInt& x, word y, BigInt& q_out, word& r_out) {
   81|  1.72M|   if(y == 0) {
  ------------------
  |  Branch (81:7): [True: 0, False: 1.72M]
  ------------------
   82|      0|      throw Invalid_Argument("ct_divide_word: cannot divide by zero");
   83|      0|   }
   84|       |
   85|  1.72M|   const size_t x_words = x.sig_words();
   86|  1.72M|   const size_t x_bits = x.bits();
   87|       |
   88|  1.72M|   BigInt q = BigInt::with_capacity(x_words);
   89|  1.72M|   word r = 0;
   90|       |
   91|   400M|   for(size_t i = 0; i != x_bits; ++i) {
  ------------------
  |  Branch (91:22): [True: 398M, False: 1.72M]
  ------------------
   92|   398M|      const size_t b = x_bits - 1 - i;
   93|   398M|      const bool x_b = x.get_bit(b);
   94|       |
   95|   398M|      const auto r_carry = CT::Mask<word>::expand(r >> (BOTAN_MP_WORD_BITS - 1));
  ------------------
  |  |   50|   398M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   96|       |
   97|   398M|      r *= 2;
   98|   398M|      r += x_b;
   99|       |
  100|   398M|      const auto r_gte_y = CT::Mask<word>::is_gte(r, y) | r_carry;
  101|   398M|      q.conditionally_set_bit(b, r_gte_y.is_set());
  102|   398M|      r = r_gte_y.select(r - y, r);
  103|   398M|   }
  104|       |
  105|  1.72M|   if(x.is_negative()) {
  ------------------
  |  Branch (105:7): [True: 0, False: 1.72M]
  ------------------
  106|      0|      q.flip_sign();
  107|      0|      if(r != 0) {
  ------------------
  |  Branch (107:10): [True: 0, False: 0]
  ------------------
  108|      0|         --q;
  109|      0|         r = y - r;
  110|      0|      }
  111|      0|   }
  112|       |
  113|  1.72M|   r_out = r;
  114|  1.72M|   q_out = q;
  115|  1.72M|}
_ZN5Botan14vartime_divideERKNS_6BigIntES2_RS0_S3_:
  155|  1.47M|void vartime_divide(const BigInt& x, const BigInt& y_arg, BigInt& q_out, BigInt& r_out) {
  156|  1.47M|   if(y_arg.is_zero()) {
  ------------------
  |  Branch (156:7): [True: 0, False: 1.47M]
  ------------------
  157|      0|      throw Invalid_Argument("vartime_divide: cannot divide by zero");
  158|      0|   }
  159|       |
  160|  1.47M|   const size_t y_words = y_arg.sig_words();
  161|       |
  162|  1.47M|   BOTAN_ASSERT_NOMSG(y_words > 0);
  ------------------
  |  |   60|  1.47M|   do {                                                                     \
  |  |   61|  1.47M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1.47M]
  |  |  ------------------
  |  |   62|  1.47M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  1.47M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|       |
  164|  1.47M|   BigInt y = y_arg;
  165|       |
  166|  1.47M|   BigInt r = x;
  167|  1.47M|   BigInt q = BigInt::zero();
  168|  1.47M|   secure_vector<word> ws;
  169|       |
  170|  1.47M|   r.set_sign(BigInt::Positive);
  171|  1.47M|   y.set_sign(BigInt::Positive);
  172|       |
  173|       |   // Calculate shifts needed to normalize y with high bit set
  174|  1.47M|   const size_t shifts = y.top_bits_free();
  175|       |
  176|  1.47M|   y <<= shifts;
  177|  1.47M|   r <<= shifts;
  178|       |
  179|       |   // we know y has not changed size, since we only shifted up to set high bit
  180|  1.47M|   const size_t t = y_words - 1;
  181|  1.47M|   const size_t n = std::max(y_words, r.sig_words()) - 1;  // r may have changed size however
  182|       |
  183|  1.47M|   BOTAN_ASSERT_NOMSG(n >= t);
  ------------------
  |  |   60|  1.47M|   do {                                                                     \
  |  |   61|  1.47M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1.47M]
  |  |  ------------------
  |  |   62|  1.47M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  1.47M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  184|       |
  185|  1.47M|   q.grow_to(n - t + 1);
  186|       |
  187|  1.47M|   word* q_words = q.mutable_data();
  188|       |
  189|  1.47M|   BigInt shifted_y = y << (BOTAN_MP_WORD_BITS * (n - t));
  ------------------
  |  |   50|  1.47M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  190|       |
  191|       |   // Set q_{n-t} to number of times r > shifted_y
  192|  1.47M|   q_words[n - t] = r.reduce_below(shifted_y, ws);
  193|       |
  194|  1.47M|   const word y_t0 = y.word_at(t);
  195|  1.47M|   const word y_t1 = y.word_at(t - 1);
  196|  1.47M|   BOTAN_DEBUG_ASSERT((y_t0 >> (BOTAN_MP_WORD_BITS - 1)) == 1);
  ------------------
  |  |   99|  1.47M|      do {                          \
  |  |  100|  1.47M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  197|       |
  198|  2.98M|   for(size_t j = n; j != t; --j) {
  ------------------
  |  Branch (198:22): [True: 1.50M, False: 1.47M]
  ------------------
  199|  1.50M|      const word x_j0 = r.word_at(j);
  200|  1.50M|      const word x_j1 = r.word_at(j - 1);
  201|  1.50M|      const word x_j2 = r.word_at(j - 2);
  202|       |
  203|  1.50M|      word qjt = bigint_divop(x_j0, x_j1, y_t0);
  204|       |
  205|  1.50M|      qjt = CT::Mask<word>::is_equal(x_j0, y_t0).select(MP_WORD_MAX, qjt);
  206|       |
  207|       |      // Per HAC 14.23, this operation is required at most twice
  208|  1.50M|      qjt -= division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2);
  209|  1.50M|      qjt -= division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2);
  210|  1.50M|      BOTAN_DEBUG_ASSERT(division_check(qjt, y_t0, y_t1, x_j0, x_j1, x_j2) == false);
  ------------------
  |  |   99|  1.50M|      do {                          \
  |  |  100|  1.50M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  211|       |
  212|  1.50M|      shifted_y >>= BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  1.50M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  213|       |      // Now shifted_y == y << (BOTAN_MP_WORD_BITS * (j-t-1))
  214|       |
  215|       |      // TODO this sequence could be better
  216|  1.50M|      r -= qjt * shifted_y;
  217|  1.50M|      qjt -= r.is_negative();
  218|  1.50M|      r += static_cast<word>(r.is_negative()) * shifted_y;
  219|       |
  220|  1.50M|      q_words[j - t - 1] = qjt;
  221|  1.50M|   }
  222|       |
  223|  1.47M|   r >>= shifts;
  224|       |
  225|  1.47M|   sign_fixup(x, y_arg, q, r);
  226|       |
  227|  1.47M|   r_out = r;
  228|  1.47M|   q_out = q;
  229|  1.47M|}
divide.cpp:_ZN5Botan12_GLOBAL__N_110sign_fixupERKNS_6BigIntES3_RS1_S4_:
   21|  1.50M|void sign_fixup(const BigInt& x, const BigInt& y, BigInt& q, BigInt& r) {
   22|  1.50M|   q.cond_flip_sign(x.sign() != y.sign());
   23|       |
   24|  1.50M|   if(x.is_negative() && r.is_nonzero()) {
  ------------------
  |  Branch (24:7): [True: 0, False: 1.50M]
  |  Branch (24:26): [True: 0, False: 0]
  ------------------
   25|      0|      q -= 1;
   26|      0|      r = y.abs() - r;
   27|      0|   }
   28|  1.50M|}
divide.cpp:_ZN5Botan12_GLOBAL__N_114division_checkEmmmmmm:
   30|  3.01M|inline bool division_check(word q, word y2, word y1, word x3, word x2, word x1) {
   31|       |   /*
   32|       |   Compute (y3,y2,y1) = (y2,y1) * q
   33|       |   and return true if (y3,y2,y1) > (x3,x2,x1)
   34|       |   */
   35|       |
   36|  3.01M|   word y3 = 0;
   37|  3.01M|   y1 = word_madd2(q, y1, &y3);
   38|  3.01M|   y2 = word_madd2(q, y2, &y3);
   39|       |
   40|  3.01M|   const word x[3] = {x1, x2, x3};
   41|  3.01M|   const word y[3] = {y1, y2, y3};
   42|       |
   43|  3.01M|   return bigint_ct_is_lt(x, 3, y, 3).is_set();
   44|  3.01M|}

_ZN5Botan17bigint_comba_sqr4EPmPKm:
   16|  6.20M|void bigint_comba_sqr4(word z[8], const word x[4]) {
   17|  6.20M|   word w2 = 0, w1 = 0, w0 = 0;
   18|       |
   19|  6.20M|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
   20|  6.20M|   z[0] = w0;
   21|  6.20M|   w0 = 0;
   22|       |
   23|  6.20M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
   24|  6.20M|   z[1] = w1;
   25|  6.20M|   w1 = 0;
   26|       |
   27|  6.20M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
   28|  6.20M|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
   29|  6.20M|   z[2] = w2;
   30|  6.20M|   w2 = 0;
   31|       |
   32|  6.20M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
   33|  6.20M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
   34|  6.20M|   z[3] = w0;
   35|  6.20M|   w0 = 0;
   36|       |
   37|  6.20M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
   38|  6.20M|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
   39|  6.20M|   z[4] = w1;
   40|  6.20M|   w1 = 0;
   41|       |
   42|  6.20M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
   43|  6.20M|   z[5] = w2;
   44|  6.20M|   w2 = 0;
   45|       |
   46|  6.20M|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
   47|  6.20M|   z[6] = w0;
   48|  6.20M|   z[7] = w1;
   49|  6.20M|}
_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   54|  7.31M|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   55|  7.31M|   word w2 = 0, w1 = 0, w0 = 0;
   56|       |
   57|  7.31M|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
   58|  7.31M|   z[0] = w0;
   59|  7.31M|   w0 = 0;
   60|       |
   61|  7.31M|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
   62|  7.31M|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
   63|  7.31M|   z[1] = w1;
   64|  7.31M|   w1 = 0;
   65|       |
   66|  7.31M|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
   67|  7.31M|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
   68|  7.31M|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
   69|  7.31M|   z[2] = w2;
   70|  7.31M|   w2 = 0;
   71|       |
   72|  7.31M|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
   73|  7.31M|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
   74|  7.31M|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
   75|  7.31M|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
   76|  7.31M|   z[3] = w0;
   77|  7.31M|   w0 = 0;
   78|       |
   79|  7.31M|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
   80|  7.31M|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
   81|  7.31M|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
   82|  7.31M|   z[4] = w1;
   83|  7.31M|   w1 = 0;
   84|       |
   85|  7.31M|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
   86|  7.31M|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
   87|  7.31M|   z[5] = w2;
   88|  7.31M|   w2 = 0;
   89|       |
   90|  7.31M|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
   91|  7.31M|   z[6] = w0;
   92|  7.31M|   z[7] = w1;
   93|  7.31M|}
_ZN5Botan17bigint_comba_sqr6EPmPKm:
   98|  13.8M|void bigint_comba_sqr6(word z[12], const word x[6]) {
   99|  13.8M|   word w2 = 0, w1 = 0, w0 = 0;
  100|       |
  101|  13.8M|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  102|  13.8M|   z[0] = w0;
  103|  13.8M|   w0 = 0;
  104|       |
  105|  13.8M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  106|  13.8M|   z[1] = w1;
  107|  13.8M|   w1 = 0;
  108|       |
  109|  13.8M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  110|  13.8M|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  111|  13.8M|   z[2] = w2;
  112|  13.8M|   w2 = 0;
  113|       |
  114|  13.8M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  115|  13.8M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  116|  13.8M|   z[3] = w0;
  117|  13.8M|   w0 = 0;
  118|       |
  119|  13.8M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  120|  13.8M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  121|  13.8M|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  122|  13.8M|   z[4] = w1;
  123|  13.8M|   w1 = 0;
  124|       |
  125|  13.8M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  126|  13.8M|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  127|  13.8M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  128|  13.8M|   z[5] = w2;
  129|  13.8M|   w2 = 0;
  130|       |
  131|  13.8M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  132|  13.8M|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  133|  13.8M|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  134|  13.8M|   z[6] = w0;
  135|  13.8M|   w0 = 0;
  136|       |
  137|  13.8M|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  138|  13.8M|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  139|  13.8M|   z[7] = w1;
  140|  13.8M|   w1 = 0;
  141|       |
  142|  13.8M|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  143|  13.8M|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  144|  13.8M|   z[8] = w2;
  145|  13.8M|   w2 = 0;
  146|       |
  147|  13.8M|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  148|  13.8M|   z[9] = w0;
  149|  13.8M|   w0 = 0;
  150|       |
  151|  13.8M|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  152|  13.8M|   z[10] = w1;
  153|  13.8M|   z[11] = w2;
  154|  13.8M|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  159|  16.2M|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  160|  16.2M|   word w2 = 0, w1 = 0, w0 = 0;
  161|       |
  162|  16.2M|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  163|  16.2M|   z[0] = w0;
  164|  16.2M|   w0 = 0;
  165|       |
  166|  16.2M|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  167|  16.2M|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  168|  16.2M|   z[1] = w1;
  169|  16.2M|   w1 = 0;
  170|       |
  171|  16.2M|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  172|  16.2M|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  173|  16.2M|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  174|  16.2M|   z[2] = w2;
  175|  16.2M|   w2 = 0;
  176|       |
  177|  16.2M|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  178|  16.2M|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  179|  16.2M|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  180|  16.2M|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  181|  16.2M|   z[3] = w0;
  182|  16.2M|   w0 = 0;
  183|       |
  184|  16.2M|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  185|  16.2M|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  186|  16.2M|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  187|  16.2M|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  188|  16.2M|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  189|  16.2M|   z[4] = w1;
  190|  16.2M|   w1 = 0;
  191|       |
  192|  16.2M|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  193|  16.2M|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  194|  16.2M|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  195|  16.2M|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  196|  16.2M|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  197|  16.2M|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  198|  16.2M|   z[5] = w2;
  199|  16.2M|   w2 = 0;
  200|       |
  201|  16.2M|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  202|  16.2M|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  203|  16.2M|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  204|  16.2M|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  205|  16.2M|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  206|  16.2M|   z[6] = w0;
  207|  16.2M|   w0 = 0;
  208|       |
  209|  16.2M|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  210|  16.2M|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  211|  16.2M|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  212|  16.2M|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  213|  16.2M|   z[7] = w1;
  214|  16.2M|   w1 = 0;
  215|       |
  216|  16.2M|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  217|  16.2M|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  218|  16.2M|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  219|  16.2M|   z[8] = w2;
  220|  16.2M|   w2 = 0;
  221|       |
  222|  16.2M|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  223|  16.2M|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  224|  16.2M|   z[9] = w0;
  225|  16.2M|   w0 = 0;
  226|       |
  227|  16.2M|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  228|  16.2M|   z[10] = w1;
  229|  16.2M|   z[11] = w2;
  230|  16.2M|}
_ZN5Botan17bigint_comba_sqr8EPmPKm:
  235|  18.9M|void bigint_comba_sqr8(word z[16], const word x[8]) {
  236|  18.9M|   word w2 = 0, w1 = 0, w0 = 0;
  237|       |
  238|  18.9M|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  239|  18.9M|   z[0] = w0;
  240|  18.9M|   w0 = 0;
  241|       |
  242|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  243|  18.9M|   z[1] = w1;
  244|  18.9M|   w1 = 0;
  245|       |
  246|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  247|  18.9M|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  248|  18.9M|   z[2] = w2;
  249|  18.9M|   w2 = 0;
  250|       |
  251|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  252|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  253|  18.9M|   z[3] = w0;
  254|  18.9M|   w0 = 0;
  255|       |
  256|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  257|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  258|  18.9M|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  259|  18.9M|   z[4] = w1;
  260|  18.9M|   w1 = 0;
  261|       |
  262|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  263|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  264|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  265|  18.9M|   z[5] = w2;
  266|  18.9M|   w2 = 0;
  267|       |
  268|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  269|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  270|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  271|  18.9M|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  272|  18.9M|   z[6] = w0;
  273|  18.9M|   w0 = 0;
  274|       |
  275|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  276|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  277|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  278|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  279|  18.9M|   z[7] = w1;
  280|  18.9M|   w1 = 0;
  281|       |
  282|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  283|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  284|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  285|  18.9M|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  286|  18.9M|   z[8] = w2;
  287|  18.9M|   w2 = 0;
  288|       |
  289|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  290|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  291|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  292|  18.9M|   z[9] = w0;
  293|  18.9M|   w0 = 0;
  294|       |
  295|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  296|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  297|  18.9M|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  298|  18.9M|   z[10] = w1;
  299|  18.9M|   w1 = 0;
  300|       |
  301|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  302|  18.9M|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  303|  18.9M|   z[11] = w2;
  304|  18.9M|   w2 = 0;
  305|       |
  306|  18.9M|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  307|  18.9M|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  308|  18.9M|   z[12] = w0;
  309|  18.9M|   w0 = 0;
  310|       |
  311|  18.9M|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  312|  18.9M|   z[13] = w1;
  313|  18.9M|   w1 = 0;
  314|       |
  315|  18.9M|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  316|  18.9M|   z[14] = w2;
  317|  18.9M|   z[15] = w0;
  318|  18.9M|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  323|  22.7M|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  324|  22.7M|   word w2 = 0, w1 = 0, w0 = 0;
  325|       |
  326|  22.7M|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  327|  22.7M|   z[0] = w0;
  328|  22.7M|   w0 = 0;
  329|       |
  330|  22.7M|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  331|  22.7M|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  332|  22.7M|   z[1] = w1;
  333|  22.7M|   w1 = 0;
  334|       |
  335|  22.7M|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  336|  22.7M|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  337|  22.7M|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  338|  22.7M|   z[2] = w2;
  339|  22.7M|   w2 = 0;
  340|       |
  341|  22.7M|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  342|  22.7M|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  343|  22.7M|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  344|  22.7M|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  345|  22.7M|   z[3] = w0;
  346|  22.7M|   w0 = 0;
  347|       |
  348|  22.7M|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  349|  22.7M|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  350|  22.7M|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  351|  22.7M|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  352|  22.7M|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  353|  22.7M|   z[4] = w1;
  354|  22.7M|   w1 = 0;
  355|       |
  356|  22.7M|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  357|  22.7M|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  358|  22.7M|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  359|  22.7M|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  360|  22.7M|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  361|  22.7M|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  362|  22.7M|   z[5] = w2;
  363|  22.7M|   w2 = 0;
  364|       |
  365|  22.7M|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  366|  22.7M|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  367|  22.7M|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  368|  22.7M|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  369|  22.7M|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  370|  22.7M|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  371|  22.7M|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  372|  22.7M|   z[6] = w0;
  373|  22.7M|   w0 = 0;
  374|       |
  375|  22.7M|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  376|  22.7M|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  377|  22.7M|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  378|  22.7M|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  379|  22.7M|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  380|  22.7M|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  381|  22.7M|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  382|  22.7M|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  383|  22.7M|   z[7] = w1;
  384|  22.7M|   w1 = 0;
  385|       |
  386|  22.7M|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  387|  22.7M|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  388|  22.7M|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  389|  22.7M|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  390|  22.7M|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  391|  22.7M|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  392|  22.7M|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  393|  22.7M|   z[8] = w2;
  394|  22.7M|   w2 = 0;
  395|       |
  396|  22.7M|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  397|  22.7M|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  398|  22.7M|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  399|  22.7M|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  400|  22.7M|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  401|  22.7M|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
  402|  22.7M|   z[9] = w0;
  403|  22.7M|   w0 = 0;
  404|       |
  405|  22.7M|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
  406|  22.7M|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
  407|  22.7M|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  408|  22.7M|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
  409|  22.7M|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
  410|  22.7M|   z[10] = w1;
  411|  22.7M|   w1 = 0;
  412|       |
  413|  22.7M|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
  414|  22.7M|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
  415|  22.7M|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
  416|  22.7M|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
  417|  22.7M|   z[11] = w2;
  418|  22.7M|   w2 = 0;
  419|       |
  420|  22.7M|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
  421|  22.7M|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
  422|  22.7M|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
  423|  22.7M|   z[12] = w0;
  424|  22.7M|   w0 = 0;
  425|       |
  426|  22.7M|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
  427|  22.7M|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
  428|  22.7M|   z[13] = w1;
  429|  22.7M|   w1 = 0;
  430|       |
  431|  22.7M|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
  432|  22.7M|   z[14] = w2;
  433|  22.7M|   z[15] = w0;
  434|  22.7M|}
_ZN5Botan17bigint_comba_sqr9EPmPKm:
  439|  26.1M|void bigint_comba_sqr9(word z[18], const word x[9]) {
  440|  26.1M|   word w2 = 0, w1 = 0, w0 = 0;
  441|       |
  442|  26.1M|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  443|  26.1M|   z[0] = w0;
  444|  26.1M|   w0 = 0;
  445|       |
  446|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  447|  26.1M|   z[1] = w1;
  448|  26.1M|   w1 = 0;
  449|       |
  450|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  451|  26.1M|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  452|  26.1M|   z[2] = w2;
  453|  26.1M|   w2 = 0;
  454|       |
  455|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  456|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  457|  26.1M|   z[3] = w0;
  458|  26.1M|   w0 = 0;
  459|       |
  460|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  461|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  462|  26.1M|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  463|  26.1M|   z[4] = w1;
  464|  26.1M|   w1 = 0;
  465|       |
  466|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  467|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  468|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  469|  26.1M|   z[5] = w2;
  470|  26.1M|   w2 = 0;
  471|       |
  472|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  473|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  474|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  475|  26.1M|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  476|  26.1M|   z[6] = w0;
  477|  26.1M|   w0 = 0;
  478|       |
  479|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  480|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  481|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  482|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  483|  26.1M|   z[7] = w1;
  484|  26.1M|   w1 = 0;
  485|       |
  486|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[0], x[8]);
  487|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  488|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  489|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  490|  26.1M|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  491|  26.1M|   z[8] = w2;
  492|  26.1M|   w2 = 0;
  493|       |
  494|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[1], x[8]);
  495|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  496|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  497|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  498|  26.1M|   z[9] = w0;
  499|  26.1M|   w0 = 0;
  500|       |
  501|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[2], x[8]);
  502|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  503|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  504|  26.1M|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  505|  26.1M|   z[10] = w1;
  506|  26.1M|   w1 = 0;
  507|       |
  508|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[3], x[8]);
  509|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  510|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  511|  26.1M|   z[11] = w2;
  512|  26.1M|   w2 = 0;
  513|       |
  514|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[4], x[8]);
  515|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  516|  26.1M|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  517|  26.1M|   z[12] = w0;
  518|  26.1M|   w0 = 0;
  519|       |
  520|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[5], x[8]);
  521|  26.1M|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  522|  26.1M|   z[13] = w1;
  523|  26.1M|   w1 = 0;
  524|       |
  525|  26.1M|   word3_muladd_2(&w1, &w0, &w2, x[6], x[8]);
  526|  26.1M|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  527|  26.1M|   z[14] = w2;
  528|  26.1M|   w2 = 0;
  529|       |
  530|  26.1M|   word3_muladd_2(&w2, &w1, &w0, x[7], x[8]);
  531|  26.1M|   z[15] = w0;
  532|  26.1M|   w0 = 0;
  533|       |
  534|  26.1M|   word3_muladd(&w0, &w2, &w1, x[8], x[8]);
  535|  26.1M|   z[16] = w1;
  536|  26.1M|   z[17] = w2;
  537|  26.1M|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  542|  26.1M|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  543|  26.1M|   word w2 = 0, w1 = 0, w0 = 0;
  544|       |
  545|  26.1M|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  546|  26.1M|   z[0] = w0;
  547|  26.1M|   w0 = 0;
  548|       |
  549|  26.1M|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  550|  26.1M|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  551|  26.1M|   z[1] = w1;
  552|  26.1M|   w1 = 0;
  553|       |
  554|  26.1M|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  555|  26.1M|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  556|  26.1M|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  557|  26.1M|   z[2] = w2;
  558|  26.1M|   w2 = 0;
  559|       |
  560|  26.1M|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  561|  26.1M|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  562|  26.1M|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  563|  26.1M|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  564|  26.1M|   z[3] = w0;
  565|  26.1M|   w0 = 0;
  566|       |
  567|  26.1M|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  568|  26.1M|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  569|  26.1M|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  570|  26.1M|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  571|  26.1M|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  572|  26.1M|   z[4] = w1;
  573|  26.1M|   w1 = 0;
  574|       |
  575|  26.1M|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  576|  26.1M|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  577|  26.1M|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  578|  26.1M|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  579|  26.1M|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  580|  26.1M|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  581|  26.1M|   z[5] = w2;
  582|  26.1M|   w2 = 0;
  583|       |
  584|  26.1M|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  585|  26.1M|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  586|  26.1M|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  587|  26.1M|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  588|  26.1M|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  589|  26.1M|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  590|  26.1M|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  591|  26.1M|   z[6] = w0;
  592|  26.1M|   w0 = 0;
  593|       |
  594|  26.1M|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  595|  26.1M|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  596|  26.1M|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  597|  26.1M|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  598|  26.1M|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  599|  26.1M|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  600|  26.1M|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  601|  26.1M|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  602|  26.1M|   z[7] = w1;
  603|  26.1M|   w1 = 0;
  604|       |
  605|  26.1M|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
  606|  26.1M|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  607|  26.1M|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  608|  26.1M|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  609|  26.1M|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  610|  26.1M|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  611|  26.1M|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  612|  26.1M|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  613|  26.1M|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
  614|  26.1M|   z[8] = w2;
  615|  26.1M|   w2 = 0;
  616|       |
  617|  26.1M|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
  618|  26.1M|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  619|  26.1M|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  620|  26.1M|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  621|  26.1M|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  622|  26.1M|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  623|  26.1M|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
  624|  26.1M|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
  625|  26.1M|   z[9] = w0;
  626|  26.1M|   w0 = 0;
  627|       |
  628|  26.1M|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
  629|  26.1M|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
  630|  26.1M|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
  631|  26.1M|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
  632|  26.1M|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
  633|  26.1M|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
  634|  26.1M|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
  635|  26.1M|   z[10] = w1;
  636|  26.1M|   w1 = 0;
  637|       |
  638|  26.1M|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
  639|  26.1M|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
  640|  26.1M|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
  641|  26.1M|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
  642|  26.1M|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
  643|  26.1M|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
  644|  26.1M|   z[11] = w2;
  645|  26.1M|   w2 = 0;
  646|       |
  647|  26.1M|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
  648|  26.1M|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
  649|  26.1M|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
  650|  26.1M|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
  651|  26.1M|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
  652|  26.1M|   z[12] = w0;
  653|  26.1M|   w0 = 0;
  654|       |
  655|  26.1M|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
  656|  26.1M|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
  657|  26.1M|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
  658|  26.1M|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
  659|  26.1M|   z[13] = w1;
  660|  26.1M|   w1 = 0;
  661|       |
  662|  26.1M|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
  663|  26.1M|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
  664|  26.1M|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
  665|  26.1M|   z[14] = w2;
  666|  26.1M|   w2 = 0;
  667|       |
  668|  26.1M|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
  669|  26.1M|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
  670|  26.1M|   z[15] = w0;
  671|  26.1M|   w0 = 0;
  672|       |
  673|  26.1M|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
  674|  26.1M|   z[16] = w1;
  675|  26.1M|   z[17] = w2;
  676|  26.1M|}
_ZN5Botan18bigint_comba_sqr16EPmPKm:
  681|   323k|void bigint_comba_sqr16(word z[32], const word x[16]) {
  682|   323k|   word w2 = 0, w1 = 0, w0 = 0;
  683|       |
  684|   323k|   word3_muladd(&w2, &w1, &w0, x[0], x[0]);
  685|   323k|   z[0] = w0;
  686|   323k|   w0 = 0;
  687|       |
  688|   323k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[1]);
  689|   323k|   z[1] = w1;
  690|   323k|   w1 = 0;
  691|       |
  692|   323k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[2]);
  693|   323k|   word3_muladd(&w1, &w0, &w2, x[1], x[1]);
  694|   323k|   z[2] = w2;
  695|   323k|   w2 = 0;
  696|       |
  697|   323k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[3]);
  698|   323k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[2]);
  699|   323k|   z[3] = w0;
  700|   323k|   w0 = 0;
  701|       |
  702|   323k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[4]);
  703|   323k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[3]);
  704|   323k|   word3_muladd(&w0, &w2, &w1, x[2], x[2]);
  705|   323k|   z[4] = w1;
  706|   323k|   w1 = 0;
  707|       |
  708|   323k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[5]);
  709|   323k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[4]);
  710|   323k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[3]);
  711|   323k|   z[5] = w2;
  712|   323k|   w2 = 0;
  713|       |
  714|   323k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[6]);
  715|   323k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[5]);
  716|   323k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[4]);
  717|   323k|   word3_muladd(&w2, &w1, &w0, x[3], x[3]);
  718|   323k|   z[6] = w0;
  719|   323k|   w0 = 0;
  720|       |
  721|   323k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[7]);
  722|   323k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[6]);
  723|   323k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[5]);
  724|   323k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[4]);
  725|   323k|   z[7] = w1;
  726|   323k|   w1 = 0;
  727|       |
  728|   323k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[8]);
  729|   323k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[7]);
  730|   323k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[6]);
  731|   323k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[5]);
  732|   323k|   word3_muladd(&w1, &w0, &w2, x[4], x[4]);
  733|   323k|   z[8] = w2;
  734|   323k|   w2 = 0;
  735|       |
  736|   323k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[9]);
  737|   323k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[8]);
  738|   323k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[7]);
  739|   323k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[6]);
  740|   323k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[5]);
  741|   323k|   z[9] = w0;
  742|   323k|   w0 = 0;
  743|       |
  744|   323k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[10]);
  745|   323k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[9]);
  746|   323k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[8]);
  747|   323k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[7]);
  748|   323k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[6]);
  749|   323k|   word3_muladd(&w0, &w2, &w1, x[5], x[5]);
  750|   323k|   z[10] = w1;
  751|   323k|   w1 = 0;
  752|       |
  753|   323k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[11]);
  754|   323k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[10]);
  755|   323k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[9]);
  756|   323k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[8]);
  757|   323k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[7]);
  758|   323k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[6]);
  759|   323k|   z[11] = w2;
  760|   323k|   w2 = 0;
  761|       |
  762|   323k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[12]);
  763|   323k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[11]);
  764|   323k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[10]);
  765|   323k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[9]);
  766|   323k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[8]);
  767|   323k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[7]);
  768|   323k|   word3_muladd(&w2, &w1, &w0, x[6], x[6]);
  769|   323k|   z[12] = w0;
  770|   323k|   w0 = 0;
  771|       |
  772|   323k|   word3_muladd_2(&w0, &w2, &w1, x[0], x[13]);
  773|   323k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[12]);
  774|   323k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[11]);
  775|   323k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[10]);
  776|   323k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[9]);
  777|   323k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[8]);
  778|   323k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[7]);
  779|   323k|   z[13] = w1;
  780|   323k|   w1 = 0;
  781|       |
  782|   323k|   word3_muladd_2(&w1, &w0, &w2, x[0], x[14]);
  783|   323k|   word3_muladd_2(&w1, &w0, &w2, x[1], x[13]);
  784|   323k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[12]);
  785|   323k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[11]);
  786|   323k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[10]);
  787|   323k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[9]);
  788|   323k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[8]);
  789|   323k|   word3_muladd(&w1, &w0, &w2, x[7], x[7]);
  790|   323k|   z[14] = w2;
  791|   323k|   w2 = 0;
  792|       |
  793|   323k|   word3_muladd_2(&w2, &w1, &w0, x[0], x[15]);
  794|   323k|   word3_muladd_2(&w2, &w1, &w0, x[1], x[14]);
  795|   323k|   word3_muladd_2(&w2, &w1, &w0, x[2], x[13]);
  796|   323k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[12]);
  797|   323k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[11]);
  798|   323k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[10]);
  799|   323k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[9]);
  800|   323k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[8]);
  801|   323k|   z[15] = w0;
  802|   323k|   w0 = 0;
  803|       |
  804|   323k|   word3_muladd_2(&w0, &w2, &w1, x[1], x[15]);
  805|   323k|   word3_muladd_2(&w0, &w2, &w1, x[2], x[14]);
  806|   323k|   word3_muladd_2(&w0, &w2, &w1, x[3], x[13]);
  807|   323k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[12]);
  808|   323k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[11]);
  809|   323k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[10]);
  810|   323k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[9]);
  811|   323k|   word3_muladd(&w0, &w2, &w1, x[8], x[8]);
  812|   323k|   z[16] = w1;
  813|   323k|   w1 = 0;
  814|       |
  815|   323k|   word3_muladd_2(&w1, &w0, &w2, x[2], x[15]);
  816|   323k|   word3_muladd_2(&w1, &w0, &w2, x[3], x[14]);
  817|   323k|   word3_muladd_2(&w1, &w0, &w2, x[4], x[13]);
  818|   323k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[12]);
  819|   323k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[11]);
  820|   323k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[10]);
  821|   323k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[9]);
  822|   323k|   z[17] = w2;
  823|   323k|   w2 = 0;
  824|       |
  825|   323k|   word3_muladd_2(&w2, &w1, &w0, x[3], x[15]);
  826|   323k|   word3_muladd_2(&w2, &w1, &w0, x[4], x[14]);
  827|   323k|   word3_muladd_2(&w2, &w1, &w0, x[5], x[13]);
  828|   323k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[12]);
  829|   323k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[11]);
  830|   323k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[10]);
  831|   323k|   word3_muladd(&w2, &w1, &w0, x[9], x[9]);
  832|   323k|   z[18] = w0;
  833|   323k|   w0 = 0;
  834|       |
  835|   323k|   word3_muladd_2(&w0, &w2, &w1, x[4], x[15]);
  836|   323k|   word3_muladd_2(&w0, &w2, &w1, x[5], x[14]);
  837|   323k|   word3_muladd_2(&w0, &w2, &w1, x[6], x[13]);
  838|   323k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[12]);
  839|   323k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[11]);
  840|   323k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[10]);
  841|   323k|   z[19] = w1;
  842|   323k|   w1 = 0;
  843|       |
  844|   323k|   word3_muladd_2(&w1, &w0, &w2, x[5], x[15]);
  845|   323k|   word3_muladd_2(&w1, &w0, &w2, x[6], x[14]);
  846|   323k|   word3_muladd_2(&w1, &w0, &w2, x[7], x[13]);
  847|   323k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[12]);
  848|   323k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[11]);
  849|   323k|   word3_muladd(&w1, &w0, &w2, x[10], x[10]);
  850|   323k|   z[20] = w2;
  851|   323k|   w2 = 0;
  852|       |
  853|   323k|   word3_muladd_2(&w2, &w1, &w0, x[6], x[15]);
  854|   323k|   word3_muladd_2(&w2, &w1, &w0, x[7], x[14]);
  855|   323k|   word3_muladd_2(&w2, &w1, &w0, x[8], x[13]);
  856|   323k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[12]);
  857|   323k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[11]);
  858|   323k|   z[21] = w0;
  859|   323k|   w0 = 0;
  860|       |
  861|   323k|   word3_muladd_2(&w0, &w2, &w1, x[7], x[15]);
  862|   323k|   word3_muladd_2(&w0, &w2, &w1, x[8], x[14]);
  863|   323k|   word3_muladd_2(&w0, &w2, &w1, x[9], x[13]);
  864|   323k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[12]);
  865|   323k|   word3_muladd(&w0, &w2, &w1, x[11], x[11]);
  866|   323k|   z[22] = w1;
  867|   323k|   w1 = 0;
  868|       |
  869|   323k|   word3_muladd_2(&w1, &w0, &w2, x[8], x[15]);
  870|   323k|   word3_muladd_2(&w1, &w0, &w2, x[9], x[14]);
  871|   323k|   word3_muladd_2(&w1, &w0, &w2, x[10], x[13]);
  872|   323k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[12]);
  873|   323k|   z[23] = w2;
  874|   323k|   w2 = 0;
  875|       |
  876|   323k|   word3_muladd_2(&w2, &w1, &w0, x[9], x[15]);
  877|   323k|   word3_muladd_2(&w2, &w1, &w0, x[10], x[14]);
  878|   323k|   word3_muladd_2(&w2, &w1, &w0, x[11], x[13]);
  879|   323k|   word3_muladd(&w2, &w1, &w0, x[12], x[12]);
  880|   323k|   z[24] = w0;
  881|   323k|   w0 = 0;
  882|       |
  883|   323k|   word3_muladd_2(&w0, &w2, &w1, x[10], x[15]);
  884|   323k|   word3_muladd_2(&w0, &w2, &w1, x[11], x[14]);
  885|   323k|   word3_muladd_2(&w0, &w2, &w1, x[12], x[13]);
  886|   323k|   z[25] = w1;
  887|   323k|   w1 = 0;
  888|       |
  889|   323k|   word3_muladd_2(&w1, &w0, &w2, x[11], x[15]);
  890|   323k|   word3_muladd_2(&w1, &w0, &w2, x[12], x[14]);
  891|   323k|   word3_muladd(&w1, &w0, &w2, x[13], x[13]);
  892|   323k|   z[26] = w2;
  893|   323k|   w2 = 0;
  894|       |
  895|   323k|   word3_muladd_2(&w2, &w1, &w0, x[12], x[15]);
  896|   323k|   word3_muladd_2(&w2, &w1, &w0, x[13], x[14]);
  897|   323k|   z[27] = w0;
  898|   323k|   w0 = 0;
  899|       |
  900|   323k|   word3_muladd_2(&w0, &w2, &w1, x[13], x[15]);
  901|   323k|   word3_muladd(&w0, &w2, &w1, x[14], x[14]);
  902|   323k|   z[28] = w1;
  903|   323k|   w1 = 0;
  904|       |
  905|   323k|   word3_muladd_2(&w1, &w0, &w2, x[14], x[15]);
  906|   323k|   z[29] = w2;
  907|   323k|   w2 = 0;
  908|       |
  909|   323k|   word3_muladd(&w2, &w1, &w0, x[15], x[15]);
  910|   323k|   z[30] = w0;
  911|   323k|   z[31] = w1;
  912|   323k|}
_ZN5Botan18bigint_comba_mul16EPmPKmS2_:
  917|   173k|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) {
  918|   173k|   word w2 = 0, w1 = 0, w0 = 0;
  919|       |
  920|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
  921|   173k|   z[0] = w0;
  922|   173k|   w0 = 0;
  923|       |
  924|   173k|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
  925|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
  926|   173k|   z[1] = w1;
  927|   173k|   w1 = 0;
  928|       |
  929|   173k|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
  930|   173k|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
  931|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
  932|   173k|   z[2] = w2;
  933|   173k|   w2 = 0;
  934|       |
  935|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
  936|   173k|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
  937|   173k|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
  938|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
  939|   173k|   z[3] = w0;
  940|   173k|   w0 = 0;
  941|       |
  942|   173k|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
  943|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
  944|   173k|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
  945|   173k|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
  946|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
  947|   173k|   z[4] = w1;
  948|   173k|   w1 = 0;
  949|       |
  950|   173k|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
  951|   173k|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
  952|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
  953|   173k|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
  954|   173k|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
  955|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
  956|   173k|   z[5] = w2;
  957|   173k|   w2 = 0;
  958|       |
  959|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
  960|   173k|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
  961|   173k|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
  962|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
  963|   173k|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
  964|   173k|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
  965|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
  966|   173k|   z[6] = w0;
  967|   173k|   w0 = 0;
  968|       |
  969|   173k|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
  970|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
  971|   173k|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
  972|   173k|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
  973|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
  974|   173k|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
  975|   173k|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
  976|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
  977|   173k|   z[7] = w1;
  978|   173k|   w1 = 0;
  979|       |
  980|   173k|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
  981|   173k|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
  982|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
  983|   173k|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
  984|   173k|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
  985|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
  986|   173k|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
  987|   173k|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
  988|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
  989|   173k|   z[8] = w2;
  990|   173k|   w2 = 0;
  991|       |
  992|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[9]);
  993|   173k|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
  994|   173k|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
  995|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
  996|   173k|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
  997|   173k|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
  998|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
  999|   173k|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
 1000|   173k|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
 1001|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[0]);
 1002|   173k|   z[9] = w0;
 1003|   173k|   w0 = 0;
 1004|       |
 1005|   173k|   word3_muladd(&w0, &w2, &w1, x[0], y[10]);
 1006|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[9]);
 1007|   173k|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
 1008|   173k|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
 1009|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
 1010|   173k|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
 1011|   173k|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
 1012|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
 1013|   173k|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
 1014|   173k|   word3_muladd(&w0, &w2, &w1, x[9], y[1]);
 1015|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[0]);
 1016|   173k|   z[10] = w1;
 1017|   173k|   w1 = 0;
 1018|       |
 1019|   173k|   word3_muladd(&w1, &w0, &w2, x[0], y[11]);
 1020|   173k|   word3_muladd(&w1, &w0, &w2, x[1], y[10]);
 1021|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[9]);
 1022|   173k|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
 1023|   173k|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
 1024|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
 1025|   173k|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
 1026|   173k|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
 1027|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
 1028|   173k|   word3_muladd(&w1, &w0, &w2, x[9], y[2]);
 1029|   173k|   word3_muladd(&w1, &w0, &w2, x[10], y[1]);
 1030|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[0]);
 1031|   173k|   z[11] = w2;
 1032|   173k|   w2 = 0;
 1033|       |
 1034|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[12]);
 1035|   173k|   word3_muladd(&w2, &w1, &w0, x[1], y[11]);
 1036|   173k|   word3_muladd(&w2, &w1, &w0, x[2], y[10]);
 1037|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[9]);
 1038|   173k|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
 1039|   173k|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
 1040|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
 1041|   173k|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
 1042|   173k|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
 1043|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[3]);
 1044|   173k|   word3_muladd(&w2, &w1, &w0, x[10], y[2]);
 1045|   173k|   word3_muladd(&w2, &w1, &w0, x[11], y[1]);
 1046|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[0]);
 1047|   173k|   z[12] = w0;
 1048|   173k|   w0 = 0;
 1049|       |
 1050|   173k|   word3_muladd(&w0, &w2, &w1, x[0], y[13]);
 1051|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[12]);
 1052|   173k|   word3_muladd(&w0, &w2, &w1, x[2], y[11]);
 1053|   173k|   word3_muladd(&w0, &w2, &w1, x[3], y[10]);
 1054|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[9]);
 1055|   173k|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
 1056|   173k|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
 1057|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
 1058|   173k|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
 1059|   173k|   word3_muladd(&w0, &w2, &w1, x[9], y[4]);
 1060|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[3]);
 1061|   173k|   word3_muladd(&w0, &w2, &w1, x[11], y[2]);
 1062|   173k|   word3_muladd(&w0, &w2, &w1, x[12], y[1]);
 1063|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[0]);
 1064|   173k|   z[13] = w1;
 1065|   173k|   w1 = 0;
 1066|       |
 1067|   173k|   word3_muladd(&w1, &w0, &w2, x[0], y[14]);
 1068|   173k|   word3_muladd(&w1, &w0, &w2, x[1], y[13]);
 1069|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[12]);
 1070|   173k|   word3_muladd(&w1, &w0, &w2, x[3], y[11]);
 1071|   173k|   word3_muladd(&w1, &w0, &w2, x[4], y[10]);
 1072|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[9]);
 1073|   173k|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
 1074|   173k|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
 1075|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
 1076|   173k|   word3_muladd(&w1, &w0, &w2, x[9], y[5]);
 1077|   173k|   word3_muladd(&w1, &w0, &w2, x[10], y[4]);
 1078|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[3]);
 1079|   173k|   word3_muladd(&w1, &w0, &w2, x[12], y[2]);
 1080|   173k|   word3_muladd(&w1, &w0, &w2, x[13], y[1]);
 1081|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[0]);
 1082|   173k|   z[14] = w2;
 1083|   173k|   w2 = 0;
 1084|       |
 1085|   173k|   word3_muladd(&w2, &w1, &w0, x[0], y[15]);
 1086|   173k|   word3_muladd(&w2, &w1, &w0, x[1], y[14]);
 1087|   173k|   word3_muladd(&w2, &w1, &w0, x[2], y[13]);
 1088|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[12]);
 1089|   173k|   word3_muladd(&w2, &w1, &w0, x[4], y[11]);
 1090|   173k|   word3_muladd(&w2, &w1, &w0, x[5], y[10]);
 1091|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[9]);
 1092|   173k|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
 1093|   173k|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
 1094|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[6]);
 1095|   173k|   word3_muladd(&w2, &w1, &w0, x[10], y[5]);
 1096|   173k|   word3_muladd(&w2, &w1, &w0, x[11], y[4]);
 1097|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[3]);
 1098|   173k|   word3_muladd(&w2, &w1, &w0, x[13], y[2]);
 1099|   173k|   word3_muladd(&w2, &w1, &w0, x[14], y[1]);
 1100|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[0]);
 1101|   173k|   z[15] = w0;
 1102|   173k|   w0 = 0;
 1103|       |
 1104|   173k|   word3_muladd(&w0, &w2, &w1, x[1], y[15]);
 1105|   173k|   word3_muladd(&w0, &w2, &w1, x[2], y[14]);
 1106|   173k|   word3_muladd(&w0, &w2, &w1, x[3], y[13]);
 1107|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[12]);
 1108|   173k|   word3_muladd(&w0, &w2, &w1, x[5], y[11]);
 1109|   173k|   word3_muladd(&w0, &w2, &w1, x[6], y[10]);
 1110|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[9]);
 1111|   173k|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
 1112|   173k|   word3_muladd(&w0, &w2, &w1, x[9], y[7]);
 1113|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[6]);
 1114|   173k|   word3_muladd(&w0, &w2, &w1, x[11], y[5]);
 1115|   173k|   word3_muladd(&w0, &w2, &w1, x[12], y[4]);
 1116|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[3]);
 1117|   173k|   word3_muladd(&w0, &w2, &w1, x[14], y[2]);
 1118|   173k|   word3_muladd(&w0, &w2, &w1, x[15], y[1]);
 1119|   173k|   z[16] = w1;
 1120|   173k|   w1 = 0;
 1121|       |
 1122|   173k|   word3_muladd(&w1, &w0, &w2, x[2], y[15]);
 1123|   173k|   word3_muladd(&w1, &w0, &w2, x[3], y[14]);
 1124|   173k|   word3_muladd(&w1, &w0, &w2, x[4], y[13]);
 1125|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[12]);
 1126|   173k|   word3_muladd(&w1, &w0, &w2, x[6], y[11]);
 1127|   173k|   word3_muladd(&w1, &w0, &w2, x[7], y[10]);
 1128|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[9]);
 1129|   173k|   word3_muladd(&w1, &w0, &w2, x[9], y[8]);
 1130|   173k|   word3_muladd(&w1, &w0, &w2, x[10], y[7]);
 1131|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[6]);
 1132|   173k|   word3_muladd(&w1, &w0, &w2, x[12], y[5]);
 1133|   173k|   word3_muladd(&w1, &w0, &w2, x[13], y[4]);
 1134|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[3]);
 1135|   173k|   word3_muladd(&w1, &w0, &w2, x[15], y[2]);
 1136|   173k|   z[17] = w2;
 1137|   173k|   w2 = 0;
 1138|       |
 1139|   173k|   word3_muladd(&w2, &w1, &w0, x[3], y[15]);
 1140|   173k|   word3_muladd(&w2, &w1, &w0, x[4], y[14]);
 1141|   173k|   word3_muladd(&w2, &w1, &w0, x[5], y[13]);
 1142|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[12]);
 1143|   173k|   word3_muladd(&w2, &w1, &w0, x[7], y[11]);
 1144|   173k|   word3_muladd(&w2, &w1, &w0, x[8], y[10]);
 1145|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[9]);
 1146|   173k|   word3_muladd(&w2, &w1, &w0, x[10], y[8]);
 1147|   173k|   word3_muladd(&w2, &w1, &w0, x[11], y[7]);
 1148|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[6]);
 1149|   173k|   word3_muladd(&w2, &w1, &w0, x[13], y[5]);
 1150|   173k|   word3_muladd(&w2, &w1, &w0, x[14], y[4]);
 1151|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[3]);
 1152|   173k|   z[18] = w0;
 1153|   173k|   w0 = 0;
 1154|       |
 1155|   173k|   word3_muladd(&w0, &w2, &w1, x[4], y[15]);
 1156|   173k|   word3_muladd(&w0, &w2, &w1, x[5], y[14]);
 1157|   173k|   word3_muladd(&w0, &w2, &w1, x[6], y[13]);
 1158|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[12]);
 1159|   173k|   word3_muladd(&w0, &w2, &w1, x[8], y[11]);
 1160|   173k|   word3_muladd(&w0, &w2, &w1, x[9], y[10]);
 1161|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[9]);
 1162|   173k|   word3_muladd(&w0, &w2, &w1, x[11], y[8]);
 1163|   173k|   word3_muladd(&w0, &w2, &w1, x[12], y[7]);
 1164|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[6]);
 1165|   173k|   word3_muladd(&w0, &w2, &w1, x[14], y[5]);
 1166|   173k|   word3_muladd(&w0, &w2, &w1, x[15], y[4]);
 1167|   173k|   z[19] = w1;
 1168|   173k|   w1 = 0;
 1169|       |
 1170|   173k|   word3_muladd(&w1, &w0, &w2, x[5], y[15]);
 1171|   173k|   word3_muladd(&w1, &w0, &w2, x[6], y[14]);
 1172|   173k|   word3_muladd(&w1, &w0, &w2, x[7], y[13]);
 1173|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[12]);
 1174|   173k|   word3_muladd(&w1, &w0, &w2, x[9], y[11]);
 1175|   173k|   word3_muladd(&w1, &w0, &w2, x[10], y[10]);
 1176|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[9]);
 1177|   173k|   word3_muladd(&w1, &w0, &w2, x[12], y[8]);
 1178|   173k|   word3_muladd(&w1, &w0, &w2, x[13], y[7]);
 1179|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[6]);
 1180|   173k|   word3_muladd(&w1, &w0, &w2, x[15], y[5]);
 1181|   173k|   z[20] = w2;
 1182|   173k|   w2 = 0;
 1183|       |
 1184|   173k|   word3_muladd(&w2, &w1, &w0, x[6], y[15]);
 1185|   173k|   word3_muladd(&w2, &w1, &w0, x[7], y[14]);
 1186|   173k|   word3_muladd(&w2, &w1, &w0, x[8], y[13]);
 1187|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[12]);
 1188|   173k|   word3_muladd(&w2, &w1, &w0, x[10], y[11]);
 1189|   173k|   word3_muladd(&w2, &w1, &w0, x[11], y[10]);
 1190|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[9]);
 1191|   173k|   word3_muladd(&w2, &w1, &w0, x[13], y[8]);
 1192|   173k|   word3_muladd(&w2, &w1, &w0, x[14], y[7]);
 1193|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[6]);
 1194|   173k|   z[21] = w0;
 1195|   173k|   w0 = 0;
 1196|       |
 1197|   173k|   word3_muladd(&w0, &w2, &w1, x[7], y[15]);
 1198|   173k|   word3_muladd(&w0, &w2, &w1, x[8], y[14]);
 1199|   173k|   word3_muladd(&w0, &w2, &w1, x[9], y[13]);
 1200|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[12]);
 1201|   173k|   word3_muladd(&w0, &w2, &w1, x[11], y[11]);
 1202|   173k|   word3_muladd(&w0, &w2, &w1, x[12], y[10]);
 1203|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[9]);
 1204|   173k|   word3_muladd(&w0, &w2, &w1, x[14], y[8]);
 1205|   173k|   word3_muladd(&w0, &w2, &w1, x[15], y[7]);
 1206|   173k|   z[22] = w1;
 1207|   173k|   w1 = 0;
 1208|       |
 1209|   173k|   word3_muladd(&w1, &w0, &w2, x[8], y[15]);
 1210|   173k|   word3_muladd(&w1, &w0, &w2, x[9], y[14]);
 1211|   173k|   word3_muladd(&w1, &w0, &w2, x[10], y[13]);
 1212|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[12]);
 1213|   173k|   word3_muladd(&w1, &w0, &w2, x[12], y[11]);
 1214|   173k|   word3_muladd(&w1, &w0, &w2, x[13], y[10]);
 1215|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[9]);
 1216|   173k|   word3_muladd(&w1, &w0, &w2, x[15], y[8]);
 1217|   173k|   z[23] = w2;
 1218|   173k|   w2 = 0;
 1219|       |
 1220|   173k|   word3_muladd(&w2, &w1, &w0, x[9], y[15]);
 1221|   173k|   word3_muladd(&w2, &w1, &w0, x[10], y[14]);
 1222|   173k|   word3_muladd(&w2, &w1, &w0, x[11], y[13]);
 1223|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[12]);
 1224|   173k|   word3_muladd(&w2, &w1, &w0, x[13], y[11]);
 1225|   173k|   word3_muladd(&w2, &w1, &w0, x[14], y[10]);
 1226|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[9]);
 1227|   173k|   z[24] = w0;
 1228|   173k|   w0 = 0;
 1229|       |
 1230|   173k|   word3_muladd(&w0, &w2, &w1, x[10], y[15]);
 1231|   173k|   word3_muladd(&w0, &w2, &w1, x[11], y[14]);
 1232|   173k|   word3_muladd(&w0, &w2, &w1, x[12], y[13]);
 1233|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[12]);
 1234|   173k|   word3_muladd(&w0, &w2, &w1, x[14], y[11]);
 1235|   173k|   word3_muladd(&w0, &w2, &w1, x[15], y[10]);
 1236|   173k|   z[25] = w1;
 1237|   173k|   w1 = 0;
 1238|       |
 1239|   173k|   word3_muladd(&w1, &w0, &w2, x[11], y[15]);
 1240|   173k|   word3_muladd(&w1, &w0, &w2, x[12], y[14]);
 1241|   173k|   word3_muladd(&w1, &w0, &w2, x[13], y[13]);
 1242|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[12]);
 1243|   173k|   word3_muladd(&w1, &w0, &w2, x[15], y[11]);
 1244|   173k|   z[26] = w2;
 1245|   173k|   w2 = 0;
 1246|       |
 1247|   173k|   word3_muladd(&w2, &w1, &w0, x[12], y[15]);
 1248|   173k|   word3_muladd(&w2, &w1, &w0, x[13], y[14]);
 1249|   173k|   word3_muladd(&w2, &w1, &w0, x[14], y[13]);
 1250|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[12]);
 1251|   173k|   z[27] = w0;
 1252|   173k|   w0 = 0;
 1253|       |
 1254|   173k|   word3_muladd(&w0, &w2, &w1, x[13], y[15]);
 1255|   173k|   word3_muladd(&w0, &w2, &w1, x[14], y[14]);
 1256|   173k|   word3_muladd(&w0, &w2, &w1, x[15], y[13]);
 1257|   173k|   z[28] = w1;
 1258|   173k|   w1 = 0;
 1259|       |
 1260|   173k|   word3_muladd(&w1, &w0, &w2, x[14], y[15]);
 1261|   173k|   word3_muladd(&w1, &w0, &w2, x[15], y[14]);
 1262|   173k|   z[29] = w2;
 1263|   173k|   w2 = 0;
 1264|       |
 1265|   173k|   word3_muladd(&w2, &w1, &w0, x[15], y[15]);
 1266|   173k|   z[30] = w0;
 1267|   173k|   z[31] = w1;
 1268|   173k|}
_ZN5Botan18bigint_comba_mul24EPmPKmS2_:
 1721|      8|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) {
 1722|      8|   word w2 = 0, w1 = 0, w0 = 0;
 1723|       |
 1724|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[0]);
 1725|      8|   z[0] = w0;
 1726|      8|   w0 = 0;
 1727|       |
 1728|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[1]);
 1729|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[0]);
 1730|      8|   z[1] = w1;
 1731|      8|   w1 = 0;
 1732|       |
 1733|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[2]);
 1734|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[1]);
 1735|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[0]);
 1736|      8|   z[2] = w2;
 1737|      8|   w2 = 0;
 1738|       |
 1739|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[3]);
 1740|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[2]);
 1741|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[1]);
 1742|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[0]);
 1743|      8|   z[3] = w0;
 1744|      8|   w0 = 0;
 1745|       |
 1746|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[4]);
 1747|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[3]);
 1748|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[2]);
 1749|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[1]);
 1750|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[0]);
 1751|      8|   z[4] = w1;
 1752|      8|   w1 = 0;
 1753|       |
 1754|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[5]);
 1755|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[4]);
 1756|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[3]);
 1757|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[2]);
 1758|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[1]);
 1759|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[0]);
 1760|      8|   z[5] = w2;
 1761|      8|   w2 = 0;
 1762|       |
 1763|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[6]);
 1764|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[5]);
 1765|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[4]);
 1766|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[3]);
 1767|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[2]);
 1768|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[1]);
 1769|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[0]);
 1770|      8|   z[6] = w0;
 1771|      8|   w0 = 0;
 1772|       |
 1773|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[7]);
 1774|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[6]);
 1775|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[5]);
 1776|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[4]);
 1777|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[3]);
 1778|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[2]);
 1779|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[1]);
 1780|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[0]);
 1781|      8|   z[7] = w1;
 1782|      8|   w1 = 0;
 1783|       |
 1784|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[8]);
 1785|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[7]);
 1786|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[6]);
 1787|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[5]);
 1788|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[4]);
 1789|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[3]);
 1790|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[2]);
 1791|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[1]);
 1792|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[0]);
 1793|      8|   z[8] = w2;
 1794|      8|   w2 = 0;
 1795|       |
 1796|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[9]);
 1797|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[8]);
 1798|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[7]);
 1799|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[6]);
 1800|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[5]);
 1801|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[4]);
 1802|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[3]);
 1803|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[2]);
 1804|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[1]);
 1805|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[0]);
 1806|      8|   z[9] = w0;
 1807|      8|   w0 = 0;
 1808|       |
 1809|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[10]);
 1810|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[9]);
 1811|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[8]);
 1812|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[7]);
 1813|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[6]);
 1814|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[5]);
 1815|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[4]);
 1816|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[3]);
 1817|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[2]);
 1818|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[1]);
 1819|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[0]);
 1820|      8|   z[10] = w1;
 1821|      8|   w1 = 0;
 1822|       |
 1823|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[11]);
 1824|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[10]);
 1825|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[9]);
 1826|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[8]);
 1827|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[7]);
 1828|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[6]);
 1829|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[5]);
 1830|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[4]);
 1831|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[3]);
 1832|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[2]);
 1833|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[1]);
 1834|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[0]);
 1835|      8|   z[11] = w2;
 1836|      8|   w2 = 0;
 1837|       |
 1838|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[12]);
 1839|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[11]);
 1840|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[10]);
 1841|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[9]);
 1842|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[8]);
 1843|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[7]);
 1844|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[6]);
 1845|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[5]);
 1846|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[4]);
 1847|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[3]);
 1848|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[2]);
 1849|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[1]);
 1850|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[0]);
 1851|      8|   z[12] = w0;
 1852|      8|   w0 = 0;
 1853|       |
 1854|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[13]);
 1855|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[12]);
 1856|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[11]);
 1857|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[10]);
 1858|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[9]);
 1859|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[8]);
 1860|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[7]);
 1861|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[6]);
 1862|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[5]);
 1863|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[4]);
 1864|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[3]);
 1865|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[2]);
 1866|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[1]);
 1867|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[0]);
 1868|      8|   z[13] = w1;
 1869|      8|   w1 = 0;
 1870|       |
 1871|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[14]);
 1872|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[13]);
 1873|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[12]);
 1874|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[11]);
 1875|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[10]);
 1876|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[9]);
 1877|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[8]);
 1878|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[7]);
 1879|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[6]);
 1880|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[5]);
 1881|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[4]);
 1882|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[3]);
 1883|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[2]);
 1884|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[1]);
 1885|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[0]);
 1886|      8|   z[14] = w2;
 1887|      8|   w2 = 0;
 1888|       |
 1889|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[15]);
 1890|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[14]);
 1891|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[13]);
 1892|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[12]);
 1893|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[11]);
 1894|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[10]);
 1895|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[9]);
 1896|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[8]);
 1897|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[7]);
 1898|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[6]);
 1899|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[5]);
 1900|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[4]);
 1901|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[3]);
 1902|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[2]);
 1903|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[1]);
 1904|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[0]);
 1905|      8|   z[15] = w0;
 1906|      8|   w0 = 0;
 1907|       |
 1908|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[16]);
 1909|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[15]);
 1910|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[14]);
 1911|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[13]);
 1912|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[12]);
 1913|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[11]);
 1914|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[10]);
 1915|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[9]);
 1916|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[8]);
 1917|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[7]);
 1918|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[6]);
 1919|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[5]);
 1920|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[4]);
 1921|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[3]);
 1922|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[2]);
 1923|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[1]);
 1924|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[0]);
 1925|      8|   z[16] = w1;
 1926|      8|   w1 = 0;
 1927|       |
 1928|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[17]);
 1929|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[16]);
 1930|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[15]);
 1931|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[14]);
 1932|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[13]);
 1933|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[12]);
 1934|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[11]);
 1935|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[10]);
 1936|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[9]);
 1937|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[8]);
 1938|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[7]);
 1939|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[6]);
 1940|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[5]);
 1941|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[4]);
 1942|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[3]);
 1943|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[2]);
 1944|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[1]);
 1945|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[0]);
 1946|      8|   z[17] = w2;
 1947|      8|   w2 = 0;
 1948|       |
 1949|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[18]);
 1950|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[17]);
 1951|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[16]);
 1952|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[15]);
 1953|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[14]);
 1954|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[13]);
 1955|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[12]);
 1956|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[11]);
 1957|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[10]);
 1958|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[9]);
 1959|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[8]);
 1960|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[7]);
 1961|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[6]);
 1962|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[5]);
 1963|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[4]);
 1964|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[3]);
 1965|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[2]);
 1966|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[1]);
 1967|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[0]);
 1968|      8|   z[18] = w0;
 1969|      8|   w0 = 0;
 1970|       |
 1971|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[19]);
 1972|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[18]);
 1973|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[17]);
 1974|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[16]);
 1975|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[15]);
 1976|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[14]);
 1977|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[13]);
 1978|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[12]);
 1979|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[11]);
 1980|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[10]);
 1981|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[9]);
 1982|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[8]);
 1983|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[7]);
 1984|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[6]);
 1985|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[5]);
 1986|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[4]);
 1987|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[3]);
 1988|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[2]);
 1989|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[1]);
 1990|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[0]);
 1991|      8|   z[19] = w1;
 1992|      8|   w1 = 0;
 1993|       |
 1994|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[20]);
 1995|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[19]);
 1996|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[18]);
 1997|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[17]);
 1998|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[16]);
 1999|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[15]);
 2000|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[14]);
 2001|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[13]);
 2002|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[12]);
 2003|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[11]);
 2004|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[10]);
 2005|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[9]);
 2006|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[8]);
 2007|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[7]);
 2008|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[6]);
 2009|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[5]);
 2010|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[4]);
 2011|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[3]);
 2012|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[2]);
 2013|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[1]);
 2014|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[0]);
 2015|      8|   z[20] = w2;
 2016|      8|   w2 = 0;
 2017|       |
 2018|      8|   word3_muladd(&w2, &w1, &w0, x[0], y[21]);
 2019|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[20]);
 2020|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[19]);
 2021|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[18]);
 2022|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[17]);
 2023|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[16]);
 2024|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[15]);
 2025|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[14]);
 2026|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[13]);
 2027|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[12]);
 2028|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[11]);
 2029|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[10]);
 2030|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[9]);
 2031|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[8]);
 2032|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[7]);
 2033|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[6]);
 2034|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[5]);
 2035|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[4]);
 2036|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[3]);
 2037|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[2]);
 2038|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[1]);
 2039|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[0]);
 2040|      8|   z[21] = w0;
 2041|      8|   w0 = 0;
 2042|       |
 2043|      8|   word3_muladd(&w0, &w2, &w1, x[0], y[22]);
 2044|      8|   word3_muladd(&w0, &w2, &w1, x[1], y[21]);
 2045|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[20]);
 2046|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[19]);
 2047|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[18]);
 2048|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[17]);
 2049|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[16]);
 2050|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[15]);
 2051|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[14]);
 2052|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[13]);
 2053|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[12]);
 2054|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[11]);
 2055|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[10]);
 2056|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[9]);
 2057|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[8]);
 2058|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[7]);
 2059|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[6]);
 2060|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[5]);
 2061|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[4]);
 2062|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[3]);
 2063|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[2]);
 2064|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[1]);
 2065|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[0]);
 2066|      8|   z[22] = w1;
 2067|      8|   w1 = 0;
 2068|       |
 2069|      8|   word3_muladd(&w1, &w0, &w2, x[0], y[23]);
 2070|      8|   word3_muladd(&w1, &w0, &w2, x[1], y[22]);
 2071|      8|   word3_muladd(&w1, &w0, &w2, x[2], y[21]);
 2072|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[20]);
 2073|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[19]);
 2074|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[18]);
 2075|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[17]);
 2076|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[16]);
 2077|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[15]);
 2078|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[14]);
 2079|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[13]);
 2080|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[12]);
 2081|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[11]);
 2082|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[10]);
 2083|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[9]);
 2084|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[8]);
 2085|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[7]);
 2086|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[6]);
 2087|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[5]);
 2088|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[4]);
 2089|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[3]);
 2090|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[2]);
 2091|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[1]);
 2092|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[0]);
 2093|      8|   z[23] = w2;
 2094|      8|   w2 = 0;
 2095|       |
 2096|      8|   word3_muladd(&w2, &w1, &w0, x[1], y[23]);
 2097|      8|   word3_muladd(&w2, &w1, &w0, x[2], y[22]);
 2098|      8|   word3_muladd(&w2, &w1, &w0, x[3], y[21]);
 2099|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[20]);
 2100|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[19]);
 2101|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[18]);
 2102|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[17]);
 2103|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[16]);
 2104|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[15]);
 2105|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[14]);
 2106|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[13]);
 2107|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[12]);
 2108|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[11]);
 2109|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[10]);
 2110|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[9]);
 2111|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[8]);
 2112|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[7]);
 2113|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[6]);
 2114|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[5]);
 2115|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[4]);
 2116|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[3]);
 2117|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[2]);
 2118|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[1]);
 2119|      8|   z[24] = w0;
 2120|      8|   w0 = 0;
 2121|       |
 2122|      8|   word3_muladd(&w0, &w2, &w1, x[2], y[23]);
 2123|      8|   word3_muladd(&w0, &w2, &w1, x[3], y[22]);
 2124|      8|   word3_muladd(&w0, &w2, &w1, x[4], y[21]);
 2125|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[20]);
 2126|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[19]);
 2127|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[18]);
 2128|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[17]);
 2129|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[16]);
 2130|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[15]);
 2131|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[14]);
 2132|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[13]);
 2133|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[12]);
 2134|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[11]);
 2135|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[10]);
 2136|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[9]);
 2137|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[8]);
 2138|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[7]);
 2139|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[6]);
 2140|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[5]);
 2141|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[4]);
 2142|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[3]);
 2143|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[2]);
 2144|      8|   z[25] = w1;
 2145|      8|   w1 = 0;
 2146|       |
 2147|      8|   word3_muladd(&w1, &w0, &w2, x[3], y[23]);
 2148|      8|   word3_muladd(&w1, &w0, &w2, x[4], y[22]);
 2149|      8|   word3_muladd(&w1, &w0, &w2, x[5], y[21]);
 2150|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[20]);
 2151|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[19]);
 2152|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[18]);
 2153|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[17]);
 2154|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[16]);
 2155|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[15]);
 2156|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[14]);
 2157|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[13]);
 2158|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[12]);
 2159|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[11]);
 2160|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[10]);
 2161|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[9]);
 2162|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[8]);
 2163|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[7]);
 2164|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[6]);
 2165|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[5]);
 2166|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[4]);
 2167|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[3]);
 2168|      8|   z[26] = w2;
 2169|      8|   w2 = 0;
 2170|       |
 2171|      8|   word3_muladd(&w2, &w1, &w0, x[4], y[23]);
 2172|      8|   word3_muladd(&w2, &w1, &w0, x[5], y[22]);
 2173|      8|   word3_muladd(&w2, &w1, &w0, x[6], y[21]);
 2174|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[20]);
 2175|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[19]);
 2176|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[18]);
 2177|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[17]);
 2178|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[16]);
 2179|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[15]);
 2180|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[14]);
 2181|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[13]);
 2182|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[12]);
 2183|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[11]);
 2184|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[10]);
 2185|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[9]);
 2186|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[8]);
 2187|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[7]);
 2188|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[6]);
 2189|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[5]);
 2190|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[4]);
 2191|      8|   z[27] = w0;
 2192|      8|   w0 = 0;
 2193|       |
 2194|      8|   word3_muladd(&w0, &w2, &w1, x[5], y[23]);
 2195|      8|   word3_muladd(&w0, &w2, &w1, x[6], y[22]);
 2196|      8|   word3_muladd(&w0, &w2, &w1, x[7], y[21]);
 2197|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[20]);
 2198|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[19]);
 2199|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[18]);
 2200|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[17]);
 2201|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[16]);
 2202|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[15]);
 2203|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[14]);
 2204|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[13]);
 2205|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[12]);
 2206|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[11]);
 2207|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[10]);
 2208|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[9]);
 2209|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[8]);
 2210|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[7]);
 2211|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[6]);
 2212|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[5]);
 2213|      8|   z[28] = w1;
 2214|      8|   w1 = 0;
 2215|       |
 2216|      8|   word3_muladd(&w1, &w0, &w2, x[6], y[23]);
 2217|      8|   word3_muladd(&w1, &w0, &w2, x[7], y[22]);
 2218|      8|   word3_muladd(&w1, &w0, &w2, x[8], y[21]);
 2219|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[20]);
 2220|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[19]);
 2221|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[18]);
 2222|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[17]);
 2223|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[16]);
 2224|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[15]);
 2225|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[14]);
 2226|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[13]);
 2227|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[12]);
 2228|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[11]);
 2229|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[10]);
 2230|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[9]);
 2231|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[8]);
 2232|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[7]);
 2233|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[6]);
 2234|      8|   z[29] = w2;
 2235|      8|   w2 = 0;
 2236|       |
 2237|      8|   word3_muladd(&w2, &w1, &w0, x[7], y[23]);
 2238|      8|   word3_muladd(&w2, &w1, &w0, x[8], y[22]);
 2239|      8|   word3_muladd(&w2, &w1, &w0, x[9], y[21]);
 2240|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[20]);
 2241|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[19]);
 2242|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[18]);
 2243|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[17]);
 2244|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[16]);
 2245|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[15]);
 2246|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[14]);
 2247|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[13]);
 2248|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[12]);
 2249|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[11]);
 2250|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[10]);
 2251|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[9]);
 2252|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[8]);
 2253|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[7]);
 2254|      8|   z[30] = w0;
 2255|      8|   w0 = 0;
 2256|       |
 2257|      8|   word3_muladd(&w0, &w2, &w1, x[8], y[23]);
 2258|      8|   word3_muladd(&w0, &w2, &w1, x[9], y[22]);
 2259|      8|   word3_muladd(&w0, &w2, &w1, x[10], y[21]);
 2260|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[20]);
 2261|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[19]);
 2262|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[18]);
 2263|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[17]);
 2264|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[16]);
 2265|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[15]);
 2266|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[14]);
 2267|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[13]);
 2268|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[12]);
 2269|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[11]);
 2270|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[10]);
 2271|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[9]);
 2272|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[8]);
 2273|      8|   z[31] = w1;
 2274|      8|   w1 = 0;
 2275|       |
 2276|      8|   word3_muladd(&w1, &w0, &w2, x[9], y[23]);
 2277|      8|   word3_muladd(&w1, &w0, &w2, x[10], y[22]);
 2278|      8|   word3_muladd(&w1, &w0, &w2, x[11], y[21]);
 2279|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[20]);
 2280|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[19]);
 2281|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[18]);
 2282|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[17]);
 2283|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[16]);
 2284|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[15]);
 2285|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[14]);
 2286|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[13]);
 2287|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[12]);
 2288|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[11]);
 2289|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[10]);
 2290|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[9]);
 2291|      8|   z[32] = w2;
 2292|      8|   w2 = 0;
 2293|       |
 2294|      8|   word3_muladd(&w2, &w1, &w0, x[10], y[23]);
 2295|      8|   word3_muladd(&w2, &w1, &w0, x[11], y[22]);
 2296|      8|   word3_muladd(&w2, &w1, &w0, x[12], y[21]);
 2297|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[20]);
 2298|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[19]);
 2299|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[18]);
 2300|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[17]);
 2301|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[16]);
 2302|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[15]);
 2303|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[14]);
 2304|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[13]);
 2305|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[12]);
 2306|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[11]);
 2307|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[10]);
 2308|      8|   z[33] = w0;
 2309|      8|   w0 = 0;
 2310|       |
 2311|      8|   word3_muladd(&w0, &w2, &w1, x[11], y[23]);
 2312|      8|   word3_muladd(&w0, &w2, &w1, x[12], y[22]);
 2313|      8|   word3_muladd(&w0, &w2, &w1, x[13], y[21]);
 2314|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[20]);
 2315|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[19]);
 2316|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[18]);
 2317|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[17]);
 2318|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[16]);
 2319|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[15]);
 2320|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[14]);
 2321|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[13]);
 2322|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[12]);
 2323|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[11]);
 2324|      8|   z[34] = w1;
 2325|      8|   w1 = 0;
 2326|       |
 2327|      8|   word3_muladd(&w1, &w0, &w2, x[12], y[23]);
 2328|      8|   word3_muladd(&w1, &w0, &w2, x[13], y[22]);
 2329|      8|   word3_muladd(&w1, &w0, &w2, x[14], y[21]);
 2330|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[20]);
 2331|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[19]);
 2332|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[18]);
 2333|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[17]);
 2334|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[16]);
 2335|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[15]);
 2336|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[14]);
 2337|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[13]);
 2338|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[12]);
 2339|      8|   z[35] = w2;
 2340|      8|   w2 = 0;
 2341|       |
 2342|      8|   word3_muladd(&w2, &w1, &w0, x[13], y[23]);
 2343|      8|   word3_muladd(&w2, &w1, &w0, x[14], y[22]);
 2344|      8|   word3_muladd(&w2, &w1, &w0, x[15], y[21]);
 2345|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[20]);
 2346|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[19]);
 2347|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[18]);
 2348|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[17]);
 2349|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[16]);
 2350|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[15]);
 2351|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[14]);
 2352|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[13]);
 2353|      8|   z[36] = w0;
 2354|      8|   w0 = 0;
 2355|       |
 2356|      8|   word3_muladd(&w0, &w2, &w1, x[14], y[23]);
 2357|      8|   word3_muladd(&w0, &w2, &w1, x[15], y[22]);
 2358|      8|   word3_muladd(&w0, &w2, &w1, x[16], y[21]);
 2359|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[20]);
 2360|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[19]);
 2361|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[18]);
 2362|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[17]);
 2363|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[16]);
 2364|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[15]);
 2365|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[14]);
 2366|      8|   z[37] = w1;
 2367|      8|   w1 = 0;
 2368|       |
 2369|      8|   word3_muladd(&w1, &w0, &w2, x[15], y[23]);
 2370|      8|   word3_muladd(&w1, &w0, &w2, x[16], y[22]);
 2371|      8|   word3_muladd(&w1, &w0, &w2, x[17], y[21]);
 2372|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[20]);
 2373|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[19]);
 2374|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[18]);
 2375|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[17]);
 2376|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[16]);
 2377|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[15]);
 2378|      8|   z[38] = w2;
 2379|      8|   w2 = 0;
 2380|       |
 2381|      8|   word3_muladd(&w2, &w1, &w0, x[16], y[23]);
 2382|      8|   word3_muladd(&w2, &w1, &w0, x[17], y[22]);
 2383|      8|   word3_muladd(&w2, &w1, &w0, x[18], y[21]);
 2384|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[20]);
 2385|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[19]);
 2386|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[18]);
 2387|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[17]);
 2388|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[16]);
 2389|      8|   z[39] = w0;
 2390|      8|   w0 = 0;
 2391|       |
 2392|      8|   word3_muladd(&w0, &w2, &w1, x[17], y[23]);
 2393|      8|   word3_muladd(&w0, &w2, &w1, x[18], y[22]);
 2394|      8|   word3_muladd(&w0, &w2, &w1, x[19], y[21]);
 2395|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[20]);
 2396|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[19]);
 2397|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[18]);
 2398|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[17]);
 2399|      8|   z[40] = w1;
 2400|      8|   w1 = 0;
 2401|       |
 2402|      8|   word3_muladd(&w1, &w0, &w2, x[18], y[23]);
 2403|      8|   word3_muladd(&w1, &w0, &w2, x[19], y[22]);
 2404|      8|   word3_muladd(&w1, &w0, &w2, x[20], y[21]);
 2405|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[20]);
 2406|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[19]);
 2407|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[18]);
 2408|      8|   z[41] = w2;
 2409|      8|   w2 = 0;
 2410|       |
 2411|      8|   word3_muladd(&w2, &w1, &w0, x[19], y[23]);
 2412|      8|   word3_muladd(&w2, &w1, &w0, x[20], y[22]);
 2413|      8|   word3_muladd(&w2, &w1, &w0, x[21], y[21]);
 2414|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[20]);
 2415|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[19]);
 2416|      8|   z[42] = w0;
 2417|      8|   w0 = 0;
 2418|       |
 2419|      8|   word3_muladd(&w0, &w2, &w1, x[20], y[23]);
 2420|      8|   word3_muladd(&w0, &w2, &w1, x[21], y[22]);
 2421|      8|   word3_muladd(&w0, &w2, &w1, x[22], y[21]);
 2422|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[20]);
 2423|      8|   z[43] = w1;
 2424|      8|   w1 = 0;
 2425|       |
 2426|      8|   word3_muladd(&w1, &w0, &w2, x[21], y[23]);
 2427|      8|   word3_muladd(&w1, &w0, &w2, x[22], y[22]);
 2428|      8|   word3_muladd(&w1, &w0, &w2, x[23], y[21]);
 2429|      8|   z[44] = w2;
 2430|      8|   w2 = 0;
 2431|       |
 2432|      8|   word3_muladd(&w2, &w1, &w0, x[22], y[23]);
 2433|      8|   word3_muladd(&w2, &w1, &w0, x[23], y[22]);
 2434|      8|   z[45] = w0;
 2435|      8|   w0 = 0;
 2436|       |
 2437|      8|   word3_muladd(&w0, &w2, &w1, x[23], y[23]);
 2438|      8|   z[46] = w1;
 2439|      8|   z[47] = w2;
 2440|      8|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|   120k|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|   120k|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 120k]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|   120k|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|   120k|   clear_mem(z, z_size);
   28|       |
   29|  2.22M|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 2.10M, False: 120k]
  ------------------
   30|  2.10M|      const word y_i = y[i];
   31|       |
   32|  2.10M|      word carry = 0;
   33|       |
   34|  6.17M|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 4.06M, False: 2.10M]
  ------------------
   35|  4.06M|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|  4.06M|      }
   37|       |
   38|  4.87M|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 2.77M, False: 2.10M]
  ------------------
   39|  2.77M|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|  2.77M|      }
   41|       |
   42|  2.10M|      z[x_size + i] = carry;
   43|  2.10M|   }
   44|   120k|}
_ZN5Botan12basecase_sqrEPmmPKmm:
   46|  1.38k|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) {
   47|  1.38k|   if(z_size < 2 * x_size) {
  ------------------
  |  Branch (47:7): [True: 0, False: 1.38k]
  ------------------
   48|      0|      throw Invalid_Argument("basecase_sqr z_size too small");
   49|      0|   }
   50|       |
   51|  1.38k|   const size_t x_size_8 = x_size - (x_size % 8);
   52|       |
   53|  1.38k|   clear_mem(z, z_size);
   54|       |
   55|  5.52k|   for(size_t i = 0; i != x_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 4.14k, False: 1.38k]
  ------------------
   56|  4.14k|      const word x_i = x[i];
   57|       |
   58|  4.14k|      word carry = 0;
   59|       |
   60|  4.14k|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (60:25): [True: 0, False: 4.14k]
  ------------------
   61|      0|         carry = word8_madd3(z + i + j, x + j, x_i, carry);
   62|      0|      }
   63|       |
   64|  16.5k|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (64:32): [True: 12.4k, False: 4.14k]
  ------------------
   65|  12.4k|         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
   66|  12.4k|      }
   67|       |
   68|  4.14k|      z[x_size + i] = carry;
   69|  4.14k|   }
   70|  1.38k|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  291|  72.6M|                size_t ws_size) {
  292|  72.6M|   clear_mem(z, z_size);
  293|       |
  294|  72.6M|   if(x_sw == 1) {
  ------------------
  |  Branch (294:7): [True: 0, False: 72.6M]
  ------------------
  295|      0|      bigint_linmul3(z, y, y_sw, x[0]);
  296|  72.6M|   } else if(y_sw == 1) {
  ------------------
  |  Branch (296:14): [True: 0, False: 72.6M]
  ------------------
  297|      0|      bigint_linmul3(z, x, x_sw, y[0]);
  298|  72.6M|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (298:14): [True: 7.31M, False: 65.3M]
  ------------------
  299|  7.31M|      bigint_comba_mul4(z, x, y);
  300|  65.3M|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (300:14): [True: 16.2M, False: 49.1M]
  ------------------
  301|  16.2M|      bigint_comba_mul6(z, x, y);
  302|  49.1M|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (302:14): [True: 22.7M, False: 26.3M]
  ------------------
  303|  22.7M|      bigint_comba_mul8(z, x, y);
  304|  26.3M|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (304:14): [True: 26.1M, False: 201k]
  ------------------
  305|  26.1M|      bigint_comba_mul9(z, x, y);
  306|  26.1M|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (306:14): [True: 34.8k, False: 167k]
  ------------------
  307|  34.8k|      bigint_comba_mul16(z, x, y);
  308|   167k|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (308:14): [True: 8, False: 167k]
  ------------------
  309|      8|      bigint_comba_mul24(z, x, y);
  310|   167k|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || !workspace) {
  ------------------
  |  Branch (310:14): [True: 97.6k, False: 69.3k]
  |  Branch (310:53): [True: 34, False: 69.3k]
  |  Branch (310:92): [True: 0, False: 69.3k]
  ------------------
  311|  97.6k|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  312|  97.6k|   } else {
  313|  69.3k|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  314|       |
  315|  69.3k|      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (315:10): [True: 46.2k, False: 23.1k]
  |  Branch (315:15): [True: 46.2k, False: 0]
  |  Branch (315:34): [True: 46.2k, False: 0]
  ------------------
  316|  46.2k|         karatsuba_mul(z, x, y, N, workspace);
  317|  46.2k|      } else {
  318|  23.1k|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  319|  23.1k|      }
  320|  69.3k|   }
  321|  72.6M|}
_ZN5Botan10bigint_sqrEPmmPKmmmS0_m:
  326|  65.1M|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) {
  327|  65.1M|   clear_mem(z, z_size);
  328|       |
  329|  65.1M|   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
  ------------------
  |  |   51|  65.1M|   do {                                                                                 \
  |  |   52|  65.1M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 65.1M]
  |  |  ------------------
  |  |   53|  65.1M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  65.1M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  330|       |
  331|  65.1M|   if(x_sw == 1) {
  ------------------
  |  Branch (331:7): [True: 3.02k, False: 65.1M]
  ------------------
  332|  3.02k|      bigint_linmul3(z, x, x_sw, x[0]);
  333|  65.1M|   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (333:14): [True: 6.20M, False: 58.9M]
  ------------------
  334|  6.20M|      bigint_comba_sqr4(z, x);
  335|  58.9M|   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (335:14): [True: 13.8M, False: 45.1M]
  ------------------
  336|  13.8M|      bigint_comba_sqr6(z, x);
  337|  45.1M|   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (337:14): [True: 18.9M, False: 26.2M]
  ------------------
  338|  18.9M|      bigint_comba_sqr8(z, x);
  339|  26.2M|   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (339:14): [True: 26.1M, False: 116k]
  ------------------
  340|  26.1M|      bigint_comba_sqr9(z, x);
  341|  26.1M|   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (341:14): [True: 11.5k, False: 105k]
  ------------------
  342|  11.5k|      bigint_comba_sqr16(z, x);
  343|   105k|   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (343:14): [True: 0, False: 105k]
  ------------------
  344|      0|      bigint_comba_sqr24(z, x);
  345|   105k|   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || !workspace) {
  ------------------
  |  Branch (345:14): [True: 1.38k, False: 104k]
  |  Branch (345:53): [True: 0, False: 104k]
  ------------------
  346|  1.38k|      basecase_sqr(z, z_size, x, x_sw);
  347|   104k|   } else {
  348|   104k|      const size_t N = karatsuba_size(z_size, x_size, x_sw);
  349|       |
  350|   104k|      if(N && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (350:10): [True: 104k, False: 0]
  |  Branch (350:15): [True: 104k, False: 0]
  |  Branch (350:34): [True: 104k, False: 0]
  ------------------
  351|   104k|         karatsuba_sqr(z, x, N, workspace);
  352|   104k|      } else {
  353|      0|         basecase_sqr(z, z_size, x, x_sw);
  354|      0|      }
  355|   104k|   }
  356|  65.1M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmmmm:
  202|  69.3k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw, size_t y_size, size_t y_sw) {
  203|  69.3k|   if(x_sw > x_size || x_sw > y_size || y_sw > x_size || y_sw > y_size) {
  ------------------
  |  Branch (203:7): [True: 0, False: 69.3k]
  |  Branch (203:24): [True: 2, False: 69.3k]
  |  Branch (203:41): [True: 0, False: 69.3k]
  |  Branch (203:58): [True: 0, False: 69.3k]
  ------------------
  204|      2|      return 0;
  205|      2|   }
  206|       |
  207|  69.3k|   if(((x_size == x_sw) && (x_size % 2)) || ((y_size == y_sw) && (y_size % 2))) {
  ------------------
  |  Branch (207:8): [True: 5.78k, False: 63.5k]
  |  Branch (207:28): [True: 0, False: 5.78k]
  |  Branch (207:46): [True: 2, False: 69.3k]
  |  Branch (207:66): [True: 0, False: 2]
  ------------------
  208|      0|      return 0;
  209|      0|   }
  210|       |
  211|  69.3k|   const size_t start = (x_sw > y_sw) ? x_sw : y_sw;
  ------------------
  |  Branch (211:25): [True: 0, False: 69.3k]
  ------------------
  212|  69.3k|   const size_t end = (x_size < y_size) ? x_size : y_size;
  ------------------
  |  Branch (212:23): [True: 17.3k, False: 52.0k]
  ------------------
  213|       |
  214|  69.3k|   if(start == end) {
  ------------------
  |  Branch (214:7): [True: 5.78k, False: 63.5k]
  ------------------
  215|  5.78k|      if(start % 2) {
  ------------------
  |  Branch (215:10): [True: 0, False: 5.78k]
  ------------------
  216|      0|         return 0;
  217|      0|      }
  218|  5.78k|      return start;
  219|  5.78k|   }
  220|       |
  221|  86.6k|   for(size_t j = start; j <= end; ++j) {
  ------------------
  |  Branch (221:26): [True: 86.6k, False: 0]
  ------------------
  222|  86.6k|      if(j % 2) {
  ------------------
  |  Branch (222:10): [True: 23.1k, False: 63.5k]
  ------------------
  223|  23.1k|         continue;
  224|  23.1k|      }
  225|       |
  226|  63.5k|      if(2 * j > z_size) {
  ------------------
  |  Branch (226:10): [True: 23.1k, False: 40.4k]
  ------------------
  227|  23.1k|         return 0;
  228|  23.1k|      }
  229|       |
  230|  40.4k|      if(x_sw <= j && j <= x_size && y_sw <= j && j <= y_size) {
  ------------------
  |  Branch (230:10): [True: 40.4k, False: 0]
  |  Branch (230:23): [True: 40.4k, False: 0]
  |  Branch (230:38): [True: 40.4k, False: 0]
  |  Branch (230:51): [True: 40.4k, False: 0]
  ------------------
  231|  40.4k|         if(j % 4 == 2 && (j + 2) <= x_size && (j + 2) <= y_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (231:13): [True: 0, False: 40.4k]
  |  Branch (231:27): [True: 0, False: 0]
  |  Branch (231:48): [True: 0, False: 0]
  |  Branch (231:69): [True: 0, False: 0]
  ------------------
  232|      0|            return j + 2;
  233|      0|         }
  234|  40.4k|         return j;
  235|  40.4k|      }
  236|  40.4k|   }
  237|       |
  238|      0|   return 0;
  239|  63.5k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_mulEPmPKmS3_mS1_:
   80|   184k|void karatsuba_mul(word z[], const word x[], const word y[], size_t N, word workspace[]) {
   81|   184k|   if(N < KARATSUBA_MULTIPLY_THRESHOLD || N % 2) {
  ------------------
  |  Branch (81:7): [True: 138k, False: 46.2k]
  |  Branch (81:43): [True: 0, False: 46.2k]
  ------------------
   82|   138k|      switch(N) {
   83|      0|         case 6:
  ------------------
  |  Branch (83:10): [True: 0, False: 138k]
  ------------------
   84|      0|            return bigint_comba_mul6(z, x, y);
   85|      0|         case 8:
  ------------------
  |  Branch (85:10): [True: 0, False: 138k]
  ------------------
   86|      0|            return bigint_comba_mul8(z, x, y);
   87|      0|         case 9:
  ------------------
  |  Branch (87:10): [True: 0, False: 138k]
  ------------------
   88|      0|            return bigint_comba_mul9(z, x, y);
   89|   138k|         case 16:
  ------------------
  |  Branch (89:10): [True: 138k, False: 0]
  ------------------
   90|   138k|            return bigint_comba_mul16(z, x, y);
   91|      0|         case 24:
  ------------------
  |  Branch (91:10): [True: 0, False: 138k]
  ------------------
   92|      0|            return bigint_comba_mul24(z, x, y);
   93|      0|         default:
  ------------------
  |  Branch (93:10): [True: 0, False: 138k]
  ------------------
   94|      0|            return basecase_mul(z, 2 * N, x, N, y, N);
   95|   138k|      }
   96|   138k|   }
   97|       |
   98|  46.2k|   const size_t N2 = N / 2;
   99|       |
  100|  46.2k|   const word* x0 = x;
  101|  46.2k|   const word* x1 = x + N2;
  102|  46.2k|   const word* y0 = y;
  103|  46.2k|   const word* y1 = y + N2;
  104|  46.2k|   word* z0 = z;
  105|  46.2k|   word* z1 = z + N;
  106|       |
  107|  46.2k|   word* ws0 = workspace;
  108|  46.2k|   word* ws1 = workspace + N;
  109|       |
  110|  46.2k|   clear_mem(workspace, 2 * N);
  111|       |
  112|       |   /*
  113|       |   * If either of cmp0 or cmp1 is zero then z0 or z1 resp is zero here,
  114|       |   * resulting in a no-op - z0*z1 will be equal to zero so we don't need to do
  115|       |   * anything, clear_mem above already set the correct result.
  116|       |   *
  117|       |   * However we ignore the result of the comparisons and always perform the
  118|       |   * subtractions and recursively multiply to avoid the timing channel.
  119|       |   */
  120|       |
  121|       |   // First compute (X_lo - X_hi)*(Y_hi - Y_lo)
  122|  46.2k|   const auto cmp0 = bigint_sub_abs(z0, x0, x1, N2, workspace);
  123|  46.2k|   const auto cmp1 = bigint_sub_abs(z1, y1, y0, N2, workspace);
  124|  46.2k|   const auto neg_mask = ~(cmp0 ^ cmp1);
  125|       |
  126|  46.2k|   karatsuba_mul(ws0, z0, z1, N2, ws1);
  127|       |
  128|       |   // Compute X_lo * Y_lo
  129|  46.2k|   karatsuba_mul(z0, x0, y0, N2, ws1);
  130|       |
  131|       |   // Compute X_hi * Y_hi
  132|  46.2k|   karatsuba_mul(z1, x1, y1, N2, ws1);
  133|       |
  134|  46.2k|   const word ws_carry = bigint_add3_nc(ws1, z0, N, z1, N);
  135|  46.2k|   word z_carry = bigint_add2_nc(z + N2, N, ws1, N);
  136|       |
  137|  46.2k|   z_carry += bigint_add2_nc(z + N + N2, N2, &ws_carry, 1);
  138|  46.2k|   bigint_add2_nc(z + N + N2, N2, &z_carry, 1);
  139|       |
  140|  46.2k|   clear_mem(workspace + N, N2);
  141|       |
  142|  46.2k|   bigint_cnd_add_or_sub(neg_mask, z + N2, workspace, 2 * N - N2);
  143|  46.2k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmm:
  244|   104k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw) {
  245|   104k|   if(x_sw == x_size) {
  ------------------
  |  Branch (245:7): [True: 0, False: 104k]
  ------------------
  246|      0|      if(x_sw % 2) {
  ------------------
  |  Branch (246:10): [True: 0, False: 0]
  ------------------
  247|      0|         return 0;
  248|      0|      }
  249|      0|      return x_sw;
  250|      0|   }
  251|       |
  252|   104k|   for(size_t j = x_sw; j <= x_size; ++j) {
  ------------------
  |  Branch (252:25): [True: 104k, False: 0]
  ------------------
  253|   104k|      if(j % 2) {
  ------------------
  |  Branch (253:10): [True: 0, False: 104k]
  ------------------
  254|      0|         continue;
  255|      0|      }
  256|       |
  257|   104k|      if(2 * j > z_size) {
  ------------------
  |  Branch (257:10): [True: 0, False: 104k]
  ------------------
  258|      0|         return 0;
  259|      0|      }
  260|       |
  261|   104k|      if(j % 4 == 2 && (j + 2) <= x_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (261:10): [True: 0, False: 104k]
  |  Branch (261:24): [True: 0, False: 0]
  |  Branch (261:45): [True: 0, False: 0]
  ------------------
  262|      0|         return j + 2;
  263|      0|      }
  264|   104k|      return j;
  265|   104k|   }
  266|       |
  267|      0|   return 0;
  268|   104k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_sqrEPmPKmmS1_:
  148|   416k|void karatsuba_sqr(word z[], const word x[], size_t N, word workspace[]) {
  149|   416k|   if(N < KARATSUBA_SQUARE_THRESHOLD || N % 2) {
  ------------------
  |  Branch (149:7): [True: 312k, False: 104k]
  |  Branch (149:41): [True: 0, False: 104k]
  ------------------
  150|   312k|      switch(N) {
  151|      0|         case 6:
  ------------------
  |  Branch (151:10): [True: 0, False: 312k]
  ------------------
  152|      0|            return bigint_comba_sqr6(z, x);
  153|      0|         case 8:
  ------------------
  |  Branch (153:10): [True: 0, False: 312k]
  ------------------
  154|      0|            return bigint_comba_sqr8(z, x);
  155|      0|         case 9:
  ------------------
  |  Branch (155:10): [True: 0, False: 312k]
  ------------------
  156|      0|            return bigint_comba_sqr9(z, x);
  157|   312k|         case 16:
  ------------------
  |  Branch (157:10): [True: 312k, False: 0]
  ------------------
  158|   312k|            return bigint_comba_sqr16(z, x);
  159|      0|         case 24:
  ------------------
  |  Branch (159:10): [True: 0, False: 312k]
  ------------------
  160|      0|            return bigint_comba_sqr24(z, x);
  161|      0|         default:
  ------------------
  |  Branch (161:10): [True: 0, False: 312k]
  ------------------
  162|      0|            return basecase_sqr(z, 2 * N, x, N);
  163|   312k|      }
  164|   312k|   }
  165|       |
  166|   104k|   const size_t N2 = N / 2;
  167|       |
  168|   104k|   const word* x0 = x;
  169|   104k|   const word* x1 = x + N2;
  170|   104k|   word* z0 = z;
  171|   104k|   word* z1 = z + N;
  172|       |
  173|   104k|   word* ws0 = workspace;
  174|   104k|   word* ws1 = workspace + N;
  175|       |
  176|   104k|   clear_mem(workspace, 2 * N);
  177|       |
  178|       |   // See comment in karatsuba_mul
  179|   104k|   bigint_sub_abs(z0, x0, x1, N2, workspace);
  180|   104k|   karatsuba_sqr(ws0, z0, N2, ws1);
  181|       |
  182|   104k|   karatsuba_sqr(z0, x0, N2, ws1);
  183|   104k|   karatsuba_sqr(z1, x1, N2, ws1);
  184|       |
  185|   104k|   const word ws_carry = bigint_add3_nc(ws1, z0, N, z1, N);
  186|   104k|   word z_carry = bigint_add2_nc(z + N2, N, ws1, N);
  187|       |
  188|   104k|   z_carry += bigint_add2_nc(z + N + N2, N2, &ws_carry, 1);
  189|   104k|   bigint_add2_nc(z + N + N2, N2, &z_carry, 1);
  190|       |
  191|       |   /*
  192|       |   * This is only actually required if cmp (result of bigint_sub_abs) is != 0,
  193|       |   * however if cmp==0 then ws0[0:N] == 0 and avoiding the jump hides a
  194|       |   * timing channel.
  195|       |   */
  196|   104k|   bigint_sub2(z + N2, 2 * N - N2, ws0, N);
  197|   104k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  271|  72.6M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  72.6M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 7.35M, False: 65.3M]
  |  Branch (272:26): [True: 7.35M, False: 3.22k]
  |  Branch (272:42): [True: 7.31M, False: 36.8k]
  |  Branch (272:56): [True: 7.31M, False: 0]
  |  Branch (272:72): [True: 7.31M, False: 0]
  ------------------
  273|  72.6M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  271|  65.3M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  65.3M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 16.2M, False: 49.0M]
  |  Branch (272:26): [True: 16.2M, False: 3.22k]
  |  Branch (272:42): [True: 16.2M, False: 32.7k]
  |  Branch (272:56): [True: 16.2M, False: 0]
  |  Branch (272:72): [True: 16.2M, False: 5.52k]
  ------------------
  273|  65.3M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  271|  49.1M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  49.1M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 22.8M, False: 26.2M]
  |  Branch (272:26): [True: 22.8M, False: 3.22k]
  |  Branch (272:42): [True: 22.7M, False: 44.3k]
  |  Branch (272:56): [True: 22.7M, False: 0]
  |  Branch (272:72): [True: 22.7M, False: 11.2k]
  ------------------
  273|  49.1M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  271|  26.3M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|  26.3M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 26.2M, False: 127k]
  |  Branch (272:26): [True: 26.1M, False: 24.7k]
  |  Branch (272:42): [True: 26.1M, False: 26.1k]
  |  Branch (272:56): [True: 26.1M, False: 15.4k]
  |  Branch (272:72): [True: 26.1M, False: 7.94k]
  ------------------
  273|  26.3M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  271|   201k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|   201k|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 109k, False: 92.6k]
  |  Branch (272:26): [True: 83.4k, False: 25.7k]
  |  Branch (272:42): [True: 60.3k, False: 23.1k]
  |  Branch (272:56): [True: 44.8k, False: 15.5k]
  |  Branch (272:72): [True: 34.8k, False: 9.99k]
  ------------------
  273|   201k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  271|   167k|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  272|   167k|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (272:12): [True: 97.5k, False: 69.4k]
  |  Branch (272:26): [True: 50.5k, False: 47.0k]
  |  Branch (272:42): [True: 38.9k, False: 11.5k]
  |  Branch (272:56): [True: 34.6k, False: 4.29k]
  |  Branch (272:72): [True: 8, False: 34.6k]
  ------------------
  273|   167k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm:
  276|  65.1M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  65.1M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 6.20M, False: 58.9M]
  |  Branch (277:26): [True: 6.20M, False: 0]
  |  Branch (277:42): [True: 6.20M, False: 1.38k]
  ------------------
  278|  65.1M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm:
  276|  58.9M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  58.9M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 13.8M, False: 45.1M]
  |  Branch (277:26): [True: 13.8M, False: 0]
  |  Branch (277:42): [True: 13.8M, False: 1.38k]
  ------------------
  278|  58.9M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm:
  276|  45.1M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  45.1M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 18.9M, False: 26.2M]
  |  Branch (277:26): [True: 18.9M, False: 0]
  |  Branch (277:42): [True: 18.9M, False: 1.38k]
  ------------------
  278|  45.1M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm:
  276|  26.2M|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|  26.2M|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 26.1M, False: 115k]
  |  Branch (277:26): [True: 26.1M, False: 0]
  |  Branch (277:42): [True: 26.1M, False: 1.38k]
  ------------------
  278|  26.2M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm:
  276|   116k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   116k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 12.9k, False: 104k]
  |  Branch (277:26): [True: 11.5k, False: 1.38k]
  |  Branch (277:42): [True: 11.5k, False: 0]
  ------------------
  278|   116k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm:
  276|   105k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  277|   105k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (277:12): [True: 1.38k, False: 104k]
  |  Branch (277:26): [True: 0, False: 1.38k]
  |  Branch (277:42): [True: 0, False: 0]
  ------------------
  278|   105k|}

_ZN5Botan25bigint_monty_redc_genericEPmmPKmmmS0_:
   31|  1.61M|void bigint_monty_redc_generic(word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) {
   32|  1.61M|   BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
  ------------------
  |  |   30|  1.61M|   do {                                                          \
  |  |   31|  3.22M|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 1.61M, False: 0]
  |  |  |  Branch (31:12): [True: 1.61M, False: 0]
  |  |  ------------------
  |  |   32|  1.61M|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  1.61M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   33|       |
   34|  1.61M|   word w2 = 0, w1 = 0, w0 = 0;
   35|       |
   36|  1.61M|   w0 = z[0];
   37|       |
   38|  1.61M|   ws[0] = w0 * p_dash;
   39|       |
   40|  1.61M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   41|       |
   42|  1.61M|   w0 = w1;
   43|  1.61M|   w1 = w2;
   44|  1.61M|   w2 = 0;
   45|       |
   46|  14.5M|   for(size_t i = 1; i != p_size; ++i) {
  ------------------
  |  Branch (46:22): [True: 12.8M, False: 1.61M]
  ------------------
   47|  70.9M|      for(size_t j = 0; j < i; ++j) {
  ------------------
  |  Branch (47:25): [True: 58.0M, False: 12.8M]
  ------------------
   48|  58.0M|         word3_muladd(&w2, &w1, &w0, ws[j], p[i - j]);
   49|  58.0M|      }
   50|       |
   51|  12.8M|      word3_add(&w2, &w1, &w0, z[i]);
   52|       |
   53|  12.8M|      ws[i] = w0 * p_dash;
   54|       |
   55|  12.8M|      word3_muladd(&w2, &w1, &w0, ws[i], p[0]);
   56|       |
   57|  12.8M|      w0 = w1;
   58|  12.8M|      w1 = w2;
   59|  12.8M|      w2 = 0;
   60|  12.8M|   }
   61|       |
   62|  14.5M|   for(size_t i = 0; i != p_size - 1; ++i) {
  ------------------
  |  Branch (62:22): [True: 12.8M, False: 1.61M]
  ------------------
   63|  70.9M|      for(size_t j = i + 1; j != p_size; ++j) {
  ------------------
  |  Branch (63:29): [True: 58.0M, False: 12.8M]
  ------------------
   64|  58.0M|         word3_muladd(&w2, &w1, &w0, ws[j], p[p_size + i - j]);
   65|  58.0M|      }
   66|       |
   67|  12.8M|      word3_add(&w2, &w1, &w0, z[p_size + i]);
   68|       |
   69|  12.8M|      ws[i] = w0;
   70|       |
   71|  12.8M|      w0 = w1;
   72|  12.8M|      w1 = w2;
   73|  12.8M|      w2 = 0;
   74|  12.8M|   }
   75|       |
   76|  1.61M|   word3_add(&w2, &w1, &w0, z[2 * p_size - 1]);
   77|       |
   78|  1.61M|   ws[p_size - 1] = w0;
   79|  1.61M|   ws[p_size] = w1;
   80|       |
   81|       |   /*
   82|       |   * The result might need to be reduced mod p. To avoid a timing
   83|       |   * channel, always perform the subtraction. If in the compution
   84|       |   * of x - p a borrow is required then x was already < p.
   85|       |   *
   86|       |   * x starts at ws[0] and is p_size+1 bytes long.
   87|       |   * x - p starts at z[0] and is also p_size+1 bytes log
   88|       |   *
   89|       |   * If borrow was set then x was already < p and the subtraction
   90|       |   * was not needed. In that case overwrite z[0:p_size] with the
   91|       |   * original x in ws[0:p_size].
   92|       |   *
   93|       |   * We only copy out p_size in the final step because we know
   94|       |   * the Montgomery result is < P
   95|       |   */
   96|       |
   97|  1.61M|   word borrow = bigint_sub3(z, ws, p_size + 1, p, p_size);
   98|       |
   99|  1.61M|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  1.61M|      do {                          \
  |  |  100|  1.61M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  100|       |
  101|  1.61M|   CT::conditional_assign_mem(borrow, z, ws, p_size);
  102|  1.61M|   clear_mem(z + p_size, z_size - p_size);
  103|  1.61M|}

_ZN5Botan19bigint_monty_redc_4EPmPKmmS0_:
   14|  5.42M|void bigint_monty_redc_4(word z[8], const word p[4], word p_dash, word ws[]) {
   15|  5.42M|   word w2 = 0, w1 = 0, w0 = 0;
   16|  5.42M|   w0 = z[0];
   17|  5.42M|   ws[0] = w0 * p_dash;
   18|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   19|  5.42M|   w0 = w1;
   20|  5.42M|   w1 = w2;
   21|  5.42M|   w2 = 0;
   22|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
   23|  5.42M|   word3_add(&w2, &w1, &w0, z[1]);
   24|  5.42M|   ws[1] = w0 * p_dash;
   25|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
   26|  5.42M|   w0 = w1;
   27|  5.42M|   w1 = w2;
   28|  5.42M|   w2 = 0;
   29|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
   30|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
   31|  5.42M|   word3_add(&w2, &w1, &w0, z[2]);
   32|  5.42M|   ws[2] = w0 * p_dash;
   33|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
   34|  5.42M|   w0 = w1;
   35|  5.42M|   w1 = w2;
   36|  5.42M|   w2 = 0;
   37|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
   38|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
   39|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
   40|  5.42M|   word3_add(&w2, &w1, &w0, z[3]);
   41|  5.42M|   ws[3] = w0 * p_dash;
   42|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
   43|  5.42M|   w0 = w1;
   44|  5.42M|   w1 = w2;
   45|  5.42M|   w2 = 0;
   46|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
   47|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
   48|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
   49|  5.42M|   word3_add(&w2, &w1, &w0, z[4]);
   50|  5.42M|   ws[0] = w0;
   51|  5.42M|   w0 = w1;
   52|  5.42M|   w1 = w2;
   53|  5.42M|   w2 = 0;
   54|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
   55|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
   56|  5.42M|   word3_add(&w2, &w1, &w0, z[5]);
   57|  5.42M|   ws[1] = w0;
   58|  5.42M|   w0 = w1;
   59|  5.42M|   w1 = w2;
   60|  5.42M|   w2 = 0;
   61|  5.42M|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
   62|  5.42M|   word3_add(&w2, &w1, &w0, z[6]);
   63|  5.42M|   ws[2] = w0;
   64|  5.42M|   w0 = w1;
   65|  5.42M|   w1 = w2;
   66|  5.42M|   w2 = 0;
   67|  5.42M|   word3_add(&w2, &w1, &w0, z[7]);
   68|  5.42M|   ws[3] = w0;
   69|  5.42M|   ws[4] = w1;
   70|  5.42M|   word borrow = bigint_sub3(z, ws, 4 + 1, p, 4);
   71|  5.42M|   CT::conditional_assign_mem(borrow, z, ws, 4);
   72|  5.42M|   clear_mem(z + 4, 4);
   73|  5.42M|}
_ZN5Botan19bigint_monty_redc_6EPmPKmmS0_:
   75|  13.9M|void bigint_monty_redc_6(word z[12], const word p[6], word p_dash, word ws[]) {
   76|  13.9M|   word w2 = 0, w1 = 0, w0 = 0;
   77|  13.9M|   w0 = z[0];
   78|  13.9M|   ws[0] = w0 * p_dash;
   79|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
   80|  13.9M|   w0 = w1;
   81|  13.9M|   w1 = w2;
   82|  13.9M|   w2 = 0;
   83|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
   84|  13.9M|   word3_add(&w2, &w1, &w0, z[1]);
   85|  13.9M|   ws[1] = w0 * p_dash;
   86|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
   87|  13.9M|   w0 = w1;
   88|  13.9M|   w1 = w2;
   89|  13.9M|   w2 = 0;
   90|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
   91|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
   92|  13.9M|   word3_add(&w2, &w1, &w0, z[2]);
   93|  13.9M|   ws[2] = w0 * p_dash;
   94|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
   95|  13.9M|   w0 = w1;
   96|  13.9M|   w1 = w2;
   97|  13.9M|   w2 = 0;
   98|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
   99|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  100|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  101|  13.9M|   word3_add(&w2, &w1, &w0, z[3]);
  102|  13.9M|   ws[3] = w0 * p_dash;
  103|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  104|  13.9M|   w0 = w1;
  105|  13.9M|   w1 = w2;
  106|  13.9M|   w2 = 0;
  107|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  108|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  109|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  110|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  111|  13.9M|   word3_add(&w2, &w1, &w0, z[4]);
  112|  13.9M|   ws[4] = w0 * p_dash;
  113|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  114|  13.9M|   w0 = w1;
  115|  13.9M|   w1 = w2;
  116|  13.9M|   w2 = 0;
  117|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  118|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  119|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  120|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  121|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  122|  13.9M|   word3_add(&w2, &w1, &w0, z[5]);
  123|  13.9M|   ws[5] = w0 * p_dash;
  124|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  125|  13.9M|   w0 = w1;
  126|  13.9M|   w1 = w2;
  127|  13.9M|   w2 = 0;
  128|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  129|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  130|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  131|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  132|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  133|  13.9M|   word3_add(&w2, &w1, &w0, z[6]);
  134|  13.9M|   ws[0] = w0;
  135|  13.9M|   w0 = w1;
  136|  13.9M|   w1 = w2;
  137|  13.9M|   w2 = 0;
  138|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  139|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  140|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  141|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  142|  13.9M|   word3_add(&w2, &w1, &w0, z[7]);
  143|  13.9M|   ws[1] = w0;
  144|  13.9M|   w0 = w1;
  145|  13.9M|   w1 = w2;
  146|  13.9M|   w2 = 0;
  147|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  148|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  149|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  150|  13.9M|   word3_add(&w2, &w1, &w0, z[8]);
  151|  13.9M|   ws[2] = w0;
  152|  13.9M|   w0 = w1;
  153|  13.9M|   w1 = w2;
  154|  13.9M|   w2 = 0;
  155|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  156|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  157|  13.9M|   word3_add(&w2, &w1, &w0, z[9]);
  158|  13.9M|   ws[3] = w0;
  159|  13.9M|   w0 = w1;
  160|  13.9M|   w1 = w2;
  161|  13.9M|   w2 = 0;
  162|  13.9M|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  163|  13.9M|   word3_add(&w2, &w1, &w0, z[10]);
  164|  13.9M|   ws[4] = w0;
  165|  13.9M|   w0 = w1;
  166|  13.9M|   w1 = w2;
  167|  13.9M|   w2 = 0;
  168|  13.9M|   word3_add(&w2, &w1, &w0, z[11]);
  169|  13.9M|   ws[5] = w0;
  170|  13.9M|   ws[6] = w1;
  171|  13.9M|   word borrow = bigint_sub3(z, ws, 6 + 1, p, 6);
  172|  13.9M|   CT::conditional_assign_mem(borrow, z, ws, 6);
  173|  13.9M|   clear_mem(z + 6, 6);
  174|  13.9M|}
_ZN5Botan19bigint_monty_redc_8EPmPKmmS0_:
  176|  41.7M|void bigint_monty_redc_8(word z[16], const word p[8], word p_dash, word ws[]) {
  177|  41.7M|   word w2 = 0, w1 = 0, w0 = 0;
  178|  41.7M|   w0 = z[0];
  179|  41.7M|   ws[0] = w0 * p_dash;
  180|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
  181|  41.7M|   w0 = w1;
  182|  41.7M|   w1 = w2;
  183|  41.7M|   w2 = 0;
  184|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
  185|  41.7M|   word3_add(&w2, &w1, &w0, z[1]);
  186|  41.7M|   ws[1] = w0 * p_dash;
  187|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
  188|  41.7M|   w0 = w1;
  189|  41.7M|   w1 = w2;
  190|  41.7M|   w2 = 0;
  191|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
  192|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
  193|  41.7M|   word3_add(&w2, &w1, &w0, z[2]);
  194|  41.7M|   ws[2] = w0 * p_dash;
  195|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
  196|  41.7M|   w0 = w1;
  197|  41.7M|   w1 = w2;
  198|  41.7M|   w2 = 0;
  199|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
  200|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
  201|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
  202|  41.7M|   word3_add(&w2, &w1, &w0, z[3]);
  203|  41.7M|   ws[3] = w0 * p_dash;
  204|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
  205|  41.7M|   w0 = w1;
  206|  41.7M|   w1 = w2;
  207|  41.7M|   w2 = 0;
  208|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
  209|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
  210|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
  211|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
  212|  41.7M|   word3_add(&w2, &w1, &w0, z[4]);
  213|  41.7M|   ws[4] = w0 * p_dash;
  214|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
  215|  41.7M|   w0 = w1;
  216|  41.7M|   w1 = w2;
  217|  41.7M|   w2 = 0;
  218|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
  219|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
  220|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
  221|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
  222|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
  223|  41.7M|   word3_add(&w2, &w1, &w0, z[5]);
  224|  41.7M|   ws[5] = w0 * p_dash;
  225|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
  226|  41.7M|   w0 = w1;
  227|  41.7M|   w1 = w2;
  228|  41.7M|   w2 = 0;
  229|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
  230|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
  231|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
  232|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
  233|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
  234|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
  235|  41.7M|   word3_add(&w2, &w1, &w0, z[6]);
  236|  41.7M|   ws[6] = w0 * p_dash;
  237|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
  238|  41.7M|   w0 = w1;
  239|  41.7M|   w1 = w2;
  240|  41.7M|   w2 = 0;
  241|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
  242|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
  243|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
  244|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
  245|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
  246|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
  247|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
  248|  41.7M|   word3_add(&w2, &w1, &w0, z[7]);
  249|  41.7M|   ws[7] = w0 * p_dash;
  250|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
  251|  41.7M|   w0 = w1;
  252|  41.7M|   w1 = w2;
  253|  41.7M|   w2 = 0;
  254|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
  255|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
  256|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
  257|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
  258|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
  259|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
  260|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
  261|  41.7M|   word3_add(&w2, &w1, &w0, z[8]);
  262|  41.7M|   ws[0] = w0;
  263|  41.7M|   w0 = w1;
  264|  41.7M|   w1 = w2;
  265|  41.7M|   w2 = 0;
  266|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
  267|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
  268|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
  269|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
  270|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
  271|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
  272|  41.7M|   word3_add(&w2, &w1, &w0, z[9]);
  273|  41.7M|   ws[1] = w0;
  274|  41.7M|   w0 = w1;
  275|  41.7M|   w1 = w2;
  276|  41.7M|   w2 = 0;
  277|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
  278|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
  279|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
  280|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
  281|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
  282|  41.7M|   word3_add(&w2, &w1, &w0, z[10]);
  283|  41.7M|   ws[2] = w0;
  284|  41.7M|   w0 = w1;
  285|  41.7M|   w1 = w2;
  286|  41.7M|   w2 = 0;
  287|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
  288|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
  289|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
  290|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
  291|  41.7M|   word3_add(&w2, &w1, &w0, z[11]);
  292|  41.7M|   ws[3] = w0;
  293|  41.7M|   w0 = w1;
  294|  41.7M|   w1 = w2;
  295|  41.7M|   w2 = 0;
  296|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
  297|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
  298|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
  299|  41.7M|   word3_add(&w2, &w1, &w0, z[12]);
  300|  41.7M|   ws[4] = w0;
  301|  41.7M|   w0 = w1;
  302|  41.7M|   w1 = w2;
  303|  41.7M|   w2 = 0;
  304|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
  305|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
  306|  41.7M|   word3_add(&w2, &w1, &w0, z[13]);
  307|  41.7M|   ws[5] = w0;
  308|  41.7M|   w0 = w1;
  309|  41.7M|   w1 = w2;
  310|  41.7M|   w2 = 0;
  311|  41.7M|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
  312|  41.7M|   word3_add(&w2, &w1, &w0, z[14]);
  313|  41.7M|   ws[6] = w0;
  314|  41.7M|   w0 = w1;
  315|  41.7M|   w1 = w2;
  316|  41.7M|   w2 = 0;
  317|  41.7M|   word3_add(&w2, &w1, &w0, z[15]);
  318|  41.7M|   ws[7] = w0;
  319|  41.7M|   ws[8] = w1;
  320|  41.7M|   word borrow = bigint_sub3(z, ws, 8 + 1, p, 8);
  321|  41.7M|   CT::conditional_assign_mem(borrow, z, ws, 8);
  322|  41.7M|   clear_mem(z + 8, 8);
  323|  41.7M|}
_ZN5Botan20bigint_monty_redc_32EPmPKmmS0_:
 1567|   109k|void bigint_monty_redc_32(word z[64], const word p[32], word p_dash, word ws[]) {
 1568|   109k|   word w2 = 0, w1 = 0, w0 = 0;
 1569|   109k|   w0 = z[0];
 1570|   109k|   ws[0] = w0 * p_dash;
 1571|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[0]);
 1572|   109k|   w0 = w1;
 1573|   109k|   w1 = w2;
 1574|   109k|   w2 = 0;
 1575|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[1]);
 1576|   109k|   word3_add(&w2, &w1, &w0, z[1]);
 1577|   109k|   ws[1] = w0 * p_dash;
 1578|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[0]);
 1579|   109k|   w0 = w1;
 1580|   109k|   w1 = w2;
 1581|   109k|   w2 = 0;
 1582|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[2]);
 1583|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[1]);
 1584|   109k|   word3_add(&w2, &w1, &w0, z[2]);
 1585|   109k|   ws[2] = w0 * p_dash;
 1586|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[0]);
 1587|   109k|   w0 = w1;
 1588|   109k|   w1 = w2;
 1589|   109k|   w2 = 0;
 1590|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[3]);
 1591|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[2]);
 1592|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[1]);
 1593|   109k|   word3_add(&w2, &w1, &w0, z[3]);
 1594|   109k|   ws[3] = w0 * p_dash;
 1595|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[0]);
 1596|   109k|   w0 = w1;
 1597|   109k|   w1 = w2;
 1598|   109k|   w2 = 0;
 1599|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[4]);
 1600|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[3]);
 1601|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[2]);
 1602|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[1]);
 1603|   109k|   word3_add(&w2, &w1, &w0, z[4]);
 1604|   109k|   ws[4] = w0 * p_dash;
 1605|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[0]);
 1606|   109k|   w0 = w1;
 1607|   109k|   w1 = w2;
 1608|   109k|   w2 = 0;
 1609|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[5]);
 1610|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[4]);
 1611|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[3]);
 1612|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[2]);
 1613|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[1]);
 1614|   109k|   word3_add(&w2, &w1, &w0, z[5]);
 1615|   109k|   ws[5] = w0 * p_dash;
 1616|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[0]);
 1617|   109k|   w0 = w1;
 1618|   109k|   w1 = w2;
 1619|   109k|   w2 = 0;
 1620|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[6]);
 1621|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[5]);
 1622|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[4]);
 1623|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[3]);
 1624|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[2]);
 1625|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[1]);
 1626|   109k|   word3_add(&w2, &w1, &w0, z[6]);
 1627|   109k|   ws[6] = w0 * p_dash;
 1628|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[0]);
 1629|   109k|   w0 = w1;
 1630|   109k|   w1 = w2;
 1631|   109k|   w2 = 0;
 1632|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[7]);
 1633|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[6]);
 1634|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[5]);
 1635|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[4]);
 1636|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[3]);
 1637|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[2]);
 1638|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[1]);
 1639|   109k|   word3_add(&w2, &w1, &w0, z[7]);
 1640|   109k|   ws[7] = w0 * p_dash;
 1641|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[0]);
 1642|   109k|   w0 = w1;
 1643|   109k|   w1 = w2;
 1644|   109k|   w2 = 0;
 1645|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[8]);
 1646|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[7]);
 1647|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[6]);
 1648|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[5]);
 1649|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[4]);
 1650|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[3]);
 1651|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[2]);
 1652|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[1]);
 1653|   109k|   word3_add(&w2, &w1, &w0, z[8]);
 1654|   109k|   ws[8] = w0 * p_dash;
 1655|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[0]);
 1656|   109k|   w0 = w1;
 1657|   109k|   w1 = w2;
 1658|   109k|   w2 = 0;
 1659|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[9]);
 1660|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[8]);
 1661|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[7]);
 1662|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[6]);
 1663|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[5]);
 1664|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[4]);
 1665|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[3]);
 1666|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[2]);
 1667|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[1]);
 1668|   109k|   word3_add(&w2, &w1, &w0, z[9]);
 1669|   109k|   ws[9] = w0 * p_dash;
 1670|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[0]);
 1671|   109k|   w0 = w1;
 1672|   109k|   w1 = w2;
 1673|   109k|   w2 = 0;
 1674|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[10]);
 1675|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[9]);
 1676|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[8]);
 1677|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[7]);
 1678|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[6]);
 1679|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[5]);
 1680|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[4]);
 1681|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[3]);
 1682|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[2]);
 1683|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[1]);
 1684|   109k|   word3_add(&w2, &w1, &w0, z[10]);
 1685|   109k|   ws[10] = w0 * p_dash;
 1686|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[0]);
 1687|   109k|   w0 = w1;
 1688|   109k|   w1 = w2;
 1689|   109k|   w2 = 0;
 1690|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[11]);
 1691|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[10]);
 1692|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[9]);
 1693|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[8]);
 1694|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[7]);
 1695|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[6]);
 1696|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[5]);
 1697|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[4]);
 1698|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[3]);
 1699|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[2]);
 1700|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[1]);
 1701|   109k|   word3_add(&w2, &w1, &w0, z[11]);
 1702|   109k|   ws[11] = w0 * p_dash;
 1703|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[0]);
 1704|   109k|   w0 = w1;
 1705|   109k|   w1 = w2;
 1706|   109k|   w2 = 0;
 1707|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[12]);
 1708|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[11]);
 1709|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[10]);
 1710|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[9]);
 1711|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[8]);
 1712|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[7]);
 1713|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[6]);
 1714|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[5]);
 1715|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[4]);
 1716|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[3]);
 1717|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[2]);
 1718|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[1]);
 1719|   109k|   word3_add(&w2, &w1, &w0, z[12]);
 1720|   109k|   ws[12] = w0 * p_dash;
 1721|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[0]);
 1722|   109k|   w0 = w1;
 1723|   109k|   w1 = w2;
 1724|   109k|   w2 = 0;
 1725|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[13]);
 1726|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[12]);
 1727|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[11]);
 1728|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[10]);
 1729|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[9]);
 1730|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[8]);
 1731|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[7]);
 1732|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[6]);
 1733|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[5]);
 1734|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[4]);
 1735|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[3]);
 1736|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[2]);
 1737|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[1]);
 1738|   109k|   word3_add(&w2, &w1, &w0, z[13]);
 1739|   109k|   ws[13] = w0 * p_dash;
 1740|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[0]);
 1741|   109k|   w0 = w1;
 1742|   109k|   w1 = w2;
 1743|   109k|   w2 = 0;
 1744|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[14]);
 1745|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[13]);
 1746|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[12]);
 1747|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[11]);
 1748|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[10]);
 1749|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[9]);
 1750|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[8]);
 1751|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[7]);
 1752|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[6]);
 1753|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[5]);
 1754|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[4]);
 1755|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[3]);
 1756|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[2]);
 1757|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[1]);
 1758|   109k|   word3_add(&w2, &w1, &w0, z[14]);
 1759|   109k|   ws[14] = w0 * p_dash;
 1760|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[0]);
 1761|   109k|   w0 = w1;
 1762|   109k|   w1 = w2;
 1763|   109k|   w2 = 0;
 1764|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[15]);
 1765|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[14]);
 1766|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[13]);
 1767|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[12]);
 1768|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[11]);
 1769|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[10]);
 1770|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[9]);
 1771|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[8]);
 1772|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[7]);
 1773|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[6]);
 1774|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[5]);
 1775|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[4]);
 1776|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[3]);
 1777|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[2]);
 1778|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[1]);
 1779|   109k|   word3_add(&w2, &w1, &w0, z[15]);
 1780|   109k|   ws[15] = w0 * p_dash;
 1781|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[0]);
 1782|   109k|   w0 = w1;
 1783|   109k|   w1 = w2;
 1784|   109k|   w2 = 0;
 1785|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[16]);
 1786|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[15]);
 1787|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[14]);
 1788|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[13]);
 1789|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[12]);
 1790|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[11]);
 1791|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[10]);
 1792|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[9]);
 1793|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[8]);
 1794|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[7]);
 1795|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[6]);
 1796|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[5]);
 1797|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[4]);
 1798|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[3]);
 1799|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[2]);
 1800|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[1]);
 1801|   109k|   word3_add(&w2, &w1, &w0, z[16]);
 1802|   109k|   ws[16] = w0 * p_dash;
 1803|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[0]);
 1804|   109k|   w0 = w1;
 1805|   109k|   w1 = w2;
 1806|   109k|   w2 = 0;
 1807|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[17]);
 1808|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[16]);
 1809|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[15]);
 1810|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[14]);
 1811|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[13]);
 1812|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[12]);
 1813|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[11]);
 1814|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[10]);
 1815|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[9]);
 1816|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[8]);
 1817|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[7]);
 1818|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[6]);
 1819|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[5]);
 1820|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[4]);
 1821|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[3]);
 1822|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[2]);
 1823|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[1]);
 1824|   109k|   word3_add(&w2, &w1, &w0, z[17]);
 1825|   109k|   ws[17] = w0 * p_dash;
 1826|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[0]);
 1827|   109k|   w0 = w1;
 1828|   109k|   w1 = w2;
 1829|   109k|   w2 = 0;
 1830|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[18]);
 1831|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[17]);
 1832|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[16]);
 1833|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[15]);
 1834|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[14]);
 1835|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[13]);
 1836|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[12]);
 1837|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[11]);
 1838|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[10]);
 1839|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[9]);
 1840|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[8]);
 1841|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[7]);
 1842|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[6]);
 1843|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[5]);
 1844|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[4]);
 1845|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[3]);
 1846|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[2]);
 1847|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[1]);
 1848|   109k|   word3_add(&w2, &w1, &w0, z[18]);
 1849|   109k|   ws[18] = w0 * p_dash;
 1850|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[0]);
 1851|   109k|   w0 = w1;
 1852|   109k|   w1 = w2;
 1853|   109k|   w2 = 0;
 1854|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[19]);
 1855|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[18]);
 1856|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[17]);
 1857|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[16]);
 1858|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[15]);
 1859|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[14]);
 1860|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[13]);
 1861|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[12]);
 1862|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[11]);
 1863|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[10]);
 1864|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[9]);
 1865|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[8]);
 1866|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[7]);
 1867|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[6]);
 1868|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[5]);
 1869|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[4]);
 1870|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[3]);
 1871|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[2]);
 1872|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[1]);
 1873|   109k|   word3_add(&w2, &w1, &w0, z[19]);
 1874|   109k|   ws[19] = w0 * p_dash;
 1875|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[0]);
 1876|   109k|   w0 = w1;
 1877|   109k|   w1 = w2;
 1878|   109k|   w2 = 0;
 1879|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[20]);
 1880|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[19]);
 1881|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[18]);
 1882|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[17]);
 1883|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[16]);
 1884|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[15]);
 1885|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[14]);
 1886|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[13]);
 1887|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[12]);
 1888|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[11]);
 1889|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[10]);
 1890|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[9]);
 1891|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[8]);
 1892|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[7]);
 1893|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[6]);
 1894|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[5]);
 1895|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[4]);
 1896|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[3]);
 1897|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[2]);
 1898|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[1]);
 1899|   109k|   word3_add(&w2, &w1, &w0, z[20]);
 1900|   109k|   ws[20] = w0 * p_dash;
 1901|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[0]);
 1902|   109k|   w0 = w1;
 1903|   109k|   w1 = w2;
 1904|   109k|   w2 = 0;
 1905|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[21]);
 1906|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[20]);
 1907|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[19]);
 1908|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[18]);
 1909|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[17]);
 1910|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[16]);
 1911|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[15]);
 1912|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[14]);
 1913|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[13]);
 1914|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[12]);
 1915|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[11]);
 1916|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[10]);
 1917|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[9]);
 1918|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[8]);
 1919|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[7]);
 1920|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[6]);
 1921|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[5]);
 1922|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[4]);
 1923|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[3]);
 1924|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[2]);
 1925|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[1]);
 1926|   109k|   word3_add(&w2, &w1, &w0, z[21]);
 1927|   109k|   ws[21] = w0 * p_dash;
 1928|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[0]);
 1929|   109k|   w0 = w1;
 1930|   109k|   w1 = w2;
 1931|   109k|   w2 = 0;
 1932|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[22]);
 1933|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[21]);
 1934|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[20]);
 1935|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[19]);
 1936|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[18]);
 1937|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[17]);
 1938|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[16]);
 1939|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[15]);
 1940|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[14]);
 1941|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[13]);
 1942|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[12]);
 1943|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[11]);
 1944|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[10]);
 1945|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[9]);
 1946|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[8]);
 1947|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[7]);
 1948|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[6]);
 1949|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[5]);
 1950|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[4]);
 1951|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[3]);
 1952|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[2]);
 1953|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[1]);
 1954|   109k|   word3_add(&w2, &w1, &w0, z[22]);
 1955|   109k|   ws[22] = w0 * p_dash;
 1956|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[0]);
 1957|   109k|   w0 = w1;
 1958|   109k|   w1 = w2;
 1959|   109k|   w2 = 0;
 1960|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[23]);
 1961|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[22]);
 1962|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[21]);
 1963|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[20]);
 1964|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[19]);
 1965|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[18]);
 1966|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[17]);
 1967|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[16]);
 1968|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[15]);
 1969|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[14]);
 1970|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[13]);
 1971|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[12]);
 1972|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[11]);
 1973|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[10]);
 1974|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[9]);
 1975|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[8]);
 1976|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[7]);
 1977|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[6]);
 1978|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[5]);
 1979|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[4]);
 1980|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[3]);
 1981|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[2]);
 1982|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[1]);
 1983|   109k|   word3_add(&w2, &w1, &w0, z[23]);
 1984|   109k|   ws[23] = w0 * p_dash;
 1985|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[0]);
 1986|   109k|   w0 = w1;
 1987|   109k|   w1 = w2;
 1988|   109k|   w2 = 0;
 1989|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[24]);
 1990|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[23]);
 1991|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[22]);
 1992|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[21]);
 1993|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[20]);
 1994|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[19]);
 1995|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[18]);
 1996|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[17]);
 1997|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[16]);
 1998|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[15]);
 1999|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[14]);
 2000|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[13]);
 2001|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[12]);
 2002|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[11]);
 2003|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[10]);
 2004|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[9]);
 2005|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[8]);
 2006|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[7]);
 2007|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[6]);
 2008|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[5]);
 2009|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[4]);
 2010|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[3]);
 2011|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[2]);
 2012|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[1]);
 2013|   109k|   word3_add(&w2, &w1, &w0, z[24]);
 2014|   109k|   ws[24] = w0 * p_dash;
 2015|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[0]);
 2016|   109k|   w0 = w1;
 2017|   109k|   w1 = w2;
 2018|   109k|   w2 = 0;
 2019|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[25]);
 2020|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[24]);
 2021|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[23]);
 2022|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[22]);
 2023|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[21]);
 2024|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[20]);
 2025|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[19]);
 2026|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[18]);
 2027|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[17]);
 2028|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[16]);
 2029|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[15]);
 2030|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[14]);
 2031|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[13]);
 2032|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[12]);
 2033|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[11]);
 2034|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[10]);
 2035|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[9]);
 2036|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[8]);
 2037|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[7]);
 2038|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[6]);
 2039|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[5]);
 2040|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[4]);
 2041|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[3]);
 2042|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[2]);
 2043|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[1]);
 2044|   109k|   word3_add(&w2, &w1, &w0, z[25]);
 2045|   109k|   ws[25] = w0 * p_dash;
 2046|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[0]);
 2047|   109k|   w0 = w1;
 2048|   109k|   w1 = w2;
 2049|   109k|   w2 = 0;
 2050|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[26]);
 2051|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[25]);
 2052|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[24]);
 2053|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[23]);
 2054|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[22]);
 2055|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[21]);
 2056|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[20]);
 2057|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[19]);
 2058|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[18]);
 2059|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[17]);
 2060|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[16]);
 2061|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[15]);
 2062|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[14]);
 2063|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[13]);
 2064|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[12]);
 2065|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[11]);
 2066|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[10]);
 2067|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[9]);
 2068|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[8]);
 2069|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[7]);
 2070|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[6]);
 2071|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[5]);
 2072|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[4]);
 2073|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[3]);
 2074|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[2]);
 2075|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[1]);
 2076|   109k|   word3_add(&w2, &w1, &w0, z[26]);
 2077|   109k|   ws[26] = w0 * p_dash;
 2078|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[0]);
 2079|   109k|   w0 = w1;
 2080|   109k|   w1 = w2;
 2081|   109k|   w2 = 0;
 2082|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[27]);
 2083|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[26]);
 2084|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[25]);
 2085|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[24]);
 2086|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[23]);
 2087|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[22]);
 2088|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[21]);
 2089|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[20]);
 2090|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[19]);
 2091|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[18]);
 2092|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[17]);
 2093|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[16]);
 2094|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[15]);
 2095|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[14]);
 2096|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[13]);
 2097|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[12]);
 2098|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[11]);
 2099|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[10]);
 2100|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[9]);
 2101|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[8]);
 2102|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[7]);
 2103|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[6]);
 2104|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[5]);
 2105|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[4]);
 2106|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[3]);
 2107|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[2]);
 2108|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[1]);
 2109|   109k|   word3_add(&w2, &w1, &w0, z[27]);
 2110|   109k|   ws[27] = w0 * p_dash;
 2111|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[0]);
 2112|   109k|   w0 = w1;
 2113|   109k|   w1 = w2;
 2114|   109k|   w2 = 0;
 2115|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[28]);
 2116|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[27]);
 2117|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[26]);
 2118|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[25]);
 2119|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[24]);
 2120|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[23]);
 2121|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[22]);
 2122|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[21]);
 2123|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[20]);
 2124|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[19]);
 2125|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[18]);
 2126|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[17]);
 2127|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[16]);
 2128|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[15]);
 2129|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[14]);
 2130|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[13]);
 2131|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[12]);
 2132|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[11]);
 2133|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[10]);
 2134|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[9]);
 2135|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[8]);
 2136|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[7]);
 2137|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[6]);
 2138|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[5]);
 2139|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[4]);
 2140|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[3]);
 2141|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[2]);
 2142|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[1]);
 2143|   109k|   word3_add(&w2, &w1, &w0, z[28]);
 2144|   109k|   ws[28] = w0 * p_dash;
 2145|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[0]);
 2146|   109k|   w0 = w1;
 2147|   109k|   w1 = w2;
 2148|   109k|   w2 = 0;
 2149|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[29]);
 2150|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[28]);
 2151|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[27]);
 2152|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[26]);
 2153|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[25]);
 2154|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[24]);
 2155|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[23]);
 2156|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[22]);
 2157|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[21]);
 2158|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[20]);
 2159|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[19]);
 2160|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[18]);
 2161|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[17]);
 2162|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[16]);
 2163|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[15]);
 2164|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[14]);
 2165|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[13]);
 2166|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[12]);
 2167|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[11]);
 2168|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[10]);
 2169|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[9]);
 2170|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[8]);
 2171|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[7]);
 2172|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[6]);
 2173|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[5]);
 2174|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[4]);
 2175|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[3]);
 2176|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[2]);
 2177|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[1]);
 2178|   109k|   word3_add(&w2, &w1, &w0, z[29]);
 2179|   109k|   ws[29] = w0 * p_dash;
 2180|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[0]);
 2181|   109k|   w0 = w1;
 2182|   109k|   w1 = w2;
 2183|   109k|   w2 = 0;
 2184|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[30]);
 2185|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[29]);
 2186|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[28]);
 2187|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[27]);
 2188|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[26]);
 2189|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[25]);
 2190|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[24]);
 2191|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[23]);
 2192|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[22]);
 2193|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[21]);
 2194|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[20]);
 2195|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[19]);
 2196|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[18]);
 2197|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[17]);
 2198|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[16]);
 2199|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[15]);
 2200|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[14]);
 2201|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[13]);
 2202|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[12]);
 2203|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[11]);
 2204|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[10]);
 2205|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[9]);
 2206|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[8]);
 2207|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[7]);
 2208|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[6]);
 2209|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[5]);
 2210|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[4]);
 2211|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[3]);
 2212|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[2]);
 2213|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[1]);
 2214|   109k|   word3_add(&w2, &w1, &w0, z[30]);
 2215|   109k|   ws[30] = w0 * p_dash;
 2216|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[0]);
 2217|   109k|   w0 = w1;
 2218|   109k|   w1 = w2;
 2219|   109k|   w2 = 0;
 2220|   109k|   word3_muladd(&w2, &w1, &w0, ws[0], p[31]);
 2221|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[30]);
 2222|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[29]);
 2223|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[28]);
 2224|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[27]);
 2225|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[26]);
 2226|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[25]);
 2227|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[24]);
 2228|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[23]);
 2229|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[22]);
 2230|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[21]);
 2231|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[20]);
 2232|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[19]);
 2233|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[18]);
 2234|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[17]);
 2235|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[16]);
 2236|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[15]);
 2237|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[14]);
 2238|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[13]);
 2239|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[12]);
 2240|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[11]);
 2241|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[10]);
 2242|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[9]);
 2243|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[8]);
 2244|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[7]);
 2245|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[6]);
 2246|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[5]);
 2247|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[4]);
 2248|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[3]);
 2249|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[2]);
 2250|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[1]);
 2251|   109k|   word3_add(&w2, &w1, &w0, z[31]);
 2252|   109k|   ws[31] = w0 * p_dash;
 2253|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[0]);
 2254|   109k|   w0 = w1;
 2255|   109k|   w1 = w2;
 2256|   109k|   w2 = 0;
 2257|   109k|   word3_muladd(&w2, &w1, &w0, ws[1], p[31]);
 2258|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[30]);
 2259|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[29]);
 2260|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[28]);
 2261|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[27]);
 2262|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[26]);
 2263|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[25]);
 2264|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[24]);
 2265|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[23]);
 2266|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[22]);
 2267|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[21]);
 2268|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[20]);
 2269|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[19]);
 2270|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[18]);
 2271|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[17]);
 2272|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[16]);
 2273|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[15]);
 2274|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[14]);
 2275|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[13]);
 2276|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[12]);
 2277|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[11]);
 2278|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[10]);
 2279|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[9]);
 2280|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[8]);
 2281|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[7]);
 2282|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[6]);
 2283|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[5]);
 2284|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[4]);
 2285|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[3]);
 2286|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[2]);
 2287|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[1]);
 2288|   109k|   word3_add(&w2, &w1, &w0, z[32]);
 2289|   109k|   ws[0] = w0;
 2290|   109k|   w0 = w1;
 2291|   109k|   w1 = w2;
 2292|   109k|   w2 = 0;
 2293|   109k|   word3_muladd(&w2, &w1, &w0, ws[2], p[31]);
 2294|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[30]);
 2295|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[29]);
 2296|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[28]);
 2297|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[27]);
 2298|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[26]);
 2299|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[25]);
 2300|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[24]);
 2301|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[23]);
 2302|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[22]);
 2303|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[21]);
 2304|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[20]);
 2305|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[19]);
 2306|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[18]);
 2307|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[17]);
 2308|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[16]);
 2309|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[15]);
 2310|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[14]);
 2311|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[13]);
 2312|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[12]);
 2313|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[11]);
 2314|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[10]);
 2315|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[9]);
 2316|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[8]);
 2317|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[7]);
 2318|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[6]);
 2319|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[5]);
 2320|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[4]);
 2321|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[3]);
 2322|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[2]);
 2323|   109k|   word3_add(&w2, &w1, &w0, z[33]);
 2324|   109k|   ws[1] = w0;
 2325|   109k|   w0 = w1;
 2326|   109k|   w1 = w2;
 2327|   109k|   w2 = 0;
 2328|   109k|   word3_muladd(&w2, &w1, &w0, ws[3], p[31]);
 2329|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[30]);
 2330|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[29]);
 2331|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[28]);
 2332|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[27]);
 2333|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[26]);
 2334|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[25]);
 2335|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[24]);
 2336|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[23]);
 2337|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[22]);
 2338|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[21]);
 2339|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[20]);
 2340|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[19]);
 2341|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[18]);
 2342|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[17]);
 2343|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[16]);
 2344|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[15]);
 2345|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[14]);
 2346|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[13]);
 2347|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[12]);
 2348|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[11]);
 2349|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[10]);
 2350|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[9]);
 2351|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[8]);
 2352|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[7]);
 2353|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[6]);
 2354|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[5]);
 2355|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[4]);
 2356|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[3]);
 2357|   109k|   word3_add(&w2, &w1, &w0, z[34]);
 2358|   109k|   ws[2] = w0;
 2359|   109k|   w0 = w1;
 2360|   109k|   w1 = w2;
 2361|   109k|   w2 = 0;
 2362|   109k|   word3_muladd(&w2, &w1, &w0, ws[4], p[31]);
 2363|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[30]);
 2364|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[29]);
 2365|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[28]);
 2366|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[27]);
 2367|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[26]);
 2368|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[25]);
 2369|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[24]);
 2370|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[23]);
 2371|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[22]);
 2372|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[21]);
 2373|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[20]);
 2374|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[19]);
 2375|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[18]);
 2376|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[17]);
 2377|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[16]);
 2378|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[15]);
 2379|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[14]);
 2380|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[13]);
 2381|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[12]);
 2382|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[11]);
 2383|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[10]);
 2384|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[9]);
 2385|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[8]);
 2386|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[7]);
 2387|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[6]);
 2388|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[5]);
 2389|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[4]);
 2390|   109k|   word3_add(&w2, &w1, &w0, z[35]);
 2391|   109k|   ws[3] = w0;
 2392|   109k|   w0 = w1;
 2393|   109k|   w1 = w2;
 2394|   109k|   w2 = 0;
 2395|   109k|   word3_muladd(&w2, &w1, &w0, ws[5], p[31]);
 2396|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[30]);
 2397|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[29]);
 2398|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[28]);
 2399|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[27]);
 2400|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[26]);
 2401|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[25]);
 2402|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[24]);
 2403|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[23]);
 2404|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[22]);
 2405|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[21]);
 2406|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[20]);
 2407|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[19]);
 2408|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[18]);
 2409|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[17]);
 2410|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[16]);
 2411|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[15]);
 2412|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[14]);
 2413|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[13]);
 2414|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[12]);
 2415|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[11]);
 2416|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[10]);
 2417|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[9]);
 2418|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[8]);
 2419|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[7]);
 2420|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[6]);
 2421|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[5]);
 2422|   109k|   word3_add(&w2, &w1, &w0, z[36]);
 2423|   109k|   ws[4] = w0;
 2424|   109k|   w0 = w1;
 2425|   109k|   w1 = w2;
 2426|   109k|   w2 = 0;
 2427|   109k|   word3_muladd(&w2, &w1, &w0, ws[6], p[31]);
 2428|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[30]);
 2429|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[29]);
 2430|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[28]);
 2431|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[27]);
 2432|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[26]);
 2433|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[25]);
 2434|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[24]);
 2435|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[23]);
 2436|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[22]);
 2437|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[21]);
 2438|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[20]);
 2439|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[19]);
 2440|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[18]);
 2441|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[17]);
 2442|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[16]);
 2443|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[15]);
 2444|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[14]);
 2445|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[13]);
 2446|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[12]);
 2447|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[11]);
 2448|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[10]);
 2449|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[9]);
 2450|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[8]);
 2451|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[7]);
 2452|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[6]);
 2453|   109k|   word3_add(&w2, &w1, &w0, z[37]);
 2454|   109k|   ws[5] = w0;
 2455|   109k|   w0 = w1;
 2456|   109k|   w1 = w2;
 2457|   109k|   w2 = 0;
 2458|   109k|   word3_muladd(&w2, &w1, &w0, ws[7], p[31]);
 2459|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[30]);
 2460|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[29]);
 2461|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[28]);
 2462|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[27]);
 2463|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[26]);
 2464|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[25]);
 2465|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[24]);
 2466|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[23]);
 2467|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[22]);
 2468|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[21]);
 2469|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[20]);
 2470|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[19]);
 2471|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[18]);
 2472|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[17]);
 2473|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[16]);
 2474|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[15]);
 2475|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[14]);
 2476|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[13]);
 2477|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[12]);
 2478|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[11]);
 2479|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[10]);
 2480|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[9]);
 2481|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[8]);
 2482|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[7]);
 2483|   109k|   word3_add(&w2, &w1, &w0, z[38]);
 2484|   109k|   ws[6] = w0;
 2485|   109k|   w0 = w1;
 2486|   109k|   w1 = w2;
 2487|   109k|   w2 = 0;
 2488|   109k|   word3_muladd(&w2, &w1, &w0, ws[8], p[31]);
 2489|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[30]);
 2490|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[29]);
 2491|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[28]);
 2492|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[27]);
 2493|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[26]);
 2494|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[25]);
 2495|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[24]);
 2496|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[23]);
 2497|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[22]);
 2498|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[21]);
 2499|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[20]);
 2500|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[19]);
 2501|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[18]);
 2502|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[17]);
 2503|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[16]);
 2504|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[15]);
 2505|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[14]);
 2506|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[13]);
 2507|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[12]);
 2508|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[11]);
 2509|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[10]);
 2510|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[9]);
 2511|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[8]);
 2512|   109k|   word3_add(&w2, &w1, &w0, z[39]);
 2513|   109k|   ws[7] = w0;
 2514|   109k|   w0 = w1;
 2515|   109k|   w1 = w2;
 2516|   109k|   w2 = 0;
 2517|   109k|   word3_muladd(&w2, &w1, &w0, ws[9], p[31]);
 2518|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[30]);
 2519|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[29]);
 2520|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[28]);
 2521|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[27]);
 2522|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[26]);
 2523|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[25]);
 2524|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[24]);
 2525|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[23]);
 2526|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[22]);
 2527|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[21]);
 2528|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[20]);
 2529|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[19]);
 2530|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[18]);
 2531|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[17]);
 2532|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[16]);
 2533|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[15]);
 2534|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[14]);
 2535|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[13]);
 2536|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[12]);
 2537|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[11]);
 2538|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[10]);
 2539|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[9]);
 2540|   109k|   word3_add(&w2, &w1, &w0, z[40]);
 2541|   109k|   ws[8] = w0;
 2542|   109k|   w0 = w1;
 2543|   109k|   w1 = w2;
 2544|   109k|   w2 = 0;
 2545|   109k|   word3_muladd(&w2, &w1, &w0, ws[10], p[31]);
 2546|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[30]);
 2547|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[29]);
 2548|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[28]);
 2549|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[27]);
 2550|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[26]);
 2551|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[25]);
 2552|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[24]);
 2553|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[23]);
 2554|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[22]);
 2555|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[21]);
 2556|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[20]);
 2557|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[19]);
 2558|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[18]);
 2559|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[17]);
 2560|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[16]);
 2561|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[15]);
 2562|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[14]);
 2563|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[13]);
 2564|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[12]);
 2565|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[11]);
 2566|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[10]);
 2567|   109k|   word3_add(&w2, &w1, &w0, z[41]);
 2568|   109k|   ws[9] = w0;
 2569|   109k|   w0 = w1;
 2570|   109k|   w1 = w2;
 2571|   109k|   w2 = 0;
 2572|   109k|   word3_muladd(&w2, &w1, &w0, ws[11], p[31]);
 2573|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[30]);
 2574|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[29]);
 2575|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[28]);
 2576|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[27]);
 2577|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[26]);
 2578|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[25]);
 2579|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[24]);
 2580|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[23]);
 2581|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[22]);
 2582|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[21]);
 2583|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[20]);
 2584|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[19]);
 2585|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[18]);
 2586|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[17]);
 2587|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[16]);
 2588|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[15]);
 2589|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[14]);
 2590|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[13]);
 2591|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[12]);
 2592|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[11]);
 2593|   109k|   word3_add(&w2, &w1, &w0, z[42]);
 2594|   109k|   ws[10] = w0;
 2595|   109k|   w0 = w1;
 2596|   109k|   w1 = w2;
 2597|   109k|   w2 = 0;
 2598|   109k|   word3_muladd(&w2, &w1, &w0, ws[12], p[31]);
 2599|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[30]);
 2600|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[29]);
 2601|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[28]);
 2602|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[27]);
 2603|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[26]);
 2604|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[25]);
 2605|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[24]);
 2606|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[23]);
 2607|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[22]);
 2608|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[21]);
 2609|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[20]);
 2610|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[19]);
 2611|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[18]);
 2612|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[17]);
 2613|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[16]);
 2614|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[15]);
 2615|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[14]);
 2616|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[13]);
 2617|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[12]);
 2618|   109k|   word3_add(&w2, &w1, &w0, z[43]);
 2619|   109k|   ws[11] = w0;
 2620|   109k|   w0 = w1;
 2621|   109k|   w1 = w2;
 2622|   109k|   w2 = 0;
 2623|   109k|   word3_muladd(&w2, &w1, &w0, ws[13], p[31]);
 2624|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[30]);
 2625|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[29]);
 2626|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[28]);
 2627|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[27]);
 2628|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[26]);
 2629|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[25]);
 2630|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[24]);
 2631|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[23]);
 2632|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[22]);
 2633|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[21]);
 2634|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[20]);
 2635|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[19]);
 2636|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[18]);
 2637|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[17]);
 2638|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[16]);
 2639|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[15]);
 2640|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[14]);
 2641|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[13]);
 2642|   109k|   word3_add(&w2, &w1, &w0, z[44]);
 2643|   109k|   ws[12] = w0;
 2644|   109k|   w0 = w1;
 2645|   109k|   w1 = w2;
 2646|   109k|   w2 = 0;
 2647|   109k|   word3_muladd(&w2, &w1, &w0, ws[14], p[31]);
 2648|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[30]);
 2649|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[29]);
 2650|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[28]);
 2651|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[27]);
 2652|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[26]);
 2653|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[25]);
 2654|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[24]);
 2655|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[23]);
 2656|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[22]);
 2657|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[21]);
 2658|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[20]);
 2659|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[19]);
 2660|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[18]);
 2661|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[17]);
 2662|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[16]);
 2663|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[15]);
 2664|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[14]);
 2665|   109k|   word3_add(&w2, &w1, &w0, z[45]);
 2666|   109k|   ws[13] = w0;
 2667|   109k|   w0 = w1;
 2668|   109k|   w1 = w2;
 2669|   109k|   w2 = 0;
 2670|   109k|   word3_muladd(&w2, &w1, &w0, ws[15], p[31]);
 2671|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[30]);
 2672|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[29]);
 2673|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[28]);
 2674|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[27]);
 2675|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[26]);
 2676|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[25]);
 2677|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[24]);
 2678|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[23]);
 2679|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[22]);
 2680|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[21]);
 2681|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[20]);
 2682|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[19]);
 2683|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[18]);
 2684|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[17]);
 2685|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[16]);
 2686|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[15]);
 2687|   109k|   word3_add(&w2, &w1, &w0, z[46]);
 2688|   109k|   ws[14] = w0;
 2689|   109k|   w0 = w1;
 2690|   109k|   w1 = w2;
 2691|   109k|   w2 = 0;
 2692|   109k|   word3_muladd(&w2, &w1, &w0, ws[16], p[31]);
 2693|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[30]);
 2694|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[29]);
 2695|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[28]);
 2696|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[27]);
 2697|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[26]);
 2698|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[25]);
 2699|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[24]);
 2700|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[23]);
 2701|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[22]);
 2702|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[21]);
 2703|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[20]);
 2704|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[19]);
 2705|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[18]);
 2706|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[17]);
 2707|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[16]);
 2708|   109k|   word3_add(&w2, &w1, &w0, z[47]);
 2709|   109k|   ws[15] = w0;
 2710|   109k|   w0 = w1;
 2711|   109k|   w1 = w2;
 2712|   109k|   w2 = 0;
 2713|   109k|   word3_muladd(&w2, &w1, &w0, ws[17], p[31]);
 2714|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[30]);
 2715|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[29]);
 2716|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[28]);
 2717|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[27]);
 2718|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[26]);
 2719|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[25]);
 2720|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[24]);
 2721|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[23]);
 2722|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[22]);
 2723|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[21]);
 2724|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[20]);
 2725|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[19]);
 2726|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[18]);
 2727|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[17]);
 2728|   109k|   word3_add(&w2, &w1, &w0, z[48]);
 2729|   109k|   ws[16] = w0;
 2730|   109k|   w0 = w1;
 2731|   109k|   w1 = w2;
 2732|   109k|   w2 = 0;
 2733|   109k|   word3_muladd(&w2, &w1, &w0, ws[18], p[31]);
 2734|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[30]);
 2735|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[29]);
 2736|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[28]);
 2737|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[27]);
 2738|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[26]);
 2739|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[25]);
 2740|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[24]);
 2741|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[23]);
 2742|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[22]);
 2743|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[21]);
 2744|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[20]);
 2745|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[19]);
 2746|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[18]);
 2747|   109k|   word3_add(&w2, &w1, &w0, z[49]);
 2748|   109k|   ws[17] = w0;
 2749|   109k|   w0 = w1;
 2750|   109k|   w1 = w2;
 2751|   109k|   w2 = 0;
 2752|   109k|   word3_muladd(&w2, &w1, &w0, ws[19], p[31]);
 2753|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[30]);
 2754|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[29]);
 2755|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[28]);
 2756|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[27]);
 2757|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[26]);
 2758|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[25]);
 2759|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[24]);
 2760|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[23]);
 2761|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[22]);
 2762|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[21]);
 2763|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[20]);
 2764|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[19]);
 2765|   109k|   word3_add(&w2, &w1, &w0, z[50]);
 2766|   109k|   ws[18] = w0;
 2767|   109k|   w0 = w1;
 2768|   109k|   w1 = w2;
 2769|   109k|   w2 = 0;
 2770|   109k|   word3_muladd(&w2, &w1, &w0, ws[20], p[31]);
 2771|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[30]);
 2772|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[29]);
 2773|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[28]);
 2774|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[27]);
 2775|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[26]);
 2776|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[25]);
 2777|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[24]);
 2778|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[23]);
 2779|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[22]);
 2780|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[21]);
 2781|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[20]);
 2782|   109k|   word3_add(&w2, &w1, &w0, z[51]);
 2783|   109k|   ws[19] = w0;
 2784|   109k|   w0 = w1;
 2785|   109k|   w1 = w2;
 2786|   109k|   w2 = 0;
 2787|   109k|   word3_muladd(&w2, &w1, &w0, ws[21], p[31]);
 2788|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[30]);
 2789|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[29]);
 2790|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[28]);
 2791|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[27]);
 2792|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[26]);
 2793|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[25]);
 2794|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[24]);
 2795|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[23]);
 2796|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[22]);
 2797|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[21]);
 2798|   109k|   word3_add(&w2, &w1, &w0, z[52]);
 2799|   109k|   ws[20] = w0;
 2800|   109k|   w0 = w1;
 2801|   109k|   w1 = w2;
 2802|   109k|   w2 = 0;
 2803|   109k|   word3_muladd(&w2, &w1, &w0, ws[22], p[31]);
 2804|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[30]);
 2805|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[29]);
 2806|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[28]);
 2807|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[27]);
 2808|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[26]);
 2809|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[25]);
 2810|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[24]);
 2811|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[23]);
 2812|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[22]);
 2813|   109k|   word3_add(&w2, &w1, &w0, z[53]);
 2814|   109k|   ws[21] = w0;
 2815|   109k|   w0 = w1;
 2816|   109k|   w1 = w2;
 2817|   109k|   w2 = 0;
 2818|   109k|   word3_muladd(&w2, &w1, &w0, ws[23], p[31]);
 2819|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[30]);
 2820|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[29]);
 2821|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[28]);
 2822|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[27]);
 2823|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[26]);
 2824|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[25]);
 2825|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[24]);
 2826|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[23]);
 2827|   109k|   word3_add(&w2, &w1, &w0, z[54]);
 2828|   109k|   ws[22] = w0;
 2829|   109k|   w0 = w1;
 2830|   109k|   w1 = w2;
 2831|   109k|   w2 = 0;
 2832|   109k|   word3_muladd(&w2, &w1, &w0, ws[24], p[31]);
 2833|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[30]);
 2834|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[29]);
 2835|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[28]);
 2836|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[27]);
 2837|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[26]);
 2838|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[25]);
 2839|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[24]);
 2840|   109k|   word3_add(&w2, &w1, &w0, z[55]);
 2841|   109k|   ws[23] = w0;
 2842|   109k|   w0 = w1;
 2843|   109k|   w1 = w2;
 2844|   109k|   w2 = 0;
 2845|   109k|   word3_muladd(&w2, &w1, &w0, ws[25], p[31]);
 2846|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[30]);
 2847|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[29]);
 2848|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[28]);
 2849|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[27]);
 2850|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[26]);
 2851|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[25]);
 2852|   109k|   word3_add(&w2, &w1, &w0, z[56]);
 2853|   109k|   ws[24] = w0;
 2854|   109k|   w0 = w1;
 2855|   109k|   w1 = w2;
 2856|   109k|   w2 = 0;
 2857|   109k|   word3_muladd(&w2, &w1, &w0, ws[26], p[31]);
 2858|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[30]);
 2859|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[29]);
 2860|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[28]);
 2861|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[27]);
 2862|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[26]);
 2863|   109k|   word3_add(&w2, &w1, &w0, z[57]);
 2864|   109k|   ws[25] = w0;
 2865|   109k|   w0 = w1;
 2866|   109k|   w1 = w2;
 2867|   109k|   w2 = 0;
 2868|   109k|   word3_muladd(&w2, &w1, &w0, ws[27], p[31]);
 2869|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[30]);
 2870|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[29]);
 2871|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[28]);
 2872|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[27]);
 2873|   109k|   word3_add(&w2, &w1, &w0, z[58]);
 2874|   109k|   ws[26] = w0;
 2875|   109k|   w0 = w1;
 2876|   109k|   w1 = w2;
 2877|   109k|   w2 = 0;
 2878|   109k|   word3_muladd(&w2, &w1, &w0, ws[28], p[31]);
 2879|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[30]);
 2880|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[29]);
 2881|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[28]);
 2882|   109k|   word3_add(&w2, &w1, &w0, z[59]);
 2883|   109k|   ws[27] = w0;
 2884|   109k|   w0 = w1;
 2885|   109k|   w1 = w2;
 2886|   109k|   w2 = 0;
 2887|   109k|   word3_muladd(&w2, &w1, &w0, ws[29], p[31]);
 2888|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[30]);
 2889|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[29]);
 2890|   109k|   word3_add(&w2, &w1, &w0, z[60]);
 2891|   109k|   ws[28] = w0;
 2892|   109k|   w0 = w1;
 2893|   109k|   w1 = w2;
 2894|   109k|   w2 = 0;
 2895|   109k|   word3_muladd(&w2, &w1, &w0, ws[30], p[31]);
 2896|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[30]);
 2897|   109k|   word3_add(&w2, &w1, &w0, z[61]);
 2898|   109k|   ws[29] = w0;
 2899|   109k|   w0 = w1;
 2900|   109k|   w1 = w2;
 2901|   109k|   w2 = 0;
 2902|   109k|   word3_muladd(&w2, &w1, &w0, ws[31], p[31]);
 2903|   109k|   word3_add(&w2, &w1, &w0, z[62]);
 2904|   109k|   ws[30] = w0;
 2905|   109k|   w0 = w1;
 2906|   109k|   w1 = w2;
 2907|   109k|   w2 = 0;
 2908|   109k|   word3_add(&w2, &w1, &w0, z[63]);
 2909|   109k|   ws[31] = w0;
 2910|   109k|   ws[32] = w1;
 2911|   109k|   word borrow = bigint_sub3(z, ws, 32 + 1, p, 32);
 2912|   109k|   CT::conditional_assign_mem(borrow, z, ws, 32);
 2913|   109k|   clear_mem(z + 32, 32);
 2914|   109k|}

_ZN5Botan11inverse_modERKNS_6BigIntES2_:
  178|  36.1k|BigInt inverse_mod(const BigInt& n, const BigInt& mod) {
  179|  36.1k|   if(mod.is_zero()) {
  ------------------
  |  Branch (179:7): [True: 0, False: 36.1k]
  ------------------
  180|      0|      throw Invalid_Argument("inverse_mod modulus cannot be zero");
  181|      0|   }
  182|  36.1k|   if(mod.is_negative() || n.is_negative()) {
  ------------------
  |  Branch (182:7): [True: 0, False: 36.1k]
  |  Branch (182:28): [True: 0, False: 36.1k]
  ------------------
  183|      0|      throw Invalid_Argument("inverse_mod: arguments must be non-negative");
  184|      0|   }
  185|  36.1k|   if(n.is_zero() || (n.is_even() && mod.is_even())) {
  ------------------
  |  Branch (185:7): [True: 0, False: 36.1k]
  |  Branch (185:23): [True: 13.0k, False: 23.0k]
  |  Branch (185:38): [True: 0, False: 13.0k]
  ------------------
  186|      0|      return BigInt::zero();
  187|      0|   }
  188|       |
  189|  36.1k|   if(mod.is_odd()) {
  ------------------
  |  Branch (189:7): [True: 36.1k, False: 0]
  ------------------
  190|       |      /*
  191|       |      Fastpath for common case. This leaks if n is greater than mod or
  192|       |      not, but we don't guarantee const time behavior in that case.
  193|       |      */
  194|  36.1k|      if(n < mod) {
  ------------------
  |  Branch (194:10): [True: 36.1k, False: 0]
  ------------------
  195|  36.1k|         return inverse_mod_odd_modulus(n, mod);
  196|  36.1k|      } else {
  197|      0|         return inverse_mod_odd_modulus(ct_modulo(n, mod), mod);
  198|      0|      }
  199|  36.1k|   }
  200|       |
  201|       |   // If n is even and mod is even we already returned 0
  202|       |   // If n is even and mod is odd we jumped directly to odd-modulus algo
  203|      0|   BOTAN_DEBUG_ASSERT(n.is_odd());
  ------------------
  |  |   99|      0|      do {                          \
  |  |  100|      0|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  204|       |
  205|      0|   const size_t mod_lz = low_zero_bits(mod);
  206|      0|   BOTAN_ASSERT_NOMSG(mod_lz > 0);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  207|      0|   const size_t mod_bits = mod.bits();
  208|      0|   BOTAN_ASSERT_NOMSG(mod_bits > mod_lz);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|       |
  210|      0|   if(mod_lz == mod_bits - 1) {
  ------------------
  |  Branch (210:7): [True: 0, False: 0]
  ------------------
  211|       |      // In this case we are performing an inversion modulo 2^k
  212|      0|      return inverse_mod_pow2(n, mod_lz);
  213|      0|   }
  214|       |
  215|      0|   if(mod_lz == 1) {
  ------------------
  |  Branch (215:7): [True: 0, False: 0]
  ------------------
  216|       |      /*
  217|       |      Inversion modulo 2*o is an easier special case of CRT
  218|       |
  219|       |      This is exactly the main CRT flow below but taking advantage of
  220|       |      the fact that any odd number ^-1 modulo 2 is 1. As a result both
  221|       |      inv_2k and c can be taken to be 1, m2k is 2, and h is always
  222|       |      either 0 or 1, and its value depends only on the low bit of inv_o.
  223|       |
  224|       |      This is worth special casing because we generate RSA primes such
  225|       |      that phi(n) is of this form. However this only works for keys
  226|       |      that we generated in this way; pre-existing keys will typically
  227|       |      fall back to the general algorithm below.
  228|       |      */
  229|       |
  230|      0|      const BigInt o = mod >> 1;
  231|      0|      const BigInt n_redc = ct_modulo(n, o);
  232|      0|      const BigInt inv_o = inverse_mod_odd_modulus(n_redc, o);
  233|       |
  234|       |      // No modular inverse in this case:
  235|      0|      if(inv_o == 0) {
  ------------------
  |  Branch (235:10): [True: 0, False: 0]
  ------------------
  236|      0|         return BigInt::zero();
  237|      0|      }
  238|       |
  239|      0|      BigInt h = inv_o;
  240|      0|      h.ct_cond_add(!inv_o.get_bit(0), o);
  241|      0|      return h;
  242|      0|   }
  243|       |
  244|       |   /*
  245|       |   * In this case we are performing an inversion modulo 2^k*o for
  246|       |   * some k >= 2 and some odd (not necessarily prime) integer.
  247|       |   * Compute the inversions modulo 2^k and modulo o, then combine them
  248|       |   * using CRT, which is possible because 2^k and o are relatively prime.
  249|       |   */
  250|       |
  251|      0|   const BigInt o = mod >> mod_lz;
  252|      0|   const BigInt n_redc = ct_modulo(n, o);
  253|      0|   const BigInt inv_o = inverse_mod_odd_modulus(n_redc, o);
  254|      0|   const BigInt inv_2k = inverse_mod_pow2(n, mod_lz);
  255|       |
  256|       |   // No modular inverse in this case:
  257|      0|   if(inv_o == 0 || inv_2k == 0) {
  ------------------
  |  Branch (257:7): [True: 0, False: 0]
  |  Branch (257:21): [True: 0, False: 0]
  ------------------
  258|      0|      return BigInt::zero();
  259|      0|   }
  260|       |
  261|      0|   const BigInt m2k = BigInt::power_of_2(mod_lz);
  262|       |   // Compute the CRT parameter
  263|      0|   const BigInt c = inverse_mod_pow2(o, mod_lz);
  264|       |
  265|       |   // Compute h = c*(inv_2k-inv_o) mod 2^k
  266|      0|   BigInt h = c * (inv_2k - inv_o);
  267|      0|   const bool h_neg = h.is_negative();
  268|      0|   h.set_sign(BigInt::Positive);
  269|      0|   h.mask_bits(mod_lz);
  270|      0|   const bool h_nonzero = h.is_nonzero();
  271|      0|   h.ct_cond_assign(h_nonzero && h_neg, m2k - h);
  ------------------
  |  Branch (271:21): [True: 0, False: 0]
  |  Branch (271:34): [True: 0, False: 0]
  ------------------
  272|       |
  273|       |   // Return result inv_o + h * o
  274|      0|   h *= o;
  275|      0|   h += inv_o;
  276|      0|   return h;
  277|      0|}
mod_inv.cpp:_ZN5Botan12_GLOBAL__N_123inverse_mod_odd_modulusERKNS_6BigIntES3_:
   18|  36.1k|BigInt inverse_mod_odd_modulus(const BigInt& n, const BigInt& mod) {
   19|       |   // Caller should assure these preconditions:
   20|  36.1k|   BOTAN_DEBUG_ASSERT(n.is_positive());
  ------------------
  |  |   99|  36.1k|      do {                          \
  |  |  100|  36.1k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   21|  36.1k|   BOTAN_DEBUG_ASSERT(mod.is_positive());
  ------------------
  |  |   99|  36.1k|      do {                          \
  |  |  100|  36.1k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   22|  36.1k|   BOTAN_DEBUG_ASSERT(n < mod);
  ------------------
  |  |   99|  36.1k|      do {                          \
  |  |  100|  36.1k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   23|  36.1k|   BOTAN_DEBUG_ASSERT(mod >= 3 && mod.is_odd());
  ------------------
  |  |   99|  36.1k|      do {                          \
  |  |  100|  36.1k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   24|       |
   25|       |   /*
   26|       |   This uses a modular inversion algorithm designed by Niels Möller
   27|       |   and implemented in Nettle. The same algorithm was later also
   28|       |   adapted to GMP in mpn_sec_invert.
   29|       |
   30|       |   It can be easily implemented in a way that does not depend on
   31|       |   secret branches or memory lookups, providing resistance against
   32|       |   some forms of side channel attack.
   33|       |
   34|       |   There is also a description of the algorithm in Appendix 5 of "Fast
   35|       |   Software Polynomial Multiplication on ARM Processors using the NEON Engine"
   36|       |   by Danilo Câmara, Conrado P. L. Gouvêa, Julio López, and Ricardo
   37|       |   Dahab in LNCS 8182
   38|       |      https://conradoplg.cryptoland.net/files/2010/12/mocrysen13.pdf
   39|       |
   40|       |   Thanks to Niels for creating the algorithm, explaining some things
   41|       |   about it, and the reference to the paper.
   42|       |   */
   43|       |
   44|  36.1k|   const size_t mod_words = mod.sig_words();
   45|  36.1k|   BOTAN_ASSERT(mod_words > 0, "Not empty");
  ------------------
  |  |   51|  36.1k|   do {                                                                                 \
  |  |   52|  36.1k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 36.1k]
  |  |  ------------------
  |  |   53|  36.1k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  36.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   46|       |
   47|  36.1k|   secure_vector<word> tmp_mem(5 * mod_words);
   48|       |
   49|  36.1k|   word* v_w = &tmp_mem[0];
   50|  36.1k|   word* u_w = &tmp_mem[1 * mod_words];
   51|  36.1k|   word* b_w = &tmp_mem[2 * mod_words];
   52|  36.1k|   word* a_w = &tmp_mem[3 * mod_words];
   53|  36.1k|   word* mp1o2 = &tmp_mem[4 * mod_words];
   54|       |
   55|  36.1k|   CT::poison(tmp_mem.data(), tmp_mem.size());
   56|       |
   57|  36.1k|   copy_mem(a_w, n.data(), std::min(n.size(), mod_words));
   58|  36.1k|   copy_mem(b_w, mod.data(), std::min(mod.size(), mod_words));
   59|  36.1k|   u_w[0] = 1;
   60|       |   // v_w = 0
   61|       |
   62|       |   // compute (mod + 1) / 2 which [because mod is odd] is equal to
   63|       |   // (mod / 2) + 1
   64|  36.1k|   copy_mem(mp1o2, mod.data(), std::min(mod.size(), mod_words));
   65|  36.1k|   bigint_shr1(mp1o2, mod_words, 0, 1);
   66|  36.1k|   word carry = bigint_add2_nc(mp1o2, mod_words, u_w, 1);
   67|  36.1k|   BOTAN_ASSERT_NOMSG(carry == 0);
  ------------------
  |  |   60|  36.1k|   do {                                                                     \
  |  |   61|  36.1k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 36.1k]
  |  |  ------------------
  |  |   62|  36.1k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  36.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   68|       |
   69|       |   // Only n.bits() + mod.bits() iterations are required, but avoid leaking the size of n
   70|  36.1k|   const size_t execs = 2 * mod.bits();
   71|       |
   72|  30.8M|   for(size_t i = 0; i != execs; ++i) {
  ------------------
  |  Branch (72:22): [True: 30.8M, False: 36.1k]
  ------------------
   73|  30.8M|      const word odd_a = a_w[0] & 1;
   74|       |
   75|       |      //if(odd_a) a -= b
   76|  30.8M|      word underflow = bigint_cnd_sub(odd_a, a_w, b_w, mod_words);
   77|       |
   78|       |      //if(underflow) { b -= a; a = abs(a); swap(u, v); }
   79|  30.8M|      bigint_cnd_add(underflow, b_w, a_w, mod_words);
   80|  30.8M|      bigint_cnd_abs(underflow, a_w, mod_words);
   81|  30.8M|      bigint_cnd_swap(underflow, u_w, v_w, mod_words);
   82|       |
   83|       |      // a >>= 1
   84|  30.8M|      bigint_shr1(a_w, mod_words, 0, 1);
   85|       |
   86|       |      //if(odd_a) u -= v;
   87|  30.8M|      word borrow = bigint_cnd_sub(odd_a, u_w, v_w, mod_words);
   88|       |
   89|       |      // if(borrow) u += p
   90|  30.8M|      bigint_cnd_add(borrow, u_w, mod.data(), mod_words);
   91|       |
   92|  30.8M|      const word odd_u = u_w[0] & 1;
   93|       |
   94|       |      // u >>= 1
   95|  30.8M|      bigint_shr1(u_w, mod_words, 0, 1);
   96|       |
   97|       |      //if(odd_u) u += mp1o2;
   98|  30.8M|      bigint_cnd_add(odd_u, u_w, mp1o2, mod_words);
   99|  30.8M|   }
  100|       |
  101|  36.1k|   auto a_is_0 = CT::Mask<word>::set();
  102|   279k|   for(size_t i = 0; i != mod_words; ++i) {
  ------------------
  |  Branch (102:22): [True: 243k, False: 36.1k]
  ------------------
  103|   243k|      a_is_0 &= CT::Mask<word>::is_zero(a_w[i]);
  104|   243k|   }
  105|       |
  106|  36.1k|   auto b_is_1 = CT::Mask<word>::is_equal(b_w[0], 1);
  107|   243k|   for(size_t i = 1; i != mod_words; ++i) {
  ------------------
  |  Branch (107:22): [True: 207k, False: 36.1k]
  ------------------
  108|   207k|      b_is_1 &= CT::Mask<word>::is_zero(b_w[i]);
  109|   207k|   }
  110|       |
  111|  36.1k|   BOTAN_ASSERT(a_is_0.is_set(), "A is zero");
  ------------------
  |  |   51|  36.1k|   do {                                                                                 \
  |  |   52|  36.1k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 36.1k]
  |  |  ------------------
  |  |   53|  36.1k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  36.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  112|       |
  113|       |   // if b != 1 then gcd(n,mod) > 1 and inverse does not exist
  114|       |   // in which case zero out the result to indicate this
  115|  36.1k|   (~b_is_1).if_set_zero_out(v_w, mod_words);
  116|       |
  117|       |   /*
  118|       |   * We've placed the result in the lowest words of the temp buffer.
  119|       |   * So just clear out the other values and then give that buffer to a
  120|       |   * BigInt.
  121|       |   */
  122|  36.1k|   clear_mem(&tmp_mem[mod_words], 4 * mod_words);
  123|       |
  124|  36.1k|   CT::unpoison(tmp_mem.data(), tmp_mem.size());
  125|       |
  126|  36.1k|   BigInt r;
  127|  36.1k|   r.swap_reg(tmp_mem);
  128|  36.1k|   return r;
  129|  36.1k|}

_ZN5Botan13monty_inverseEm:
   16|  33.1k|word monty_inverse(word a) {
   17|  33.1k|   if(a % 2 == 0) {
  ------------------
  |  Branch (17:7): [True: 0, False: 33.1k]
  ------------------
   18|      0|      throw Invalid_Argument("monty_inverse only valid for odd integers");
   19|      0|   }
   20|       |
   21|       |   /*
   22|       |   * From "A New Algorithm for Inversion mod p^k" by Çetin Kaya Koç
   23|       |   * https://eprint.iacr.org/2017/411.pdf sections 5 and 7.
   24|       |   */
   25|       |
   26|  33.1k|   word b = 1;
   27|  33.1k|   word r = 0;
   28|       |
   29|  2.15M|   for(size_t i = 0; i != BOTAN_MP_WORD_BITS; ++i) {
  ------------------
  |  |   50|  2.15M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (29:22): [True: 2.11M, False: 33.1k]
  ------------------
   30|  2.11M|      const word bi = b % 2;
   31|  2.11M|      r >>= 1;
   32|  2.11M|      r += bi << (BOTAN_MP_WORD_BITS - 1);
  ------------------
  |  |   50|  2.11M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   33|       |
   34|  2.11M|      b -= a * bi;
   35|  2.11M|      b >>= 1;
   36|  2.11M|   }
   37|       |
   38|       |   // Now invert in addition space
   39|  33.1k|   r = (MP_WORD_MAX - r) + 1;
   40|       |
   41|  33.1k|   return r;
   42|  33.1k|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_15Modular_ReducerE:
   44|  21.5k|Montgomery_Params::Montgomery_Params(const BigInt& p, const Modular_Reducer& mod_p) {
   45|  21.5k|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (45:7): [True: 0, False: 21.5k]
  |  Branch (45:22): [True: 0, False: 21.5k]
  ------------------
   46|      0|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   47|      0|   }
   48|       |
   49|  21.5k|   m_p = p;
   50|  21.5k|   m_p_words = m_p.sig_words();
   51|  21.5k|   m_p_dash = monty_inverse(m_p.word_at(0));
   52|       |
   53|  21.5k|   const BigInt r = BigInt::power_of_2(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|  21.5k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   54|       |
   55|  21.5k|   m_r1 = mod_p.reduce(r);
   56|  21.5k|   m_r2 = mod_p.square(m_r1);
   57|  21.5k|   m_r3 = mod_p.multiply(m_r1, m_r2);
   58|  21.5k|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntE:
   60|  11.5k|Montgomery_Params::Montgomery_Params(const BigInt& p) {
   61|  11.5k|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (61:7): [True: 0, False: 11.5k]
  |  Branch (61:22): [True: 0, False: 11.5k]
  ------------------
   62|      0|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   63|      0|   }
   64|       |
   65|  11.5k|   m_p = p;
   66|  11.5k|   m_p_words = m_p.sig_words();
   67|  11.5k|   m_p_dash = monty_inverse(m_p.word_at(0));
   68|       |
   69|  11.5k|   const BigInt r = BigInt::power_of_2(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|  11.5k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   70|       |
   71|       |   // It might be faster to use ct_modulo here vs setting up Barrett reduction?
   72|  11.5k|   Modular_Reducer mod_p(p);
   73|       |
   74|  11.5k|   m_r1 = mod_p.reduce(r);
   75|  11.5k|   m_r2 = mod_p.square(m_r1);
   76|  11.5k|   m_r3 = mod_p.multiply(m_r1, m_r2);
   77|  11.5k|}
_ZNK5Botan17Montgomery_Params4redcERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   84|  15.7k|BigInt Montgomery_Params::redc(const BigInt& x, secure_vector<word>& ws) const {
   85|  15.7k|   const size_t output_size = m_p_words + 1;
   86|       |
   87|  15.7k|   if(ws.size() < output_size) {
  ------------------
  |  Branch (87:7): [True: 15.7k, False: 0]
  ------------------
   88|  15.7k|      ws.resize(output_size);
   89|  15.7k|   }
   90|       |
   91|  15.7k|   BigInt z = x;
   92|  15.7k|   z.grow_to(2 * m_p_words);
   93|       |
   94|  15.7k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
   95|       |
   96|  15.7k|   return z;
   97|  15.7k|}
_ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   99|   155k|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  100|   155k|   const size_t output_size = 2 * m_p_words + 2;
  101|       |
  102|   155k|   if(ws.size() < output_size) {
  ------------------
  |  Branch (102:7): [True: 155k, False: 0]
  ------------------
  103|   155k|      ws.resize(output_size);
  104|   155k|   }
  105|       |
  106|   155k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|   155k|      do {                          \
  |  |  100|   155k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  107|   155k|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|   155k|      do {                          \
  |  |  100|   155k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  108|       |
  109|   155k|   BigInt z = BigInt::with_capacity(output_size);
  110|   155k|   bigint_mul(z.mutable_data(),
  111|   155k|              z.size(),
  112|   155k|              x.data(),
  113|   155k|              x.size(),
  114|   155k|              std::min(m_p_words, x.size()),
  115|   155k|              y.data(),
  116|   155k|              y.size(),
  117|   155k|              std::min(m_p_words, y.size()),
  118|   155k|              ws.data(),
  119|   155k|              ws.size());
  120|       |
  121|   155k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  122|       |
  123|   155k|   return z;
  124|   155k|}
_ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  182|   583k|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  183|   583k|   const size_t output_size = 2 * m_p_words;
  184|       |
  185|   583k|   if(ws.size() < 2 * output_size) {
  ------------------
  |  Branch (185:7): [True: 0, False: 583k]
  ------------------
  186|      0|      ws.resize(2 * output_size);
  187|      0|   }
  188|       |
  189|   583k|   word* z_data = &ws[0];
  190|   583k|   word* ws_data = &ws[output_size];
  191|       |
  192|   583k|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|   583k|      do {                          \
  |  |  100|   583k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  193|       |
  194|   583k|   bigint_mul(z_data,
  195|   583k|              output_size,
  196|   583k|              x.data(),
  197|   583k|              x.size(),
  198|   583k|              std::min(m_p_words, x.size()),
  199|   583k|              y.data(),
  200|   583k|              y.size(),
  201|   583k|              std::min(m_p_words, y.size()),
  202|   583k|              ws_data,
  203|   583k|              output_size);
  204|       |
  205|   583k|   bigint_monty_redc(z_data, m_p.data(), m_p_words, m_p_dash, ws_data, output_size);
  206|       |
  207|   583k|   if(x.size() < output_size) {
  ------------------
  |  Branch (207:7): [True: 0, False: 583k]
  ------------------
  208|      0|      x.grow_to(output_size);
  209|      0|   }
  210|   583k|   copy_mem(x.mutable_data(), z_data, output_size);
  211|   583k|}
_ZNK5Botan17Montgomery_Params11square_thisERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  231|  4.41M|void Montgomery_Params::square_this(BigInt& x, secure_vector<word>& ws) const {
  232|  4.41M|   const size_t output_size = 2 * m_p_words;
  233|       |
  234|  4.41M|   if(ws.size() < 2 * output_size) {
  ------------------
  |  Branch (234:7): [True: 15.7k, False: 4.40M]
  ------------------
  235|  15.7k|      ws.resize(2 * output_size);
  236|  15.7k|   }
  237|       |
  238|  4.41M|   word* z_data = &ws[0];
  239|  4.41M|   word* ws_data = &ws[output_size];
  240|       |
  241|  4.41M|   BOTAN_DEBUG_ASSERT(x.sig_words() <= m_p_words);
  ------------------
  |  |   99|  4.41M|      do {                          \
  |  |  100|  4.41M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  242|       |
  243|  4.41M|   bigint_sqr(z_data, output_size, x.data(), x.size(), std::min(m_p_words, x.size()), ws_data, output_size);
  244|       |
  245|  4.41M|   bigint_monty_redc(z_data, m_p.data(), m_p_words, m_p_dash, ws_data, output_size);
  246|       |
  247|  4.41M|   if(x.size() < output_size) {
  ------------------
  |  Branch (247:7): [True: 0, False: 4.41M]
  ------------------
  248|      0|      x.grow_to(output_size);
  249|      0|   }
  250|  4.41M|   copy_mem(x.mutable_data(), z_data, output_size);
  251|  4.41M|}
_ZN5Botan14Montgomery_IntC2ERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEb:
  256|   171k|      m_params(params) {
  257|   171k|   if(redc_needed == false) {
  ------------------
  |  Branch (257:7): [True: 155k, False: 15.7k]
  ------------------
  258|   155k|      m_v = v;
  259|   155k|   } else {
  260|  15.7k|      BOTAN_ASSERT_NOMSG(m_v < m_params->p());
  ------------------
  |  |   60|  15.7k|   do {                                                                     \
  |  |   61|  15.7k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 15.7k]
  |  |  ------------------
  |  |   62|  15.7k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  15.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  261|  15.7k|      secure_vector<word> ws;
  262|  15.7k|      m_v = m_params->mul(v, m_params->R2(), ws);
  263|  15.7k|   }
  264|   171k|}
_ZN5Botan14Montgomery_Int8fix_sizeEv:
  292|   171k|void Montgomery_Int::fix_size() {
  293|   171k|   const size_t p_words = m_params->p_words();
  294|       |
  295|   171k|   if(m_v.sig_words() > p_words) {
  ------------------
  |  Branch (295:7): [True: 0, False: 171k]
  ------------------
  296|      0|      throw Internal_Error("Montgomery_Int::fix_size v too large");
  297|      0|   }
  298|       |
  299|   171k|   m_v.grow_to(p_words);
  300|   171k|}
_ZNK5Botan14Montgomery_Int5valueEv:
  318|  15.7k|BigInt Montgomery_Int::value() const {
  319|  15.7k|   secure_vector<word> ws;
  320|  15.7k|   return m_params->redc(m_v, ws);
  321|  15.7k|}
_ZNK5Botan14Montgomery_IntmlERKS0_:
  357|   139k|Montgomery_Int Montgomery_Int::operator*(const Montgomery_Int& other) const {
  358|   139k|   secure_vector<word> ws;
  359|   139k|   return Montgomery_Int(m_params, m_params->mul(m_v, other.m_v, ws), false);
  360|   139k|}
_ZN5Botan14Montgomery_Int6mul_byERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  366|   583k|Montgomery_Int& Montgomery_Int::mul_by(const Montgomery_Int& other, secure_vector<word>& ws) {
  367|   583k|   m_params->mul_by(m_v, other.m_v, ws);
  368|   583k|   return (*this);
  369|   583k|}
_ZN5Botan14Montgomery_Int19square_this_n_timesERNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  386|  1.17M|Montgomery_Int& Montgomery_Int::square_this_n_times(secure_vector<word>& ws, size_t n) {
  387|  5.59M|   for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (387:22): [True: 4.41M, False: 1.17M]
  ------------------
  388|  4.41M|      m_params->square_this(m_v, ws);
  389|  4.41M|   }
  390|  1.17M|   return (*this);
  391|  1.17M|}

_ZN5Botan30Montgomery_Exponentation_StateC2ERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEmb:
   40|  15.7k|      m_params(params), m_window_bits(window_bits == 0 ? 4 : window_bits) {
   41|  15.7k|   BOTAN_ARG_CHECK(g < m_params->p(), "Montgomery base too big");
  ------------------
  |  |   30|  15.7k|   do {                                                          \
  |  |   31|  15.7k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 15.7k]
  |  |  ------------------
  |  |   32|  15.7k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  15.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|  15.7k|   if(m_window_bits < 1 || m_window_bits > 12) {  // really even 8 is too large ...
  ------------------
  |  Branch (43:7): [True: 0, False: 15.7k]
  |  Branch (43:28): [True: 0, False: 15.7k]
  ------------------
   44|      0|      throw Invalid_Argument("Invalid window bits for Montgomery exponentiation");
   45|      0|   }
   46|       |
   47|  15.7k|   const size_t window_size = (static_cast<size_t>(1) << m_window_bits);
   48|       |
   49|  15.7k|   m_g.reserve(window_size);
   50|       |
   51|  15.7k|   m_g.push_back(Montgomery_Int(m_params, m_params->R1(), false));
   52|       |
   53|  15.7k|   m_g.push_back(Montgomery_Int(m_params, g));
   54|       |
   55|   155k|   for(size_t i = 2; i != window_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 139k, False: 15.7k]
  ------------------
   56|   139k|      m_g.push_back(m_g[1] * m_g[i - 1]);
   57|   139k|   }
   58|       |
   59|       |   // Resize each element to exactly p words
   60|   187k|   for(size_t i = 0; i != window_size; ++i) {
  ------------------
  |  Branch (60:22): [True: 171k, False: 15.7k]
  ------------------
   61|   171k|      m_g[i].fix_size();
   62|   171k|      if(const_time) {
  ------------------
  |  Branch (62:10): [True: 0, False: 171k]
  ------------------
   63|      0|         m_g[i].const_time_poison();
   64|      0|      }
   65|   171k|   }
   66|  15.7k|}
_ZNK5Botan30Montgomery_Exponentation_State22exponentiation_vartimeERKNS_6BigIntE:
  121|  15.7k|BigInt Montgomery_Exponentation_State::exponentiation_vartime(const BigInt& scalar) const {
  122|  15.7k|   const size_t exp_nibbles = (scalar.bits() + m_window_bits - 1) / m_window_bits;
  123|       |
  124|  15.7k|   secure_vector<word> ws;
  125|       |
  126|  15.7k|   if(exp_nibbles == 0) {
  ------------------
  |  Branch (126:7): [True: 0, False: 15.7k]
  ------------------
  127|      0|      return BigInt::one();
  128|      0|   }
  129|       |
  130|  15.7k|   Montgomery_Int x = m_g[scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits)];
  131|       |
  132|  1.18M|   for(size_t i = exp_nibbles - 1; i > 0; --i) {
  ------------------
  |  Branch (132:36): [True: 1.17M, False: 15.7k]
  ------------------
  133|  1.17M|      x.square_this_n_times(ws, m_window_bits);
  134|       |
  135|  1.17M|      const uint32_t nibble = scalar.get_substring(m_window_bits * (i - 1), m_window_bits);
  136|  1.17M|      if(nibble > 0) {
  ------------------
  |  Branch (136:10): [True: 583k, False: 590k]
  ------------------
  137|   583k|         x.mul_by(m_g[nibble], ws);
  138|   583k|      }
  139|  1.17M|   }
  140|       |
  141|  15.7k|   x.const_time_unpoison();
  142|  15.7k|   return x.value();
  143|  15.7k|}
_ZN5Botan16monty_precomputeERKNSt3__110shared_ptrIKNS_17Montgomery_ParamsEEERKNS_6BigIntEmb:
  146|  15.7k|   const std::shared_ptr<const Montgomery_Params>& params, const BigInt& g, size_t window_bits, bool const_time) {
  147|  15.7k|   return std::make_shared<const Montgomery_Exponentation_State>(params, g, window_bits, const_time);
  148|  15.7k|}
_ZN5Botan21monty_execute_vartimeERKNS_30Montgomery_Exponentation_StateERKNS_6BigIntE:
  154|  15.7k|BigInt monty_execute_vartime(const Montgomery_Exponentation_State& precomputed_state, const BigInt& k) {
  155|  15.7k|   return precomputed_state.exponentiation_vartime(k);
  156|  15.7k|}

_ZN5Botan10prime_p521Ev:
   15|  4.06M|const BigInt& prime_p521() {
   16|  4.06M|   static const BigInt p521(
   17|  4.06M|      "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
   18|  4.06M|      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
   19|       |
   20|  4.06M|   return p521;
   21|  4.06M|}
_ZN5Botan9redc_p521ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   23|  50.7M|void redc_p521(BigInt& x, secure_vector<word>& ws) {
   24|  50.7M|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  50.7M|      do {                          \
  |  |  100|  50.7M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
   25|       |
   26|  50.7M|   const size_t p_full_words = 521 / BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  50.7M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   27|  50.7M|   const size_t p_top_bits = 521 % BOTAN_MP_WORD_BITS;
  ------------------
  |  |   50|  50.7M|#define BOTAN_MP_WORD_BITS 64
  ------------------
   28|  50.7M|   const size_t p_words = p_full_words + 1;
   29|       |
   30|  50.7M|#if(BOTAN_MP_WORD_BITS == 64)
   31|  50.7M|   static const word p521_words[p_words] = {0xFFFFFFFFFFFFFFFF,
   32|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   33|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   34|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   35|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   36|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   37|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   38|  50.7M|                                            0xFFFFFFFFFFFFFFFF,
   39|  50.7M|                                            0x1FF};
   40|       |#else
   41|       |   static const word p521_words[p_words] = {0xFFFFFFFF,
   42|       |                                            0xFFFFFFFF,
   43|       |                                            0xFFFFFFFF,
   44|       |                                            0xFFFFFFFF,
   45|       |                                            0xFFFFFFFF,
   46|       |                                            0xFFFFFFFF,
   47|       |                                            0xFFFFFFFF,
   48|       |                                            0xFFFFFFFF,
   49|       |                                            0xFFFFFFFF,
   50|       |                                            0xFFFFFFFF,
   51|       |                                            0xFFFFFFFF,
   52|       |                                            0xFFFFFFFF,
   53|       |                                            0xFFFFFFFF,
   54|       |                                            0xFFFFFFFF,
   55|       |                                            0xFFFFFFFF,
   56|       |                                            0xFFFFFFFF,
   57|       |                                            0x1FF};
   58|       |#endif
   59|       |
   60|  50.7M|   if(ws.size() < p_words + 1) {
  ------------------
  |  Branch (60:7): [True: 5.52k, False: 50.7M]
  ------------------
   61|  5.52k|      ws.resize(p_words + 1);
   62|  5.52k|   }
   63|       |
   64|  50.7M|   clear_mem(ws.data(), ws.size());
   65|  50.7M|   bigint_shr2(ws.data(), x.data(), std::min(x.size(), 2 * p_words), p_full_words, p_top_bits);
   66|       |
   67|  50.7M|   x.mask_bits(521);
   68|  50.7M|   x.grow_to(p_words);
   69|       |
   70|       |   // Word-level carry will be zero
   71|  50.7M|   word carry = bigint_add3_nc(x.mutable_data(), x.data(), p_words, ws.data(), p_words);
   72|  50.7M|   BOTAN_ASSERT_EQUAL(carry, 0, "Final carry in P-521 reduction");
  ------------------
  |  |   69|  50.7M|   do {                                                                                                \
  |  |   70|  50.7M|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 50.7M]
  |  |  ------------------
  |  |   71|  50.7M|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  50.7M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   73|       |
   74|  50.7M|   const word top_word = x.word_at(p_full_words);
   75|       |
   76|       |   /*
   77|       |   * Check if we need to reduce modulo P
   78|       |   * There are two possible cases:
   79|       |   * - The result overflowed past 521 bits, in which case bit 522 will be set
   80|       |   * - The result is exactly 2**521 - 1
   81|       |   */
   82|  50.7M|   const auto bit_522_set = CT::Mask<word>::expand(top_word >> p_top_bits);
   83|       |
   84|  50.7M|   word and_512 = MP_WORD_MAX;
   85|   456M|   for(size_t i = 0; i != p_full_words; ++i) {
  ------------------
  |  Branch (85:22): [True: 405M, False: 50.7M]
  ------------------
   86|   405M|      and_512 &= x.word_at(i);
   87|   405M|   }
   88|  50.7M|   const auto all_512_low_bits_set = CT::Mask<word>::is_equal(and_512, MP_WORD_MAX);
   89|  50.7M|   const auto has_p521_top_word = CT::Mask<word>::is_equal(top_word, 0x1FF);
   90|  50.7M|   const auto is_p521 = all_512_low_bits_set & has_p521_top_word;
   91|       |
   92|  50.7M|   const auto needs_reduction = is_p521 | bit_522_set;
   93|       |
   94|  50.7M|   bigint_cnd_sub(needs_reduction.value(), x.mutable_data(), p521_words, p_words);
   95|  50.7M|}
_ZN5Botan10prime_p192Ev:
  122|      6|const BigInt& prime_p192() {
  123|      6|   static const BigInt p192("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF");
  124|      6|   return p192;
  125|      6|}
_ZN5Botan10prime_p224Ev:
  217|      6|const BigInt& prime_p224() {
  218|      6|   static const BigInt p224("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001");
  219|      6|   return p224;
  220|      6|}
_ZN5Botan10prime_p256Ev:
  319|   646k|const BigInt& prime_p256() {
  320|   646k|   static const BigInt p256("0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF");
  321|   646k|   return p256;
  322|   646k|}
_ZN5Botan9redc_p256ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  324|  8.10M|void redc_p256(BigInt& x, secure_vector<word>& ws) {
  325|  8.10M|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  8.10M|      do {                          \
  |  |  100|  8.10M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  326|       |
  327|  8.10M|   static const size_t p256_limbs = (BOTAN_MP_WORD_BITS == 32) ? 8 : 4;
  ------------------
  |  |   50|  8.10M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (327:37): [Folded - Ignored]
  ------------------
  328|       |
  329|  8.10M|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|  8.10M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  330|       |
  331|  8.10M|   x.grow_to(2 * p256_limbs);
  332|  8.10M|   word* xw = x.mutable_data();
  333|       |
  334|  8.10M|   const int64_t X00 = get_uint32(xw, 0);
  335|  8.10M|   const int64_t X01 = get_uint32(xw, 1);
  336|  8.10M|   const int64_t X02 = get_uint32(xw, 2);
  337|  8.10M|   const int64_t X03 = get_uint32(xw, 3);
  338|  8.10M|   const int64_t X04 = get_uint32(xw, 4);
  339|  8.10M|   const int64_t X05 = get_uint32(xw, 5);
  340|  8.10M|   const int64_t X06 = get_uint32(xw, 6);
  341|  8.10M|   const int64_t X07 = get_uint32(xw, 7);
  342|  8.10M|   const int64_t X08 = get_uint32(xw, 8);
  343|  8.10M|   const int64_t X09 = get_uint32(xw, 9);
  344|  8.10M|   const int64_t X10 = get_uint32(xw, 10);
  345|  8.10M|   const int64_t X11 = get_uint32(xw, 11);
  346|  8.10M|   const int64_t X12 = get_uint32(xw, 12);
  347|  8.10M|   const int64_t X13 = get_uint32(xw, 13);
  348|  8.10M|   const int64_t X14 = get_uint32(xw, 14);
  349|  8.10M|   const int64_t X15 = get_uint32(xw, 15);
  350|       |
  351|       |   // Adds 6 * P-256 to prevent underflow
  352|  8.10M|   const int64_t S0 = 0xFFFFFFFA + X00 + X08 + X09 - (X11 + X12 + X13) - X14;
  353|  8.10M|   const int64_t S1 = 0xFFFFFFFF + X01 + X09 + X10 - X12 - (X13 + X14 + X15);
  354|  8.10M|   const int64_t S2 = 0xFFFFFFFF + X02 + X10 + X11 - (X13 + X14 + X15);
  355|  8.10M|   const int64_t S3 = 0x00000005 + X03 + (X11 + X12) * 2 + X13 - X15 - X08 - X09;
  356|  8.10M|   const int64_t S4 = 0x00000000 + X04 + (X12 + X13) * 2 + X14 - X09 - X10;
  357|  8.10M|   const int64_t S5 = 0x00000000 + X05 + (X13 + X14) * 2 + X15 - X10 - X11;
  358|  8.10M|   const int64_t S6 = 0x00000006 + X06 + X13 + X14 * 3 + X15 * 2 - X08 - X09;
  359|  8.10M|   const int64_t S7 = 0xFFFFFFFA + X07 + X15 * 3 + X08 - X10 - (X11 + X12 + X13);
  360|       |
  361|  8.10M|   int64_t S = 0;
  362|       |
  363|  8.10M|   uint32_t R0 = 0, R1 = 0;
  364|       |
  365|  8.10M|   S += S0;
  366|  8.10M|   R0 = static_cast<uint32_t>(S);
  367|  8.10M|   S >>= 32;
  368|       |
  369|  8.10M|   S += S1;
  370|  8.10M|   R1 = static_cast<uint32_t>(S);
  371|  8.10M|   S >>= 32;
  372|       |
  373|  8.10M|   set_words(xw, 0, R0, R1);
  374|       |
  375|  8.10M|   S += S2;
  376|  8.10M|   R0 = static_cast<uint32_t>(S);
  377|  8.10M|   S >>= 32;
  378|       |
  379|  8.10M|   S += S3;
  380|  8.10M|   R1 = static_cast<uint32_t>(S);
  381|  8.10M|   S >>= 32;
  382|       |
  383|  8.10M|   set_words(xw, 2, R0, R1);
  384|       |
  385|  8.10M|   S += S4;
  386|  8.10M|   R0 = static_cast<uint32_t>(S);
  387|  8.10M|   S >>= 32;
  388|       |
  389|  8.10M|   S += S5;
  390|  8.10M|   R1 = static_cast<uint32_t>(S);
  391|  8.10M|   S >>= 32;
  392|       |
  393|  8.10M|   set_words(xw, 4, R0, R1);
  394|       |
  395|  8.10M|   S += S6;
  396|  8.10M|   R0 = static_cast<uint32_t>(S);
  397|  8.10M|   S >>= 32;
  398|       |
  399|  8.10M|   S += S7;
  400|  8.10M|   R1 = static_cast<uint32_t>(S);
  401|  8.10M|   S >>= 32;
  402|  8.10M|   set_words(xw, 6, R0, R1);
  403|       |
  404|  8.10M|   S += 5;  // the top digits of 6*P-256
  405|       |
  406|       |   /*
  407|       |   This is a table of (i*P-256) % 2**256 for i in 1...10
  408|       |   */
  409|  8.10M|   static const word p256_mults[11][p256_limbs] = {
  410|  8.10M|#if(BOTAN_MP_WORD_BITS == 64)
  411|  8.10M|      {0xFFFFFFFFFFFFFFFF, 0x00000000FFFFFFFF, 0x0000000000000000, 0xFFFFFFFF00000001},
  412|  8.10M|      {0xFFFFFFFFFFFFFFFE, 0x00000001FFFFFFFF, 0x0000000000000000, 0xFFFFFFFE00000002},
  413|  8.10M|      {0xFFFFFFFFFFFFFFFD, 0x00000002FFFFFFFF, 0x0000000000000000, 0xFFFFFFFD00000003},
  414|  8.10M|      {0xFFFFFFFFFFFFFFFC, 0x00000003FFFFFFFF, 0x0000000000000000, 0xFFFFFFFC00000004},
  415|  8.10M|      {0xFFFFFFFFFFFFFFFB, 0x00000004FFFFFFFF, 0x0000000000000000, 0xFFFFFFFB00000005},
  416|  8.10M|      {0xFFFFFFFFFFFFFFFA, 0x00000005FFFFFFFF, 0x0000000000000000, 0xFFFFFFFA00000006},
  417|  8.10M|      {0xFFFFFFFFFFFFFFF9, 0x00000006FFFFFFFF, 0x0000000000000000, 0xFFFFFFF900000007},
  418|  8.10M|      {0xFFFFFFFFFFFFFFF8, 0x00000007FFFFFFFF, 0x0000000000000000, 0xFFFFFFF800000008},
  419|  8.10M|      {0xFFFFFFFFFFFFFFF7, 0x00000008FFFFFFFF, 0x0000000000000000, 0xFFFFFFF700000009},
  420|  8.10M|      {0xFFFFFFFFFFFFFFF6, 0x00000009FFFFFFFF, 0x0000000000000000, 0xFFFFFFF60000000A},
  421|  8.10M|      {0xFFFFFFFFFFFFFFF5, 0x0000000AFFFFFFFF, 0x0000000000000000, 0xFFFFFFF50000000B},
  422|       |#else
  423|       |      {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000, 0x00000001, 0xFFFFFFFF},
  424|       |      {0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000001, 0x00000000, 0x00000000, 0x00000002, 0xFFFFFFFE},
  425|       |      {0xFFFFFFFD, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000002, 0x00000000, 0x00000000, 0x00000003, 0xFFFFFFFD},
  426|       |      {0xFFFFFFFC, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000003, 0x00000000, 0x00000000, 0x00000004, 0xFFFFFFFC},
  427|       |      {0xFFFFFFFB, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000004, 0x00000000, 0x00000000, 0x00000005, 0xFFFFFFFB},
  428|       |      {0xFFFFFFFA, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000005, 0x00000000, 0x00000000, 0x00000006, 0xFFFFFFFA},
  429|       |      {0xFFFFFFF9, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000006, 0x00000000, 0x00000000, 0x00000007, 0xFFFFFFF9},
  430|       |      {0xFFFFFFF8, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000007, 0x00000000, 0x00000000, 0x00000008, 0xFFFFFFF8},
  431|       |      {0xFFFFFFF7, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000008, 0x00000000, 0x00000000, 0x00000009, 0xFFFFFFF7},
  432|       |      {0xFFFFFFF6, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000009, 0x00000000, 0x00000000, 0x0000000A, 0xFFFFFFF6},
  433|       |      {0xFFFFFFF5, 0xFFFFFFFF, 0xFFFFFFFF, 0x0000000A, 0x00000000, 0x00000000, 0x0000000B, 0xFFFFFFF5},
  434|       |#endif
  435|  8.10M|   };
  436|       |
  437|  8.10M|   CT::unpoison(S);
  438|  8.10M|   BOTAN_ASSERT(S >= 0 && S <= 10, "Expected overflow");
  ------------------
  |  |   51|  8.10M|   do {                                                                                 \
  |  |   52|  16.2M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 8.10M, False: 0]
  |  |  |  Branch (52:12): [True: 8.10M, False: 0]
  |  |  ------------------
  |  |   53|  8.10M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  8.10M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  439|       |
  440|  8.10M|   BOTAN_ASSERT_NOMSG(x.size() >= p256_limbs + 1);
  ------------------
  |  |   60|  8.10M|   do {                                                                     \
  |  |   61|  8.10M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 8.10M]
  |  |  ------------------
  |  |   62|  8.10M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  8.10M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  441|  8.10M|   x.mask_bits(256);
  442|  8.10M|   word borrow = bigint_sub2(x.mutable_data(), p256_limbs + 1, p256_mults[S], p256_limbs);
  443|  8.10M|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  8.10M|      do {                          \
  |  |  100|  8.10M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  444|  8.10M|   bigint_cnd_add(borrow, x.mutable_data(), p256_limbs + 1, p256_mults[0], p256_limbs);
  445|  8.10M|}
_ZN5Botan10prime_p384Ev:
  447|  1.33M|const BigInt& prime_p384() {
  448|  1.33M|   static const BigInt p384(
  449|  1.33M|      "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF");
  450|  1.33M|   return p384;
  451|  1.33M|}
_ZN5Botan9redc_p384ERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  453|  16.1M|void redc_p384(BigInt& x, secure_vector<word>& ws) {
  454|  16.1M|   BOTAN_DEBUG_ASSERT(x.is_positive());
  ------------------
  |  |   99|  16.1M|      do {                          \
  |  |  100|  16.1M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  455|       |
  456|  16.1M|   BOTAN_UNUSED(ws);
  ------------------
  |  |  118|  16.1M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  457|       |
  458|  16.1M|   static const size_t p384_limbs = (BOTAN_MP_WORD_BITS == 32) ? 12 : 6;
  ------------------
  |  |   50|  16.1M|#define BOTAN_MP_WORD_BITS 64
  ------------------
  |  Branch (458:37): [Folded - Ignored]
  ------------------
  459|       |
  460|  16.1M|   x.grow_to(2 * p384_limbs);
  461|  16.1M|   word* xw = x.mutable_data();
  462|       |
  463|  16.1M|   const int64_t X00 = get_uint32(xw, 0);
  464|  16.1M|   const int64_t X01 = get_uint32(xw, 1);
  465|  16.1M|   const int64_t X02 = get_uint32(xw, 2);
  466|  16.1M|   const int64_t X03 = get_uint32(xw, 3);
  467|  16.1M|   const int64_t X04 = get_uint32(xw, 4);
  468|  16.1M|   const int64_t X05 = get_uint32(xw, 5);
  469|  16.1M|   const int64_t X06 = get_uint32(xw, 6);
  470|  16.1M|   const int64_t X07 = get_uint32(xw, 7);
  471|  16.1M|   const int64_t X08 = get_uint32(xw, 8);
  472|  16.1M|   const int64_t X09 = get_uint32(xw, 9);
  473|  16.1M|   const int64_t X10 = get_uint32(xw, 10);
  474|  16.1M|   const int64_t X11 = get_uint32(xw, 11);
  475|  16.1M|   const int64_t X12 = get_uint32(xw, 12);
  476|  16.1M|   const int64_t X13 = get_uint32(xw, 13);
  477|  16.1M|   const int64_t X14 = get_uint32(xw, 14);
  478|  16.1M|   const int64_t X15 = get_uint32(xw, 15);
  479|  16.1M|   const int64_t X16 = get_uint32(xw, 16);
  480|  16.1M|   const int64_t X17 = get_uint32(xw, 17);
  481|  16.1M|   const int64_t X18 = get_uint32(xw, 18);
  482|  16.1M|   const int64_t X19 = get_uint32(xw, 19);
  483|  16.1M|   const int64_t X20 = get_uint32(xw, 20);
  484|  16.1M|   const int64_t X21 = get_uint32(xw, 21);
  485|  16.1M|   const int64_t X22 = get_uint32(xw, 22);
  486|  16.1M|   const int64_t X23 = get_uint32(xw, 23);
  487|       |
  488|       |   // One copy of P-384 is added to prevent underflow
  489|  16.1M|   const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23;
  490|  16.1M|   const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20;
  491|  16.1M|   const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21;
  492|  16.1M|   const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23;
  493|  16.1M|   const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2;
  494|  16.1M|   const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16;
  495|  16.1M|   const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17;
  496|  16.1M|   const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18;
  497|  16.1M|   const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19;
  498|  16.1M|   const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20;
  499|  16.1M|   const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21;
  500|  16.1M|   const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22;
  501|       |
  502|  16.1M|   int64_t S = 0;
  503|       |
  504|  16.1M|   uint32_t R0 = 0, R1 = 0;
  505|       |
  506|  16.1M|   S += S0;
  507|  16.1M|   R0 = static_cast<uint32_t>(S);
  508|  16.1M|   S >>= 32;
  509|       |
  510|  16.1M|   S += S1;
  511|  16.1M|   R1 = static_cast<uint32_t>(S);
  512|  16.1M|   S >>= 32;
  513|       |
  514|  16.1M|   set_words(xw, 0, R0, R1);
  515|       |
  516|  16.1M|   S += S2;
  517|  16.1M|   R0 = static_cast<uint32_t>(S);
  518|  16.1M|   S >>= 32;
  519|       |
  520|  16.1M|   S += S3;
  521|  16.1M|   R1 = static_cast<uint32_t>(S);
  522|  16.1M|   S >>= 32;
  523|       |
  524|  16.1M|   set_words(xw, 2, R0, R1);
  525|       |
  526|  16.1M|   S += S4;
  527|  16.1M|   R0 = static_cast<uint32_t>(S);
  528|  16.1M|   S >>= 32;
  529|       |
  530|  16.1M|   S += S5;
  531|  16.1M|   R1 = static_cast<uint32_t>(S);
  532|  16.1M|   S >>= 32;
  533|       |
  534|  16.1M|   set_words(xw, 4, R0, R1);
  535|       |
  536|  16.1M|   S += S6;
  537|  16.1M|   R0 = static_cast<uint32_t>(S);
  538|  16.1M|   S >>= 32;
  539|       |
  540|  16.1M|   S += S7;
  541|  16.1M|   R1 = static_cast<uint32_t>(S);
  542|  16.1M|   S >>= 32;
  543|       |
  544|  16.1M|   set_words(xw, 6, R0, R1);
  545|       |
  546|  16.1M|   S += S8;
  547|  16.1M|   R0 = static_cast<uint32_t>(S);
  548|  16.1M|   S >>= 32;
  549|       |
  550|  16.1M|   S += S9;
  551|  16.1M|   R1 = static_cast<uint32_t>(S);
  552|  16.1M|   S >>= 32;
  553|       |
  554|  16.1M|   set_words(xw, 8, R0, R1);
  555|       |
  556|  16.1M|   S += SA;
  557|  16.1M|   R0 = static_cast<uint32_t>(S);
  558|  16.1M|   S >>= 32;
  559|       |
  560|  16.1M|   S += SB;
  561|  16.1M|   R1 = static_cast<uint32_t>(S);
  562|  16.1M|   S >>= 32;
  563|       |
  564|  16.1M|   set_words(xw, 10, R0, R1);
  565|       |
  566|       |   /*
  567|       |   This is a table of (i*P-384) % 2**384 for i in 1...4
  568|       |   */
  569|  16.1M|   static const word p384_mults[5][p384_limbs] = {
  570|  16.1M|#if(BOTAN_MP_WORD_BITS == 64)
  571|  16.1M|      {0x00000000FFFFFFFF,
  572|  16.1M|       0xFFFFFFFF00000000,
  573|  16.1M|       0xFFFFFFFFFFFFFFFE,
  574|  16.1M|       0xFFFFFFFFFFFFFFFF,
  575|  16.1M|       0xFFFFFFFFFFFFFFFF,
  576|  16.1M|       0xFFFFFFFFFFFFFFFF},
  577|  16.1M|      {0x00000001FFFFFFFE,
  578|  16.1M|       0xFFFFFFFE00000000,
  579|  16.1M|       0xFFFFFFFFFFFFFFFD,
  580|  16.1M|       0xFFFFFFFFFFFFFFFF,
  581|  16.1M|       0xFFFFFFFFFFFFFFFF,
  582|  16.1M|       0xFFFFFFFFFFFFFFFF},
  583|  16.1M|      {0x00000002FFFFFFFD,
  584|  16.1M|       0xFFFFFFFD00000000,
  585|  16.1M|       0xFFFFFFFFFFFFFFFC,
  586|  16.1M|       0xFFFFFFFFFFFFFFFF,
  587|  16.1M|       0xFFFFFFFFFFFFFFFF,
  588|  16.1M|       0xFFFFFFFFFFFFFFFF},
  589|  16.1M|      {0x00000003FFFFFFFC,
  590|  16.1M|       0xFFFFFFFC00000000,
  591|  16.1M|       0xFFFFFFFFFFFFFFFB,
  592|  16.1M|       0xFFFFFFFFFFFFFFFF,
  593|  16.1M|       0xFFFFFFFFFFFFFFFF,
  594|  16.1M|       0xFFFFFFFFFFFFFFFF},
  595|  16.1M|      {0x00000004FFFFFFFB,
  596|  16.1M|       0xFFFFFFFB00000000,
  597|  16.1M|       0xFFFFFFFFFFFFFFFA,
  598|  16.1M|       0xFFFFFFFFFFFFFFFF,
  599|  16.1M|       0xFFFFFFFFFFFFFFFF,
  600|  16.1M|       0xFFFFFFFFFFFFFFFF},
  601|       |
  602|       |#else
  603|       |      {0xFFFFFFFF,
  604|       |       0x00000000,
  605|       |       0x00000000,
  606|       |       0xFFFFFFFF,
  607|       |       0xFFFFFFFE,
  608|       |       0xFFFFFFFF,
  609|       |       0xFFFFFFFF,
  610|       |       0xFFFFFFFF,
  611|       |       0xFFFFFFFF,
  612|       |       0xFFFFFFFF,
  613|       |       0xFFFFFFFF,
  614|       |       0xFFFFFFFF},
  615|       |      {0xFFFFFFFE,
  616|       |       0x00000001,
  617|       |       0x00000000,
  618|       |       0xFFFFFFFE,
  619|       |       0xFFFFFFFD,
  620|       |       0xFFFFFFFF,
  621|       |       0xFFFFFFFF,
  622|       |       0xFFFFFFFF,
  623|       |       0xFFFFFFFF,
  624|       |       0xFFFFFFFF,
  625|       |       0xFFFFFFFF,
  626|       |       0xFFFFFFFF},
  627|       |      {0xFFFFFFFD,
  628|       |       0x00000002,
  629|       |       0x00000000,
  630|       |       0xFFFFFFFD,
  631|       |       0xFFFFFFFC,
  632|       |       0xFFFFFFFF,
  633|       |       0xFFFFFFFF,
  634|       |       0xFFFFFFFF,
  635|       |       0xFFFFFFFF,
  636|       |       0xFFFFFFFF,
  637|       |       0xFFFFFFFF,
  638|       |       0xFFFFFFFF},
  639|       |      {0xFFFFFFFC,
  640|       |       0x00000003,
  641|       |       0x00000000,
  642|       |       0xFFFFFFFC,
  643|       |       0xFFFFFFFB,
  644|       |       0xFFFFFFFF,
  645|       |       0xFFFFFFFF,
  646|       |       0xFFFFFFFF,
  647|       |       0xFFFFFFFF,
  648|       |       0xFFFFFFFF,
  649|       |       0xFFFFFFFF,
  650|       |       0xFFFFFFFF},
  651|       |      {0xFFFFFFFB,
  652|       |       0x00000004,
  653|       |       0x00000000,
  654|       |       0xFFFFFFFB,
  655|       |       0xFFFFFFFA,
  656|       |       0xFFFFFFFF,
  657|       |       0xFFFFFFFF,
  658|       |       0xFFFFFFFF,
  659|       |       0xFFFFFFFF,
  660|       |       0xFFFFFFFF,
  661|       |       0xFFFFFFFF,
  662|       |       0xFFFFFFFF},
  663|       |#endif
  664|  16.1M|   };
  665|       |
  666|  16.1M|   CT::unpoison(S);
  667|  16.1M|   BOTAN_ASSERT(S >= 0 && S <= 4, "Expected overflow");
  ------------------
  |  |   51|  16.1M|   do {                                                                                 \
  |  |   52|  32.3M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 16.1M, False: 0]
  |  |  |  Branch (52:12): [True: 16.1M, False: 0]
  |  |  ------------------
  |  |   53|  16.1M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  16.1M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  668|       |
  669|  16.1M|   BOTAN_ASSERT_NOMSG(x.size() >= p384_limbs + 1);
  ------------------
  |  |   60|  16.1M|   do {                                                                     \
  |  |   61|  16.1M|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 16.1M]
  |  |  ------------------
  |  |   62|  16.1M|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  16.1M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  670|  16.1M|   x.mask_bits(384);
  671|  16.1M|   word borrow = bigint_sub2(x.mutable_data(), p384_limbs + 1, p384_mults[S], p384_limbs);
  672|  16.1M|   BOTAN_DEBUG_ASSERT(borrow == 0 || borrow == 1);
  ------------------
  |  |   99|  16.1M|      do {                          \
  |  |  100|  16.1M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  673|  16.1M|   bigint_cnd_add(borrow, x.mutable_data(), p384_limbs + 1, p384_mults[0], p384_limbs);
  674|  16.1M|}
nistp_redc.cpp:_ZN5Botan12_GLOBAL__N_110get_uint32EPKmm:
  103|   517M|inline uint32_t get_uint32(const word xw[], size_t i) {
  104|       |#if(BOTAN_MP_WORD_BITS == 32)
  105|       |   return xw[i];
  106|       |#else
  107|   517M|   return static_cast<uint32_t>(xw[i / 2] >> ((i % 2) * 32));
  108|   517M|#endif
  109|   517M|}
nistp_redc.cpp:_ZN5Botan12_GLOBAL__N_19set_wordsEPmmjj:
  111|   129M|inline void set_words(word x[], size_t i, uint32_t R0, uint32_t R1) {
  112|       |#if(BOTAN_MP_WORD_BITS == 32)
  113|       |   x[i] = R0;
  114|       |   x[i + 1] = R1;
  115|       |#else
  116|   129M|   x[i / 2] = (static_cast<uint64_t>(R1) << 32) | R0;
  117|   129M|#endif
  118|   129M|}

_ZN5Botan17sqrt_modulo_primeERKNS_6BigIntES2_:
   38|  13.7k|BigInt sqrt_modulo_prime(const BigInt& a, const BigInt& p) {
   39|  13.7k|   BOTAN_ARG_CHECK(p > 1, "invalid prime");
  ------------------
  |  |   30|  13.7k|   do {                                                          \
  |  |   31|  13.7k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 13.7k]
  |  |  ------------------
  |  |   32|  13.7k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  13.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   40|  13.7k|   BOTAN_ARG_CHECK(a < p, "value to solve for must be less than p");
  ------------------
  |  |   30|  13.7k|   do {                                                          \
  |  |   31|  13.7k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 13.7k]
  |  |  ------------------
  |  |   32|  13.7k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  13.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   41|  13.7k|   BOTAN_ARG_CHECK(a >= 0, "value to solve for must not be negative");
  ------------------
  |  |   30|  13.7k|   do {                                                          \
  |  |   31|  13.7k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 13.7k]
  |  |  ------------------
  |  |   32|  13.7k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  13.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|       |   // some very easy cases
   44|  13.7k|   if(p == 2 || a <= 1) {
  ------------------
  |  Branch (44:7): [True: 0, False: 13.7k]
  |  Branch (44:17): [True: 0, False: 13.7k]
  ------------------
   45|      0|      return a;
   46|      0|   }
   47|       |
   48|  13.7k|   BOTAN_ARG_CHECK(p.is_odd(), "invalid prime");
  ------------------
  |  |   30|  13.7k|   do {                                                          \
  |  |   31|  13.7k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 13.7k]
  |  |  ------------------
  |  |   32|  13.7k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  13.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   49|       |
   50|  13.7k|   if(jacobi(a, p) != 1) {  // not a quadratic residue
  ------------------
  |  Branch (50:7): [True: 3.72k, False: 9.98k]
  ------------------
   51|  3.72k|      return BigInt::from_s32(-1);
   52|  3.72k|   }
   53|       |
   54|  9.98k|   Modular_Reducer mod_p(p);
   55|  9.98k|   auto monty_p = std::make_shared<Montgomery_Params>(p, mod_p);
   56|       |
   57|  9.98k|   if(p % 4 == 3)  // The easy case
  ------------------
  |  Branch (57:7): [True: 9.98k, False: 0]
  ------------------
   58|  9.98k|   {
   59|  9.98k|      return monty_exp_vartime(monty_p, a, ((p + 1) >> 2));
   60|  9.98k|   }
   61|       |
   62|       |   // Otherwise we have to use Shanks-Tonelli
   63|      0|   size_t s = low_zero_bits(p - 1);
   64|      0|   BigInt q = p >> s;
   65|       |
   66|      0|   q -= 1;
   67|      0|   q >>= 1;
   68|       |
   69|      0|   BigInt r = monty_exp_vartime(monty_p, a, q);
   70|      0|   BigInt n = mod_p.multiply(a, mod_p.square(r));
   71|      0|   r = mod_p.multiply(r, a);
   72|       |
   73|      0|   if(n == 1) {
  ------------------
  |  Branch (73:7): [True: 0, False: 0]
  ------------------
   74|      0|      return r;
   75|      0|   }
   76|       |
   77|       |   // find random quadratic nonresidue z
   78|      0|   word z = 2;
   79|      0|   for(;;) {
   80|      0|      if(jacobi(BigInt::from_word(z), p) == -1) {  // found one
  ------------------
  |  Branch (80:10): [True: 0, False: 0]
  ------------------
   81|      0|         break;
   82|      0|      }
   83|       |
   84|      0|      z += 1;  // try next z
   85|       |
   86|       |      /*
   87|       |      * The expected number of tests to find a non-residue modulo a
   88|       |      * prime is 2. If we have not found one after 256 then almost
   89|       |      * certainly we have been given a non-prime p.
   90|       |      */
   91|      0|      if(z >= 256) {
  ------------------
  |  Branch (91:10): [True: 0, False: 0]
  ------------------
   92|      0|         return BigInt::from_s32(-1);
   93|      0|      }
   94|      0|   }
   95|       |
   96|      0|   BigInt c = monty_exp_vartime(monty_p, BigInt::from_word(z), (q << 1) + 1);
   97|       |
   98|      0|   while(n > 1) {
  ------------------
  |  Branch (98:10): [True: 0, False: 0]
  ------------------
   99|      0|      q = n;
  100|       |
  101|      0|      size_t i = 0;
  102|      0|      while(q != 1) {
  ------------------
  |  Branch (102:13): [True: 0, False: 0]
  ------------------
  103|      0|         q = mod_p.square(q);
  104|      0|         ++i;
  105|       |
  106|      0|         if(i >= s) {
  ------------------
  |  Branch (106:13): [True: 0, False: 0]
  ------------------
  107|      0|            return BigInt::from_s32(-1);
  108|      0|         }
  109|      0|      }
  110|       |
  111|      0|      BOTAN_ASSERT_NOMSG(s >= (i + 1));  // No underflow!
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  112|      0|      c = monty_exp_vartime(monty_p, c, BigInt::power_of_2(s - i - 1));
  113|      0|      r = mod_p.multiply(r, c);
  114|      0|      c = mod_p.square(c);
  115|      0|      n = mod_p.multiply(n, c);
  116|       |
  117|       |      // s decreases as the algorithm proceeds
  118|      0|      BOTAN_ASSERT_NOMSG(s >= i);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  119|      0|      s = i;
  120|      0|   }
  121|       |
  122|      0|   return r;
  123|      0|}
_ZN5Botan6jacobiERKNS_6BigIntES2_:
  128|  13.7k|int32_t jacobi(const BigInt& a, const BigInt& n) {
  129|  13.7k|   if(n.is_even() || n < 2) {
  ------------------
  |  Branch (129:7): [True: 0, False: 13.7k]
  |  Branch (129:22): [True: 0, False: 13.7k]
  ------------------
  130|      0|      throw Invalid_Argument("jacobi: second argument must be odd and > 1");
  131|      0|   }
  132|       |
  133|  13.7k|   BigInt x = a % n;
  134|  13.7k|   BigInt y = n;
  135|  13.7k|   int32_t J = 1;
  136|       |
  137|  1.74M|   while(y > 1) {
  ------------------
  |  Branch (137:10): [True: 1.72M, False: 13.7k]
  ------------------
  138|  1.72M|      x %= y;
  139|  1.72M|      if(x > y / 2) {
  ------------------
  |  Branch (139:10): [True: 820k, False: 907k]
  ------------------
  140|   820k|         x = y - x;
  141|   820k|         if(y % 4 == 3) {
  ------------------
  |  Branch (141:13): [True: 416k, False: 404k]
  ------------------
  142|   416k|            J = -J;
  143|   416k|         }
  144|   820k|      }
  145|  1.72M|      if(x.is_zero()) {
  ------------------
  |  Branch (145:10): [True: 0, False: 1.72M]
  ------------------
  146|      0|         return 0;
  147|      0|      }
  148|       |
  149|  1.72M|      size_t shifts = low_zero_bits(x);
  150|  1.72M|      x >>= shifts;
  151|  1.72M|      if(shifts % 2) {
  ------------------
  |  Branch (151:10): [True: 553k, False: 1.17M]
  ------------------
  152|   553k|         word y_mod_8 = y % 8;
  153|   553k|         if(y_mod_8 == 3 || y_mod_8 == 5) {
  ------------------
  |  Branch (153:13): [True: 139k, False: 414k]
  |  Branch (153:29): [True: 141k, False: 273k]
  ------------------
  154|   280k|            J = -J;
  155|   280k|         }
  156|   553k|      }
  157|       |
  158|  1.72M|      if(x % 4 == 3 && y % 4 == 3) {
  ------------------
  |  Branch (158:10): [True: 857k, False: 871k]
  |  Branch (158:24): [True: 428k, False: 428k]
  ------------------
  159|   428k|         J = -J;
  160|   428k|      }
  161|  1.72M|      std::swap(x, y);
  162|  1.72M|   }
  163|  13.7k|   return J;
  164|  13.7k|}
_ZN5Botan6squareERKNS_6BigIntE:
  169|  33.1k|BigInt square(const BigInt& x) {
  170|  33.1k|   BigInt z = x;
  171|  33.1k|   secure_vector<word> ws;
  172|  33.1k|   z.square(ws);
  173|  33.1k|   return z;
  174|  33.1k|}
_ZN5Botan13low_zero_bitsERKNS_6BigIntE:
  179|  1.72M|size_t low_zero_bits(const BigInt& n) {
  180|  1.72M|   size_t low_zero = 0;
  181|       |
  182|  1.72M|   auto seen_nonempty_word = CT::Mask<word>::cleared();
  183|       |
  184|  18.3M|   for(size_t i = 0; i != n.size(); ++i) {
  ------------------
  |  Branch (184:22): [True: 16.6M, False: 1.72M]
  ------------------
  185|  16.6M|      const word x = n.word_at(i);
  186|       |
  187|       |      // ctz(0) will return sizeof(word)
  188|  16.6M|      const size_t tz_x = ctz(x);
  189|       |
  190|       |      // if x > 0 we want to count tz_x in total but not any
  191|       |      // further words, so set the mask after the addition
  192|  16.6M|      low_zero += seen_nonempty_word.if_not_set_return(tz_x);
  193|       |
  194|  16.6M|      seen_nonempty_word |= CT::Mask<word>::expand(x);
  195|  16.6M|   }
  196|       |
  197|       |   // if we saw no words with x > 0 then n == 0 and the value we have
  198|       |   // computed is meaningless. Instead return BigInt::zero() in that case.
  199|  1.72M|   return seen_nonempty_word.if_set_return(low_zero);
  200|  1.72M|}

_ZN5Botan15Modular_ReducerC2ERKNS_6BigIntE:
   19|  33.1k|Modular_Reducer::Modular_Reducer(const BigInt& mod) {
   20|  33.1k|   if(mod < 0) {
  ------------------
  |  Branch (20:7): [True: 0, False: 33.1k]
  ------------------
   21|      0|      throw Invalid_Argument("Modular_Reducer: modulus must be positive");
   22|      0|   }
   23|       |
   24|       |   // Left uninitialized if mod == 0
   25|  33.1k|   m_mod_words = 0;
   26|       |
   27|  33.1k|   if(mod > 0) {
  ------------------
  |  Branch (27:7): [True: 33.1k, False: 0]
  ------------------
   28|  33.1k|      m_modulus = mod;
   29|  33.1k|      m_mod_words = m_modulus.sig_words();
   30|       |
   31|       |      // Compute mu = floor(2^{2k} / m)
   32|  33.1k|      m_mu.set_bit(2 * BOTAN_MP_WORD_BITS * m_mod_words);
  ------------------
  |  |   50|  33.1k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   33|  33.1k|      m_mu = ct_divide(m_mu, m_modulus);
   34|  33.1k|   }
   35|  33.1k|}
_ZNK5Botan15Modular_Reducer6reduceERKNS_6BigIntE:
   37|   118k|BigInt Modular_Reducer::reduce(const BigInt& x) const {
   38|   118k|   BigInt r;
   39|   118k|   secure_vector<word> ws;
   40|   118k|   reduce(r, x, ws);
   41|   118k|   return r;
   42|   118k|}
_ZNK5Botan15Modular_Reducer6reduceERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   69|   118k|void Modular_Reducer::reduce(BigInt& t1, const BigInt& x, secure_vector<word>& ws) const {
   70|   118k|   if(&t1 == &x) {
  ------------------
  |  Branch (70:7): [True: 0, False: 118k]
  ------------------
   71|      0|      throw Invalid_State("Modular_Reducer arguments cannot alias");
   72|      0|   }
   73|   118k|   if(m_mod_words == 0) {
  ------------------
  |  Branch (73:7): [True: 0, False: 118k]
  ------------------
   74|      0|      throw Invalid_State("Modular_Reducer: Never initalized");
   75|      0|   }
   76|       |
   77|   118k|   const size_t x_sw = x.sig_words();
   78|       |
   79|   118k|   if(x_sw > 2 * m_mod_words) {
  ------------------
  |  Branch (79:7): [True: 0, False: 118k]
  ------------------
   80|       |      // too big, fall back to slow boat division
   81|      0|      t1 = ct_modulo(x, m_modulus);
   82|      0|      return;
   83|      0|   }
   84|       |
   85|   118k|   t1 = x;
   86|   118k|   t1.set_sign(BigInt::Positive);
   87|   118k|   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words - 1));
  ------------------
  |  |   50|   118k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   88|       |
   89|   118k|   t1.mul(m_mu, ws);
   90|   118k|   t1 >>= (BOTAN_MP_WORD_BITS * (m_mod_words + 1));
  ------------------
  |  |   50|   118k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   91|       |
   92|       |   // TODO add masked mul to avoid computing high bits
   93|   118k|   t1.mul(m_modulus, ws);
   94|   118k|   t1.mask_bits(BOTAN_MP_WORD_BITS * (m_mod_words + 1));
  ------------------
  |  |   50|   118k|#define BOTAN_MP_WORD_BITS 64
  ------------------
   95|       |
   96|   118k|   t1.rev_sub(x.data(), std::min(x_sw, m_mod_words + 1), ws);
   97|       |
   98|       |   /*
   99|       |   * If t1 < 0 then we must add b^(k+1) where b = 2^w. To avoid a
  100|       |   * side channel perform the addition unconditionally, with ws set
  101|       |   * to either b^(k+1) or else 0.
  102|       |   */
  103|   118k|   const word t1_neg = t1.is_negative();
  104|       |
  105|   118k|   if(ws.size() < m_mod_words + 2) {
  ------------------
  |  Branch (105:7): [True: 4.41k, False: 113k]
  ------------------
  106|  4.41k|      ws.resize(m_mod_words + 2);
  107|  4.41k|   }
  108|   118k|   clear_mem(ws.data(), ws.size());
  109|   118k|   ws[m_mod_words + 1] = t1_neg;
  110|       |
  111|   118k|   t1.add(ws.data(), m_mod_words + 2, BigInt::Positive);
  112|       |
  113|       |   // Per HAC this step requires at most 2 subtractions
  114|   118k|   t1.ct_reduce_below(m_modulus, ws, 2);
  115|       |
  116|   118k|   cnd_rev_sub(t1.is_nonzero() && x.is_negative(), t1, m_modulus.data(), m_modulus.size(), ws);
  ------------------
  |  Branch (116:16): [True: 118k, False: 0]
  |  Branch (116:35): [True: 0, False: 118k]
  ------------------
  117|   118k|}
reducer.cpp:_ZN5Botan12_GLOBAL__N_111cnd_rev_subEbRNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
   49|   118k|void cnd_rev_sub(bool cnd, BigInt& x, const word y[], size_t y_sw, secure_vector<word>& ws) {
   50|   118k|   if(x.sign() != BigInt::Positive) {
  ------------------
  |  Branch (50:7): [True: 0, False: 118k]
  ------------------
   51|      0|      throw Invalid_State("BigInt::sub_rev requires this is positive");
   52|      0|   }
   53|       |
   54|   118k|   const size_t x_sw = x.sig_words();
   55|       |
   56|   118k|   const size_t max_words = std::max(x_sw, y_sw);
   57|   118k|   ws.resize(std::max(x_sw, y_sw));
   58|   118k|   clear_mem(ws.data(), ws.size());
   59|   118k|   x.grow_to(max_words);
   60|       |
   61|   118k|   const int32_t relative_size = bigint_sub_abs(ws.data(), x.data(), x_sw, y, y_sw);
   62|       |
   63|   118k|   x.cond_flip_sign((relative_size > 0) && cnd);
  ------------------
  |  Branch (63:21): [True: 0, False: 118k]
  |  Branch (63:44): [True: 0, False: 0]
  ------------------
   64|   118k|   bigint_cnd_swap(cnd, x.mutable_data(), ws.data(), max_words);
   65|   118k|}

_ZN5Botan9AEAD_Mode15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_10Cipher_DirES5_:
   45|    473|                                                      std::string_view provider) {
   46|    473|   if(auto aead = AEAD_Mode::create(algo, dir, provider)) {
  ------------------
  |  Branch (46:12): [True: 473, False: 0]
  ------------------
   47|    473|      return aead;
   48|    473|   }
   49|       |
   50|      0|   throw Lookup_Error("AEAD", algo, provider);
   51|    473|}
_ZN5Botan9AEAD_Mode6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEENS_10Cipher_DirES5_:
   53|    846|std::unique_ptr<AEAD_Mode> AEAD_Mode::create(std::string_view algo, Cipher_Dir dir, std::string_view provider) {
   54|    846|   BOTAN_UNUSED(provider);
  ------------------
  |  |  118|    846|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   55|    846|#if defined(BOTAN_HAS_AEAD_CHACHA20_POLY1305)
   56|    846|   if(algo == "ChaCha20Poly1305") {
  ------------------
  |  Branch (56:7): [True: 100, False: 746]
  ------------------
   57|    100|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (57:10): [True: 37, False: 63]
  ------------------
   58|     37|         return std::make_unique<ChaCha20Poly1305_Encryption>();
   59|     63|      } else {
   60|     63|         return std::make_unique<ChaCha20Poly1305_Decryption>();
   61|     63|      }
   62|    100|   }
   63|    746|#endif
   64|       |
   65|    746|   if(algo.find('/') != std::string::npos) {
  ------------------
  |  Branch (65:7): [True: 373, False: 373]
  ------------------
   66|    373|      const std::vector<std::string> algo_parts = split_on(algo, '/');
   67|    373|      std::string_view cipher_name = algo_parts[0];
   68|    373|      const std::vector<std::string> mode_info = parse_algorithm_name(algo_parts[1]);
   69|       |
   70|    373|      if(mode_info.empty()) {
  ------------------
  |  Branch (70:10): [True: 0, False: 373]
  ------------------
   71|      0|         return std::unique_ptr<AEAD_Mode>();
   72|      0|      }
   73|       |
   74|    373|      std::ostringstream mode_name;
   75|       |
   76|    373|      mode_name << mode_info[0] << '(' << cipher_name;
   77|    559|      for(size_t i = 1; i < mode_info.size(); ++i) {
  ------------------
  |  Branch (77:25): [True: 186, False: 373]
  ------------------
   78|    186|         mode_name << ',' << mode_info[i];
   79|    186|      }
   80|    373|      for(size_t i = 2; i < algo_parts.size(); ++i) {
  ------------------
  |  Branch (80:25): [True: 0, False: 373]
  ------------------
   81|      0|         mode_name << ',' << algo_parts[i];
   82|      0|      }
   83|    373|      mode_name << ')';
   84|       |
   85|    373|      return AEAD_Mode::create(mode_name.str(), dir);
   86|    373|   }
   87|       |
   88|    373|#if defined(BOTAN_HAS_BLOCK_CIPHER)
   89|       |
   90|    373|   SCAN_Name req(algo);
   91|       |
   92|    373|   if(req.arg_count() == 0) {
  ------------------
  |  Branch (92:7): [True: 0, False: 373]
  ------------------
   93|      0|      return std::unique_ptr<AEAD_Mode>();
   94|      0|   }
   95|       |
   96|    373|   auto bc = BlockCipher::create(req.arg(0), provider);
   97|       |
   98|    373|   if(!bc) {
  ------------------
  |  Branch (98:7): [True: 0, False: 373]
  ------------------
   99|      0|      return std::unique_ptr<AEAD_Mode>();
  100|      0|   }
  101|       |
  102|    373|   #if defined(BOTAN_HAS_AEAD_CCM)
  103|    373|   if(req.algo_name() == "CCM") {
  ------------------
  |  Branch (103:7): [True: 54, False: 319]
  ------------------
  104|     54|      size_t tag_len = req.arg_as_integer(1, 16);
  105|     54|      size_t L_len = req.arg_as_integer(2, 3);
  106|     54|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (106:10): [True: 11, False: 43]
  ------------------
  107|     11|         return std::make_unique<CCM_Encryption>(std::move(bc), tag_len, L_len);
  108|     43|      } else {
  109|     43|         return std::make_unique<CCM_Decryption>(std::move(bc), tag_len, L_len);
  110|     43|      }
  111|     54|   }
  112|    319|   #endif
  113|       |
  114|    319|   #if defined(BOTAN_HAS_AEAD_GCM)
  115|    319|   if(req.algo_name() == "GCM") {
  ------------------
  |  Branch (115:7): [True: 182, False: 137]
  ------------------
  116|    182|      size_t tag_len = req.arg_as_integer(1, 16);
  117|    182|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (117:10): [True: 54, False: 128]
  ------------------
  118|     54|         return std::make_unique<GCM_Encryption>(std::move(bc), tag_len);
  119|    128|      } else {
  120|    128|         return std::make_unique<GCM_Decryption>(std::move(bc), tag_len);
  121|    128|      }
  122|    182|   }
  123|    137|   #endif
  124|       |
  125|    137|   #if defined(BOTAN_HAS_AEAD_OCB)
  126|    137|   if(req.algo_name() == "OCB") {
  ------------------
  |  Branch (126:7): [True: 137, False: 0]
  ------------------
  127|    137|      size_t tag_len = req.arg_as_integer(1, 16);
  128|    137|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (128:10): [True: 45, False: 92]
  ------------------
  129|     45|         return std::make_unique<OCB_Encryption>(std::move(bc), tag_len);
  130|     92|      } else {
  131|     92|         return std::make_unique<OCB_Decryption>(std::move(bc), tag_len);
  132|     92|      }
  133|    137|   }
  134|      0|   #endif
  135|       |
  136|      0|   #if defined(BOTAN_HAS_AEAD_EAX)
  137|      0|   if(req.algo_name() == "EAX") {
  ------------------
  |  Branch (137:7): [True: 0, False: 0]
  ------------------
  138|      0|      size_t tag_len = req.arg_as_integer(1, bc->block_size());
  139|      0|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (139:10): [True: 0, False: 0]
  ------------------
  140|      0|         return std::make_unique<EAX_Encryption>(std::move(bc), tag_len);
  141|      0|      } else {
  142|      0|         return std::make_unique<EAX_Decryption>(std::move(bc), tag_len);
  143|      0|      }
  144|      0|   }
  145|      0|   #endif
  146|       |
  147|      0|   #if defined(BOTAN_HAS_AEAD_SIV)
  148|      0|   if(req.algo_name() == "SIV") {
  ------------------
  |  Branch (148:7): [True: 0, False: 0]
  ------------------
  149|      0|      if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (149:10): [True: 0, False: 0]
  ------------------
  150|      0|         return std::make_unique<SIV_Encryption>(std::move(bc));
  151|      0|      } else {
  152|      0|         return std::make_unique<SIV_Decryption>(std::move(bc));
  153|      0|      }
  154|      0|   }
  155|      0|   #endif
  156|       |
  157|      0|#endif
  158|       |
  159|      0|   return std::unique_ptr<AEAD_Mode>();
  160|      0|}

_ZN5Botan8CCM_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEmm:
   23|     54|      m_tag_size(tag_size), m_L(L), m_cipher(std::move(cipher)) {
   24|     54|   if(m_cipher->block_size() != CCM_BS) {
  ------------------
  |  Branch (24:7): [True: 0, False: 54]
  ------------------
   25|      0|      throw Invalid_Argument(m_cipher->name() + " cannot be used with CCM mode");
   26|      0|   }
   27|       |
   28|     54|   if(L < 2 || L > 8) {
  ------------------
  |  Branch (28:7): [True: 0, False: 54]
  |  Branch (28:16): [True: 0, False: 54]
  ------------------
   29|      0|      throw Invalid_Argument(fmt("Invalid CCM L value {}", L));
   30|      0|   }
   31|       |
   32|     54|   if(tag_size < 4 || tag_size > 16 || tag_size % 2 != 0) {
  ------------------
  |  Branch (32:7): [True: 0, False: 54]
  |  Branch (32:23): [True: 0, False: 54]
  |  Branch (32:40): [True: 0, False: 54]
  ------------------
   33|      0|      throw Invalid_Argument(fmt("Invalid CCM tag length {}", tag_size));
   34|      0|   }
   35|     54|}
_ZN5Botan8CCM_Mode5resetEv:
   42|     20|void CCM_Mode::reset() {
   43|     20|   m_nonce.clear();
   44|     20|   m_msg_buf.clear();
   45|     20|   m_ad_buf.clear();
   46|     20|}
_ZNK5Botan8CCM_Mode18valid_nonce_lengthEm:
   50|     55|bool CCM_Mode::valid_nonce_length(size_t n) const { return (n == (15 - L())); }
_ZNK5Botan8CCM_Mode8key_specEv:
   63|     54|Key_Length_Specification CCM_Mode::key_spec() const { return m_cipher->key_spec(); }
_ZN5Botan8CCM_Mode12key_scheduleEPKhm:
   67|     54|void CCM_Mode::key_schedule(const uint8_t key[], size_t length) { m_cipher->set_key(key, length); }
_ZN5Botan8CCM_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
   69|     55|void CCM_Mode::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
   70|     55|   BOTAN_ARG_CHECK(idx == 0, "CCM: cannot handle non-zero index in set_associated_data_n");
  ------------------
  |  |   30|     55|   do {                                                          \
  |  |   31|     55|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 55]
  |  |  ------------------
  |  |   32|     55|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     55|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   71|       |
   72|     55|   m_ad_buf.clear();
   73|       |
   74|     55|   if(!ad.empty()) {
  ------------------
  |  Branch (74:7): [True: 55, False: 0]
  ------------------
   75|       |      // FIXME: support larger AD using length encoding rules
   76|     55|      BOTAN_ARG_CHECK(ad.size() < (0xFFFF - 0xFF), "Supported CCM AD length");
  ------------------
  |  |   30|     55|   do {                                                          \
  |  |   31|     55|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 55]
  |  |  ------------------
  |  |   32|     55|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     55|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   77|       |
   78|     55|      m_ad_buf.push_back(get_byte<0>(static_cast<uint16_t>(ad.size())));
   79|     55|      m_ad_buf.push_back(get_byte<1>(static_cast<uint16_t>(ad.size())));
   80|     55|      m_ad_buf.insert(m_ad_buf.end(), ad.begin(), ad.end());
   81|    110|      while(m_ad_buf.size() % CCM_BS) {
  ------------------
  |  Branch (81:13): [True: 55, False: 55]
  ------------------
   82|     55|         m_ad_buf.push_back(0);  // pad with zeros to full block size
   83|     55|      }
   84|     55|   }
   85|     55|}
_ZN5Botan8CCM_Mode9start_msgEPKhm:
   87|     55|void CCM_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
   88|     55|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (88:7): [True: 0, False: 55]
  ------------------
   89|      0|      throw Invalid_IV_Length(name(), nonce_len);
   90|      0|   }
   91|       |
   92|     55|   m_nonce.assign(nonce, nonce + nonce_len);
   93|     55|   m_msg_buf.clear();
   94|     55|}
_ZN5Botan8CCM_Mode13encode_lengthEmPh:
  102|     55|void CCM_Mode::encode_length(uint64_t len, uint8_t out[]) {
  103|     55|   const size_t len_bytes = L();
  104|       |
  105|     55|   BOTAN_ASSERT_NOMSG(len_bytes >= 2 && len_bytes <= 8);
  ------------------
  |  |   60|     55|   do {                                                                     \
  |  |   61|    110|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:12): [True: 55, False: 0]
  |  |  |  Branch (61:12): [True: 55, False: 0]
  |  |  ------------------
  |  |   62|     55|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     55|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  106|       |
  107|    220|   for(size_t i = 0; i != len_bytes; ++i) {
  ------------------
  |  Branch (107:22): [True: 165, False: 55]
  ------------------
  108|    165|      out[len_bytes - 1 - i] = get_byte_var(sizeof(uint64_t) - 1 - i, len);
  109|    165|   }
  110|       |
  111|     55|   if(len_bytes < 8 && (len >> (len_bytes * 8)) > 0) {
  ------------------
  |  Branch (111:7): [True: 55, False: 0]
  |  Branch (111:24): [True: 0, False: 55]
  ------------------
  112|      0|      throw Encoding_Error("CCM message length too long to encode in L field");
  113|      0|   }
  114|     55|}
_ZN5Botan8CCM_Mode3incERNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  116|  1.92k|void CCM_Mode::inc(secure_vector<uint8_t>& C) {
  117|  1.92k|   for(size_t i = 0; i != C.size(); ++i) {
  ------------------
  |  Branch (117:22): [True: 1.92k, False: 0]
  ------------------
  118|  1.92k|      if(++C[C.size() - i - 1]) {
  ------------------
  |  Branch (118:10): [True: 1.92k, False: 2]
  ------------------
  119|  1.92k|         break;
  120|  1.92k|      }
  121|  1.92k|   }
  122|  1.92k|}
_ZN5Botan8CCM_Mode9format_b0Em:
  124|     55|secure_vector<uint8_t> CCM_Mode::format_b0(size_t sz) {
  125|     55|   if(m_nonce.size() != 15 - L()) {
  ------------------
  |  Branch (125:7): [True: 0, False: 55]
  ------------------
  126|      0|      throw Invalid_State("CCM mode must set nonce");
  127|      0|   }
  128|     55|   secure_vector<uint8_t> B0(CCM_BS);
  129|       |
  130|     55|   const uint8_t b_flags =
  131|     55|      static_cast<uint8_t>((!m_ad_buf.empty() ? 64 : 0) + (((tag_size() / 2) - 1) << 3) + (L() - 1));
  ------------------
  |  Branch (131:29): [True: 55, False: 0]
  ------------------
  132|       |
  133|     55|   B0[0] = b_flags;
  134|     55|   copy_mem(&B0[1], m_nonce.data(), m_nonce.size());
  135|     55|   encode_length(sz, &B0[m_nonce.size() + 1]);
  136|       |
  137|     55|   return B0;
  138|     55|}
_ZN5Botan8CCM_Mode9format_c0Ev:
  140|     55|secure_vector<uint8_t> CCM_Mode::format_c0() {
  141|     55|   if(m_nonce.size() != 15 - L()) {
  ------------------
  |  Branch (141:7): [True: 0, False: 55]
  ------------------
  142|      0|      throw Invalid_State("CCM mode must set nonce");
  143|      0|   }
  144|     55|   secure_vector<uint8_t> C(CCM_BS);
  145|       |
  146|     55|   const uint8_t a_flags = static_cast<uint8_t>(L() - 1);
  147|       |
  148|     55|   C[0] = a_flags;
  149|     55|   copy_mem(&C[1], m_nonce.data(), m_nonce.size());
  150|       |
  151|     55|   return C;
  152|     55|}
_ZN5Botan14CCM_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  154|     20|void CCM_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  155|     20|   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");
  ------------------
  |  |   30|     20|   do {                                                          \
  |  |   31|     20|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 20]
  |  |  ------------------
  |  |   32|     20|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     20|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  156|       |
  157|     20|   buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end());
  158|       |
  159|     20|   const size_t sz = buffer.size() - offset;
  160|     20|   uint8_t* buf = buffer.data() + offset;
  161|       |
  162|     20|   const secure_vector<uint8_t>& ad = ad_buf();
  163|     20|   BOTAN_ARG_CHECK(ad.size() % CCM_BS == 0, "AD is block size multiple");
  ------------------
  |  |   30|     20|   do {                                                          \
  |  |   31|     20|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 20]
  |  |  ------------------
  |  |   32|     20|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     20|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  164|       |
  165|     20|   const BlockCipher& E = cipher();
  166|       |
  167|     20|   secure_vector<uint8_t> T(CCM_BS);
  168|     20|   E.encrypt(format_b0(sz), T);
  169|       |
  170|     40|   for(size_t i = 0; i != ad.size(); i += CCM_BS) {
  ------------------
  |  Branch (170:22): [True: 20, False: 20]
  ------------------
  171|     20|      xor_buf(T.data(), &ad[i], CCM_BS);
  172|     20|      E.encrypt(T);
  173|     20|   }
  174|       |
  175|     20|   secure_vector<uint8_t> C = format_c0();
  176|     20|   secure_vector<uint8_t> S0(CCM_BS);
  177|     20|   E.encrypt(C, S0);
  178|     20|   inc(C);
  179|       |
  180|     20|   secure_vector<uint8_t> X(CCM_BS);
  181|       |
  182|     20|   const uint8_t* buf_end = &buf[sz];
  183|       |
  184|     40|   while(buf != buf_end) {
  ------------------
  |  Branch (184:10): [True: 20, False: 20]
  ------------------
  185|     20|      const size_t to_proc = std::min<size_t>(CCM_BS, buf_end - buf);
  186|       |
  187|     20|      xor_buf(T.data(), buf, to_proc);
  188|     20|      E.encrypt(T);
  189|       |
  190|     20|      E.encrypt(C, X);
  191|     20|      xor_buf(buf, X.data(), to_proc);
  192|     20|      inc(C);
  193|       |
  194|     20|      buf += to_proc;
  195|     20|   }
  196|       |
  197|     20|   T ^= S0;
  198|       |
  199|     20|   buffer += std::make_pair(T.data(), tag_size());
  200|       |
  201|     20|   reset();
  202|     20|}
_ZN5Botan14CCM_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  204|     35|void CCM_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  205|     35|   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");
  ------------------
  |  |   30|     35|   do {                                                          \
  |  |   31|     35|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 35]
  |  |  ------------------
  |  |   32|     35|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     35|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  206|       |
  207|     35|   buffer.insert(buffer.begin() + offset, msg_buf().begin(), msg_buf().end());
  208|       |
  209|     35|   const size_t sz = buffer.size() - offset;
  210|     35|   uint8_t* buf = buffer.data() + offset;
  211|       |
  212|     35|   BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag");
  ------------------
  |  |   30|     35|   do {                                                          \
  |  |   31|     35|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 35]
  |  |  ------------------
  |  |   32|     35|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     35|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  213|       |
  214|     35|   const secure_vector<uint8_t>& ad = ad_buf();
  215|     35|   BOTAN_ARG_CHECK(ad.size() % CCM_BS == 0, "AD is block size multiple");
  ------------------
  |  |   30|     35|   do {                                                          \
  |  |   31|     35|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 35]
  |  |  ------------------
  |  |   32|     35|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     35|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  216|       |
  217|     35|   const BlockCipher& E = cipher();
  218|       |
  219|     35|   secure_vector<uint8_t> T(CCM_BS);
  220|     35|   E.encrypt(format_b0(sz - tag_size()), T);
  221|       |
  222|     70|   for(size_t i = 0; i != ad.size(); i += CCM_BS) {
  ------------------
  |  Branch (222:22): [True: 35, False: 35]
  ------------------
  223|     35|      xor_buf(T.data(), &ad[i], CCM_BS);
  224|     35|      E.encrypt(T);
  225|     35|   }
  226|       |
  227|     35|   secure_vector<uint8_t> C = format_c0();
  228|       |
  229|     35|   secure_vector<uint8_t> S0(CCM_BS);
  230|     35|   E.encrypt(C, S0);
  231|     35|   inc(C);
  232|       |
  233|     35|   secure_vector<uint8_t> X(CCM_BS);
  234|       |
  235|     35|   const uint8_t* buf_end = &buf[sz - tag_size()];
  236|       |
  237|  1.88k|   while(buf != buf_end) {
  ------------------
  |  Branch (237:10): [True: 1.84k, False: 35]
  ------------------
  238|  1.84k|      const size_t to_proc = std::min<size_t>(CCM_BS, buf_end - buf);
  239|       |
  240|  1.84k|      E.encrypt(C, X);
  241|  1.84k|      xor_buf(buf, X.data(), to_proc);
  242|  1.84k|      inc(C);
  243|       |
  244|  1.84k|      xor_buf(T.data(), buf, to_proc);
  245|  1.84k|      E.encrypt(T);
  246|       |
  247|  1.84k|      buf += to_proc;
  248|  1.84k|   }
  249|       |
  250|     35|   T ^= S0;
  251|       |
  252|     35|   if(!constant_time_compare(T.data(), buf_end, tag_size())) {
  ------------------
  |  Branch (252:7): [True: 35, False: 0]
  ------------------
  253|     35|      throw Invalid_Authentication_Tag("CCM tag check failed");
  254|     35|   }
  255|       |
  256|      0|   buffer.resize(buffer.size() - tag_size());
  257|       |
  258|      0|   reset();
  259|      0|}

_ZN5Botan21ChaCha20Poly1305_ModeC2Ev:
   16|    100|      m_chacha(StreamCipher::create("ChaCha")), m_poly1305(MessageAuthenticationCode::create("Poly1305")) {
   17|    100|   if(!m_chacha || !m_poly1305) {
  ------------------
  |  Branch (17:7): [True: 0, False: 100]
  |  Branch (17:20): [True: 0, False: 100]
  ------------------
   18|      0|      throw Algorithm_Not_Found("ChaCha20Poly1305");
   19|      0|   }
   20|    100|}
_ZNK5Botan21ChaCha20Poly1305_Mode18valid_nonce_lengthEm:
   22|    106|bool ChaCha20Poly1305_Mode::valid_nonce_length(size_t n) const { return (n == 8 || n == 12 || n == 24); }
  ------------------
  |  Branch (22:74): [True: 0, False: 106]
  |  Branch (22:84): [True: 106, False: 0]
  |  Branch (22:95): [True: 0, False: 0]
  ------------------
_ZN5Botan21ChaCha20Poly1305_Mode12key_scheduleEPKhm:
   42|    100|void ChaCha20Poly1305_Mode::key_schedule(const uint8_t key[], size_t length) { m_chacha->set_key(key, length); }
_ZN5Botan21ChaCha20Poly1305_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
   44|    106|void ChaCha20Poly1305_Mode::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
   45|    106|   BOTAN_ARG_CHECK(idx == 0, "ChaCha20Poly1305: cannot handle non-zero index in set_associated_data_n");
  ------------------
  |  |   30|    106|   do {                                                          \
  |  |   31|    106|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 106]
  |  |  ------------------
  |  |   32|    106|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    106|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   46|    106|   if(m_ctext_len > 0 || m_nonce_len > 0) {
  ------------------
  |  Branch (46:7): [True: 0, False: 106]
  |  Branch (46:26): [True: 0, False: 106]
  ------------------
   47|      0|      throw Invalid_State("Cannot set AD for ChaCha20Poly1305 while processing a message");
   48|      0|   }
   49|    106|   m_ad.assign(ad.begin(), ad.end());
   50|    106|}
_ZN5Botan21ChaCha20Poly1305_Mode10update_lenEm:
   52|    212|void ChaCha20Poly1305_Mode::update_len(size_t len) {
   53|    212|   uint8_t len8[8] = {0};
   54|    212|   store_le(static_cast<uint64_t>(len), len8);
   55|    212|   m_poly1305->update(len8, 8);
   56|    212|}
_ZN5Botan21ChaCha20Poly1305_Mode9start_msgEPKhm:
   58|    106|void ChaCha20Poly1305_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
   59|    106|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (59:7): [True: 0, False: 106]
  ------------------
   60|      0|      throw Invalid_IV_Length(name(), nonce_len);
   61|      0|   }
   62|       |
   63|    106|   m_ctext_len = 0;
   64|    106|   m_nonce_len = nonce_len;
   65|       |
   66|    106|   m_chacha->set_iv(nonce, nonce_len);
   67|       |
   68|    106|   uint8_t first_block[64];
   69|    106|   m_chacha->write_keystream(first_block, sizeof(first_block));
   70|       |
   71|    106|   m_poly1305->set_key(first_block, 32);
   72|       |   // Remainder of first block is discarded
   73|    106|   secure_scrub_memory(first_block, sizeof(first_block));
   74|       |
   75|    106|   m_poly1305->update(m_ad);
   76|       |
   77|    106|   if(cfrg_version()) {
  ------------------
  |  Branch (77:7): [True: 106, False: 0]
  ------------------
   78|    106|      if(m_ad.size() % 16) {
  ------------------
  |  Branch (78:10): [True: 106, False: 0]
  ------------------
   79|    106|         const uint8_t zeros[16] = {0};
   80|    106|         m_poly1305->update(zeros, 16 - m_ad.size() % 16);
   81|    106|      }
   82|    106|   } else {
   83|      0|      update_len(m_ad.size());
   84|      0|   }
   85|    106|}
_ZN5Botan27ChaCha20Poly1305_Encryption11process_msgEPhm:
   87|     63|size_t ChaCha20Poly1305_Encryption::process_msg(uint8_t buf[], size_t sz) {
   88|     63|   m_chacha->cipher1(buf, sz);
   89|     63|   m_poly1305->update(buf, sz);  // poly1305 of ciphertext
   90|     63|   m_ctext_len += sz;
   91|     63|   return sz;
   92|     63|}
_ZN5Botan27ChaCha20Poly1305_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
   94|     63|void ChaCha20Poly1305_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
   95|     63|   update(buffer, offset);
   96|     63|   if(cfrg_version()) {
  ------------------
  |  Branch (96:7): [True: 63, False: 0]
  ------------------
   97|     63|      if(m_ctext_len % 16) {
  ------------------
  |  Branch (97:10): [True: 26, False: 37]
  ------------------
   98|     26|         const uint8_t zeros[16] = {0};
   99|     26|         m_poly1305->update(zeros, 16 - m_ctext_len % 16);
  100|     26|      }
  101|     63|      update_len(m_ad.size());
  102|     63|   }
  103|     63|   update_len(m_ctext_len);
  104|       |
  105|     63|   buffer.resize(buffer.size() + tag_size());
  106|     63|   m_poly1305->final(&buffer[buffer.size() - tag_size()]);
  107|     63|   m_ctext_len = 0;
  108|     63|   m_nonce_len = 0;
  109|     63|}
_ZN5Botan27ChaCha20Poly1305_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  118|     43|void ChaCha20Poly1305_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  119|     43|   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");
  ------------------
  |  |   30|     43|   do {                                                          \
  |  |   31|     43|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 43]
  |  |  ------------------
  |  |   32|     43|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     43|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  120|     43|   const size_t sz = buffer.size() - offset;
  121|     43|   uint8_t* buf = buffer.data() + offset;
  122|       |
  123|     43|   BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag");
  ------------------
  |  |   30|     43|   do {                                                          \
  |  |   31|     43|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 43]
  |  |  ------------------
  |  |   32|     43|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     43|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|       |
  125|     43|   const size_t remaining = sz - tag_size();
  126|       |
  127|     43|   if(remaining) {
  ------------------
  |  Branch (127:7): [True: 38, False: 5]
  ------------------
  128|     38|      m_poly1305->update(buf, remaining);  // poly1305 of ciphertext
  129|     38|      m_chacha->cipher1(buf, remaining);
  130|     38|      m_ctext_len += remaining;
  131|     38|   }
  132|       |
  133|     43|   if(cfrg_version()) {
  ------------------
  |  Branch (133:7): [True: 43, False: 0]
  ------------------
  134|     43|      if(m_ctext_len % 16) {
  ------------------
  |  Branch (134:10): [True: 29, False: 14]
  ------------------
  135|     29|         const uint8_t zeros[16] = {0};
  136|     29|         m_poly1305->update(zeros, 16 - m_ctext_len % 16);
  137|     29|      }
  138|     43|      update_len(m_ad.size());
  139|     43|   }
  140|       |
  141|     43|   update_len(m_ctext_len);
  142|       |
  143|     43|   uint8_t mac[16];
  144|     43|   m_poly1305->final(mac);
  145|       |
  146|     43|   const uint8_t* included_tag = &buf[remaining];
  147|       |
  148|     43|   m_ctext_len = 0;
  149|     43|   m_nonce_len = 0;
  150|       |
  151|     43|   if(!constant_time_compare(mac, included_tag, tag_size())) {
  ------------------
  |  Branch (151:7): [True: 43, False: 0]
  ------------------
  152|     43|      throw Invalid_Authentication_Tag("ChaCha20Poly1305 tag check failed");
  153|     43|   }
  154|      0|   buffer.resize(offset + remaining);
  155|      0|}

_ZN5Botan8GCM_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
   22|    182|      m_tag_size(tag_size), m_cipher_name(cipher->name()) {
   23|    182|   if(cipher->block_size() != GCM_BS) {
  ------------------
  |  Branch (23:7): [True: 0, False: 182]
  ------------------
   24|      0|      throw Invalid_Argument("Invalid block cipher for GCM");
   25|      0|   }
   26|       |
   27|       |   /* We allow any of the values 128, 120, 112, 104, or 96 bits as a tag size */
   28|       |   /* 64 bit tag is still supported but deprecated and will be removed in the future */
   29|    182|   if(m_tag_size != 8 && (m_tag_size < 12 || m_tag_size > 16)) {
  ------------------
  |  Branch (29:7): [True: 182, False: 0]
  |  Branch (29:27): [True: 0, False: 182]
  |  Branch (29:46): [True: 0, False: 182]
  ------------------
   30|      0|      throw Invalid_Argument(fmt("{} cannot use a tag of {} bytes", name(), m_tag_size));
   31|      0|   }
   32|       |
   33|    182|   m_ctr = std::make_unique<CTR_BE>(std::move(cipher), 4);
   34|    182|   m_ghash = std::make_unique<GHASH>();
   35|    182|}
_ZN5Botan8GCM_ModeD2Ev:
   37|    182|GCM_Mode::~GCM_Mode() = default;
_ZNK5Botan8GCM_Mode18valid_nonce_lengthEm:
   55|    187|bool GCM_Mode::valid_nonce_length(size_t len) const {
   56|       |   // GCM does not support empty nonces
   57|    187|   return (len > 0);
   58|    187|}
_ZNK5Botan8GCM_Mode8key_specEv:
   60|    182|Key_Length_Specification GCM_Mode::key_spec() const { return m_ctr->key_spec(); }
_ZN5Botan8GCM_Mode12key_scheduleEPKhm:
   64|    182|void GCM_Mode::key_schedule(const uint8_t key[], size_t keylen) {
   65|    182|   m_ctr->set_key(key, keylen);
   66|       |
   67|    182|   const std::vector<uint8_t> zeros(GCM_BS);
   68|    182|   m_ctr->set_iv(zeros.data(), zeros.size());
   69|       |
   70|    182|   secure_vector<uint8_t> H(GCM_BS);
   71|    182|   m_ctr->encipher(H);
   72|    182|   m_ghash->set_key(H);
   73|    182|}
_ZN5Botan8GCM_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
   75|    187|void GCM_Mode::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
   76|    187|   BOTAN_ARG_CHECK(idx == 0, "GCM: cannot handle non-zero index in set_associated_data_n");
  ------------------
  |  |   30|    187|   do {                                                          \
  |  |   31|    187|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 187]
  |  |  ------------------
  |  |   32|    187|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    187|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   77|    187|   m_ghash->set_associated_data(ad.data(), ad.size());
   78|    187|}
_ZN5Botan8GCM_Mode9start_msgEPKhm:
   80|    187|void GCM_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
   81|    187|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (81:7): [True: 0, False: 187]
  ------------------
   82|      0|      throw Invalid_IV_Length(name(), nonce_len);
   83|      0|   }
   84|       |
   85|    187|   if(m_y0.size() != GCM_BS) {
  ------------------
  |  Branch (85:7): [True: 149, False: 38]
  ------------------
   86|    149|      m_y0.resize(GCM_BS);
   87|    149|   }
   88|       |
   89|    187|   clear_mem(m_y0.data(), m_y0.size());
   90|       |
   91|    187|   if(nonce_len == 12) {
  ------------------
  |  Branch (91:7): [True: 187, False: 0]
  ------------------
   92|    187|      copy_mem(m_y0.data(), nonce, nonce_len);
   93|    187|      m_y0[15] = 1;
   94|    187|   } else {
   95|      0|      m_ghash->nonce_hash(m_y0, nonce, nonce_len);
   96|      0|   }
   97|       |
   98|    187|   m_ctr->set_iv(m_y0.data(), m_y0.size());
   99|       |
  100|    187|   clear_mem(m_y0.data(), m_y0.size());
  101|    187|   m_ctr->encipher(m_y0);
  102|       |
  103|    187|   m_ghash->start(m_y0.data(), m_y0.size());
  104|    187|   clear_mem(m_y0.data(), m_y0.size());
  105|    187|}
_ZN5Botan14GCM_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  114|     92|void GCM_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  115|     92|   BOTAN_ARG_CHECK(offset <= buffer.size(), "Invalid offset");
  ------------------
  |  |   30|     92|   do {                                                          \
  |  |   31|     92|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 92]
  |  |  ------------------
  |  |   32|     92|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     92|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|     92|   const size_t sz = buffer.size() - offset;
  117|     92|   uint8_t* buf = buffer.data() + offset;
  118|       |
  119|     92|   m_ctr->cipher(buf, buf, sz);
  120|     92|   m_ghash->update(buf, sz);
  121|       |
  122|     92|   uint8_t mac[16] = {0};
  123|     92|   m_ghash->final(mac, tag_size());
  124|     92|   buffer += std::make_pair(mac, tag_size());
  125|     92|}
_ZN5Botan14GCM_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  134|     95|void GCM_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  135|     95|   BOTAN_ARG_CHECK(offset <= buffer.size(), "Invalid offset");
  ------------------
  |  |   30|     95|   do {                                                          \
  |  |   31|     95|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 95]
  |  |  ------------------
  |  |   32|     95|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     95|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  136|     95|   const size_t sz = buffer.size() - offset;
  137|     95|   uint8_t* buf = buffer.data() + offset;
  138|       |
  139|     95|   BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag");
  ------------------
  |  |   30|     95|   do {                                                          \
  |  |   31|     95|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 95]
  |  |  ------------------
  |  |   32|     95|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     95|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  140|       |
  141|     95|   const size_t remaining = sz - tag_size();
  142|       |
  143|       |   // handle any final input before the tag
  144|     95|   if(remaining) {
  ------------------
  |  Branch (144:7): [True: 90, False: 5]
  ------------------
  145|     90|      m_ghash->update(buf, remaining);
  146|     90|      m_ctr->cipher(buf, buf, remaining);
  147|     90|   }
  148|       |
  149|     95|   uint8_t mac[16] = {0};
  150|     95|   m_ghash->final(mac, tag_size());
  151|       |
  152|     95|   const uint8_t* included_tag = &buffer[remaining + offset];
  153|       |
  154|     95|   if(!constant_time_compare(mac, included_tag, tag_size())) {
  ------------------
  |  Branch (154:7): [True: 95, False: 0]
  ------------------
  155|     95|      throw Invalid_Authentication_Tag("GCM tag check failed");
  156|     95|   }
  157|       |
  158|      0|   buffer.resize(offset + remaining);
  159|      0|}

_ZN5Botan8OCB_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
  154|    137|      m_par_blocks(m_cipher->parallel_bytes() / m_block_size) {
  155|    137|   const size_t BS = block_size();
  156|       |
  157|       |   /*
  158|       |   * draft-krovetz-ocb-wide-d1 specifies OCB for several other block
  159|       |   * sizes but only 128, 192, 256 and 512 bit are currently supported
  160|       |   * by this implementation.
  161|       |   */
  162|    137|   BOTAN_ARG_CHECK(BS == 16 || BS == 24 || BS == 32 || BS == 64, "Invalid block size for OCB");
  ------------------
  |  |   30|    137|   do {                                                          \
  |  |   31|    411|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 137, False: 0]
  |  |  |  Branch (31:12): [True: 0, False: 0]
  |  |  |  Branch (31:12): [True: 0, False: 0]
  |  |  |  Branch (31:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   32|    137|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    137|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|       |
  164|    137|   BOTAN_ARG_CHECK(m_tag_size % 4 == 0 && m_tag_size >= 8 && m_tag_size <= BS && m_tag_size <= 32,
  ------------------
  |  |   30|    137|   do {                                                          \
  |  |   31|    822|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 137, False: 0]
  |  |  |  Branch (31:12): [True: 137, False: 0]
  |  |  |  Branch (31:12): [True: 137, False: 0]
  |  |  |  Branch (31:12): [True: 137, False: 0]
  |  |  ------------------
  |  |   32|    137|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    137|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  165|    137|                   "Invalid OCB tag length");
  166|    137|}
_ZN5Botan8OCB_ModeD2Ev:
  168|    137|OCB_Mode::~OCB_Mode() = default;
_ZNK5Botan8OCB_Mode18valid_nonce_lengthEm:
  184|    126|bool OCB_Mode::valid_nonce_length(size_t length) const {
  185|    126|   if(length == 0) {
  ------------------
  |  Branch (185:7): [True: 0, False: 126]
  ------------------
  186|      0|      return false;
  187|      0|   }
  188|    126|   if(block_size() == 16) {
  ------------------
  |  Branch (188:7): [True: 126, False: 0]
  ------------------
  189|    126|      return length < 16;
  190|    126|   } else {
  191|      0|      return length < (block_size() - 1);
  192|      0|   }
  193|    126|}
_ZNK5Botan8OCB_Mode8key_specEv:
  203|    137|Key_Length_Specification OCB_Mode::key_spec() const { return m_cipher->key_spec(); }
_ZNK5Botan8OCB_Mode19has_keying_materialEv:
  205|    501|bool OCB_Mode::has_keying_material() const { return m_cipher->has_keying_material(); }
_ZN5Botan8OCB_Mode12key_scheduleEPKhm:
  207|    137|void OCB_Mode::key_schedule(const uint8_t key[], size_t length) {
  208|    137|   m_cipher->set_key(key, length);
  209|    137|   m_L = std::make_unique<L_computer>(*m_cipher);
  210|    137|}
_ZN5Botan8OCB_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
  212|    126|void OCB_Mode::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
  213|    126|   BOTAN_ARG_CHECK(idx == 0, "OCB: cannot handle non-zero index in set_associated_data_n");
  ------------------
  |  |   30|    126|   do {                                                          \
  |  |   31|    126|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 126]
  |  |  ------------------
  |  |   32|    126|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    126|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  214|    126|   assert_key_material_set();
  215|    126|   m_ad_hash = ocb_hash(*m_L, *m_cipher, ad.data(), ad.size());
  216|    126|}
_ZN5Botan8OCB_Mode12update_nonceEPKhm:
  218|    126|const secure_vector<uint8_t>& OCB_Mode::update_nonce(const uint8_t nonce[], size_t nonce_len) {
  219|    126|   const size_t BS = block_size();
  220|       |
  221|    126|   BOTAN_ASSERT(BS == 16 || BS == 24 || BS == 32 || BS == 64, "OCB block size is supported");
  ------------------
  |  |   51|    126|   do {                                                                                 \
  |  |   52|    378|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 126, False: 0]
  |  |  |  Branch (52:12): [True: 0, False: 0]
  |  |  |  Branch (52:12): [True: 0, False: 0]
  |  |  |  Branch (52:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   53|    126|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    126|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  222|       |
  223|    126|   const size_t MASKLEN = (BS == 16 ? 6 : ((BS == 24) ? 7 : 8));
  ------------------
  |  Branch (223:28): [True: 126, False: 0]
  |  Branch (223:44): [True: 0, False: 0]
  ------------------
  224|       |
  225|    126|   const uint8_t BOTTOM_MASK = static_cast<uint8_t>((static_cast<uint16_t>(1) << MASKLEN) - 1);
  226|       |
  227|    126|   m_nonce_buf.resize(BS);
  228|    126|   clear_mem(&m_nonce_buf[0], m_nonce_buf.size());
  229|       |
  230|    126|   copy_mem(&m_nonce_buf[BS - nonce_len], nonce, nonce_len);
  231|    126|   m_nonce_buf[0] = static_cast<uint8_t>(((tag_size() * 8) % (BS * 8)) << (BS <= 16 ? 1 : 0));
  ------------------
  |  Branch (231:76): [True: 126, False: 0]
  ------------------
  232|       |
  233|    126|   m_nonce_buf[BS - nonce_len - 1] ^= 1;
  234|       |
  235|    126|   const uint8_t bottom = m_nonce_buf[BS - 1] & BOTTOM_MASK;
  236|    126|   m_nonce_buf[BS - 1] &= ~BOTTOM_MASK;
  237|       |
  238|    126|   const bool need_new_stretch = (m_last_nonce != m_nonce_buf);
  239|       |
  240|    126|   if(need_new_stretch) {
  ------------------
  |  Branch (240:7): [True: 103, False: 23]
  ------------------
  241|    103|      m_last_nonce = m_nonce_buf;
  242|       |
  243|    103|      m_cipher->encrypt(m_nonce_buf);
  244|       |
  245|       |      /*
  246|       |      The loop bounds (BS vs BS/2) are derived from the relation
  247|       |      between the block size and the MASKLEN. Using the terminology
  248|       |      of draft-krovetz-ocb-wide, we have to derive enough bits in
  249|       |      ShiftedKtop to read up to BLOCKLEN+bottom bits from Stretch.
  250|       |
  251|       |                 +----------+---------+-------+---------+
  252|       |                 | BLOCKLEN | RESIDUE | SHIFT | MASKLEN |
  253|       |                 +----------+---------+-------+---------+
  254|       |                 |       32 |     141 |    17 |    4    |
  255|       |                 |       64 |      27 |    25 |    5    |
  256|       |                 |       96 |    1601 |    33 |    6    |
  257|       |                 |      128 |     135 |     8 |    6    |
  258|       |                 |      192 |     135 |    40 |    7    |
  259|       |                 |      256 |    1061 |     1 |    8    |
  260|       |                 |      384 |    4109 |    80 |    8    |
  261|       |                 |      512 |     293 |   176 |    8    |
  262|       |                 |     1024 |  524355 |   352 |    9    |
  263|       |                 +----------+---------+-------+---------+
  264|       |      */
  265|    103|      if(BS == 16) {
  ------------------
  |  Branch (265:10): [True: 103, False: 0]
  ------------------
  266|    927|         for(size_t i = 0; i != BS / 2; ++i) {
  ------------------
  |  Branch (266:28): [True: 824, False: 103]
  ------------------
  267|    824|            m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 1]);
  268|    824|         }
  269|    103|      } else if(BS == 24) {
  ------------------
  |  Branch (269:17): [True: 0, False: 0]
  ------------------
  270|      0|         for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (270:28): [True: 0, False: 0]
  ------------------
  271|      0|            m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 5]);
  272|      0|         }
  273|      0|      } else if(BS == 32) {
  ------------------
  |  Branch (273:17): [True: 0, False: 0]
  ------------------
  274|      0|         for(size_t i = 0; i != BS; ++i) {
  ------------------
  |  Branch (274:28): [True: 0, False: 0]
  ------------------
  275|      0|            m_nonce_buf.push_back(m_nonce_buf[i] ^ (m_nonce_buf[i] << 1) ^ (m_nonce_buf[i + 1] >> 7));
  276|      0|         }
  277|      0|      } else if(BS == 64) {
  ------------------
  |  Branch (277:17): [True: 0, False: 0]
  ------------------
  278|      0|         for(size_t i = 0; i != BS / 2; ++i) {
  ------------------
  |  Branch (278:28): [True: 0, False: 0]
  ------------------
  279|      0|            m_nonce_buf.push_back(m_nonce_buf[i] ^ m_nonce_buf[i + 22]);
  280|      0|         }
  281|      0|      }
  282|       |
  283|    103|      m_stretch = m_nonce_buf;
  284|    103|   }
  285|       |
  286|       |   // now set the offset from stretch and bottom
  287|    126|   const size_t shift_bytes = bottom / 8;
  288|    126|   const size_t shift_bits = bottom % 8;
  289|       |
  290|    126|   BOTAN_ASSERT(m_stretch.size() >= BS + shift_bytes + 1, "Size ok");
  ------------------
  |  |   51|    126|   do {                                                                                 \
  |  |   52|    126|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 126]
  |  |  ------------------
  |  |   53|    126|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    126|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  291|       |
  292|    126|   m_offset.resize(BS);
  293|  2.14k|   for(size_t i = 0; i != BS; ++i) {
  ------------------
  |  Branch (293:22): [True: 2.01k, False: 126]
  ------------------
  294|  2.01k|      m_offset[i] = (m_stretch[i + shift_bytes] << shift_bits);
  295|  2.01k|      m_offset[i] |= (m_stretch[i + shift_bytes + 1] >> (8 - shift_bits));
  296|  2.01k|   }
  297|       |
  298|    126|   return m_offset;
  299|    126|}
_ZN5Botan8OCB_Mode9start_msgEPKhm:
  301|    126|void OCB_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
  302|    126|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (302:7): [True: 0, False: 126]
  ------------------
  303|      0|      throw Invalid_IV_Length(name(), nonce_len);
  304|      0|   }
  305|       |
  306|    126|   assert_key_material_set();
  307|       |
  308|    126|   m_L->init(update_nonce(nonce, nonce_len));
  309|    126|   zeroise(m_checksum);
  310|    126|   m_block_index = 0;
  311|    126|}
_ZN5Botan14OCB_Encryption7encryptEPhm:
  313|     68|void OCB_Encryption::encrypt(uint8_t buffer[], size_t blocks) {
  314|     68|   assert_key_material_set();
  315|     68|   BOTAN_STATE_CHECK(m_L->initialized());
  ------------------
  |  |   42|     68|   do {                                                         \
  |  |   43|     68|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 68]
  |  |  ------------------
  |  |   44|     68|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|     68|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  316|       |
  317|     68|   const size_t BS = block_size();
  318|       |
  319|    113|   while(blocks) {
  ------------------
  |  Branch (319:10): [True: 45, False: 68]
  ------------------
  320|     45|      const size_t proc_blocks = std::min(blocks, par_blocks());
  321|     45|      const size_t proc_bytes = proc_blocks * BS;
  322|       |
  323|     45|      const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks);
  324|       |
  325|     45|      xor_buf(m_checksum.data(), buffer, proc_bytes);
  326|       |
  327|     45|      m_cipher->encrypt_n_xex(buffer, offsets, proc_blocks);
  328|       |
  329|     45|      buffer += proc_bytes;
  330|     45|      blocks -= proc_blocks;
  331|     45|      m_block_index += proc_blocks;
  332|     45|   }
  333|     68|}
_ZN5Botan14OCB_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  341|     68|void OCB_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  342|     68|   assert_key_material_set();
  343|     68|   BOTAN_STATE_CHECK(m_L->initialized());
  ------------------
  |  |   42|     68|   do {                                                         \
  |  |   43|     68|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 68]
  |  |  ------------------
  |  |   44|     68|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|     68|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  344|       |
  345|     68|   const size_t BS = block_size();
  346|       |
  347|     68|   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");
  ------------------
  |  |   30|     68|   do {                                                          \
  |  |   31|     68|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 68]
  |  |  ------------------
  |  |   32|     68|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     68|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  348|     68|   const size_t sz = buffer.size() - offset;
  349|     68|   uint8_t* buf = buffer.data() + offset;
  350|       |
  351|     68|   secure_vector<uint8_t> mac(BS);
  352|       |
  353|     68|   if(sz) {
  ------------------
  |  Branch (353:7): [True: 68, False: 0]
  ------------------
  354|     68|      const size_t final_full_blocks = sz / BS;
  355|     68|      const size_t remainder_bytes = sz - (final_full_blocks * BS);
  356|       |
  357|     68|      encrypt(buf, final_full_blocks);
  358|     68|      mac = m_L->offset();
  359|       |
  360|     68|      if(remainder_bytes) {
  ------------------
  |  Branch (360:10): [True: 23, False: 45]
  ------------------
  361|     23|         BOTAN_ASSERT(remainder_bytes < BS, "Only a partial block left");
  ------------------
  |  |   51|     23|   do {                                                                                 \
  |  |   52|     23|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 23]
  |  |  ------------------
  |  |   53|     23|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     23|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  362|     23|         uint8_t* remainder = &buf[sz - remainder_bytes];
  363|       |
  364|     23|         xor_buf(m_checksum.data(), remainder, remainder_bytes);
  365|     23|         m_checksum[remainder_bytes] ^= 0x80;
  366|       |
  367|       |         // Offset_*
  368|     23|         mac ^= m_L->star();
  369|       |
  370|     23|         secure_vector<uint8_t> pad(BS);
  371|     23|         m_cipher->encrypt(mac, pad);
  372|     23|         xor_buf(remainder, pad.data(), remainder_bytes);
  373|     23|      }
  374|     68|   } else {
  375|      0|      mac = m_L->offset();
  376|      0|   }
  377|       |
  378|       |   // now compute the tag
  379|       |
  380|       |   // fold checksum
  381|  1.15k|   for(size_t i = 0; i != m_checksum.size(); i += BS) {
  ------------------
  |  Branch (381:22): [True: 1.08k, False: 68]
  ------------------
  382|  1.08k|      xor_buf(mac.data(), m_checksum.data() + i, BS);
  383|  1.08k|   }
  384|       |
  385|     68|   xor_buf(mac.data(), m_L->dollar().data(), BS);
  386|     68|   m_cipher->encrypt(mac);
  387|     68|   xor_buf(mac.data(), m_ad_hash.data(), BS);
  388|       |
  389|     68|   buffer += std::make_pair(mac.data(), tag_size());
  390|       |
  391|     68|   zeroise(m_checksum);
  392|     68|   m_block_index = 0;
  393|     68|}
_ZN5Botan14OCB_Decryption7decryptEPhm:
  395|     55|void OCB_Decryption::decrypt(uint8_t buffer[], size_t blocks) {
  396|     55|   assert_key_material_set();
  397|     55|   BOTAN_STATE_CHECK(m_L->initialized());
  ------------------
  |  |   42|     55|   do {                                                         \
  |  |   43|     55|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 55]
  |  |  ------------------
  |  |   44|     55|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|     55|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  398|       |
  399|     55|   const size_t BS = block_size();
  400|       |
  401|    415|   while(blocks) {
  ------------------
  |  Branch (401:10): [True: 360, False: 55]
  ------------------
  402|    360|      const size_t proc_blocks = std::min(blocks, par_blocks());
  403|    360|      const size_t proc_bytes = proc_blocks * BS;
  404|       |
  405|    360|      const uint8_t* offsets = m_L->compute_offsets(m_block_index, proc_blocks);
  406|       |
  407|    360|      m_cipher->decrypt_n_xex(buffer, offsets, proc_blocks);
  408|       |
  409|    360|      xor_buf(m_checksum.data(), buffer, proc_bytes);
  410|       |
  411|    360|      buffer += proc_bytes;
  412|    360|      blocks -= proc_blocks;
  413|    360|      m_block_index += proc_blocks;
  414|    360|   }
  415|     55|}
_ZN5Botan14OCB_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  423|     58|void OCB_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  424|     58|   assert_key_material_set();
  425|     58|   BOTAN_STATE_CHECK(m_L->initialized());
  ------------------
  |  |   42|     58|   do {                                                         \
  |  |   43|     58|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 58]
  |  |  ------------------
  |  |   44|     58|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|     58|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  426|       |
  427|     58|   const size_t BS = block_size();
  428|       |
  429|     58|   BOTAN_ARG_CHECK(buffer.size() >= offset, "Offset is out of range");
  ------------------
  |  |   30|     58|   do {                                                          \
  |  |   31|     58|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 58]
  |  |  ------------------
  |  |   32|     58|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     58|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  430|     58|   const size_t sz = buffer.size() - offset;
  431|     58|   uint8_t* buf = buffer.data() + offset;
  432|       |
  433|     58|   BOTAN_ARG_CHECK(sz >= tag_size(), "input did not include the tag");
  ------------------
  |  |   30|     58|   do {                                                          \
  |  |   31|     58|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 58]
  |  |  ------------------
  |  |   32|     58|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     58|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  434|       |
  435|     58|   const size_t remaining = sz - tag_size();
  436|       |
  437|     58|   secure_vector<uint8_t> mac(BS);
  438|       |
  439|     58|   if(remaining) {
  ------------------
  |  Branch (439:7): [True: 55, False: 3]
  ------------------
  440|     55|      const size_t final_full_blocks = remaining / BS;
  441|     55|      const size_t final_bytes = remaining - (final_full_blocks * BS);
  442|       |
  443|     55|      decrypt(buf, final_full_blocks);
  444|     55|      mac ^= m_L->offset();
  445|       |
  446|     55|      if(final_bytes) {
  ------------------
  |  Branch (446:10): [True: 51, False: 4]
  ------------------
  447|     51|         BOTAN_ASSERT(final_bytes < BS, "Only a partial block left");
  ------------------
  |  |   51|     51|   do {                                                                                 \
  |  |   52|     51|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 51]
  |  |  ------------------
  |  |   53|     51|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     51|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  448|       |
  449|     51|         uint8_t* remainder = &buf[remaining - final_bytes];
  450|       |
  451|     51|         mac ^= m_L->star();
  452|     51|         secure_vector<uint8_t> pad(BS);
  453|     51|         m_cipher->encrypt(mac, pad);  // P_*
  454|     51|         xor_buf(remainder, pad.data(), final_bytes);
  455|       |
  456|     51|         xor_buf(m_checksum.data(), remainder, final_bytes);
  457|     51|         m_checksum[final_bytes] ^= 0x80;
  458|     51|      }
  459|     55|   } else {
  460|      3|      mac = m_L->offset();
  461|      3|   }
  462|       |
  463|       |   // compute the mac
  464|       |
  465|       |   // fold checksum
  466|    986|   for(size_t i = 0; i != m_checksum.size(); i += BS) {
  ------------------
  |  Branch (466:22): [True: 928, False: 58]
  ------------------
  467|    928|      xor_buf(mac.data(), m_checksum.data() + i, BS);
  468|    928|   }
  469|       |
  470|     58|   mac ^= m_L->dollar();
  471|     58|   m_cipher->encrypt(mac);
  472|     58|   mac ^= m_ad_hash;
  473|       |
  474|       |   // reset state
  475|     58|   zeroise(m_checksum);
  476|     58|   m_block_index = 0;
  477|       |
  478|       |   // compare mac
  479|     58|   const uint8_t* included_tag = &buf[remaining];
  480|       |
  481|     58|   if(!constant_time_compare(mac.data(), included_tag, tag_size())) {
  ------------------
  |  Branch (481:7): [True: 58, False: 0]
  ------------------
  482|     58|      throw Invalid_Authentication_Tag("OCB tag check failed");
  483|     58|   }
  484|       |
  485|       |   // remove tag from end of message
  486|      0|   buffer.resize(remaining + offset);
  487|      0|}
ocb.cpp:_ZN5Botan12_GLOBAL__N_18ocb_hashERKNS_10L_computerERKNS_11BlockCipherEPKhm:
  115|    126|secure_vector<uint8_t> ocb_hash(const L_computer& L, const BlockCipher& cipher, const uint8_t ad[], size_t ad_len) {
  116|    126|   const size_t BS = cipher.block_size();
  117|    126|   secure_vector<uint8_t> sum(BS);
  118|    126|   secure_vector<uint8_t> offset(BS);
  119|       |
  120|    126|   secure_vector<uint8_t> buf(BS);
  121|       |
  122|    126|   const size_t ad_blocks = (ad_len / BS);
  123|    126|   const size_t ad_remainder = (ad_len % BS);
  124|       |
  125|    126|   for(size_t i = 0; i != ad_blocks; ++i) {
  ------------------
  |  Branch (125:22): [True: 0, False: 126]
  ------------------
  126|       |      // this loop could run in parallel
  127|      0|      offset ^= L.get(var_ctz32(static_cast<uint32_t>(i + 1)));
  128|      0|      buf = offset;
  129|      0|      xor_buf(buf.data(), &ad[BS * i], BS);
  130|      0|      cipher.encrypt(buf);
  131|      0|      sum ^= buf;
  132|      0|   }
  133|       |
  134|    126|   if(ad_remainder) {
  ------------------
  |  Branch (134:7): [True: 126, False: 0]
  ------------------
  135|    126|      offset ^= L.star();
  136|    126|      buf = offset;
  137|    126|      xor_buf(buf.data(), &ad[BS * ad_blocks], ad_remainder);
  138|    126|      buf[ad_remainder] ^= 0x80;
  139|    126|      cipher.encrypt(buf);
  140|    126|      sum ^= buf;
  141|    126|   }
  142|       |
  143|    126|   return sum;
  144|    126|}
_ZNK5Botan10L_computer3getEm:
   44|  2.25k|      const secure_vector<uint8_t>& get(size_t i) const {
   45|  2.26k|         while(m_L.size() <= i) {
  ------------------
  |  Branch (45:16): [True: 9, False: 2.25k]
  ------------------
   46|      9|            m_L.push_back(poly_double(m_L.back()));
   47|      9|         }
   48|       |
   49|  2.25k|         return m_L[i];
   50|  2.25k|      }
_ZN5Botan10L_computer11poly_doubleERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
   97|  1.24k|      static secure_vector<uint8_t> poly_double(const secure_vector<uint8_t>& in) {
   98|  1.24k|         secure_vector<uint8_t> out(in.size());
   99|  1.24k|         poly_double_n(out.data(), in.data(), out.size());
  100|  1.24k|         return out;
  101|  1.24k|      }
_ZN5Botan10L_computer4initERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
   34|    126|      void init(const secure_vector<uint8_t>& offset) { m_offset = offset; }
_ZNK5Botan10L_computer11initializedEv:
   36|    249|      bool initialized() const { return m_offset.empty() == false; }
_ZN5Botan10L_computer15compute_offsetsEmm:
   52|    405|      const uint8_t* compute_offsets(size_t block_index, size_t blocks) {
   53|    405|         BOTAN_ASSERT(blocks <= m_max_blocks, "OCB offsets");
  ------------------
  |  |   51|    405|   do {                                                                                 \
  |  |   52|    405|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 405]
  |  |  ------------------
  |  |   53|    405|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    405|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   54|       |
   55|    405|         uint8_t* offsets = m_offset_buf.data();
   56|       |
   57|    405|         if(block_index % 4 == 0) {
  ------------------
  |  Branch (57:13): [True: 405, False: 0]
  ------------------
   58|    405|            const secure_vector<uint8_t>& L0 = get(0);
   59|    405|            const secure_vector<uint8_t>& L1 = get(1);
   60|       |
   61|  1.71k|            while(blocks >= 4) {
  ------------------
  |  Branch (61:19): [True: 1.31k, False: 405]
  ------------------
   62|       |               // ntz(4*i+1) == 0
   63|       |               // ntz(4*i+2) == 1
   64|       |               // ntz(4*i+3) == 0
   65|  1.31k|               block_index += 4;
   66|  1.31k|               const size_t ntz4 = var_ctz32(static_cast<uint32_t>(block_index));
   67|       |
   68|  1.31k|               xor_buf(offsets, m_offset.data(), L0.data(), m_BS);
   69|  1.31k|               offsets += m_BS;
   70|       |
   71|  1.31k|               xor_buf(offsets, offsets - m_BS, L1.data(), m_BS);
   72|  1.31k|               offsets += m_BS;
   73|       |
   74|  1.31k|               xor_buf(m_offset.data(), L1.data(), m_BS);
   75|  1.31k|               copy_mem(offsets, m_offset.data(), m_BS);
   76|  1.31k|               offsets += m_BS;
   77|       |
   78|  1.31k|               xor_buf(m_offset.data(), get(ntz4).data(), m_BS);
   79|  1.31k|               copy_mem(offsets, m_offset.data(), m_BS);
   80|  1.31k|               offsets += m_BS;
   81|       |
   82|  1.31k|               blocks -= 4;
   83|  1.31k|            }
   84|    405|         }
   85|       |
   86|    541|         for(size_t i = 0; i != blocks; ++i) {  // could be done in parallel
  ------------------
  |  Branch (86:28): [True: 136, False: 405]
  ------------------
   87|    136|            const size_t ntz = var_ctz32(static_cast<uint32_t>(block_index + i + 1));
   88|    136|            xor_buf(m_offset.data(), get(ntz).data(), m_BS);
   89|    136|            copy_mem(offsets, m_offset.data(), m_BS);
   90|    136|            offsets += m_BS;
   91|    136|         }
   92|       |
   93|    405|         return m_offset_buf.data();
   94|    405|      }
_ZNK5Botan10L_computer6offsetEv:
   42|    126|      const secure_vector<uint8_t>& offset() const { return m_offset; }
_ZNK5Botan10L_computer4starEv:
   38|    337|      const secure_vector<uint8_t>& star() const { return m_L_star; }
_ZNK5Botan10L_computer6dollarEv:
   40|    263|      const secure_vector<uint8_t>& dollar() const { return m_L_dollar; }
_ZN5Botan10L_computerC2ERKNS_11BlockCipherE:
   21|    137|            m_BS(cipher.block_size()), m_max_blocks(cipher.parallel_bytes() / m_BS) {
   22|    137|         m_L_star.resize(m_BS);
   23|    137|         cipher.encrypt(m_L_star);
   24|    137|         m_L_dollar = poly_double(star());
   25|    137|         m_L.push_back(poly_double(dollar()));
   26|       |
   27|  1.09k|         while(m_L.size() < 8) {
  ------------------
  |  Branch (27:16): [True: 959, False: 137]
  ------------------
   28|    959|            m_L.push_back(poly_double(m_L.back()));
   29|    959|         }
   30|       |
   31|    137|         m_offset_buf.resize(m_BS * m_max_blocks);
   32|    137|      }

_ZN5Botan8CBC_ModeC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEENS2_INS_28BlockCipherModePaddingMethodENS4_IS7_EEEE:
   19|    287|      m_cipher(std::move(cipher)), m_padding(std::move(padding)), m_block_size(m_cipher->block_size()) {
   20|    287|   if(m_padding && !m_padding->valid_blocksize(m_block_size)) {
  ------------------
  |  Branch (20:7): [True: 287, False: 0]
  |  Branch (20:20): [True: 0, False: 287]
  ------------------
   21|      0|      throw Invalid_Argument(fmt("Padding {} cannot be used with {} in CBC mode", m_padding->name(), m_cipher->name()));
   22|      0|   }
   23|    287|}
_ZNK5Botan8CBC_Mode17ideal_granularityEv:
   42|    189|size_t CBC_Mode::ideal_granularity() const { return cipher().parallel_bytes(); }
_ZNK5Botan8CBC_Mode8key_specEv:
   44|    287|Key_Length_Specification CBC_Mode::key_spec() const { return cipher().key_spec(); }
_ZNK5Botan8CBC_Mode18valid_nonce_lengthEm:
   48|    196|bool CBC_Mode::valid_nonce_length(size_t n) const { return (n == 0 || n == block_size()); }
  ------------------
  |  Branch (48:61): [True: 0, False: 196]
  |  Branch (48:71): [True: 196, False: 0]
  ------------------
_ZN5Botan8CBC_Mode12key_scheduleEPKhm:
   52|    287|void CBC_Mode::key_schedule(const uint8_t key[], size_t length) {
   53|    287|   m_cipher->set_key(key, length);
   54|    287|   m_state.clear();
   55|    287|}
_ZN5Botan8CBC_Mode9start_msgEPKhm:
   57|    196|void CBC_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
   58|    196|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (58:7): [True: 0, False: 196]
  ------------------
   59|      0|      throw Invalid_IV_Length(name(), nonce_len);
   60|      0|   }
   61|       |
   62|       |   /*
   63|       |   * A nonce of zero length means carry the last ciphertext value over
   64|       |   * as the new IV, as unfortunately some protocols require this. If
   65|       |   * this is the first message then we use an IV of all zeros.
   66|       |   */
   67|    196|   if(nonce_len) {
  ------------------
  |  Branch (67:7): [True: 196, False: 0]
  ------------------
   68|    196|      m_state.assign(nonce, nonce + nonce_len);
   69|    196|   } else if(m_state.empty()) {
  ------------------
  |  Branch (69:14): [True: 0, False: 0]
  ------------------
   70|      0|      m_state.resize(m_cipher->block_size());
   71|      0|   }
   72|       |   // else leave the state alone
   73|    196|}
_ZN5Botan14CBC_Encryption11process_msgEPhm:
   85|    124|size_t CBC_Encryption::process_msg(uint8_t buf[], size_t sz) {
   86|    124|   BOTAN_STATE_CHECK(state().empty() == false);
  ------------------
  |  |   42|    124|   do {                                                         \
  |  |   43|    124|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 124]
  |  |  ------------------
  |  |   44|    124|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|    124|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   87|    124|   const size_t BS = block_size();
   88|       |
   89|    124|   BOTAN_ARG_CHECK(sz % BS == 0, "CBC input is not full blocks");
  ------------------
  |  |   30|    124|   do {                                                          \
  |  |   31|    124|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 124]
  |  |  ------------------
  |  |   32|    124|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    124|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   90|    124|   const size_t blocks = sz / BS;
   91|       |
   92|    124|   if(blocks > 0) {
  ------------------
  |  Branch (92:7): [True: 124, False: 0]
  ------------------
   93|    124|      xor_buf(&buf[0], state_ptr(), BS);
   94|    124|      cipher().encrypt(&buf[0]);
   95|       |
   96|    464|      for(size_t i = 1; i != blocks; ++i) {
  ------------------
  |  Branch (96:25): [True: 340, False: 124]
  ------------------
   97|    340|         xor_buf(&buf[BS * i], &buf[BS * (i - 1)], BS);
   98|    340|         cipher().encrypt(&buf[BS * i]);
   99|    340|      }
  100|       |
  101|    124|      state().assign(&buf[BS * (blocks - 1)], &buf[BS * blocks]);
  102|    124|   }
  103|       |
  104|    124|   return sz;
  105|    124|}
_ZN5Botan14CBC_Decryption11process_msgEPhm:
  178|     72|size_t CBC_Decryption::process_msg(uint8_t buf[], size_t sz) {
  179|     72|   BOTAN_STATE_CHECK(state().empty() == false);
  ------------------
  |  |   42|     72|   do {                                                         \
  |  |   43|     72|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 72]
  |  |  ------------------
  |  |   44|     72|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|     72|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  180|       |
  181|     72|   const size_t BS = block_size();
  182|       |
  183|     72|   BOTAN_ARG_CHECK(sz % BS == 0, "Input is not full blocks");
  ------------------
  |  |   30|     72|   do {                                                          \
  |  |   31|     72|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 72]
  |  |  ------------------
  |  |   32|     72|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|     72|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  184|     72|   size_t blocks = sz / BS;
  185|       |
  186|  1.43k|   while(blocks) {
  ------------------
  |  Branch (186:10): [True: 1.36k, False: 72]
  ------------------
  187|  1.36k|      const size_t to_proc = std::min(BS * blocks, m_tempbuf.size());
  188|       |
  189|  1.36k|      cipher().decrypt_n(buf, m_tempbuf.data(), to_proc / BS);
  190|       |
  191|  1.36k|      xor_buf(m_tempbuf.data(), state_ptr(), BS);
  192|  1.36k|      xor_buf(&m_tempbuf[BS], buf, to_proc - BS);
  193|  1.36k|      copy_mem(state_ptr(), buf + (to_proc - BS), BS);
  194|       |
  195|  1.36k|      copy_mem(buf, m_tempbuf.data(), to_proc);
  196|       |
  197|  1.36k|      buf += to_proc;
  198|  1.36k|      blocks -= to_proc / BS;
  199|  1.36k|   }
  200|       |
  201|     72|   return sz;
  202|     72|}

_ZN5Botan4EMSA6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   35|  5.77k|std::unique_ptr<EMSA> EMSA::create(std::string_view algo_spec) {
   36|  5.77k|   SCAN_Name req(algo_spec);
   37|       |
   38|  5.77k|#if defined(BOTAN_HAS_EMSA_PKCS1)
   39|  5.77k|   if(req.algo_name() == "EMSA_PKCS1" || req.algo_name() == "PKCS1v15" || req.algo_name() == "EMSA-PKCS1-v1_5" ||
  ------------------
  |  Branch (39:7): [True: 0, False: 5.77k]
  |  Branch (39:7): [True: 5.77k, False: 0]
  |  Branch (39:42): [True: 0, False: 5.77k]
  |  Branch (39:75): [True: 0, False: 5.77k]
  ------------------
   40|  5.77k|      req.algo_name() == "EMSA3") {
  ------------------
  |  Branch (40:7): [True: 5.77k, False: 0]
  ------------------
   41|  5.77k|      if(req.arg_count() == 2 && req.arg(0) == "Raw") {
  ------------------
  |  Branch (41:10): [True: 0, False: 5.77k]
  |  Branch (41:10): [True: 0, False: 5.77k]
  |  Branch (41:34): [True: 0, False: 0]
  ------------------
   42|      0|         return std::make_unique<EMSA_PKCS1v15_Raw>(req.arg(1));
   43|  5.77k|      } else if(req.arg_count() == 1) {
  ------------------
  |  Branch (43:17): [True: 5.77k, False: 0]
  ------------------
   44|  5.77k|         if(req.arg(0) == "Raw") {
  ------------------
  |  Branch (44:13): [True: 0, False: 5.77k]
  ------------------
   45|      0|            return std::make_unique<EMSA_PKCS1v15_Raw>();
   46|  5.77k|         } else {
   47|  5.77k|            if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (47:21): [True: 5.77k, False: 0]
  ------------------
   48|  5.77k|               return std::make_unique<EMSA_PKCS1v15>(std::move(hash));
   49|  5.77k|            }
   50|  5.77k|         }
   51|  5.77k|      }
   52|  5.77k|   }
   53|      0|#endif
   54|       |
   55|      0|#if defined(BOTAN_HAS_EMSA_PSSR)
   56|      0|   if(req.algo_name() == "PSS_Raw" || req.algo_name() == "PSSR_Raw") {
  ------------------
  |  Branch (56:7): [True: 0, False: 0]
  |  Branch (56:7): [True: 0, False: 0]
  |  Branch (56:39): [True: 0, False: 0]
  ------------------
   57|      0|      if(req.arg_count_between(1, 3) && req.arg(1, "MGF1") == "MGF1") {
  ------------------
  |  Branch (57:10): [True: 0, False: 0]
  |  Branch (57:10): [True: 0, False: 0]
  |  Branch (57:41): [True: 0, False: 0]
  ------------------
   58|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (58:18): [True: 0, False: 0]
  ------------------
   59|      0|            if(req.arg_count() == 3) {
  ------------------
  |  Branch (59:16): [True: 0, False: 0]
  ------------------
   60|      0|               const size_t salt_size = req.arg_as_integer(2, 0);
   61|      0|               return std::make_unique<PSSR_Raw>(std::move(hash), salt_size);
   62|      0|            } else {
   63|      0|               return std::make_unique<PSSR_Raw>(std::move(hash));
   64|      0|            }
   65|      0|         }
   66|      0|      }
   67|      0|   }
   68|       |
   69|      0|   if(req.algo_name() == "PSS" || req.algo_name() == "PSSR" || req.algo_name() == "EMSA-PSS" ||
  ------------------
  |  Branch (69:7): [True: 0, False: 0]
  |  Branch (69:7): [True: 0, False: 0]
  |  Branch (69:35): [True: 0, False: 0]
  |  Branch (69:64): [True: 0, False: 0]
  ------------------
   70|      0|      req.algo_name() == "PSS-MGF1" || req.algo_name() == "EMSA4") {
  ------------------
  |  Branch (70:7): [True: 0, False: 0]
  |  Branch (70:40): [True: 0, False: 0]
  ------------------
   71|      0|      if(req.arg_count_between(1, 3) && req.arg(1, "MGF1") == "MGF1") {
  ------------------
  |  Branch (71:10): [True: 0, False: 0]
  |  Branch (71:10): [True: 0, False: 0]
  |  Branch (71:41): [True: 0, False: 0]
  ------------------
   72|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (72:18): [True: 0, False: 0]
  ------------------
   73|      0|            if(req.arg_count() == 3) {
  ------------------
  |  Branch (73:16): [True: 0, False: 0]
  ------------------
   74|      0|               const size_t salt_size = req.arg_as_integer(2, 0);
   75|      0|               return std::make_unique<PSSR>(std::move(hash), salt_size);
   76|      0|            } else {
   77|      0|               return std::make_unique<PSSR>(std::move(hash));
   78|      0|            }
   79|      0|         }
   80|      0|      }
   81|      0|   }
   82|      0|#endif
   83|       |
   84|      0|#if defined(BOTAN_HAS_ISO_9796)
   85|      0|   if(req.algo_name() == "ISO_9796_DS2") {
  ------------------
  |  Branch (85:7): [True: 0, False: 0]
  ------------------
   86|      0|      if(req.arg_count_between(1, 3)) {
  ------------------
  |  Branch (86:10): [True: 0, False: 0]
  ------------------
   87|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (87:18): [True: 0, False: 0]
  ------------------
   88|      0|            const size_t salt_size = req.arg_as_integer(2, hash->output_length());
   89|      0|            const bool implicit = req.arg(1, "exp") == "imp";
   90|      0|            return std::make_unique<ISO_9796_DS2>(std::move(hash), implicit, salt_size);
   91|      0|         }
   92|      0|      }
   93|      0|   }
   94|       |   //ISO-9796-2 DS 3 is deterministic and DS2 without a salt
   95|      0|   if(req.algo_name() == "ISO_9796_DS3") {
  ------------------
  |  Branch (95:7): [True: 0, False: 0]
  ------------------
   96|      0|      if(req.arg_count_between(1, 2)) {
  ------------------
  |  Branch (96:10): [True: 0, False: 0]
  ------------------
   97|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (97:18): [True: 0, False: 0]
  ------------------
   98|      0|            const bool implicit = req.arg(1, "exp") == "imp";
   99|      0|            return std::make_unique<ISO_9796_DS3>(std::move(hash), implicit);
  100|      0|         }
  101|      0|      }
  102|      0|   }
  103|      0|#endif
  104|       |
  105|      0|#if defined(BOTAN_HAS_EMSA_X931)
  106|      0|   if(req.algo_name() == "EMSA_X931" || req.algo_name() == "EMSA2" || req.algo_name() == "X9.31") {
  ------------------
  |  Branch (106:7): [True: 0, False: 0]
  |  Branch (106:7): [True: 0, False: 0]
  |  Branch (106:41): [True: 0, False: 0]
  |  Branch (106:71): [True: 0, False: 0]
  ------------------
  107|      0|      if(req.arg_count() == 1) {
  ------------------
  |  Branch (107:10): [True: 0, False: 0]
  ------------------
  108|      0|         if(auto hash = HashFunction::create(req.arg(0))) {
  ------------------
  |  Branch (108:18): [True: 0, False: 0]
  ------------------
  109|      0|            return std::make_unique<EMSA_X931>(std::move(hash));
  110|      0|         }
  111|      0|      }
  112|      0|   }
  113|      0|#endif
  114|       |
  115|      0|#if defined(BOTAN_HAS_EMSA_RAW)
  116|      0|   if(req.algo_name() == "Raw") {
  ------------------
  |  Branch (116:7): [True: 0, False: 0]
  ------------------
  117|      0|      if(req.arg_count() == 0) {
  ------------------
  |  Branch (117:10): [True: 0, False: 0]
  ------------------
  118|      0|         return std::make_unique<EMSA_Raw>();
  119|      0|      } else {
  120|      0|         auto hash = HashFunction::create(req.arg(0));
  121|      0|         if(hash) {
  ------------------
  |  Branch (121:13): [True: 0, False: 0]
  ------------------
  122|      0|            return std::make_unique<EMSA_Raw>(hash->output_length());
  123|      0|         }
  124|      0|      }
  125|      0|   }
  126|      0|#endif
  127|       |
  128|      0|   return nullptr;
  129|      0|}
_ZN5Botan4EMSA15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  131|  5.77k|std::unique_ptr<EMSA> EMSA::create_or_throw(std::string_view algo_spec) {
  132|  5.77k|   auto emsa = EMSA::create(algo_spec);
  133|  5.77k|   if(emsa) {
  ------------------
  |  Branch (133:7): [True: 5.77k, False: 0]
  ------------------
  134|  5.77k|      return emsa;
  135|  5.77k|   }
  136|      0|   throw Algorithm_Not_Found(algo_spec);
  137|  5.77k|}

_ZN5Botan13EMSA_PKCS1v156updateEPKhm:
   44|  5.77k|void EMSA_PKCS1v15::update(const uint8_t input[], size_t length) { m_hash->update(input, length); }
_ZN5Botan13EMSA_PKCS1v158raw_dataEv:
   46|  5.77k|std::vector<uint8_t> EMSA_PKCS1v15::raw_data() { return m_hash->final_stdvec(); }
_ZN5Botan13EMSA_PKCS1v156verifyERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_m:
   58|  5.77k|bool EMSA_PKCS1v15::verify(const std::vector<uint8_t>& coded, const std::vector<uint8_t>& raw, size_t key_bits) {
   59|  5.77k|   if(raw.size() != m_hash->output_length()) {
  ------------------
  |  Branch (59:7): [True: 0, False: 5.77k]
  ------------------
   60|      0|      return false;
   61|      0|   }
   62|       |
   63|  5.77k|   try {
   64|  5.77k|      return (coded == emsa3_encoding(raw, key_bits, m_hash_id.data(), m_hash_id.size()));
   65|  5.77k|   } catch(...) {
   66|      0|      return false;
   67|      0|   }
   68|  5.77k|}
_ZN5Botan13EMSA_PKCS1v15C2ENSt3__110unique_ptrINS_12HashFunctionENS1_14default_deleteIS3_EEEE:
   70|  5.77k|EMSA_PKCS1v15::EMSA_PKCS1v15(std::unique_ptr<HashFunction> hash) : m_hash(std::move(hash)) {
   71|  5.77k|   m_hash_id = pkcs_hash_id(m_hash->name());
   72|  5.77k|}
emsa_pkcs1.cpp:_ZN5Botan12_GLOBAL__N_114emsa3_encodingERKNSt3__16vectorIhNS1_9allocatorIhEEEEmPKhm:
   20|  5.77k|                                    size_t hash_id_length) {
   21|  5.77k|   size_t output_length = output_bits / 8;
   22|  5.77k|   if(output_length < hash_id_length + msg.size() + 10) {
  ------------------
  |  Branch (22:7): [True: 0, False: 5.77k]
  ------------------
   23|      0|      throw Encoding_Error("emsa3_encoding: Output length is too small");
   24|      0|   }
   25|       |
   26|  5.77k|   std::vector<uint8_t> T(output_length);
   27|  5.77k|   const size_t P_LENGTH = output_length - msg.size() - hash_id_length - 2;
   28|       |
   29|  5.77k|   T[0] = 0x01;
   30|  5.77k|   set_mem(&T[1], P_LENGTH, 0xFF);
   31|  5.77k|   T[P_LENGTH + 1] = 0x00;
   32|       |
   33|  5.77k|   if(hash_id_length > 0) {
  ------------------
  |  Branch (33:7): [True: 5.77k, False: 0]
  ------------------
   34|  5.77k|      BOTAN_ASSERT_NONNULL(hash_id);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   35|  5.77k|      buffer_insert(T, P_LENGTH + 2, hash_id, hash_id_length);
   36|  5.77k|   }
   37|       |
   38|  5.77k|   buffer_insert(T, output_length - msg.size(), msg.data(), msg.size());
   39|  5.77k|   return T;
   40|  5.77k|}

_ZN5Botan12pkcs_hash_idENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
   78|  5.77k|std::vector<uint8_t> pkcs_hash_id(std::string_view name) {
   79|       |   // Special case for SSL/TLS RSA signatures
   80|  5.77k|   if(name == "Parallel(MD5,SHA-1)") {
  ------------------
  |  Branch (80:7): [True: 0, False: 5.77k]
  ------------------
   81|      0|      return std::vector<uint8_t>();
   82|      0|   }
   83|       |
   84|       |   // If you add a value to this function, also update test_hash_id.cpp
   85|       |
   86|  5.77k|   if(name == "MD5") {
  ------------------
  |  Branch (86:7): [True: 0, False: 5.77k]
  ------------------
   87|      0|      return std::vector<uint8_t>(MD5_PKCS_ID, MD5_PKCS_ID + sizeof(MD5_PKCS_ID));
   88|      0|   }
   89|       |
   90|  5.77k|   if(name == "RIPEMD-160") {
  ------------------
  |  Branch (90:7): [True: 0, False: 5.77k]
  ------------------
   91|      0|      return std::vector<uint8_t>(RIPEMD_160_PKCS_ID, RIPEMD_160_PKCS_ID + sizeof(RIPEMD_160_PKCS_ID));
   92|      0|   }
   93|       |
   94|  5.77k|   if(name == "SHA-1") {
  ------------------
  |  Branch (94:7): [True: 0, False: 5.77k]
  ------------------
   95|      0|      return std::vector<uint8_t>(SHA_1_PKCS_ID, SHA_1_PKCS_ID + sizeof(SHA_1_PKCS_ID));
   96|      0|   }
   97|       |
   98|  5.77k|   if(name == "SHA-224") {
  ------------------
  |  Branch (98:7): [True: 0, False: 5.77k]
  ------------------
   99|      0|      return std::vector<uint8_t>(SHA_224_PKCS_ID, SHA_224_PKCS_ID + sizeof(SHA_224_PKCS_ID));
  100|      0|   }
  101|       |
  102|  5.77k|   if(name == "SHA-256") {
  ------------------
  |  Branch (102:7): [True: 5.77k, False: 0]
  ------------------
  103|  5.77k|      return std::vector<uint8_t>(SHA_256_PKCS_ID, SHA_256_PKCS_ID + sizeof(SHA_256_PKCS_ID));
  104|  5.77k|   }
  105|       |
  106|      0|   if(name == "SHA-384") {
  ------------------
  |  Branch (106:7): [True: 0, False: 0]
  ------------------
  107|      0|      return std::vector<uint8_t>(SHA_384_PKCS_ID, SHA_384_PKCS_ID + sizeof(SHA_384_PKCS_ID));
  108|      0|   }
  109|       |
  110|      0|   if(name == "SHA-512") {
  ------------------
  |  Branch (110:7): [True: 0, False: 0]
  ------------------
  111|      0|      return std::vector<uint8_t>(SHA_512_PKCS_ID, SHA_512_PKCS_ID + sizeof(SHA_512_PKCS_ID));
  112|      0|   }
  113|       |
  114|      0|   if(name == "SHA-512-256") {
  ------------------
  |  Branch (114:7): [True: 0, False: 0]
  ------------------
  115|      0|      return std::vector<uint8_t>(SHA_512_256_PKCS_ID, SHA_512_256_PKCS_ID + sizeof(SHA_512_256_PKCS_ID));
  116|      0|   }
  117|       |
  118|      0|   if(name == "SHA-3(224)") {
  ------------------
  |  Branch (118:7): [True: 0, False: 0]
  ------------------
  119|      0|      return std::vector<uint8_t>(SHA3_224_PKCS_ID, SHA3_224_PKCS_ID + sizeof(SHA3_224_PKCS_ID));
  120|      0|   }
  121|       |
  122|      0|   if(name == "SHA-3(256)") {
  ------------------
  |  Branch (122:7): [True: 0, False: 0]
  ------------------
  123|      0|      return std::vector<uint8_t>(SHA3_256_PKCS_ID, SHA3_256_PKCS_ID + sizeof(SHA3_256_PKCS_ID));
  124|      0|   }
  125|       |
  126|      0|   if(name == "SHA-3(384)") {
  ------------------
  |  Branch (126:7): [True: 0, False: 0]
  ------------------
  127|      0|      return std::vector<uint8_t>(SHA3_384_PKCS_ID, SHA3_384_PKCS_ID + sizeof(SHA3_384_PKCS_ID));
  128|      0|   }
  129|       |
  130|      0|   if(name == "SHA-3(512)") {
  ------------------
  |  Branch (130:7): [True: 0, False: 0]
  ------------------
  131|      0|      return std::vector<uint8_t>(SHA3_512_PKCS_ID, SHA3_512_PKCS_ID + sizeof(SHA3_512_PKCS_ID));
  132|      0|   }
  133|       |
  134|      0|   if(name == "SM3") {
  ------------------
  |  Branch (134:7): [True: 0, False: 0]
  ------------------
  135|      0|      return std::vector<uint8_t>(SM3_PKCS_ID, SM3_PKCS_ID + sizeof(SM3_PKCS_ID));
  136|      0|   }
  137|       |
  138|      0|   throw Invalid_Argument("No PKCS #1 identifier for " + std::string(name));
  139|      0|}

_ZN5Botan20curve25519_basepointEPhPKh:
   18|    604|void curve25519_basepoint(uint8_t mypublic[32], const uint8_t secret[32]) {
   19|    604|   const uint8_t basepoint[32] = {9};
   20|    604|   curve25519_donna(mypublic, secret, basepoint);
   21|    604|}
_ZN5Botan21Curve25519_PrivateKeyC1ERNS_21RandomNumberGeneratorE:
   65|    604|Curve25519_PrivateKey::Curve25519_PrivateKey(RandomNumberGenerator& rng) {
   66|    604|   m_private = rng.random_vec(32);
   67|    604|   m_public.resize(32);
   68|    604|   curve25519_basepoint(m_public.data(), m_private.data());
   69|    604|}

_ZN5Botan16curve25519_donnaEPhPKhS2_:
  452|    604|void curve25519_donna(uint8_t mypublic[32], const uint8_t secret[32], const uint8_t basepoint[32]) {
  453|    604|   CT::poison(secret, 32);
  454|    604|   CT::poison(basepoint, 32);
  455|       |
  456|    604|   uint64_t bp[5], x[5], z[5], zmone[5];
  457|    604|   uint8_t e[32];
  458|       |
  459|    604|   copy_mem(e, secret, 32);
  460|    604|   e[0] &= 248;
  461|    604|   e[31] &= 127;
  462|    604|   e[31] |= 64;
  463|       |
  464|    604|   fexpand(bp, basepoint);
  465|    604|   cmult(x, z, e, bp);
  466|    604|   crecip(zmone, z);
  467|    604|   fmul(z, x, zmone);
  468|    604|   fcontract(mypublic, z);
  469|       |
  470|    604|   CT::unpoison(secret, 32);
  471|    604|   CT::unpoison(basepoint, 32);
  472|    604|   CT::unpoison(mypublic, 32);
  473|    604|}
donna.cpp:_ZN5Botan12_GLOBAL__N_17fexpandEPmPKh:
  216|    604|inline void fexpand(uint64_t* out, const uint8_t* in) {
  217|    604|   out[0] = load_le<uint64_t>(in, 0) & 0x7ffffffffffff;
  218|    604|   out[1] = (load_le<uint64_t>(in + 6, 0) >> 3) & 0x7ffffffffffff;
  219|    604|   out[2] = (load_le<uint64_t>(in + 12, 0) >> 6) & 0x7ffffffffffff;
  220|    604|   out[3] = (load_le<uint64_t>(in + 19, 0) >> 1) & 0x7ffffffffffff;
  221|    604|   out[4] = (load_le<uint64_t>(in + 24, 0) >> 12) & 0x7ffffffffffff;
  222|    604|}
donna.cpp:_ZN5Botan12_GLOBAL__N_15cmultEPmS1_PKhPKm:
  364|    604|void cmult(uint64_t resultx[5], uint64_t resultz[5], const uint8_t n[32], const uint64_t q[5]) {
  365|    604|   uint64_t a[5] = {0};  // nqpqx
  366|    604|   uint64_t b[5] = {1};  // npqpz
  367|    604|   uint64_t c[5] = {1};  // nqx
  368|    604|   uint64_t d[5] = {0};  // nqz
  369|    604|   uint64_t e[5] = {0};  // npqqx2
  370|    604|   uint64_t f[5] = {1};  // npqqz2
  371|    604|   uint64_t g[5] = {0};  // nqx2
  372|    604|   uint64_t h[5] = {1};  // nqz2
  373|       |
  374|    604|   copy_mem(a, q, 5);
  375|       |
  376|  19.9k|   for(size_t i = 0; i < 32; ++i) {
  ------------------
  |  Branch (376:22): [True: 19.3k, False: 604]
  ------------------
  377|  19.3k|      const uint64_t bit0 = (n[31 - i] >> 7) & 1;
  378|  19.3k|      const uint64_t bit1 = (n[31 - i] >> 6) & 1;
  379|  19.3k|      const uint64_t bit2 = (n[31 - i] >> 5) & 1;
  380|  19.3k|      const uint64_t bit3 = (n[31 - i] >> 4) & 1;
  381|  19.3k|      const uint64_t bit4 = (n[31 - i] >> 3) & 1;
  382|  19.3k|      const uint64_t bit5 = (n[31 - i] >> 2) & 1;
  383|  19.3k|      const uint64_t bit6 = (n[31 - i] >> 1) & 1;
  384|  19.3k|      const uint64_t bit7 = (n[31 - i] >> 0) & 1;
  385|       |
  386|  19.3k|      swap_conditional(c, a, d, b, bit0);
  387|  19.3k|      fmonty(g, h, e, f, c, d, a, b, q);
  388|       |
  389|  19.3k|      swap_conditional(g, e, h, f, bit0 ^ bit1);
  390|  19.3k|      fmonty(c, d, a, b, g, h, e, f, q);
  391|       |
  392|  19.3k|      swap_conditional(c, a, d, b, bit1 ^ bit2);
  393|  19.3k|      fmonty(g, h, e, f, c, d, a, b, q);
  394|       |
  395|  19.3k|      swap_conditional(g, e, h, f, bit2 ^ bit3);
  396|  19.3k|      fmonty(c, d, a, b, g, h, e, f, q);
  397|       |
  398|  19.3k|      swap_conditional(c, a, d, b, bit3 ^ bit4);
  399|  19.3k|      fmonty(g, h, e, f, c, d, a, b, q);
  400|       |
  401|  19.3k|      swap_conditional(g, e, h, f, bit4 ^ bit5);
  402|  19.3k|      fmonty(c, d, a, b, g, h, e, f, q);
  403|       |
  404|  19.3k|      swap_conditional(c, a, d, b, bit5 ^ bit6);
  405|  19.3k|      fmonty(g, h, e, f, c, d, a, b, q);
  406|       |
  407|  19.3k|      swap_conditional(g, e, h, f, bit6 ^ bit7);
  408|  19.3k|      fmonty(c, d, a, b, g, h, e, f, q);
  409|       |
  410|  19.3k|      swap_conditional(c, a, d, b, bit7);
  411|  19.3k|   }
  412|       |
  413|    604|   copy_mem(resultx, c, 5);
  414|    604|   copy_mem(resultz, d, 5);
  415|    604|}
donna.cpp:_ZN5Botan12_GLOBAL__N_116swap_conditionalEPmS1_S1_S1_m:
  345|   173k|inline void swap_conditional(uint64_t a[5], uint64_t b[5], uint64_t c[5], uint64_t d[5], uint64_t iswap) {
  346|   173k|   const uint64_t swap = 0 - iswap;
  347|       |
  348|  1.04M|   for(size_t i = 0; i < 5; ++i) {
  ------------------
  |  Branch (348:22): [True: 869k, False: 173k]
  ------------------
  349|   869k|      const uint64_t x0 = swap & (a[i] ^ b[i]);
  350|   869k|      const uint64_t x1 = swap & (c[i] ^ d[i]);
  351|   869k|      a[i] ^= x0;
  352|   869k|      b[i] ^= x0;
  353|   869k|      c[i] ^= x1;
  354|   869k|      d[i] ^= x1;
  355|   869k|   }
  356|   173k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_16fmontyEPmS1_S1_S1_S1_S1_S1_S1_PKm:
  307|   154k|            const uint64_t q_minus_q_dash[5]) {
  308|   154k|   uint64_t zzz[5];
  309|   154k|   uint64_t xx[5];
  310|   154k|   uint64_t zz[5];
  311|   154k|   uint64_t xxprime[5];
  312|   154k|   uint64_t zzprime[5];
  313|   154k|   uint64_t zzzprime[5];
  314|       |
  315|   154k|   fadd_sub(in_q_z, in_q_x);
  316|   154k|   fadd_sub(in_q_dash_z, in_q_dash_x);
  317|       |
  318|   154k|   fmul(xxprime, in_q_dash_x, in_q_z);
  319|   154k|   fmul(zzprime, in_q_dash_z, in_q_x);
  320|       |
  321|   154k|   fadd_sub(zzprime, xxprime);
  322|       |
  323|   154k|   fsquare(result_q_plus_q_dash_x, xxprime);
  324|   154k|   fsquare(zzzprime, zzprime);
  325|   154k|   fmul(result_q_plus_q_dash_z, zzzprime, q_minus_q_dash);
  326|       |
  327|   154k|   fsquare(xx, in_q_x);
  328|   154k|   fsquare(zz, in_q_z);
  329|   154k|   fmul(result_two_q_x, xx, zz);
  330|       |
  331|   154k|   fdifference_backwards(zz, xx);  // does zz = xx - zz
  332|   154k|   fscalar_product(zzz, zz, 121665);
  333|   154k|   fsum(zzz, xx);
  334|       |
  335|   154k|   fmul(result_two_q_z, zz, zzz);
  336|   154k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_18fadd_subEPmS1_:
   77|   463k|inline void fadd_sub(uint64_t x[5], uint64_t y[5]) {
   78|       |   // TODO merge these and avoid the tmp array
   79|   463k|   uint64_t tmp[5];
   80|   463k|   copy_mem(tmp, y, 5);
   81|   463k|   fsum(y, x);
   82|   463k|   fdifference_backwards(x, tmp);  // does x - z
   83|   463k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_17fsquareEPmPKmm:
  168|   625k|inline void fsquare(uint64_t out[5], const uint64_t in[5], size_t count = 1) {
  169|   625k|   uint64_t r0 = in[0];
  170|   625k|   uint64_t r1 = in[1];
  171|   625k|   uint64_t r2 = in[2];
  172|   625k|   uint64_t r3 = in[3];
  173|   625k|   uint64_t r4 = in[4];
  174|       |
  175|  1.39M|   for(size_t i = 0; i != count; ++i) {
  ------------------
  |  Branch (175:22): [True: 771k, False: 625k]
  ------------------
  176|   771k|      const uint64_t d0 = r0 * 2;
  177|   771k|      const uint64_t d1 = r1 * 2;
  178|   771k|      const uint64_t d2 = r2 * 2 * 19;
  179|   771k|      const uint64_t d419 = r4 * 19;
  180|   771k|      const uint64_t d4 = d419 * 2;
  181|       |
  182|   771k|      uint128_t t0 = uint128_t(r0) * r0 + uint128_t(d4) * r1 + uint128_t(d2) * (r3);
  183|   771k|      uint128_t t1 = uint128_t(d0) * r1 + uint128_t(d4) * r2 + uint128_t(r3) * (r3 * 19);
  184|   771k|      uint128_t t2 = uint128_t(d0) * r2 + uint128_t(r1) * r1 + uint128_t(d4) * (r3);
  185|   771k|      uint128_t t3 = uint128_t(d0) * r3 + uint128_t(d1) * r2 + uint128_t(r4) * (d419);
  186|   771k|      uint128_t t4 = uint128_t(d0) * r4 + uint128_t(d1) * r3 + uint128_t(r2) * (r2);
  187|       |
  188|   771k|      r0 = t0 & 0x7ffffffffffff;
  189|   771k|      t1 += carry_shift(t0, 51);
  190|   771k|      r1 = t1 & 0x7ffffffffffff;
  191|   771k|      t2 += carry_shift(t1, 51);
  192|   771k|      r2 = t2 & 0x7ffffffffffff;
  193|   771k|      t3 += carry_shift(t2, 51);
  194|   771k|      r3 = t3 & 0x7ffffffffffff;
  195|   771k|      t4 += carry_shift(t3, 51);
  196|   771k|      r4 = t4 & 0x7ffffffffffff;
  197|   771k|      uint64_t c = carry_shift(t4, 51);
  198|       |
  199|   771k|      r0 += c * 19;
  200|   771k|      c = r0 >> 51;
  201|   771k|      r0 = r0 & 0x7ffffffffffff;
  202|   771k|      r1 += c;
  203|   771k|      c = r1 >> 51;
  204|   771k|      r1 = r1 & 0x7ffffffffffff;
  205|   771k|      r2 += c;
  206|   771k|   }
  207|       |
  208|   625k|   out[0] = r0;
  209|   625k|   out[1] = r1;
  210|   625k|   out[2] = r2;
  211|   625k|   out[3] = r3;
  212|   625k|   out[4] = r4;
  213|   625k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_121fdifference_backwardsEPmPKm:
   65|   618k|inline void fdifference_backwards(uint64_t out[5], const uint64_t in[5]) {
   66|       |   /* 152 is 19 << 3 */
   67|   618k|   const uint64_t two54m152 = (static_cast<uint64_t>(1) << 54) - 152;
   68|   618k|   const uint64_t two54m8 = (static_cast<uint64_t>(1) << 54) - 8;
   69|       |
   70|   618k|   out[0] = in[0] + two54m152 - out[0];
   71|   618k|   out[1] = in[1] + two54m8 - out[1];
   72|   618k|   out[2] = in[2] + two54m8 - out[2];
   73|   618k|   out[3] = in[3] + two54m8 - out[3];
   74|   618k|   out[4] = in[4] + two54m8 - out[4];
   75|   618k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_115fscalar_productEPmPKmm:
   86|   154k|inline void fscalar_product(uint64_t out[5], const uint64_t in[5], const uint64_t scalar) {
   87|   154k|   uint128_t a = uint128_t(in[0]) * scalar;
   88|   154k|   out[0] = a & 0x7ffffffffffff;
   89|       |
   90|   154k|   a = uint128_t(in[1]) * scalar + carry_shift(a, 51);
   91|   154k|   out[1] = a & 0x7ffffffffffff;
   92|       |
   93|   154k|   a = uint128_t(in[2]) * scalar + carry_shift(a, 51);
   94|   154k|   out[2] = a & 0x7ffffffffffff;
   95|       |
   96|   154k|   a = uint128_t(in[3]) * scalar + carry_shift(a, 51);
   97|   154k|   out[3] = a & 0x7ffffffffffff;
   98|       |
   99|   154k|   a = uint128_t(in[4]) * scalar + carry_shift(a, 51);
  100|   154k|   out[4] = a & 0x7ffffffffffff;
  101|       |
  102|   154k|   out[0] += carry_shift(a, 51) * 19;
  103|   154k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_14fsumEPmPKm:
   51|   618k|inline void fsum(uint64_t out[5], const uint64_t in[5]) {
   52|   618k|   out[0] += in[0];
   53|   618k|   out[1] += in[1];
   54|   618k|   out[2] += in[2];
   55|   618k|   out[3] += in[3];
   56|   618k|   out[4] += in[4];
   57|   618k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_16crecipEPmPKm:
  420|    604|void crecip(uint64_t out[5], const uint64_t z[5]) {
  421|    604|   uint64_t a[5];
  422|    604|   uint64_t b[5];
  423|    604|   uint64_t c[5];
  424|    604|   uint64_t t0[5];
  425|       |
  426|    604|   fsquare(a, z);        // 2
  427|    604|   fsquare(t0, a, 2);    // 8
  428|    604|   fmul(b, t0, z);       // 9
  429|    604|   fmul(a, b, a);        // 11
  430|    604|   fsquare(t0, a);       // 22
  431|    604|   fmul(b, t0, b);       // 2^5 - 2^0 = 31
  432|    604|   fsquare(t0, b, 5);    // 2^10 - 2^5
  433|    604|   fmul(b, t0, b);       // 2^10 - 2^0
  434|    604|   fsquare(t0, b, 10);   // 2^20 - 2^10
  435|    604|   fmul(c, t0, b);       // 2^20 - 2^0
  436|    604|   fsquare(t0, c, 20);   // 2^40 - 2^20
  437|    604|   fmul(t0, t0, c);      // 2^40 - 2^0
  438|    604|   fsquare(t0, t0, 10);  // 2^50 - 2^10
  439|    604|   fmul(b, t0, b);       // 2^50 - 2^0
  440|    604|   fsquare(t0, b, 50);   // 2^100 - 2^50
  441|    604|   fmul(c, t0, b);       // 2^100 - 2^0
  442|    604|   fsquare(t0, c, 100);  // 2^200 - 2^100
  443|    604|   fmul(t0, t0, c);      // 2^200 - 2^0
  444|    604|   fsquare(t0, t0, 50);  // 2^250 - 2^50
  445|    604|   fmul(t0, t0, b);      // 2^250 - 2^0
  446|    604|   fsquare(t0, t0, 5);   // 2^255 - 2^5
  447|    604|   fmul(out, t0, a);     // 2^255 - 21
  448|    604|}
donna.cpp:_ZN5Botan12_GLOBAL__N_14fmulEPmPKmS3_:
  113|   780k|inline void fmul(uint64_t out[5], const uint64_t in[5], const uint64_t in2[5]) {
  114|   780k|   const uint128_t s0 = in2[0];
  115|   780k|   const uint128_t s1 = in2[1];
  116|   780k|   const uint128_t s2 = in2[2];
  117|   780k|   const uint128_t s3 = in2[3];
  118|   780k|   const uint128_t s4 = in2[4];
  119|       |
  120|   780k|   uint64_t r0 = in[0];
  121|   780k|   uint64_t r1 = in[1];
  122|   780k|   uint64_t r2 = in[2];
  123|   780k|   uint64_t r3 = in[3];
  124|   780k|   uint64_t r4 = in[4];
  125|       |
  126|   780k|   uint128_t t0 = r0 * s0;
  127|   780k|   uint128_t t1 = r0 * s1 + r1 * s0;
  128|   780k|   uint128_t t2 = r0 * s2 + r2 * s0 + r1 * s1;
  129|   780k|   uint128_t t3 = r0 * s3 + r3 * s0 + r1 * s2 + r2 * s1;
  130|   780k|   uint128_t t4 = r0 * s4 + r4 * s0 + r3 * s1 + r1 * s3 + r2 * s2;
  131|       |
  132|   780k|   r4 *= 19;
  133|   780k|   r1 *= 19;
  134|   780k|   r2 *= 19;
  135|   780k|   r3 *= 19;
  136|       |
  137|   780k|   t0 += r4 * s1 + r1 * s4 + r2 * s3 + r3 * s2;
  138|   780k|   t1 += r4 * s2 + r2 * s4 + r3 * s3;
  139|   780k|   t2 += r4 * s3 + r3 * s4;
  140|   780k|   t3 += r4 * s4;
  141|       |
  142|   780k|   r0 = t0 & 0x7ffffffffffff;
  143|   780k|   t1 += carry_shift(t0, 51);
  144|   780k|   r1 = t1 & 0x7ffffffffffff;
  145|   780k|   t2 += carry_shift(t1, 51);
  146|   780k|   r2 = t2 & 0x7ffffffffffff;
  147|   780k|   t3 += carry_shift(t2, 51);
  148|   780k|   r3 = t3 & 0x7ffffffffffff;
  149|   780k|   t4 += carry_shift(t3, 51);
  150|   780k|   r4 = t4 & 0x7ffffffffffff;
  151|   780k|   uint64_t c = carry_shift(t4, 51);
  152|       |
  153|   780k|   r0 += c * 19;
  154|   780k|   c = r0 >> 51;
  155|   780k|   r0 = r0 & 0x7ffffffffffff;
  156|   780k|   r1 += c;
  157|   780k|   c = r1 >> 51;
  158|   780k|   r1 = r1 & 0x7ffffffffffff;
  159|   780k|   r2 += c;
  160|       |
  161|   780k|   out[0] = r0;
  162|   780k|   out[1] = r1;
  163|   780k|   out[2] = r2;
  164|   780k|   out[3] = r3;
  165|   780k|   out[4] = r4;
  166|   780k|}
donna.cpp:_ZN5Botan12_GLOBAL__N_19fcontractEPhPKm:
  227|    604|inline void fcontract(uint8_t* out, const uint64_t input[5]) {
  228|    604|   uint128_t t0 = input[0];
  229|    604|   uint128_t t1 = input[1];
  230|    604|   uint128_t t2 = input[2];
  231|    604|   uint128_t t3 = input[3];
  232|    604|   uint128_t t4 = input[4];
  233|       |
  234|  1.81k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (234:22): [True: 1.20k, False: 604]
  ------------------
  235|  1.20k|      t1 += t0 >> 51;
  236|  1.20k|      t0 &= 0x7ffffffffffff;
  237|  1.20k|      t2 += t1 >> 51;
  238|  1.20k|      t1 &= 0x7ffffffffffff;
  239|  1.20k|      t3 += t2 >> 51;
  240|  1.20k|      t2 &= 0x7ffffffffffff;
  241|  1.20k|      t4 += t3 >> 51;
  242|  1.20k|      t3 &= 0x7ffffffffffff;
  243|  1.20k|      t0 += (t4 >> 51) * 19;
  244|  1.20k|      t4 &= 0x7ffffffffffff;
  245|  1.20k|   }
  246|       |
  247|       |   /* now t is between 0 and 2^255-1, properly carried. */
  248|       |   /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
  249|       |
  250|    604|   t0 += 19;
  251|       |
  252|    604|   t1 += t0 >> 51;
  253|    604|   t0 &= 0x7ffffffffffff;
  254|    604|   t2 += t1 >> 51;
  255|    604|   t1 &= 0x7ffffffffffff;
  256|    604|   t3 += t2 >> 51;
  257|    604|   t2 &= 0x7ffffffffffff;
  258|    604|   t4 += t3 >> 51;
  259|    604|   t3 &= 0x7ffffffffffff;
  260|    604|   t0 += (t4 >> 51) * 19;
  261|    604|   t4 &= 0x7ffffffffffff;
  262|       |
  263|       |   /* now between 19 and 2^255-1 in both cases, and offset by 19. */
  264|       |
  265|    604|   t0 += 0x8000000000000 - 19;
  266|    604|   t1 += 0x8000000000000 - 1;
  267|    604|   t2 += 0x8000000000000 - 1;
  268|    604|   t3 += 0x8000000000000 - 1;
  269|    604|   t4 += 0x8000000000000 - 1;
  270|       |
  271|       |   /* now between 2^255 and 2^256-20, and offset by 2^255. */
  272|       |
  273|    604|   t1 += t0 >> 51;
  274|    604|   t0 &= 0x7ffffffffffff;
  275|    604|   t2 += t1 >> 51;
  276|    604|   t1 &= 0x7ffffffffffff;
  277|    604|   t3 += t2 >> 51;
  278|    604|   t2 &= 0x7ffffffffffff;
  279|    604|   t4 += t3 >> 51;
  280|    604|   t3 &= 0x7ffffffffffff;
  281|    604|   t4 &= 0x7ffffffffffff;
  282|       |
  283|    604|   store_le(out,
  284|    604|            combine_lower(t0, 0, t1, 51),
  285|    604|            combine_lower(t1, 13, t2, 38),
  286|    604|            combine_lower(t2, 26, t3, 25),
  287|    604|            combine_lower(t3, 39, t4, 12));
  288|    604|}

_ZN5Botan8CurveGFp11choose_reprERKNS_6BigIntES3_S3_:
  564|      6|std::shared_ptr<CurveGFp_Repr> CurveGFp::choose_repr(const BigInt& p, const BigInt& a, const BigInt& b) {
  565|      6|   if(p == prime_p192()) {
  ------------------
  |  Branch (565:7): [True: 0, False: 6]
  ------------------
  566|      0|      return std::make_shared<CurveGFp_P192>(a, b);
  567|      0|   }
  568|      6|   if(p == prime_p224()) {
  ------------------
  |  Branch (568:7): [True: 0, False: 6]
  ------------------
  569|      0|      return std::make_shared<CurveGFp_P224>(a, b);
  570|      0|   }
  571|      6|   if(p == prime_p256()) {
  ------------------
  |  Branch (571:7): [True: 1, False: 5]
  ------------------
  572|      1|      return std::make_shared<CurveGFp_P256>(a, b);
  573|      1|   }
  574|      5|   if(p == prime_p384()) {
  ------------------
  |  Branch (574:7): [True: 1, False: 4]
  ------------------
  575|      1|      return std::make_shared<CurveGFp_P384>(a, b);
  576|      1|   }
  577|      4|   if(p == prime_p521()) {
  ------------------
  |  Branch (577:7): [True: 1, False: 3]
  ------------------
  578|      1|      return std::make_shared<CurveGFp_P521>(a, b);
  579|      1|   }
  580|       |
  581|      3|   return std::make_shared<CurveGFp_Montgomery>(p, a, b);
  582|      4|}
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_NISTC2EmRKNS_6BigIntES4_:
  157|      3|            m_1(1), m_a(a), m_b(b), m_p_words((p_bits + BOTAN_MP_WORD_BITS - 1) / BOTAN_MP_WORD_BITS) {
  158|       |         // All Solinas prime curves are assumed a == -3
  159|      3|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST5get_aEv:
  165|  12.9k|      const BigInt& get_a() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST5get_bEv:
  167|  12.9k|      const BigInt& get_b() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST11get_p_wordsEv:
  171|  47.3k|      size_t get_p_words() const override { return m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST11get_ws_sizeEv:
  173|  80.9M|      size_t get_ws_size() const override { return 2 * m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST6is_oneERKNS_6BigIntE:
  179|  41.4k|      bool is_one(const BigInt& x) const override { return x == 1; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9a_is_zeroEv:
  161|  3.29M|      bool a_is_zero() const override { return false; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST12a_is_minus_3Ev:
  163|  3.29M|      bool a_is_minus_3() const override { return true; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_a_repEv:
  175|  24.9k|      const BigInt& get_a_rep() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_b_repEv:
  177|  34.9k|      const BigInt& get_b_rep() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST9get_1_repEv:
  169|  47.9k|      const BigInt& get_1_rep() const override { return m_1; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST12to_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  181|  20.5k|      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override { redc_mod_p(x, ws); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST14from_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  183|   101k|      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override { redc_mod_p(x, ws); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST15curve_mul_wordsERNS_6BigIntEPKmmRKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  217|  38.7M|   BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  218|  38.7M|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|  38.7M|      do {                          \
  |  |  100|  38.7M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  219|       |
  220|  38.7M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (220:7): [True: 0, False: 38.7M]
  ------------------
  221|      0|      ws.resize(get_ws_size());
  222|      0|   }
  223|       |
  224|  38.7M|   const size_t output_size = 2 * m_p_words;
  225|  38.7M|   if(z.size() < output_size) {
  ------------------
  |  Branch (225:7): [True: 322k, False: 38.4M]
  ------------------
  226|   322k|      z.grow_to(output_size);
  227|   322k|   }
  228|       |
  229|  38.7M|   bigint_mul(z.mutable_data(),
  230|  38.7M|              z.size(),
  231|  38.7M|              x_w,
  232|  38.7M|              x_size,
  233|  38.7M|              std::min(m_p_words, x_size),
  234|  38.7M|              y.data(),
  235|  38.7M|              y.size(),
  236|  38.7M|              std::min(m_p_words, y.size()),
  237|  38.7M|              ws.data(),
  238|  38.7M|              ws.size());
  239|       |
  240|  38.7M|   this->redc_mod_p(z, ws);
  241|  38.7M|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST15curve_sqr_wordsERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  243|  36.0M|void CurveGFp_NIST::curve_sqr_words(BigInt& z, const word x[], size_t x_size, secure_vector<word>& ws) const {
  244|  36.0M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (244:7): [True: 71.6k, False: 36.0M]
  ------------------
  245|  71.6k|      ws.resize(get_ws_size());
  246|  71.6k|   }
  247|       |
  248|  36.0M|   const size_t output_size = 2 * m_p_words;
  249|  36.0M|   if(z.size() < output_size) {
  ------------------
  |  Branch (249:7): [True: 3.50M, False: 32.5M]
  ------------------
  250|  3.50M|      z.grow_to(output_size);
  251|  3.50M|   }
  252|       |
  253|  36.0M|   bigint_sqr(z.mutable_data(), output_size, x, x_size, std::min(m_p_words, x_size), ws.data(), ws.size());
  254|       |
  255|  36.0M|   this->redc_mod_p(z, ws);
  256|  36.0M|}
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P256C2ERKNS_6BigIntES4_:
  289|      1|      CurveGFp_P256(const BigInt& a, const BigInt& b) : CurveGFp_NIST(256, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P2565get_pEv:
  291|   646k|      const BigInt& get_p() const override { return prime_p256(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P25614invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  299|  5.95k|BigInt CurveGFp_P256::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  300|  5.95k|   BigInt r, p2, p4, p8, p16, p32, tmp;
  301|       |
  302|  5.95k|   curve_sqr(r, x, ws);
  303|       |
  304|  5.95k|   curve_mul(p2, r, x, ws);
  305|  5.95k|   curve_sqr(r, p2, ws);
  306|  5.95k|   curve_sqr_tmp(r, tmp, ws);
  307|       |
  308|  5.95k|   curve_mul(p4, r, p2, ws);
  309|       |
  310|  5.95k|   curve_sqr(r, p4, ws);
  311|  23.8k|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (311:22): [True: 17.8k, False: 5.95k]
  ------------------
  312|  17.8k|      curve_sqr_tmp(r, tmp, ws);
  313|  17.8k|   }
  314|  5.95k|   curve_mul(p8, r, p4, ws);
  315|       |
  316|  5.95k|   curve_sqr(r, p8, ws);
  317|  47.6k|   for(size_t i = 0; i != 7; ++i) {
  ------------------
  |  Branch (317:22): [True: 41.6k, False: 5.95k]
  ------------------
  318|  41.6k|      curve_sqr_tmp(r, tmp, ws);
  319|  41.6k|   }
  320|  5.95k|   curve_mul(p16, r, p8, ws);
  321|       |
  322|  5.95k|   curve_sqr(r, p16, ws);
  323|  95.2k|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (323:22): [True: 89.3k, False: 5.95k]
  ------------------
  324|  89.3k|      curve_sqr_tmp(r, tmp, ws);
  325|  89.3k|   }
  326|  5.95k|   curve_mul(p32, r, p16, ws);
  327|       |
  328|  5.95k|   curve_sqr(r, p32, ws);
  329|   190k|   for(size_t i = 0; i != 31; ++i) {
  ------------------
  |  Branch (329:22): [True: 184k, False: 5.95k]
  ------------------
  330|   184k|      curve_sqr_tmp(r, tmp, ws);
  331|   184k|   }
  332|  5.95k|   curve_mul_tmp(r, x, tmp, ws);
  333|       |
  334|   768k|   for(size_t i = 0; i != 32 * 4; ++i) {
  ------------------
  |  Branch (334:22): [True: 762k, False: 5.95k]
  ------------------
  335|   762k|      curve_sqr_tmp(r, tmp, ws);
  336|   762k|   }
  337|  5.95k|   curve_mul_tmp(r, p32, tmp, ws);
  338|       |
  339|   196k|   for(size_t i = 0; i != 32; ++i) {
  ------------------
  |  Branch (339:22): [True: 190k, False: 5.95k]
  ------------------
  340|   190k|      curve_sqr_tmp(r, tmp, ws);
  341|   190k|   }
  342|  5.95k|   curve_mul_tmp(r, p32, tmp, ws);
  343|       |
  344|   101k|   for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (344:22): [True: 95.2k, False: 5.95k]
  ------------------
  345|  95.2k|      curve_sqr_tmp(r, tmp, ws);
  346|  95.2k|   }
  347|  5.95k|   curve_mul_tmp(r, p16, tmp, ws);
  348|  53.5k|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (348:22): [True: 47.6k, False: 5.95k]
  ------------------
  349|  47.6k|      curve_sqr_tmp(r, tmp, ws);
  350|  47.6k|   }
  351|  5.95k|   curve_mul_tmp(r, p8, tmp, ws);
  352|       |
  353|  29.7k|   for(size_t i = 0; i != 4; ++i) {
  ------------------
  |  Branch (353:22): [True: 23.8k, False: 5.95k]
  ------------------
  354|  23.8k|      curve_sqr_tmp(r, tmp, ws);
  355|  23.8k|   }
  356|  5.95k|   curve_mul_tmp(r, p4, tmp, ws);
  357|       |
  358|  17.8k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (358:22): [True: 11.9k, False: 5.95k]
  ------------------
  359|  11.9k|      curve_sqr_tmp(r, tmp, ws);
  360|  11.9k|   }
  361|  5.95k|   curve_mul_tmp(r, p2, tmp, ws);
  362|       |
  363|  17.8k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (363:22): [True: 11.9k, False: 5.95k]
  ------------------
  364|  11.9k|      curve_sqr_tmp(r, tmp, ws);
  365|  11.9k|   }
  366|  5.95k|   curve_mul_tmp(r, x, tmp, ws);
  367|       |
  368|  5.95k|   return r;
  369|  5.95k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST13curve_sqr_tmpERNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  197|  13.7M|      void curve_sqr_tmp(BigInt& x, BigInt& tmp, secure_vector<word>& ws) const {
  198|  13.7M|         curve_sqr(tmp, x, ws);
  199|  13.7M|         x.swap(tmp);
  200|  13.7M|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_NIST13curve_mul_tmpERNS_6BigIntERKS2_S3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  192|   386k|      void curve_mul_tmp(BigInt& x, const BigInt& y, BigInt& tmp, secure_vector<word>& ws) const {
  193|   386k|         curve_mul(tmp, x, y, ws);
  194|   386k|         x.swap(tmp);
  195|   386k|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P25610redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  294|  8.10M|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p256(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P384C2ERKNS_6BigIntES4_:
  376|      1|      CurveGFp_P384(const BigInt& a, const BigInt& b) : CurveGFp_NIST(384, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P3845get_pEv:
  378|  1.33M|      const BigInt& get_p() const override { return prime_p384(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P38414invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  386|  6.97k|BigInt CurveGFp_P384::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  387|       |   // From https://briansmith.org/ecc-inversion-addition-chains-01
  388|       |
  389|  6.97k|   BigInt r, x2, x3, x15, x30, tmp, rl;
  390|       |
  391|  6.97k|   r = x;
  392|  6.97k|   curve_sqr_tmp(r, tmp, ws);
  393|  6.97k|   curve_mul_tmp(r, x, tmp, ws);
  394|  6.97k|   x2 = r;
  395|       |
  396|  6.97k|   curve_sqr_tmp(r, tmp, ws);
  397|  6.97k|   curve_mul_tmp(r, x, tmp, ws);
  398|       |
  399|  6.97k|   x3 = r;
  400|       |
  401|  27.8k|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (401:22): [True: 20.9k, False: 6.97k]
  ------------------
  402|  20.9k|      curve_sqr_tmp(r, tmp, ws);
  403|  20.9k|   }
  404|  6.97k|   curve_mul_tmp(r, x3, tmp, ws);
  405|       |
  406|  6.97k|   rl = r;
  407|  48.8k|   for(size_t i = 0; i != 6; ++i) {
  ------------------
  |  Branch (407:22): [True: 41.8k, False: 6.97k]
  ------------------
  408|  41.8k|      curve_sqr_tmp(r, tmp, ws);
  409|  41.8k|   }
  410|  6.97k|   curve_mul_tmp(r, rl, tmp, ws);
  411|       |
  412|  27.8k|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (412:22): [True: 20.9k, False: 6.97k]
  ------------------
  413|  20.9k|      curve_sqr_tmp(r, tmp, ws);
  414|  20.9k|   }
  415|  6.97k|   curve_mul_tmp(r, x3, tmp, ws);
  416|       |
  417|  6.97k|   x15 = r;
  418|   111k|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (418:22): [True: 104k, False: 6.97k]
  ------------------
  419|   104k|      curve_sqr_tmp(r, tmp, ws);
  420|   104k|   }
  421|  6.97k|   curve_mul_tmp(r, x15, tmp, ws);
  422|       |
  423|  6.97k|   x30 = r;
  424|   216k|   for(size_t i = 0; i != 30; ++i) {
  ------------------
  |  Branch (424:22): [True: 209k, False: 6.97k]
  ------------------
  425|   209k|      curve_sqr_tmp(r, tmp, ws);
  426|   209k|   }
  427|  6.97k|   curve_mul_tmp(r, x30, tmp, ws);
  428|       |
  429|  6.97k|   rl = r;
  430|   425k|   for(size_t i = 0; i != 60; ++i) {
  ------------------
  |  Branch (430:22): [True: 418k, False: 6.97k]
  ------------------
  431|   418k|      curve_sqr_tmp(r, tmp, ws);
  432|   418k|   }
  433|  6.97k|   curve_mul_tmp(r, rl, tmp, ws);
  434|       |
  435|  6.97k|   rl = r;
  436|   843k|   for(size_t i = 0; i != 120; ++i) {
  ------------------
  |  Branch (436:22): [True: 836k, False: 6.97k]
  ------------------
  437|   836k|      curve_sqr_tmp(r, tmp, ws);
  438|   836k|   }
  439|  6.97k|   curve_mul_tmp(r, rl, tmp, ws);
  440|       |
  441|   111k|   for(size_t i = 0; i != 15; ++i) {
  ------------------
  |  Branch (441:22): [True: 104k, False: 6.97k]
  ------------------
  442|   104k|      curve_sqr_tmp(r, tmp, ws);
  443|   104k|   }
  444|  6.97k|   curve_mul_tmp(r, x15, tmp, ws);
  445|       |
  446|   223k|   for(size_t i = 0; i != 31; ++i) {
  ------------------
  |  Branch (446:22): [True: 216k, False: 6.97k]
  ------------------
  447|   216k|      curve_sqr_tmp(r, tmp, ws);
  448|   216k|   }
  449|  6.97k|   curve_mul_tmp(r, x30, tmp, ws);
  450|       |
  451|  20.9k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (451:22): [True: 13.9k, False: 6.97k]
  ------------------
  452|  13.9k|      curve_sqr_tmp(r, tmp, ws);
  453|  13.9k|   }
  454|  6.97k|   curve_mul_tmp(r, x2, tmp, ws);
  455|       |
  456|   662k|   for(size_t i = 0; i != 94; ++i) {
  ------------------
  |  Branch (456:22): [True: 655k, False: 6.97k]
  ------------------
  457|   655k|      curve_sqr_tmp(r, tmp, ws);
  458|   655k|   }
  459|  6.97k|   curve_mul_tmp(r, x30, tmp, ws);
  460|       |
  461|  20.9k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (461:22): [True: 13.9k, False: 6.97k]
  ------------------
  462|  13.9k|      curve_sqr_tmp(r, tmp, ws);
  463|  13.9k|   }
  464|       |
  465|  6.97k|   curve_mul_tmp(r, x, tmp, ws);
  466|       |
  467|  6.97k|   return r;
  468|  6.97k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P38410redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  381|  16.1M|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p384(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_113CurveGFp_P521C2ERKNS_6BigIntES4_:
  475|      1|      CurveGFp_P521(const BigInt& a, const BigInt& b) : CurveGFp_NIST(521, a, b) {}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P5215get_pEv:
  477|  4.06M|      const BigInt& get_p() const override { return prime_p521(); }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P52114invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  485|  18.5k|BigInt CurveGFp_P521::invert_element(const BigInt& x, secure_vector<word>& ws) const {
  486|       |   // Addition chain from https://eprint.iacr.org/2014/852.pdf section
  487|       |
  488|  18.5k|   BigInt r;
  489|  18.5k|   BigInt rl;
  490|  18.5k|   BigInt a7;
  491|  18.5k|   BigInt tmp;
  492|       |
  493|  18.5k|   curve_sqr(r, x, ws);
  494|  18.5k|   curve_mul_tmp(r, x, tmp, ws);
  495|       |
  496|  18.5k|   curve_sqr_tmp(r, tmp, ws);
  497|  18.5k|   curve_mul_tmp(r, x, tmp, ws);
  498|       |
  499|  18.5k|   rl = r;
  500|       |
  501|  74.3k|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (501:22): [True: 55.7k, False: 18.5k]
  ------------------
  502|  55.7k|      curve_sqr_tmp(r, tmp, ws);
  503|  55.7k|   }
  504|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  505|       |
  506|  18.5k|   curve_sqr_tmp(r, tmp, ws);
  507|  18.5k|   curve_mul_tmp(r, x, tmp, ws);
  508|  18.5k|   a7 = r;  // need this value later
  509|       |
  510|  18.5k|   curve_sqr_tmp(r, tmp, ws);
  511|  18.5k|   curve_mul_tmp(r, x, tmp, ws);
  512|       |
  513|  18.5k|   rl = r;
  514|   167k|   for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (514:22): [True: 148k, False: 18.5k]
  ------------------
  515|   148k|      curve_sqr_tmp(r, tmp, ws);
  516|   148k|   }
  517|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  518|       |
  519|  18.5k|   rl = r;
  520|   315k|   for(size_t i = 0; i != 16; ++i) {
  ------------------
  |  Branch (520:22): [True: 297k, False: 18.5k]
  ------------------
  521|   297k|      curve_sqr_tmp(r, tmp, ws);
  522|   297k|   }
  523|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  524|       |
  525|  18.5k|   rl = r;
  526|   613k|   for(size_t i = 0; i != 32; ++i) {
  ------------------
  |  Branch (526:22): [True: 594k, False: 18.5k]
  ------------------
  527|   594k|      curve_sqr_tmp(r, tmp, ws);
  528|   594k|   }
  529|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  530|       |
  531|  18.5k|   rl = r;
  532|  1.20M|   for(size_t i = 0; i != 64; ++i) {
  ------------------
  |  Branch (532:22): [True: 1.18M, False: 18.5k]
  ------------------
  533|  1.18M|      curve_sqr_tmp(r, tmp, ws);
  534|  1.18M|   }
  535|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  536|       |
  537|  18.5k|   rl = r;
  538|  2.39M|   for(size_t i = 0; i != 128; ++i) {
  ------------------
  |  Branch (538:22): [True: 2.37M, False: 18.5k]
  ------------------
  539|  2.37M|      curve_sqr_tmp(r, tmp, ws);
  540|  2.37M|   }
  541|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  542|       |
  543|  18.5k|   rl = r;
  544|  4.77M|   for(size_t i = 0; i != 256; ++i) {
  ------------------
  |  Branch (544:22): [True: 4.75M, False: 18.5k]
  ------------------
  545|  4.75M|      curve_sqr_tmp(r, tmp, ws);
  546|  4.75M|   }
  547|  18.5k|   curve_mul_tmp(r, rl, tmp, ws);
  548|       |
  549|   148k|   for(size_t i = 0; i != 7; ++i) {
  ------------------
  |  Branch (549:22): [True: 130k, False: 18.5k]
  ------------------
  550|   130k|      curve_sqr_tmp(r, tmp, ws);
  551|   130k|   }
  552|  18.5k|   curve_mul_tmp(r, a7, tmp, ws);
  553|       |
  554|  55.7k|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (554:22): [True: 37.1k, False: 18.5k]
  ------------------
  555|  37.1k|      curve_sqr_tmp(r, tmp, ws);
  556|  37.1k|   }
  557|  18.5k|   curve_mul_tmp(r, x, tmp, ws);
  558|       |
  559|  18.5k|   return r;
  560|  18.5k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_113CurveGFp_P52110redc_mod_pERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  480|  50.7M|      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p521(x, ws); }
curve_gfp.cpp:_ZN5Botan12_GLOBAL__N_119CurveGFp_MontgomeryC2ERKNS_6BigIntES4_S4_:
   24|      3|            m_p(p), m_a(a), m_b(b), m_p_words(m_p.sig_words()), m_p_dash(monty_inverse(m_p.word_at(0))) {
   25|      3|         Modular_Reducer mod_p(m_p);
   26|       |
   27|      3|         m_r.set_bit(m_p_words * BOTAN_MP_WORD_BITS);
  ------------------
  |  |   50|      3|#define BOTAN_MP_WORD_BITS 64
  ------------------
   28|      3|         m_r = mod_p.reduce(m_r);
   29|       |
   30|      3|         m_r2 = mod_p.square(m_r);
   31|      3|         m_r3 = mod_p.multiply(m_r, m_r2);
   32|      3|         m_a_r = mod_p.multiply(m_r, m_a);
   33|      3|         m_b_r = mod_p.multiply(m_r, m_b);
   34|       |
   35|      3|         m_a_is_zero = m_a.is_zero();
   36|      3|         m_a_is_minus_3 = (m_a + 3 == m_p);
   37|      3|      }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_pEv:
   47|  5.17M|      const BigInt& get_p() const override { return m_p; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_aEv:
   43|  10.2k|      const BigInt& get_a() const override { return m_a; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery5get_bEv:
   45|  10.2k|      const BigInt& get_b() const override { return m_b; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery11get_p_wordsEv:
   57|  35.8k|      size_t get_p_words() const override { return m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery11get_ws_sizeEv:
   59|  62.7M|      size_t get_ws_size() const override { return 2 * m_p_words; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery6is_oneERKNS_6BigIntE:
   55|  34.4k|      bool is_one(const BigInt& x) const override { return x == m_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9a_is_zeroEv:
   39|  2.80M|      bool a_is_zero() const override { return m_a_is_zero; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery12a_is_minus_3Ev:
   41|  2.80M|      bool a_is_minus_3() const override { return m_a_is_minus_3; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_a_repEv:
   49|  2.82M|      const BigInt& get_a_rep() const override { return m_a_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_b_repEv:
   51|  29.4k|      const BigInt& get_b_rep() const override { return m_b_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery9get_1_repEv:
   53|  39.0k|      const BigInt& get_1_rep() const override { return m_r; }
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery14invert_elementERKNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   86|  26.2k|BigInt CurveGFp_Montgomery::invert_element(const BigInt& x, secure_vector<word>& ws) const {
   87|       |   // Should we use Montgomery inverse instead?
   88|  26.2k|   const BigInt inv = inverse_mod(x, m_p);
   89|  26.2k|   BigInt res;
   90|  26.2k|   curve_mul(res, inv, m_r3, ws);
   91|  26.2k|   return res;
   92|  26.2k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery12to_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   94|  16.5k|void CurveGFp_Montgomery::to_curve_rep(BigInt& x, secure_vector<word>& ws) const {
   95|  16.5k|   const BigInt tx = x;
   96|  16.5k|   curve_mul(x, tx, m_r2, ws);
   97|  16.5k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery14from_curve_repERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   99|  85.1k|void CurveGFp_Montgomery::from_curve_rep(BigInt& z, secure_vector<word>& ws) const {
  100|  85.1k|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (100:7): [True: 8.15k, False: 77.0k]
  ------------------
  101|  8.15k|      ws.resize(get_ws_size());
  102|  8.15k|   }
  103|       |
  104|  85.1k|   const size_t output_size = 2 * m_p_words;
  105|  85.1k|   if(z.size() < output_size) {
  ------------------
  |  Branch (105:7): [True: 7.41k, False: 77.7k]
  ------------------
  106|  7.41k|      z.grow_to(output_size);
  107|  7.41k|   }
  108|       |
  109|  85.1k|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  110|  85.1k|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery15curve_mul_wordsERNS_6BigIntEPKmmRKS2_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  113|  32.8M|   BigInt& z, const word x_w[], size_t x_size, const BigInt& y, secure_vector<word>& ws) const {
  114|  32.8M|   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
  ------------------
  |  |   99|  32.8M|      do {                          \
  |  |  100|  32.8M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  32.8M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (116:7): [True: 0, False: 32.8M]
  ------------------
  117|      0|      ws.resize(get_ws_size());
  118|      0|   }
  119|       |
  120|  32.8M|   const size_t output_size = 2 * m_p_words;
  121|  32.8M|   if(z.size() < output_size) {
  ------------------
  |  Branch (121:7): [True: 267k, False: 32.6M]
  ------------------
  122|   267k|      z.grow_to(output_size);
  123|   267k|   }
  124|       |
  125|  32.8M|   bigint_mul(z.mutable_data(),
  126|  32.8M|              z.size(),
  127|  32.8M|              x_w,
  128|  32.8M|              x_size,
  129|  32.8M|              std::min(m_p_words, x_size),
  130|  32.8M|              y.data(),
  131|  32.8M|              y.size(),
  132|  32.8M|              std::min(m_p_words, y.size()),
  133|  32.8M|              ws.data(),
  134|  32.8M|              ws.size());
  135|       |
  136|  32.8M|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  137|  32.8M|}
curve_gfp.cpp:_ZNK5Botan12_GLOBAL__N_119CurveGFp_Montgomery15curve_sqr_wordsERNS_6BigIntEPKmmRNSt3__16vectorImNS_16secure_allocatorImEEEE:
  139|  24.6M|void CurveGFp_Montgomery::curve_sqr_words(BigInt& z, const word x[], size_t x_size, secure_vector<word>& ws) const {
  140|  24.6M|   if(ws.size() < get_ws_size()) {
  ------------------
  |  Branch (140:7): [True: 60.4k, False: 24.5M]
  ------------------
  141|  60.4k|      ws.resize(get_ws_size());
  142|  60.4k|   }
  143|       |
  144|  24.6M|   const size_t output_size = 2 * m_p_words;
  145|  24.6M|   if(z.size() < output_size) {
  ------------------
  |  Branch (145:7): [True: 149k, False: 24.4M]
  ------------------
  146|   149k|      z.grow_to(output_size);
  147|   149k|   }
  148|       |
  149|  24.6M|   bigint_sqr(z.mutable_data(), z.size(), x, x_size, std::min(m_p_words, x_size), ws.data(), ws.size());
  150|       |
  151|  24.6M|   bigint_monty_redc(z.mutable_data(), m_p.data(), m_p_words, m_p_dash, ws.data(), ws.size());
  152|  24.6M|}

_ZN5Botan8EC_Group13ec_group_dataEv:
  289|  33.5k|EC_Group_Data_Map& EC_Group::ec_group_data() {
  290|       |   /*
  291|       |   * This exists purely to ensure the allocator is constructed before g_ec_data,
  292|       |   * which ensures that its destructor runs after ~g_ec_data is complete.
  293|       |   */
  294|       |
  295|  33.5k|   static Allocator_Initializer g_init_allocator;
  296|  33.5k|   static EC_Group_Data_Map g_ec_data;
  297|  33.5k|   return g_ec_data;
  298|  33.5k|}
_ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE:
  310|      6|                                                            const OID& oid) {
  311|      6|   const BigInt p(p_str);
  312|      6|   const BigInt a(a_str);
  313|      6|   const BigInt b(b_str);
  314|      6|   const BigInt g_x(g_x_str);
  315|      6|   const BigInt g_y(g_y_str);
  316|      6|   const BigInt order(order_str);
  317|      6|   const BigInt cofactor(1);  // implicit
  318|       |
  319|      6|   return std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin);
  320|      6|}
_ZN5Botan8EC_GroupC2Ev:
  384|  18.6k|EC_Group::EC_Group() = default;
_ZN5Botan8EC_GroupD2Ev:
  386|  71.9k|EC_Group::~EC_Group() = default;
_ZN5Botan8EC_GroupC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  395|  33.5k|EC_Group::EC_Group(std::string_view str) {
  396|  33.5k|   if(str.empty()) {
  ------------------
  |  Branch (396:7): [True: 0, False: 33.5k]
  ------------------
  397|      0|      return;  // no initialization / uninitialized
  398|      0|   }
  399|       |
  400|  33.5k|   try {
  401|  33.5k|      const OID oid = OID::from_string(str);
  402|  33.5k|      if(oid.has_value()) {
  ------------------
  |  Branch (402:10): [True: 33.5k, False: 0]
  ------------------
  403|  33.5k|         m_data = ec_group_data().lookup(oid);
  404|  33.5k|      }
  405|  33.5k|   } catch(...) {}
  406|       |
  407|  33.5k|   if(m_data == nullptr) {
  ------------------
  |  Branch (407:7): [True: 0, False: 33.5k]
  ------------------
  408|      0|      if(str.size() > 30 && str.substr(0, 29) == "-----BEGIN EC PARAMETERS-----") {
  ------------------
  |  Branch (408:10): [True: 0, False: 0]
  |  Branch (408:29): [True: 0, False: 0]
  ------------------
  409|       |         // OK try it as PEM ...
  410|      0|         secure_vector<uint8_t> ber = PEM_Code::decode_check_label(str, "EC PARAMETERS");
  411|      0|         this->m_data = BER_decode_EC_group(ber.data(), ber.size(), EC_Group_Source::ExternalSource);
  412|      0|      }
  413|      0|   }
  414|       |
  415|  33.5k|   if(m_data == nullptr) {
  ------------------
  |  Branch (415:7): [True: 0, False: 33.5k]
  ------------------
  416|      0|      throw Invalid_Argument(fmt("Unknown ECC group '{}'", str));
  417|      0|   }
  418|  33.5k|}
_ZNK5Botan8EC_Group4dataEv:
  442|   148k|const EC_Group_Data& EC_Group::data() const {
  443|   148k|   if(m_data == nullptr) {
  ------------------
  |  Branch (443:7): [True: 0, False: 148k]
  ------------------
  444|      0|      throw Invalid_State("EC_Group uninitialized");
  445|      0|   }
  446|   148k|   return *m_data;
  447|   148k|}
_ZNK5Botan8EC_Group10get_p_bitsEv:
  453|  9.82k|size_t EC_Group::get_p_bits() const { return data().p_bits(); }
_ZNK5Botan8EC_Group11get_p_bytesEv:
  455|  9.06k|size_t EC_Group::get_p_bytes() const { return data().p_bytes(); }
_ZNK5Botan8EC_Group9get_orderEv:
  469|  28.5k|const BigInt& EC_Group::get_order() const { return data().order(); }
_ZNK5Botan8EC_Group12get_cofactorEv:
  475|  19.6k|const BigInt& EC_Group::get_cofactor() const { return data().cofactor(); }
_ZNK5Botan8EC_Group17inverse_mod_orderERKNS_6BigIntE:
  487|  9.82k|BigInt EC_Group::inverse_mod_order(const BigInt& x) const { return data().inverse_mod_order(x); }
_ZNK5Botan8EC_Group13get_curve_oidEv:
  489|  28.5k|const OID& EC_Group::get_curve_oid() const { return data().oid(); }
_ZNK5Botan8EC_Group6OS2ECPEPKhm:
  502|  24.7k|EC_Point EC_Group::OS2ECP(const uint8_t bits[], size_t len) const { return Botan::OS2ECP(bits, len, data().curve()); }
_ZNK5Botan8EC_Group27blinded_base_point_multiplyERKNS_6BigIntERNS_21RandomNumberGeneratorERNSt3__16vectorIS1_NS6_9allocatorIS1_EEEE:
  516|  18.6k|                                               std::vector<BigInt>& ws) const {
  517|  18.6k|   return data().blinded_base_point_multiply(k, rng, ws);
  518|  18.6k|}
_ZNK5Botan8EC_Group13random_scalarERNS_21RandomNumberGeneratorE:
  531|  18.6k|BigInt EC_Group::random_scalar(RandomNumberGenerator& rng) const {
  532|  18.6k|   return BigInt::random_integer(rng, BigInt::one(), get_order());
  533|  18.6k|}
_ZNK5Botan8EC_Group26blinded_var_point_multiplyERKNS_8EC_PointERKNS_6BigIntERNS_21RandomNumberGeneratorERNSt3__16vectorIS4_NS9_9allocatorIS4_EEEE:
  538|  9.82k|                                              std::vector<BigInt>& ws) const {
  539|  9.82k|   EC_Point_Var_Point_Precompute mul(point, rng, ws);
  540|  9.82k|   return mul.mul(k, rng, get_order(), ws);
  541|  9.82k|}
_ZN5Botan17EC_Group_Data_MapC2Ev:
  147|      1|      EC_Group_Data_Map() = default;
_ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE:
  156|  33.5k|      std::shared_ptr<EC_Group_Data> lookup(const OID& oid) {
  157|  33.5k|         lock_guard_type<mutex_type> lock(m_mutex);
  158|       |
  159|   116k|         for(auto i : m_registered_curves) {
  ------------------
  |  Branch (159:21): [True: 116k, False: 6]
  ------------------
  160|   116k|            if(i->oid() == oid) {
  ------------------
  |  Branch (160:16): [True: 33.5k, False: 82.7k]
  ------------------
  161|  33.5k|               return i;
  162|  33.5k|            }
  163|   116k|         }
  164|       |
  165|       |         // Not found, check hardcoded data
  166|      6|         std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid);
  167|       |
  168|      6|         if(data) {
  ------------------
  |  Branch (168:13): [True: 6, False: 0]
  ------------------
  169|     15|            for(auto curve : m_registered_curves) {
  ------------------
  |  Branch (169:28): [True: 15, False: 6]
  ------------------
  170|     15|               if(curve->oid().empty() == true && curve->params_match(*data)) {
  ------------------
  |  Branch (170:19): [True: 0, False: 15]
  |  Branch (170:51): [True: 0, False: 0]
  ------------------
  171|      0|                  curve->set_oid(oid);
  172|      0|                  return curve;
  173|      0|               }
  174|     15|            }
  175|       |
  176|      6|            m_registered_curves.push_back(data);
  177|      6|            return data;
  178|      6|         }
  179|       |
  180|       |         // Nope, unknown curve
  181|      0|         return std::shared_ptr<EC_Group_Data>();
  182|      6|      }
_ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE:
   54|      6|            m_source(source) {}
_ZNK5Botan13EC_Group_Data6p_bitsEv:
   93|  9.82k|      size_t p_bits() const { return m_p_bits; }
_ZNK5Botan13EC_Group_Data7p_bytesEv:
   95|  9.06k|      size_t p_bytes() const { return (m_p_bits + 7) / 8; }
_ZNK5Botan13EC_Group_Data5orderEv:
   85|  28.5k|      const BigInt& order() const { return m_order; }
_ZNK5Botan13EC_Group_Data8cofactorEv:
   87|  19.6k|      const BigInt& cofactor() const { return m_cofactor; }
_ZNK5Botan13EC_Group_Data17inverse_mod_orderERKNS_6BigIntE:
  119|  9.82k|      BigInt inverse_mod_order(const BigInt& x) const { return inverse_mod(x, m_order); }
_ZNK5Botan13EC_Group_Data3oidEv:
   77|   144k|      const OID& oid() const { return m_oid; }
_ZNK5Botan13EC_Group_Data5curveEv:
  101|  24.7k|      const CurveGFp& curve() const { return m_curve; }
_ZNK5Botan13EC_Group_Data27blinded_base_point_multiplyERKNS_6BigIntERNS_21RandomNumberGeneratorERNSt3__16vectorIS1_NS6_9allocatorIS1_EEEE:
  121|  18.6k|      EC_Point blinded_base_point_multiply(const BigInt& k, RandomNumberGenerator& rng, std::vector<BigInt>& ws) const {
  122|  18.6k|         return m_base_mult.mul(k, rng, m_order, ws);
  123|  18.6k|      }

_ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE:
   15|      6|std::shared_ptr<EC_Group_Data> EC_Group::EC_group_info(const OID& oid) {
   16|       |   // secp256r1
   17|      6|   if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) {
  ------------------
  |  Branch (17:7): [True: 1, False: 5]
  ------------------
   18|      1|      return load_EC_group_info(
   19|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
   20|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
   21|      1|         "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
   22|      1|         "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
   23|      1|         "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
   24|      1|         "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
   25|      1|         oid);
   26|      1|   }
   27|       |
   28|       |   // secp384r1
   29|      5|   if(oid == OID{1, 3, 132, 0, 34}) {
  ------------------
  |  Branch (29:7): [True: 1, False: 4]
  ------------------
   30|      1|      return load_EC_group_info(
   31|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
   32|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
   33|      1|         "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
   34|      1|         "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
   35|      1|         "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
   36|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
   37|      1|         oid);
   38|      1|   }
   39|       |
   40|       |   // secp521r1
   41|      4|   if(oid == OID{1, 3, 132, 0, 35}) {
  ------------------
  |  Branch (41:7): [True: 1, False: 3]
  ------------------
   42|      1|      return load_EC_group_info(
   43|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
   44|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
   45|      1|         "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
   46|      1|         "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
   47|      1|         "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
   48|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
   49|      1|         oid);
   50|      1|   }
   51|       |
   52|       |   // brainpool160r1
   53|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) {
  ------------------
  |  Branch (53:7): [True: 0, False: 3]
  ------------------
   54|      0|      return load_EC_group_info(
   55|      0|         "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F",
   56|      0|         "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
   57|      0|         "0x1E589A8595423412134FAA2DBDEC95C8D8675E58",
   58|      0|         "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
   59|      0|         "0x1667CB477A1A8EC338F94741669C976316DA6321",
   60|      0|         "0xE95E4A5F737059DC60DF5991D45029409E60FC09",
   61|      0|         oid);
   62|      0|   }
   63|       |
   64|       |   // brainpool192r1
   65|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) {
  ------------------
  |  Branch (65:7): [True: 0, False: 3]
  ------------------
   66|      0|      return load_EC_group_info(
   67|      0|         "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
   68|      0|         "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
   69|      0|         "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
   70|      0|         "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
   71|      0|         "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
   72|      0|         "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
   73|      0|         oid);
   74|      0|   }
   75|       |
   76|       |   // brainpool224r1
   77|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) {
  ------------------
  |  Branch (77:7): [True: 0, False: 3]
  ------------------
   78|      0|      return load_EC_group_info(
   79|      0|         "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
   80|      0|         "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
   81|      0|         "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
   82|      0|         "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
   83|      0|         "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
   84|      0|         "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
   85|      0|         oid);
   86|      0|   }
   87|       |
   88|       |   // brainpool256r1
   89|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) {
  ------------------
  |  Branch (89:7): [True: 1, False: 2]
  ------------------
   90|      1|      return load_EC_group_info(
   91|      1|         "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
   92|      1|         "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
   93|      1|         "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
   94|      1|         "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
   95|      1|         "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
   96|      1|         "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
   97|      1|         oid);
   98|      1|   }
   99|       |
  100|       |   // brainpool320r1
  101|      2|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) {
  ------------------
  |  Branch (101:7): [True: 0, False: 2]
  ------------------
  102|      0|      return load_EC_group_info(
  103|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
  104|      0|         "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
  105|      0|         "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
  106|      0|         "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
  107|      0|         "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
  108|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
  109|      0|         oid);
  110|      0|   }
  111|       |
  112|       |   // brainpool384r1
  113|      2|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) {
  ------------------
  |  Branch (113:7): [True: 1, False: 1]
  ------------------
  114|      1|      return load_EC_group_info(
  115|      1|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
  116|      1|         "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
  117|      1|         "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
  118|      1|         "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
  119|      1|         "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
  120|      1|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
  121|      1|         oid);
  122|      1|   }
  123|       |
  124|       |   // brainpool512r1
  125|      1|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) {
  ------------------
  |  Branch (125:7): [True: 1, False: 0]
  ------------------
  126|      1|      return load_EC_group_info(
  127|      1|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
  128|      1|         "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
  129|      1|         "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
  130|      1|         "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
  131|      1|         "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
  132|      1|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
  133|      1|         oid);
  134|      1|   }
  135|       |
  136|       |   // frp256v1
  137|      0|   if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) {
  ------------------
  |  Branch (137:7): [True: 0, False: 0]
  ------------------
  138|      0|      return load_EC_group_info(
  139|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03",
  140|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00",
  141|      0|         "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F",
  142|      0|         "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF",
  143|      0|         "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB",
  144|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1",
  145|      0|         oid);
  146|      0|   }
  147|       |
  148|       |   // gost_256A
  149|      0|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) {
  ------------------
  |  Branch (149:7): [True: 0, False: 0]
  |  Branch (149:7): [True: 0, False: 0]
  |  Branch (149:50): [True: 0, False: 0]
  |  Branch (149:88): [True: 0, False: 0]
  ------------------
  150|      0|      return load_EC_group_info(
  151|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97",
  152|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94",
  153|      0|         "0xA6",
  154|      0|         "1",
  155|      0|         "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14",
  156|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893",
  157|      0|         OID{1, 2, 643, 7, 1, 2, 1, 1, 1});
  158|      0|   }
  159|       |
  160|       |   // gost_512A
  161|      0|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) {
  ------------------
  |  Branch (161:7): [True: 0, False: 0]
  ------------------
  162|      0|      return load_EC_group_info(
  163|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7",
  164|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4",
  165|      0|         "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760",
  166|      0|         "3",
  167|      0|         "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4",
  168|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275",
  169|      0|         oid);
  170|      0|   }
  171|       |
  172|       |   // secp160k1
  173|      0|   if(oid == OID{1, 3, 132, 0, 9}) {
  ------------------
  |  Branch (173:7): [True: 0, False: 0]
  ------------------
  174|      0|      return load_EC_group_info(
  175|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  176|      0|         "0",
  177|      0|         "7",
  178|      0|         "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
  179|      0|         "0x938CF935318FDCED6BC28286531733C3F03C4FEE",
  180|      0|         "0x100000000000000000001B8FA16DFAB9ACA16B6B3",
  181|      0|         oid);
  182|      0|   }
  183|       |
  184|       |   // secp160r1
  185|      0|   if(oid == OID{1, 3, 132, 0, 8}) {
  ------------------
  |  Branch (185:7): [True: 0, False: 0]
  ------------------
  186|      0|      return load_EC_group_info(
  187|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
  188|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
  189|      0|         "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
  190|      0|         "0x4A96B5688EF573284664698968C38BB913CBFC82",
  191|      0|         "0x23A628553168947D59DCC912042351377AC5FB32",
  192|      0|         "0x100000000000000000001F4C8F927AED3CA752257",
  193|      0|         oid);
  194|      0|   }
  195|       |
  196|       |   // secp160r2
  197|      0|   if(oid == OID{1, 3, 132, 0, 30}) {
  ------------------
  |  Branch (197:7): [True: 0, False: 0]
  ------------------
  198|      0|      return load_EC_group_info(
  199|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  200|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
  201|      0|         "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA",
  202|      0|         "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D",
  203|      0|         "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
  204|      0|         "0x100000000000000000000351EE786A818F3A1A16B",
  205|      0|         oid);
  206|      0|   }
  207|       |
  208|       |   // secp192k1
  209|      0|   if(oid == OID{1, 3, 132, 0, 31}) {
  ------------------
  |  Branch (209:7): [True: 0, False: 0]
  ------------------
  210|      0|      return load_EC_group_info(
  211|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
  212|      0|         "0",
  213|      0|         "3",
  214|      0|         "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
  215|      0|         "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
  216|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
  217|      0|         oid);
  218|      0|   }
  219|       |
  220|       |   // secp192r1
  221|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) {
  ------------------
  |  Branch (221:7): [True: 0, False: 0]
  ------------------
  222|      0|      return load_EC_group_info(
  223|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  224|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  225|      0|         "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
  226|      0|         "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
  227|      0|         "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
  228|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
  229|      0|         oid);
  230|      0|   }
  231|       |
  232|       |   // secp224k1
  233|      0|   if(oid == OID{1, 3, 132, 0, 32}) {
  ------------------
  |  Branch (233:7): [True: 0, False: 0]
  ------------------
  234|      0|      return load_EC_group_info(
  235|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
  236|      0|         "0",
  237|      0|         "5",
  238|      0|         "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
  239|      0|         "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
  240|      0|         "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
  241|      0|         oid);
  242|      0|   }
  243|       |
  244|       |   // secp224r1
  245|      0|   if(oid == OID{1, 3, 132, 0, 33}) {
  ------------------
  |  Branch (245:7): [True: 0, False: 0]
  ------------------
  246|      0|      return load_EC_group_info(
  247|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
  248|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
  249|      0|         "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
  250|      0|         "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
  251|      0|         "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
  252|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
  253|      0|         oid);
  254|      0|   }
  255|       |
  256|       |   // secp256k1
  257|      0|   if(oid == OID{1, 3, 132, 0, 10}) {
  ------------------
  |  Branch (257:7): [True: 0, False: 0]
  ------------------
  258|      0|      return load_EC_group_info(
  259|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
  260|      0|         "0",
  261|      0|         "7",
  262|      0|         "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
  263|      0|         "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
  264|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
  265|      0|         oid);
  266|      0|   }
  267|       |
  268|       |   // sm2p256v1
  269|      0|   if(oid == OID{1, 2, 156, 10197, 1, 301}) {
  ------------------
  |  Branch (269:7): [True: 0, False: 0]
  ------------------
  270|      0|      return load_EC_group_info(
  271|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF",
  272|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC",
  273|      0|         "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93",
  274|      0|         "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7",
  275|      0|         "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0",
  276|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123",
  277|      0|         oid);
  278|      0|   }
  279|       |
  280|       |   // x962_p192v2
  281|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) {
  ------------------
  |  Branch (281:7): [True: 0, False: 0]
  ------------------
  282|      0|      return load_EC_group_info(
  283|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  284|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  285|      0|         "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
  286|      0|         "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
  287|      0|         "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15",
  288|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",
  289|      0|         oid);
  290|      0|   }
  291|       |
  292|       |   // x962_p192v3
  293|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) {
  ------------------
  |  Branch (293:7): [True: 0, False: 0]
  ------------------
  294|      0|      return load_EC_group_info(
  295|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  296|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  297|      0|         "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
  298|      0|         "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
  299|      0|         "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0",
  300|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",
  301|      0|         oid);
  302|      0|   }
  303|       |
  304|       |   // x962_p239v1
  305|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) {
  ------------------
  |  Branch (305:7): [True: 0, False: 0]
  ------------------
  306|      0|      return load_EC_group_info(
  307|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  308|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  309|      0|         "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
  310|      0|         "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
  311|      0|         "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE",
  312|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",
  313|      0|         oid);
  314|      0|   }
  315|       |
  316|       |   // x962_p239v2
  317|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) {
  ------------------
  |  Branch (317:7): [True: 0, False: 0]
  ------------------
  318|      0|      return load_EC_group_info(
  319|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  320|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  321|      0|         "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
  322|      0|         "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
  323|      0|         "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA",
  324|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",
  325|      0|         oid);
  326|      0|   }
  327|       |
  328|       |   // x962_p239v3
  329|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) {
  ------------------
  |  Branch (329:7): [True: 0, False: 0]
  ------------------
  330|      0|      return load_EC_group_info(
  331|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  332|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  333|      0|         "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
  334|      0|         "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
  335|      0|         "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3",
  336|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",
  337|      0|         oid);
  338|      0|   }
  339|       |
  340|      0|   return std::shared_ptr<EC_Group_Data>();
  341|      0|}

_ZN5Botan8EC_PointC2ERKNS_8CurveGFpE:
   18|  49.6k|EC_Point::EC_Point(const CurveGFp& curve) : m_curve(curve), m_coord_x(0), m_coord_y(curve.get_1_rep()), m_coord_z(0) {
   19|       |   // Assumes Montgomery rep of zero is zero
   20|  49.6k|}
_ZN5Botan8EC_PointC2ERKNS_8CurveGFpERKNS_6BigIntES6_:
   23|  18.6k|      m_curve(curve), m_coord_x(x), m_coord_y(y), m_coord_z(m_curve.get_1_rep()) {
   24|  18.6k|   if(x < 0 || x >= curve.get_p()) {
  ------------------
  |  Branch (24:7): [True: 0, False: 18.6k]
  |  Branch (24:16): [True: 135, False: 18.5k]
  ------------------
   25|    135|      throw Invalid_Argument("Invalid EC_Point affine x");
   26|    135|   }
   27|  18.5k|   if(y < 0 || y >= curve.get_p()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 18.5k]
  |  Branch (27:16): [True: 1, False: 18.5k]
  ------------------
   28|      1|      throw Invalid_Argument("Invalid EC_Point affine y");
   29|      1|   }
   30|       |
   31|  18.5k|   secure_vector<word> monty_ws(m_curve.get_ws_size());
   32|  18.5k|   m_curve.to_rep(m_coord_x, monty_ws);
   33|  18.5k|   m_curve.to_rep(m_coord_y, monty_ws);
   34|  18.5k|}
_ZN5Botan8EC_Point14randomize_reprERNS_21RandomNumberGeneratorE:
   36|  9.82k|void EC_Point::randomize_repr(RandomNumberGenerator& rng) {
   37|  9.82k|   secure_vector<word> ws(m_curve.get_ws_size());
   38|  9.82k|   randomize_repr(rng, ws);
   39|  9.82k|}
_ZN5Botan8EC_Point14randomize_reprERNS_21RandomNumberGeneratorERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   41|  38.3k|void EC_Point::randomize_repr(RandomNumberGenerator& rng, secure_vector<word>& ws) {
   42|  38.3k|   const BigInt mask = BigInt::random_integer(rng, 2, m_curve.get_p());
   43|       |
   44|       |   /*
   45|       |   * No reason to convert this to Montgomery representation first,
   46|       |   * just pretend the random mask was chosen as Redc(mask) and the
   47|       |   * random mask we generated above is in the Montgomery
   48|       |   * representation.
   49|       |   * //m_curve.to_rep(mask, ws);
   50|       |   */
   51|  38.3k|   const BigInt mask2 = m_curve.sqr_to_tmp(mask, ws);
   52|  38.3k|   const BigInt mask3 = m_curve.mul_to_tmp(mask2, mask, ws);
   53|       |
   54|  38.3k|   m_coord_x = m_curve.mul_to_tmp(m_coord_x, mask2, ws);
   55|  38.3k|   m_coord_y = m_curve.mul_to_tmp(m_coord_y, mask3, ws);
   56|  38.3k|   m_coord_z = m_curve.mul_to_tmp(m_coord_z, mask, ws);
   57|  38.3k|}
_ZN5Botan8EC_Point10add_affineEPKmmS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
   74|  4.02M|   const word x_words[], size_t x_size, const word y_words[], size_t y_size, std::vector<BigInt>& ws_bn) {
   75|  4.02M|   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(y_words, y_size)).is_set()) {
  ------------------
  |  Branch (75:7): [True: 501k, False: 3.51M]
  ------------------
   76|   501k|      return;
   77|   501k|   }
   78|       |
   79|  3.51M|   if(is_zero()) {
  ------------------
  |  Branch (79:7): [True: 18.6k, False: 3.49M]
  ------------------
   80|  18.6k|      m_coord_x.set_words(x_words, x_size);
   81|  18.6k|      m_coord_y.set_words(y_words, y_size);
   82|  18.6k|      m_coord_z = m_curve.get_1_rep();
   83|  18.6k|      return;
   84|  18.6k|   }
   85|       |
   86|  3.49M|   resize_ws(ws_bn, m_curve.get_ws_size());
   87|       |
   88|  3.49M|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   89|  3.49M|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
   90|       |
   91|  3.49M|   BigInt& T0 = ws_bn[2];
   92|  3.49M|   BigInt& T1 = ws_bn[3];
   93|  3.49M|   BigInt& T2 = ws_bn[4];
   94|  3.49M|   BigInt& T3 = ws_bn[5];
   95|  3.49M|   BigInt& T4 = ws_bn[6];
   96|       |
   97|       |   /*
   98|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   99|       |   simplified with Z2 = 1
  100|       |   */
  101|       |
  102|  3.49M|   const BigInt& p = m_curve.get_p();
  103|       |
  104|  3.49M|   m_curve.sqr(T3, m_coord_z, ws);            // z1^2
  105|  3.49M|   m_curve.mul(T4, x_words, x_size, T3, ws);  // x2*z1^2
  106|       |
  107|  3.49M|   m_curve.mul(T2, m_coord_z, T3, ws);        // z1^3
  108|  3.49M|   m_curve.mul(T0, y_words, y_size, T2, ws);  // y2*z1^3
  109|       |
  110|  3.49M|   T4.mod_sub(m_coord_x, p, sub_ws);  // x2*z1^2 - x1*z2^2
  111|       |
  112|  3.49M|   T0.mod_sub(m_coord_y, p, sub_ws);
  113|       |
  114|  3.49M|   if(T4.is_zero()) {
  ------------------
  |  Branch (114:7): [True: 0, False: 3.49M]
  ------------------
  115|      0|      if(T0.is_zero()) {
  ------------------
  |  Branch (115:10): [True: 0, False: 0]
  ------------------
  116|      0|         mult2(ws_bn);
  117|      0|         return;
  118|      0|      }
  119|       |
  120|       |      // setting to zero:
  121|      0|      m_coord_x.clear();
  122|      0|      m_coord_y = m_curve.get_1_rep();
  123|      0|      m_coord_z.clear();
  124|      0|      return;
  125|      0|   }
  126|       |
  127|  3.49M|   m_curve.sqr(T2, T4, ws);
  128|       |
  129|  3.49M|   m_curve.mul(T3, m_coord_x, T2, ws);
  130|       |
  131|  3.49M|   m_curve.mul(T1, T2, T4, ws);
  132|       |
  133|  3.49M|   m_curve.sqr(m_coord_x, T0, ws);
  134|  3.49M|   m_coord_x.mod_sub(T1, p, sub_ws);
  135|       |
  136|  3.49M|   m_coord_x.mod_sub(T3, p, sub_ws);
  137|  3.49M|   m_coord_x.mod_sub(T3, p, sub_ws);
  138|       |
  139|  3.49M|   T3.mod_sub(m_coord_x, p, sub_ws);
  140|       |
  141|  3.49M|   m_curve.mul(T2, T0, T3, ws);
  142|  3.49M|   m_curve.mul(T0, m_coord_y, T1, ws);
  143|  3.49M|   T2.mod_sub(T0, p, sub_ws);
  144|  3.49M|   m_coord_y.swap(T2);
  145|       |
  146|  3.49M|   m_curve.mul(T0, m_coord_z, T4, ws);
  147|  3.49M|   m_coord_z.swap(T0);
  148|  3.49M|}
_ZN5Botan8EC_Point3addEPKmmS2_mS2_mRNSt3__16vectorINS_6BigIntENS3_9allocatorIS5_EEEE:
  156|  1.73M|                   std::vector<BigInt>& ws_bn) {
  157|  1.73M|   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(z_words, z_size)).is_set()) {
  ------------------
  |  Branch (157:7): [True: 242k, False: 1.49M]
  ------------------
  158|   242k|      return;
  159|   242k|   }
  160|       |
  161|  1.49M|   if(is_zero()) {
  ------------------
  |  Branch (161:7): [True: 18.1k, False: 1.47M]
  ------------------
  162|  18.1k|      m_coord_x.set_words(x_words, x_size);
  163|  18.1k|      m_coord_y.set_words(y_words, y_size);
  164|  18.1k|      m_coord_z.set_words(z_words, z_size);
  165|  18.1k|      return;
  166|  18.1k|   }
  167|       |
  168|  1.47M|   resize_ws(ws_bn, m_curve.get_ws_size());
  169|       |
  170|  1.47M|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
  171|  1.47M|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
  172|       |
  173|  1.47M|   BigInt& T0 = ws_bn[2];
  174|  1.47M|   BigInt& T1 = ws_bn[3];
  175|  1.47M|   BigInt& T2 = ws_bn[4];
  176|  1.47M|   BigInt& T3 = ws_bn[5];
  177|  1.47M|   BigInt& T4 = ws_bn[6];
  178|  1.47M|   BigInt& T5 = ws_bn[7];
  179|       |
  180|       |   /*
  181|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
  182|       |   */
  183|       |
  184|  1.47M|   const BigInt& p = m_curve.get_p();
  185|       |
  186|  1.47M|   m_curve.sqr(T0, z_words, z_size, ws);      // z2^2
  187|  1.47M|   m_curve.mul(T1, m_coord_x, T0, ws);        // x1*z2^2
  188|  1.47M|   m_curve.mul(T3, z_words, z_size, T0, ws);  // z2^3
  189|  1.47M|   m_curve.mul(T2, m_coord_y, T3, ws);        // y1*z2^3
  190|       |
  191|  1.47M|   m_curve.sqr(T3, m_coord_z, ws);            // z1^2
  192|  1.47M|   m_curve.mul(T4, x_words, x_size, T3, ws);  // x2*z1^2
  193|       |
  194|  1.47M|   m_curve.mul(T5, m_coord_z, T3, ws);        // z1^3
  195|  1.47M|   m_curve.mul(T0, y_words, y_size, T5, ws);  // y2*z1^3
  196|       |
  197|  1.47M|   T4.mod_sub(T1, p, sub_ws);  // x2*z1^2 - x1*z2^2
  198|       |
  199|  1.47M|   T0.mod_sub(T2, p, sub_ws);
  200|       |
  201|  1.47M|   if(T4.is_zero()) {
  ------------------
  |  Branch (201:7): [True: 0, False: 1.47M]
  ------------------
  202|      0|      if(T0.is_zero()) {
  ------------------
  |  Branch (202:10): [True: 0, False: 0]
  ------------------
  203|      0|         mult2(ws_bn);
  204|      0|         return;
  205|      0|      }
  206|       |
  207|       |      // setting to zero:
  208|      0|      m_coord_x.clear();
  209|      0|      m_coord_y = m_curve.get_1_rep();
  210|      0|      m_coord_z.clear();
  211|      0|      return;
  212|      0|   }
  213|       |
  214|  1.47M|   m_curve.sqr(T5, T4, ws);
  215|       |
  216|  1.47M|   m_curve.mul(T3, T1, T5, ws);
  217|       |
  218|  1.47M|   m_curve.mul(T1, T5, T4, ws);
  219|       |
  220|  1.47M|   m_curve.sqr(m_coord_x, T0, ws);
  221|  1.47M|   m_coord_x.mod_sub(T1, p, sub_ws);
  222|  1.47M|   m_coord_x.mod_sub(T3, p, sub_ws);
  223|  1.47M|   m_coord_x.mod_sub(T3, p, sub_ws);
  224|       |
  225|  1.47M|   T3.mod_sub(m_coord_x, p, sub_ws);
  226|       |
  227|  1.47M|   m_curve.mul(m_coord_y, T0, T3, ws);
  228|  1.47M|   m_curve.mul(T3, T2, T1, ws);
  229|       |
  230|  1.47M|   m_coord_y.mod_sub(T3, p, sub_ws);
  231|       |
  232|  1.47M|   m_curve.mul(T3, z_words, z_size, m_coord_z, ws);
  233|  1.47M|   m_curve.mul(m_coord_z, T3, T4, ws);
  234|  1.47M|}
_ZN5Botan8EC_Point6mult2iEmRNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE:
  236|  1.64M|void EC_Point::mult2i(size_t iterations, std::vector<BigInt>& ws_bn) {
  237|  1.64M|   if(iterations == 0) {
  ------------------
  |  Branch (237:7): [True: 0, False: 1.64M]
  ------------------
  238|      0|      return;
  239|      0|   }
  240|       |
  241|  1.64M|   if(m_coord_y.is_zero()) {
  ------------------
  |  Branch (241:7): [True: 0, False: 1.64M]
  ------------------
  242|      0|      *this = EC_Point(m_curve);  // setting myself to zero
  243|      0|      return;
  244|      0|   }
  245|       |
  246|       |   /*
  247|       |   TODO we can save 2 squarings per iteration by computing
  248|       |   a*Z^4 using values cached from previous iteration
  249|       |   */
  250|  8.23M|   for(size_t i = 0; i != iterations; ++i) {
  ------------------
  |  Branch (250:22): [True: 6.58M, False: 1.64M]
  ------------------
  251|  6.58M|      mult2(ws_bn);
  252|  6.58M|   }
  253|  1.64M|}
_ZN5Botan8EC_Point5mult2ERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEE:
  256|  6.66M|void EC_Point::mult2(std::vector<BigInt>& ws_bn) {
  257|  6.66M|   if(is_zero()) {
  ------------------
  |  Branch (257:7): [True: 574k, False: 6.09M]
  ------------------
  258|   574k|      return;
  259|   574k|   }
  260|       |
  261|  6.09M|   if(m_coord_y.is_zero()) {
  ------------------
  |  Branch (261:7): [True: 0, False: 6.09M]
  ------------------
  262|      0|      *this = EC_Point(m_curve);  // setting myself to zero
  263|      0|      return;
  264|      0|   }
  265|       |
  266|  6.09M|   resize_ws(ws_bn, m_curve.get_ws_size());
  267|       |
  268|  6.09M|   secure_vector<word>& ws = ws_bn[0].get_word_vector();
  269|  6.09M|   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
  270|       |
  271|  6.09M|   BigInt& T0 = ws_bn[2];
  272|  6.09M|   BigInt& T1 = ws_bn[3];
  273|  6.09M|   BigInt& T2 = ws_bn[4];
  274|  6.09M|   BigInt& T3 = ws_bn[5];
  275|  6.09M|   BigInt& T4 = ws_bn[6];
  276|       |
  277|       |   /*
  278|       |   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc
  279|       |   */
  280|  6.09M|   const BigInt& p = m_curve.get_p();
  281|       |
  282|  6.09M|   m_curve.sqr(T0, m_coord_y, ws);
  283|       |
  284|  6.09M|   m_curve.mul(T1, m_coord_x, T0, ws);
  285|  6.09M|   T1.mod_mul(4, p, sub_ws);
  286|       |
  287|  6.09M|   if(m_curve.a_is_zero()) {
  ------------------
  |  Branch (287:7): [True: 0, False: 6.09M]
  ------------------
  288|       |      // if a == 0 then 3*x^2 + a*z^4 is just 3*x^2
  289|      0|      m_curve.sqr(T4, m_coord_x, ws);  // x^2
  290|      0|      T4.mod_mul(3, p, sub_ws);        // 3*x^2
  291|  6.09M|   } else if(m_curve.a_is_minus_3()) {
  ------------------
  |  Branch (291:14): [True: 3.29M, False: 2.80M]
  ------------------
  292|       |      /*
  293|       |      if a == -3 then
  294|       |        3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  295|       |      */
  296|  3.29M|      m_curve.sqr(T3, m_coord_z, ws);  // z^2
  297|       |
  298|       |      // (x-z^2)
  299|  3.29M|      T2 = m_coord_x;
  300|  3.29M|      T2.mod_sub(T3, p, sub_ws);
  301|       |
  302|       |      // (x+z^2)
  303|  3.29M|      T3.mod_add(m_coord_x, p, sub_ws);
  304|       |
  305|  3.29M|      m_curve.mul(T4, T2, T3, ws);  // (x-z^2)*(x+z^2)
  306|       |
  307|  3.29M|      T4.mod_mul(3, p, sub_ws);  // 3*(x-z^2)*(x+z^2)
  308|  3.29M|   } else {
  309|  2.80M|      m_curve.sqr(T3, m_coord_z, ws);                // z^2
  310|  2.80M|      m_curve.sqr(T4, T3, ws);                       // z^4
  311|  2.80M|      m_curve.mul(T3, m_curve.get_a_rep(), T4, ws);  // a*z^4
  312|       |
  313|  2.80M|      m_curve.sqr(T4, m_coord_x, ws);  // x^2
  314|  2.80M|      T4.mod_mul(3, p, sub_ws);
  315|  2.80M|      T4.mod_add(T3, p, sub_ws);  // 3*x^2 + a*z^4
  316|  2.80M|   }
  317|       |
  318|  6.09M|   m_curve.sqr(T2, T4, ws);
  319|  6.09M|   T2.mod_sub(T1, p, sub_ws);
  320|  6.09M|   T2.mod_sub(T1, p, sub_ws);
  321|       |
  322|  6.09M|   m_curve.sqr(T3, T0, ws);
  323|  6.09M|   T3.mod_mul(8, p, sub_ws);
  324|       |
  325|  6.09M|   T1.mod_sub(T2, p, sub_ws);
  326|       |
  327|  6.09M|   m_curve.mul(T0, T4, T1, ws);
  328|  6.09M|   T0.mod_sub(T3, p, sub_ws);
  329|       |
  330|  6.09M|   m_coord_x.swap(T2);
  331|       |
  332|  6.09M|   m_curve.mul(T2, m_coord_y, m_coord_z, ws);
  333|  6.09M|   T2.mod_mul(2, p, sub_ws);
  334|       |
  335|  6.09M|   m_coord_y.swap(T0);
  336|  6.09M|   m_coord_z.swap(T2);
  337|  6.09M|}
_ZN5BotanmlERKNS_6BigIntERKNS_8EC_PointE:
  363|  9.82k|EC_Point operator*(const BigInt& scalar, const EC_Point& point) {
  364|  9.82k|   BOTAN_DEBUG_ASSERT(point.on_the_curve());
  ------------------
  |  |   99|  9.82k|      do {                          \
  |  |  100|  9.82k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  365|       |
  366|  9.82k|   const size_t scalar_bits = scalar.bits();
  367|       |
  368|  9.82k|   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
  369|       |
  370|  9.82k|   EC_Point R[2] = {point.zero(), point};
  371|       |
  372|  19.6k|   for(size_t i = scalar_bits; i > 0; i--) {
  ------------------
  |  Branch (372:32): [True: 9.82k, False: 9.82k]
  ------------------
  373|  9.82k|      const size_t b = scalar.get_bit(i - 1);
  374|  9.82k|      R[b ^ 1].add(R[b], ws);
  375|  9.82k|      R[b].mult2(ws);
  376|  9.82k|   }
  377|       |
  378|  9.82k|   if(scalar.is_negative()) {
  ------------------
  |  Branch (378:7): [True: 0, False: 9.82k]
  ------------------
  379|      0|      R[0].negate();
  380|      0|   }
  381|       |
  382|  9.82k|   BOTAN_DEBUG_ASSERT(R[0].on_the_curve());
  ------------------
  |  |   99|  9.82k|      do {                          \
  |  |  100|  9.82k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  383|       |
  384|  9.82k|   return R[0];
  385|  9.82k|}
_ZN5Botan8EC_Point16force_all_affineERNSt3__16vectorIS0_NS1_9allocatorIS0_EEEERNS2_ImNS_16secure_allocatorImEEEE:
  388|      6|void EC_Point::force_all_affine(std::vector<EC_Point>& points, secure_vector<word>& ws) {
  389|      6|   if(points.size() <= 1) {
  ------------------
  |  Branch (389:7): [True: 0, False: 6]
  ------------------
  390|      0|      for(auto& point : points) {
  ------------------
  |  Branch (390:23): [True: 0, False: 0]
  ------------------
  391|      0|         point.force_affine();
  392|      0|      }
  393|      0|      return;
  394|      0|   }
  395|       |
  396|  8.13k|   for(auto& point : points) {
  ------------------
  |  Branch (396:20): [True: 8.13k, False: 6]
  ------------------
  397|  8.13k|      if(point.is_zero()) {
  ------------------
  |  Branch (397:10): [True: 0, False: 8.13k]
  ------------------
  398|      0|         throw Invalid_State("Cannot convert zero ECC point to affine");
  399|      0|      }
  400|  8.13k|   }
  401|       |
  402|       |   /*
  403|       |   For >= 2 points use Montgomery's trick
  404|       |
  405|       |   See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  406|       |   (Hankerson, Menezes, Vanstone)
  407|       |
  408|       |   TODO is it really necessary to save all k points in c?
  409|       |   */
  410|       |
  411|      6|   const CurveGFp& curve = points[0].m_curve;
  412|      6|   const BigInt& rep_1 = curve.get_1_rep();
  413|       |
  414|      6|   if(ws.size() < curve.get_ws_size()) {
  ------------------
  |  Branch (414:7): [True: 0, False: 6]
  ------------------
  415|      0|      ws.resize(curve.get_ws_size());
  416|      0|   }
  417|       |
  418|      6|   std::vector<BigInt> c(points.size());
  419|      6|   c[0] = points[0].m_coord_z;
  420|       |
  421|  8.13k|   for(size_t i = 1; i != points.size(); ++i) {
  ------------------
  |  Branch (421:22): [True: 8.12k, False: 6]
  ------------------
  422|  8.12k|      curve.mul(c[i], c[i - 1], points[i].m_coord_z, ws);
  423|  8.12k|   }
  424|       |
  425|      6|   BigInt s_inv = curve.invert_element(c[c.size() - 1], ws);
  426|       |
  427|      6|   BigInt z_inv, z2_inv, z3_inv;
  428|       |
  429|  8.13k|   for(size_t i = points.size() - 1; i != 0; i--) {
  ------------------
  |  Branch (429:38): [True: 8.12k, False: 6]
  ------------------
  430|  8.12k|      EC_Point& point = points[i];
  431|       |
  432|  8.12k|      curve.mul(z_inv, s_inv, c[i - 1], ws);
  433|       |
  434|  8.12k|      s_inv = curve.mul_to_tmp(s_inv, point.m_coord_z, ws);
  435|       |
  436|  8.12k|      curve.sqr(z2_inv, z_inv, ws);
  437|  8.12k|      curve.mul(z3_inv, z2_inv, z_inv, ws);
  438|  8.12k|      point.m_coord_x = curve.mul_to_tmp(point.m_coord_x, z2_inv, ws);
  439|  8.12k|      point.m_coord_y = curve.mul_to_tmp(point.m_coord_y, z3_inv, ws);
  440|  8.12k|      point.m_coord_z = rep_1;
  441|  8.12k|   }
  442|       |
  443|      6|   curve.sqr(z2_inv, s_inv, ws);
  444|      6|   curve.mul(z3_inv, z2_inv, s_inv, ws);
  445|      6|   points[0].m_coord_x = curve.mul_to_tmp(points[0].m_coord_x, z2_inv, ws);
  446|      6|   points[0].m_coord_y = curve.mul_to_tmp(points[0].m_coord_y, z3_inv, ws);
  447|      6|   points[0].m_coord_z = rep_1;
  448|      6|}
_ZNK5Botan8EC_Point9is_affineEv:
  465|  75.9k|bool EC_Point::is_affine() const { return m_curve.is_one(m_coord_z); }
_ZNK5Botan8EC_Point12get_affine_xEv:
  467|  43.2k|BigInt EC_Point::get_affine_x() const {
  468|  43.2k|   if(is_zero()) {
  ------------------
  |  Branch (468:7): [True: 765, False: 42.4k]
  ------------------
  469|    765|      throw Invalid_State("Cannot convert zero point to affine");
  470|    765|   }
  471|       |
  472|  42.4k|   secure_vector<word> monty_ws;
  473|       |
  474|  42.4k|   if(is_affine()) {
  ------------------
  |  Branch (474:7): [True: 9.06k, False: 33.4k]
  ------------------
  475|  9.06k|      return m_curve.from_rep_to_tmp(m_coord_x, monty_ws);
  476|  9.06k|   }
  477|       |
  478|  33.4k|   BigInt z2 = m_curve.sqr_to_tmp(m_coord_z, monty_ws);
  479|  33.4k|   z2 = m_curve.invert_element(z2, monty_ws);
  480|       |
  481|  33.4k|   BigInt r;
  482|  33.4k|   m_curve.mul(r, m_coord_x, z2, monty_ws);
  483|  33.4k|   m_curve.from_rep(r, monty_ws);
  484|  33.4k|   return r;
  485|  42.4k|}
_ZNK5Botan8EC_Point12get_affine_yEv:
  487|  33.4k|BigInt EC_Point::get_affine_y() const {
  488|  33.4k|   if(is_zero()) {
  ------------------
  |  Branch (488:7): [True: 0, False: 33.4k]
  ------------------
  489|      0|      throw Invalid_State("Cannot convert zero point to affine");
  490|      0|   }
  491|       |
  492|  33.4k|   secure_vector<word> monty_ws;
  493|       |
  494|  33.4k|   if(is_affine()) {
  ------------------
  |  Branch (494:7): [True: 9.06k, False: 24.3k]
  ------------------
  495|  9.06k|      return m_curve.from_rep_to_tmp(m_coord_y, monty_ws);
  496|  9.06k|   }
  497|       |
  498|  24.3k|   const BigInt z2 = m_curve.sqr_to_tmp(m_coord_z, monty_ws);
  499|  24.3k|   const BigInt z3 = m_curve.mul_to_tmp(m_coord_z, z2, monty_ws);
  500|  24.3k|   const BigInt z3_inv = m_curve.invert_element(z3, monty_ws);
  501|       |
  502|  24.3k|   BigInt r;
  503|  24.3k|   m_curve.mul(r, m_coord_y, z3_inv, monty_ws);
  504|  24.3k|   m_curve.from_rep(r, monty_ws);
  505|  24.3k|   return r;
  506|  33.4k|}
_ZNK5Botan8EC_Point12on_the_curveEv:
  508|  47.0k|bool EC_Point::on_the_curve() const {
  509|       |   /*
  510|       |   Is the point still on the curve?? (If everything is correct, the
  511|       |   point is always on its curve; then the function will return true.
  512|       |   If somehow the state is corrupted, which suggests a fault attack
  513|       |   (or internal computational error), then return false.
  514|       |   */
  515|  47.0k|   if(is_zero()) {
  ------------------
  |  Branch (515:7): [True: 765, False: 46.2k]
  ------------------
  516|    765|      return true;
  517|    765|   }
  518|       |
  519|  46.2k|   secure_vector<word> monty_ws;
  520|       |
  521|  46.2k|   const BigInt y2 = m_curve.from_rep_to_tmp(m_curve.sqr_to_tmp(m_coord_y, monty_ws), monty_ws);
  522|  46.2k|   const BigInt x3 = m_curve.mul_to_tmp(m_coord_x, m_curve.sqr_to_tmp(m_coord_x, monty_ws), monty_ws);
  523|  46.2k|   const BigInt ax = m_curve.mul_to_tmp(m_coord_x, m_curve.get_a_rep(), monty_ws);
  524|  46.2k|   const BigInt z2 = m_curve.sqr_to_tmp(m_coord_z, monty_ws);
  525|       |
  526|  46.2k|   if(m_coord_z == z2)  // Is z equal to 1 (in Montgomery form)?
  ------------------
  |  Branch (526:7): [True: 18.5k, False: 27.7k]
  ------------------
  527|  18.5k|   {
  528|  18.5k|      if(y2 != m_curve.from_rep_to_tmp(x3 + ax + m_curve.get_b_rep(), monty_ws)) {
  ------------------
  |  Branch (528:10): [True: 402, False: 18.1k]
  ------------------
  529|    402|         return false;
  530|    402|      }
  531|  18.5k|   }
  532|       |
  533|  45.8k|   const BigInt z3 = m_curve.mul_to_tmp(m_coord_z, z2, monty_ws);
  534|  45.8k|   const BigInt ax_z4 = m_curve.mul_to_tmp(ax, m_curve.sqr_to_tmp(z2, monty_ws), monty_ws);
  535|  45.8k|   const BigInt b_z6 = m_curve.mul_to_tmp(m_curve.get_b_rep(), m_curve.sqr_to_tmp(z3, monty_ws), monty_ws);
  536|       |
  537|  45.8k|   if(y2 != m_curve.from_rep_to_tmp(x3 + ax_z4 + b_z6, monty_ws)) {
  ------------------
  |  Branch (537:7): [True: 0, False: 45.8k]
  ------------------
  538|      0|      return false;
  539|      0|   }
  540|       |
  541|  45.8k|   return true;
  542|  45.8k|}
_ZN5Botan8EC_Point4swapERS0_:
  545|   191k|void EC_Point::swap(EC_Point& other) {
  546|   191k|   m_curve.swap(other.m_curve);
  547|   191k|   m_coord_x.swap(other.m_coord_x);
  548|   191k|   m_coord_y.swap(other.m_coord_y);
  549|   191k|   m_coord_z.swap(other.m_coord_z);
  550|   191k|}
_ZNK5Botan8EC_Point6encodeENS_15EC_Point_FormatE:
  566|  34.1k|std::vector<uint8_t> EC_Point::encode(EC_Point_Format format) const {
  567|  34.1k|   if(is_zero()) {
  ------------------
  |  Branch (567:7): [True: 765, False: 33.4k]
  ------------------
  568|    765|      return std::vector<uint8_t>(1);  // single 0 byte
  569|    765|   }
  570|       |
  571|  33.4k|   const size_t p_bytes = m_curve.get_p().bytes();
  572|       |
  573|  33.4k|   const BigInt x = get_affine_x();
  574|  33.4k|   const BigInt y = get_affine_y();
  575|       |
  576|  33.4k|   std::vector<uint8_t> result;
  577|       |
  578|  33.4k|   if(format == EC_Point_Format::Uncompressed) {
  ------------------
  |  Branch (578:7): [True: 33.4k, False: 6]
  ------------------
  579|  33.4k|      result.resize(1 + 2 * p_bytes);
  580|  33.4k|      result[0] = 0x04;
  581|  33.4k|      BigInt::encode_1363(&result[1], p_bytes, x);
  582|  33.4k|      BigInt::encode_1363(&result[1 + p_bytes], p_bytes, y);
  583|  33.4k|   } else if(format == EC_Point_Format::Compressed) {
  ------------------
  |  Branch (583:14): [True: 6, False: 0]
  ------------------
  584|      6|      result.resize(1 + p_bytes);
  585|      6|      result[0] = 0x02 | static_cast<uint8_t>(y.get_bit(0));
  586|      6|      BigInt::encode_1363(&result[1], p_bytes, x);
  587|      6|   } else if(format == EC_Point_Format::Hybrid) {
  ------------------
  |  Branch (587:14): [True: 0, False: 0]
  ------------------
  588|      0|      result.resize(1 + 2 * p_bytes);
  589|      0|      result[0] = 0x06 | static_cast<uint8_t>(y.get_bit(0));
  590|      0|      BigInt::encode_1363(&result[1], p_bytes, x);
  591|      0|      BigInt::encode_1363(&result[1 + p_bytes], p_bytes, y);
  592|      0|   } else {
  593|      0|      throw Invalid_Argument("EC2OSP illegal point encoding");
  594|      0|   }
  595|       |
  596|  33.4k|   return result;
  597|  33.4k|}
_ZN5Botan6OS2ECPEPKhmRKNS_8CurveGFpE:
  625|  24.7k|EC_Point OS2ECP(const uint8_t data[], size_t data_len, const CurveGFp& curve) {
  626|       |   // Should we really be doing this?
  627|  24.7k|   if(data_len <= 1) {
  ------------------
  |  Branch (627:7): [True: 1.53k, False: 23.1k]
  ------------------
  628|  1.53k|      return EC_Point(curve);  // return zero
  629|  1.53k|   }
  630|       |
  631|  23.1k|   std::pair<BigInt, BigInt> xy = OS2ECP(data, data_len, curve.get_p(), curve.get_a(), curve.get_b());
  632|       |
  633|  23.1k|   EC_Point point(curve, xy.first, xy.second);
  634|       |
  635|  23.1k|   if(!point.on_the_curve()) {
  ------------------
  |  Branch (635:7): [True: 402, False: 22.7k]
  ------------------
  636|    402|      throw Decoding_Error("OS2ECP: Decoded point was not on the curve");
  637|    402|   }
  638|       |
  639|  22.7k|   return point;
  640|  23.1k|}
_ZN5Botan6OS2ECPEPKhmRKNS_6BigIntES4_S4_:
  643|  23.1k|   const uint8_t data[], size_t data_len, const BigInt& curve_p, const BigInt& curve_a, const BigInt& curve_b) {
  644|  23.1k|   if(data_len <= 1) {
  ------------------
  |  Branch (644:7): [True: 0, False: 23.1k]
  ------------------
  645|      0|      throw Decoding_Error("OS2ECP invalid point");
  646|      0|   }
  647|       |
  648|  23.1k|   const uint8_t pc = data[0];
  649|       |
  650|  23.1k|   BigInt x, y;
  651|       |
  652|  23.1k|   if(pc == 2 || pc == 3) {
  ------------------
  |  Branch (652:7): [True: 865, False: 22.3k]
  |  Branch (652:18): [True: 11.2k, False: 11.0k]
  ------------------
  653|       |      //compressed form
  654|  12.1k|      x = BigInt::decode(&data[1], data_len - 1);
  655|       |
  656|  12.1k|      const bool y_mod_2 = ((pc & 0x01) == 1);
  657|  12.1k|      y = decompress_point(y_mod_2, x, curve_p, curve_a, curve_b);
  658|  12.1k|   } else if(pc == 4) {
  ------------------
  |  Branch (658:14): [True: 9.46k, False: 1.56k]
  ------------------
  659|  9.46k|      const size_t l = (data_len - 1) / 2;
  660|       |
  661|       |      // uncompressed form
  662|  9.46k|      x = BigInt::decode(&data[1], l);
  663|  9.46k|      y = BigInt::decode(&data[l + 1], l);
  664|  9.46k|   } else if(pc == 6 || pc == 7) {
  ------------------
  |  Branch (664:14): [True: 184, False: 1.37k]
  |  Branch (664:25): [True: 1.36k, False: 12]
  ------------------
  665|  1.55k|      const size_t l = (data_len - 1) / 2;
  666|       |
  667|       |      // hybrid form
  668|  1.55k|      x = BigInt::decode(&data[1], l);
  669|  1.55k|      y = BigInt::decode(&data[l + 1], l);
  670|       |
  671|  1.55k|      const bool y_mod_2 = ((pc & 0x01) == 1);
  672|       |
  673|  1.55k|      if(decompress_point(y_mod_2, x, curve_p, curve_a, curve_b) != y) {
  ------------------
  |  Branch (673:10): [True: 794, False: 757]
  ------------------
  674|    794|         throw Decoding_Error("OS2ECP: Decoding error in hybrid format");
  675|    794|      }
  676|  1.55k|   } else {
  677|     12|      throw Invalid_Argument("OS2ECP: Unknown format type " + std::to_string(pc));
  678|     12|   }
  679|       |
  680|  22.3k|   return std::make_pair(x, y);
  681|  23.1k|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_19resize_wsERNSt3__16vectorINS_6BigIntENS1_9allocatorIS3_EEEEm:
   61|  11.0M|inline void resize_ws(std::vector<BigInt>& ws_bn, size_t cap_size) {
   62|  11.0M|   BOTAN_ASSERT(ws_bn.size() >= EC_Point::WORKSPACE_SIZE, "Expected size for EC_Point workspace");
  ------------------
  |  |   51|  11.0M|   do {                                                                                 \
  |  |   52|  11.0M|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 11.0M]
  |  |  ------------------
  |  |   53|  11.0M|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  11.0M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   63|       |
   64|  88.5M|   for(auto& ws : ws_bn) {
  ------------------
  |  Branch (64:17): [True: 88.5M, False: 11.0M]
  ------------------
   65|  88.5M|      if(ws.size() < cap_size) {
  ------------------
  |  Branch (65:10): [True: 3.07M, False: 85.4M]
  ------------------
   66|  3.07M|         ws.get_word_vector().resize(cap_size);
   67|  3.07M|      }
   68|  88.5M|   }
   69|  11.0M|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_116decompress_pointEbRKNS_6BigIntES3_S3_S3_:
  602|  13.7k|   bool yMod2, const BigInt& x, const BigInt& curve_p, const BigInt& curve_a, const BigInt& curve_b) {
  603|  13.7k|   BigInt xpow3 = x * x * x;
  604|       |
  605|  13.7k|   BigInt g = curve_a * x;
  606|  13.7k|   g += xpow3;
  607|  13.7k|   g += curve_b;
  608|  13.7k|   g = g % curve_p;
  609|       |
  610|  13.7k|   BigInt z = sqrt_modulo_prime(g, curve_p);
  611|       |
  612|  13.7k|   if(z < 0) {
  ------------------
  |  Branch (612:7): [True: 3.72k, False: 9.98k]
  ------------------
  613|  3.72k|      throw Decoding_Error("Error during EC point decompression");
  614|  3.72k|   }
  615|       |
  616|  9.98k|   if(z.get_bit(0) != yMod2) {
  ------------------
  |  Branch (616:7): [True: 5.84k, False: 4.14k]
  ------------------
  617|  5.84k|      z = curve_p - z;
  618|  5.84k|   }
  619|       |
  620|  9.98k|   return z;
  621|  13.7k|}

_ZN5Botan30EC_Point_Base_Point_PrecomputeC2ERKNS_8EC_PointERKNS_15Modular_ReducerE:
   28|      6|      m_base_point(base), m_mod_order(mod_order), m_p_words(base.get_curve().get_p().sig_words()) {
   29|      6|   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
   30|       |
   31|      6|   const size_t p_bits = base.get_curve().get_p().bits();
   32|       |
   33|       |   /*
   34|       |   * Some of the curves (eg secp160k1) have an order slightly larger than
   35|       |   * the size of the prime modulus. In all cases they are at most 1 bit
   36|       |   * longer. The +1 compensates for this.
   37|       |   */
   38|      6|   const size_t T_bits = round_up(p_bits + blinding_size(mod_order.get_modulus()) + 1, WINDOW_BITS) / WINDOW_BITS;
   39|       |
   40|      6|   std::vector<EC_Point> T(WINDOW_SIZE * T_bits);
   41|       |
   42|      6|   EC_Point g = base;
   43|      6|   EC_Point g2, g4;
   44|       |
   45|  1.16k|   for(size_t i = 0; i != T_bits; i++) {
  ------------------
  |  Branch (45:22): [True: 1.16k, False: 6]
  ------------------
   46|  1.16k|      g2 = g;
   47|  1.16k|      g2.mult2(ws);
   48|  1.16k|      g4 = g2;
   49|  1.16k|      g4.mult2(ws);
   50|       |
   51|  1.16k|      T[7 * i + 0] = g;
   52|  1.16k|      T[7 * i + 1] = std::move(g2);
   53|  1.16k|      T[7 * i + 2] = T[7 * i + 1].plus(T[7 * i + 0], ws);  // g2+g
   54|  1.16k|      T[7 * i + 3] = g4;
   55|  1.16k|      T[7 * i + 4] = T[7 * i + 3].plus(T[7 * i + 0], ws);  // g4+g
   56|  1.16k|      T[7 * i + 5] = T[7 * i + 3].plus(T[7 * i + 1], ws);  // g4+g2
   57|  1.16k|      T[7 * i + 6] = T[7 * i + 3].plus(T[7 * i + 2], ws);  // g4+g2+g
   58|       |
   59|  1.16k|      g.swap(g4);
   60|  1.16k|      g.mult2(ws);
   61|  1.16k|   }
   62|       |
   63|      6|   EC_Point::force_all_affine(T, ws[0].get_word_vector());
   64|       |
   65|      6|   m_W.resize(T.size() * 2 * m_p_words);
   66|       |
   67|      6|   word* p = &m_W[0];
   68|  8.14k|   for(size_t i = 0; i != T.size(); ++i) {
  ------------------
  |  Branch (68:22): [True: 8.13k, False: 6]
  ------------------
   69|  8.13k|      T[i].get_x().encode_words(p, m_p_words);
   70|  8.13k|      p += m_p_words;
   71|  8.13k|      T[i].get_y().encode_words(p, m_p_words);
   72|  8.13k|      p += m_p_words;
   73|  8.13k|   }
   74|      6|}
_ZNK5Botan30EC_Point_Base_Point_Precompute3mulERKNS_6BigIntERNS_21RandomNumberGeneratorES3_RNSt3__16vectorIS1_NS6_9allocatorIS1_EEEE:
   79|  18.6k|                                             std::vector<BigInt>& ws) const {
   80|  18.6k|   if(k.is_negative()) {
  ------------------
  |  Branch (80:7): [True: 0, False: 18.6k]
  ------------------
   81|      0|      throw Invalid_Argument("EC_Point_Base_Point_Precompute scalar must be positive");
   82|      0|   }
   83|       |
   84|       |   // Instead of reducing k mod group order should we alter the mask size??
   85|  18.6k|   BigInt scalar = m_mod_order.reduce(k);
   86|       |
   87|  18.6k|   if(rng.is_seeded()) {
  ------------------
  |  Branch (87:7): [True: 18.6k, False: 0]
  ------------------
   88|       |      // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure)
   89|  18.6k|      const BigInt mask(rng, blinding_size(group_order));
   90|  18.6k|      scalar += group_order * mask;
   91|  18.6k|   } else {
   92|       |      /*
   93|       |      When we don't have an RNG we cannot do scalar blinding. Instead use the
   94|       |      same trick as OpenSSL and add one or two copies of the order to normalize
   95|       |      the length of the scalar at order.bits()+1. This at least ensures the loop
   96|       |      bound does not leak information about the high bits of the scalar.
   97|       |      */
   98|      0|      scalar += group_order;
   99|      0|      if(scalar.bits() == group_order.bits()) {
  ------------------
  |  Branch (99:10): [True: 0, False: 0]
  ------------------
  100|      0|         scalar += group_order;
  101|      0|      }
  102|      0|      BOTAN_DEBUG_ASSERT(scalar.bits() == group_order.bits() + 1);
  ------------------
  |  |   99|      0|      do {                          \
  |  |  100|      0|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  103|      0|   }
  104|       |
  105|  18.6k|   const size_t windows = round_up(scalar.bits(), WINDOW_BITS) / WINDOW_BITS;
  106|       |
  107|  18.6k|   const size_t elem_size = 2 * m_p_words;
  108|       |
  109|  18.6k|   BOTAN_ASSERT(windows <= m_W.size() / (3 * elem_size), "Precomputed sufficient values for scalar mult");
  ------------------
  |  |   51|  18.6k|   do {                                                                                 \
  |  |   52|  18.6k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 18.6k]
  |  |  ------------------
  |  |   53|  18.6k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  18.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  110|       |
  111|  18.6k|   EC_Point R = m_base_point.zero();
  112|       |
  113|  18.6k|   if(ws.size() < EC_Point::WORKSPACE_SIZE) {
  ------------------
  |  Branch (113:7): [True: 18.6k, False: 0]
  ------------------
  114|  18.6k|      ws.resize(EC_Point::WORKSPACE_SIZE);
  115|  18.6k|   }
  116|       |
  117|       |   // the precomputed multiples are not secret so use std::vector
  118|  18.6k|   std::vector<word> Wt(elem_size);
  119|       |
  120|  4.03M|   for(size_t i = 0; i != windows; ++i) {
  ------------------
  |  Branch (120:22): [True: 4.02M, False: 18.6k]
  ------------------
  121|  4.02M|      const size_t window = windows - i - 1;
  122|  4.02M|      const size_t base_addr = (WINDOW_SIZE * window) * elem_size;
  123|       |
  124|  4.02M|      const word w = scalar.get_substring(WINDOW_BITS * window, WINDOW_BITS);
  125|       |
  126|  4.02M|      const auto w_is_1 = CT::Mask<word>::is_equal(w, 1);
  127|  4.02M|      const auto w_is_2 = CT::Mask<word>::is_equal(w, 2);
  128|  4.02M|      const auto w_is_3 = CT::Mask<word>::is_equal(w, 3);
  129|  4.02M|      const auto w_is_4 = CT::Mask<word>::is_equal(w, 4);
  130|  4.02M|      const auto w_is_5 = CT::Mask<word>::is_equal(w, 5);
  131|  4.02M|      const auto w_is_6 = CT::Mask<word>::is_equal(w, 6);
  132|  4.02M|      const auto w_is_7 = CT::Mask<word>::is_equal(w, 7);
  133|       |
  134|  63.7M|      for(size_t j = 0; j != elem_size; ++j) {
  ------------------
  |  Branch (134:25): [True: 59.7M, False: 4.02M]
  ------------------
  135|  59.7M|         const word w1 = w_is_1.if_set_return(m_W[base_addr + 0 * elem_size + j]);
  136|  59.7M|         const word w2 = w_is_2.if_set_return(m_W[base_addr + 1 * elem_size + j]);
  137|  59.7M|         const word w3 = w_is_3.if_set_return(m_W[base_addr + 2 * elem_size + j]);
  138|  59.7M|         const word w4 = w_is_4.if_set_return(m_W[base_addr + 3 * elem_size + j]);
  139|  59.7M|         const word w5 = w_is_5.if_set_return(m_W[base_addr + 4 * elem_size + j]);
  140|  59.7M|         const word w6 = w_is_6.if_set_return(m_W[base_addr + 5 * elem_size + j]);
  141|  59.7M|         const word w7 = w_is_7.if_set_return(m_W[base_addr + 6 * elem_size + j]);
  142|       |
  143|  59.7M|         Wt[j] = w1 | w2 | w3 | w4 | w5 | w6 | w7;
  144|  59.7M|      }
  145|       |
  146|  4.02M|      R.add_affine(&Wt[0], m_p_words, &Wt[m_p_words], m_p_words, ws);
  147|       |
  148|  4.02M|      if(i == 0 && rng.is_seeded()) {
  ------------------
  |  Branch (148:10): [True: 18.6k, False: 4.00M]
  |  Branch (148:20): [True: 18.6k, False: 0]
  ------------------
  149|       |         /*
  150|       |         * Since we start with the top bit of the exponent we know the
  151|       |         * first window must have a non-zero element, and thus R is
  152|       |         * now a point other than the point at infinity.
  153|       |         */
  154|  18.6k|         BOTAN_DEBUG_ASSERT(w != 0);
  ------------------
  |  |   99|  18.6k|      do {                          \
  |  |  100|  18.6k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  155|  18.6k|         R.randomize_repr(rng, ws[0].get_word_vector());
  156|  18.6k|      }
  157|  4.02M|   }
  158|       |
  159|  18.6k|   BOTAN_DEBUG_ASSERT(R.on_the_curve());
  ------------------
  |  |   99|  18.6k|      do {                          \
  |  |  100|  18.6k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  160|       |
  161|  18.6k|   return R;
  162|  18.6k|}
_ZN5Botan29EC_Point_Var_Point_PrecomputeC2ERKNS_8EC_PointERNS_21RandomNumberGeneratorERNSt3__16vectorINS_6BigIntENS6_9allocatorIS8_EEEE:
  167|  9.82k|      m_curve(point.get_curve()), m_p_words(m_curve.get_p().sig_words()), m_window_bits(4) {
  168|  9.82k|   if(ws.size() < EC_Point::WORKSPACE_SIZE) {
  ------------------
  |  Branch (168:7): [True: 9.82k, False: 0]
  ------------------
  169|  9.82k|      ws.resize(EC_Point::WORKSPACE_SIZE);
  170|  9.82k|   }
  171|       |
  172|  9.82k|   std::vector<EC_Point> U(static_cast<size_t>(1) << m_window_bits);
  173|  9.82k|   U[0] = point.zero();
  174|  9.82k|   U[1] = point;
  175|       |
  176|  78.6k|   for(size_t i = 2; i < U.size(); i += 2) {
  ------------------
  |  Branch (176:22): [True: 68.7k, False: 9.82k]
  ------------------
  177|  68.7k|      U[i] = U[i / 2].double_of(ws);
  178|  68.7k|      U[i + 1] = U[i].plus(point, ws);
  179|  68.7k|   }
  180|       |
  181|       |   // Hack to handle Blinded_Point_Multiply
  182|  9.82k|   if(rng.is_seeded()) {
  ------------------
  |  Branch (182:7): [True: 9.82k, False: 0]
  ------------------
  183|  9.82k|      BigInt& mask = ws[0];
  184|  9.82k|      BigInt& mask2 = ws[1];
  185|  9.82k|      BigInt& mask3 = ws[2];
  186|  9.82k|      BigInt& new_x = ws[3];
  187|  9.82k|      BigInt& new_y = ws[4];
  188|  9.82k|      BigInt& new_z = ws[5];
  189|  9.82k|      secure_vector<word>& tmp = ws[6].get_word_vector();
  190|       |
  191|  9.82k|      const CurveGFp& curve = U[0].get_curve();
  192|       |
  193|  9.82k|      const size_t p_bits = curve.get_p().bits();
  194|       |
  195|       |      // Skipping zero point since it can't be randomized
  196|   157k|      for(size_t i = 1; i != U.size(); ++i) {
  ------------------
  |  Branch (196:25): [True: 147k, False: 9.82k]
  ------------------
  197|   147k|         mask.randomize(rng, p_bits - 1, false);
  198|       |         // Easy way of ensuring mask != 0
  199|   147k|         mask.set_bit(0);
  200|       |
  201|   147k|         curve.sqr(mask2, mask, tmp);
  202|   147k|         curve.mul(mask3, mask, mask2, tmp);
  203|       |
  204|   147k|         curve.mul(new_x, U[i].get_x(), mask2, tmp);
  205|   147k|         curve.mul(new_y, U[i].get_y(), mask3, tmp);
  206|   147k|         curve.mul(new_z, U[i].get_z(), mask, tmp);
  207|       |
  208|   147k|         U[i].swap_coords(new_x, new_y, new_z);
  209|   147k|      }
  210|  9.82k|   }
  211|       |
  212|  9.82k|   m_T.resize(U.size() * 3 * m_p_words);
  213|       |
  214|  9.82k|   word* p = &m_T[0];
  215|   167k|   for(size_t i = 0; i != U.size(); ++i) {
  ------------------
  |  Branch (215:22): [True: 157k, False: 9.82k]
  ------------------
  216|   157k|      U[i].get_x().encode_words(p, m_p_words);
  217|   157k|      U[i].get_y().encode_words(p + m_p_words, m_p_words);
  218|   157k|      U[i].get_z().encode_words(p + 2 * m_p_words, m_p_words);
  219|   157k|      p += 3 * m_p_words;
  220|   157k|   }
  221|  9.82k|}
_ZNK5Botan29EC_Point_Var_Point_Precompute3mulERKNS_6BigIntERNS_21RandomNumberGeneratorES3_RNSt3__16vectorIS1_NS6_9allocatorIS1_EEEE:
  226|  9.82k|                                            std::vector<BigInt>& ws) const {
  227|  9.82k|   if(k.is_negative()) {
  ------------------
  |  Branch (227:7): [True: 0, False: 9.82k]
  ------------------
  228|      0|      throw Invalid_Argument("EC_Point_Var_Point_Precompute scalar must be positive");
  229|      0|   }
  230|  9.82k|   if(ws.size() < EC_Point::WORKSPACE_SIZE) {
  ------------------
  |  Branch (230:7): [True: 0, False: 9.82k]
  ------------------
  231|      0|      ws.resize(EC_Point::WORKSPACE_SIZE);
  232|      0|   }
  233|       |
  234|       |   // Choose a small mask m and use k' = k + m*order (Coron's 1st countermeasure)
  235|  9.82k|   const BigInt mask(rng, blinding_size(group_order), false);
  236|  9.82k|   const BigInt scalar = k + group_order * mask;
  237|       |
  238|  9.82k|   const size_t elem_size = 3 * m_p_words;
  239|  9.82k|   const size_t window_elems = static_cast<size_t>(1) << m_window_bits;
  240|       |
  241|  9.82k|   size_t windows = round_up(scalar.bits(), m_window_bits) / m_window_bits;
  242|  9.82k|   EC_Point R(m_curve);
  243|  9.82k|   secure_vector<word> e(elem_size);
  244|       |
  245|  9.82k|   if(windows > 0) {
  ------------------
  |  Branch (245:7): [True: 9.82k, False: 0]
  ------------------
  246|  9.82k|      windows--;
  247|       |
  248|  9.82k|      const uint32_t w = scalar.get_substring(windows * m_window_bits, m_window_bits);
  249|       |
  250|  9.82k|      clear_mem(e.data(), e.size());
  251|   157k|      for(size_t i = 1; i != window_elems; ++i) {
  ------------------
  |  Branch (251:25): [True: 147k, False: 9.82k]
  ------------------
  252|   147k|         const auto wmask = CT::Mask<word>::is_equal(w, i);
  253|       |
  254|  3.38M|         for(size_t j = 0; j != elem_size; ++j) {
  ------------------
  |  Branch (254:28): [True: 3.23M, False: 147k]
  ------------------
  255|  3.23M|            e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
  256|  3.23M|         }
  257|   147k|      }
  258|       |
  259|  9.82k|      R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
  260|       |
  261|       |      /*
  262|       |      Randomize after adding the first nibble as before the addition R
  263|       |      is zero, and we cannot effectively randomize the point
  264|       |      representation of the zero point.
  265|       |      */
  266|  9.82k|      R.randomize_repr(rng, ws[0].get_word_vector());
  267|  9.82k|   }
  268|       |
  269|  1.65M|   while(windows) {
  ------------------
  |  Branch (269:10): [True: 1.64M, False: 9.82k]
  ------------------
  270|  1.64M|      R.mult2i(m_window_bits, ws);
  271|       |
  272|  1.64M|      const uint32_t w = scalar.get_substring((windows - 1) * m_window_bits, m_window_bits);
  273|       |
  274|  1.64M|      clear_mem(e.data(), e.size());
  275|  26.3M|      for(size_t i = 1; i != window_elems; ++i) {
  ------------------
  |  Branch (275:25): [True: 24.6M, False: 1.64M]
  ------------------
  276|  24.6M|         const auto wmask = CT::Mask<word>::is_equal(w, i);
  277|       |
  278|   593M|         for(size_t j = 0; j != elem_size; ++j) {
  ------------------
  |  Branch (278:28): [True: 569M, False: 24.6M]
  ------------------
  279|   569M|            e[j] |= wmask.if_set_return(m_T[i * elem_size + j]);
  280|   569M|         }
  281|  24.6M|      }
  282|       |
  283|  1.64M|      R.add(&e[0], m_p_words, &e[m_p_words], m_p_words, &e[2 * m_p_words], m_p_words, ws);
  284|       |
  285|  1.64M|      windows--;
  286|  1.64M|   }
  287|       |
  288|  9.82k|   BOTAN_DEBUG_ASSERT(R.on_the_curve());
  ------------------
  |  |   99|  9.82k|      do {                          \
  |  |  100|  9.82k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  289|       |
  290|  9.82k|   return R;
  291|  9.82k|}
point_mul.cpp:_ZN5Botan12_GLOBAL__N_113blinding_sizeERKNS_6BigIntE:
   18|  28.5k|size_t blinding_size(const BigInt& group_order) { return (group_order.bits() + 1) / 2; }

_ZNK5Botan12EC_PublicKey10key_lengthEv:
   21|  9.82k|size_t EC_PublicKey::key_length() const { return domain().get_p_bits(); }
_ZN5Botan12EC_PublicKeyC2ERKNS_8EC_GroupERKNS_8EC_PointE:
   38|  9.82k|      m_domain_params(dom_par), m_public_key(pub_point), m_domain_encoding(default_encoding_for(m_domain_params)) {}
_ZNK5Botan13EC_PrivateKey13private_valueEv:
   71|  9.82k|const BigInt& EC_PrivateKey::private_value() const {
   72|  9.82k|   if(m_private_key == 0) {
  ------------------
  |  Branch (72:7): [True: 0, False: 9.82k]
  ------------------
   73|      0|      throw Invalid_State("EC_PrivateKey::private_value - uninitialized");
   74|      0|   }
   75|       |
   76|  9.82k|   return m_private_key;
   77|  9.82k|}
_ZN5Botan13EC_PrivateKeyC2ERNS_21RandomNumberGeneratorERKNS_8EC_GroupERKNS_6BigIntEb:
   85|  18.6k|                             bool with_modular_inverse) {
   86|  18.6k|   m_domain_params = ec_group;
   87|  18.6k|   m_domain_encoding = default_encoding_for(m_domain_params);
   88|       |
   89|  18.6k|   if(x == 0) {
  ------------------
  |  Branch (89:7): [True: 18.6k, False: 0]
  ------------------
   90|  18.6k|      m_private_key = ec_group.random_scalar(rng);
   91|  18.6k|   } else {
   92|      0|      m_private_key = x;
   93|      0|   }
   94|       |
   95|  18.6k|   std::vector<BigInt> ws;
   96|       |
   97|  18.6k|   if(with_modular_inverse) {
  ------------------
  |  Branch (97:7): [True: 0, False: 18.6k]
  ------------------
   98|       |      // ECKCDSA
   99|      0|      m_public_key = domain().blinded_base_point_multiply(m_domain_params.inverse_mod_order(m_private_key), rng, ws);
  100|  18.6k|   } else {
  101|  18.6k|      m_public_key = domain().blinded_base_point_multiply(m_private_key, rng, ws);
  102|  18.6k|   }
  103|       |
  104|  18.6k|   BOTAN_ASSERT(m_public_key.on_the_curve(), "Generated public key point was on the curve");
  ------------------
  |  |   51|  18.6k|   do {                                                                                 \
  |  |   52|  18.6k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 18.6k]
  |  |  ------------------
  |  |   53|  18.6k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  18.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  105|  18.6k|}
ecc_key.cpp:_ZN5Botan12_GLOBAL__N_120default_encoding_forERNS_8EC_GroupE:
   27|  28.5k|EC_Group_Encoding default_encoding_for(EC_Group& group) {
   28|  28.5k|   if(group.get_curve_oid().empty()) {
  ------------------
  |  Branch (28:7): [True: 0, False: 28.5k]
  ------------------
   29|      0|      return EC_Group_Encoding::Explicit;
   30|  28.5k|   } else {
   31|  28.5k|      return EC_Group_Encoding::NamedCurve;
   32|  28.5k|   }
   33|  28.5k|}

_ZNK5Botan15ECDH_PrivateKey23create_key_agreement_opERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEES7_:
   58|  9.82k|                                                                                std::string_view provider) const {
   59|  9.82k|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (59:7): [True: 0, False: 9.82k]
  |  Branch (59:29): [True: 9.82k, False: 0]
  ------------------
   60|  9.82k|      return std::make_unique<ECDH_KA_Operation>(*this, params, rng);
   61|  9.82k|   }
   62|       |
   63|      0|   throw Provider_Not_Found(algo_name(), provider);
   64|  9.82k|}
ecdh.cpp:_ZN5Botan12_GLOBAL__N_117ECDH_KA_OperationC2ERKNS_15ECDH_PrivateKeyENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEERNS_21RandomNumberGeneratorE:
   29|  9.82k|            PK_Ops::Key_Agreement_with_KDF(kdf), m_group(key.domain()), m_rng(rng) {
   30|  9.82k|         m_l_times_priv = m_group.inverse_mod_order(m_group.get_cofactor()) * key.private_value();
   31|  9.82k|      }
ecdh.cpp:_ZN5Botan12_GLOBAL__N_117ECDH_KA_Operation9raw_agreeEPKhm:
   35|  9.82k|      secure_vector<uint8_t> raw_agree(const uint8_t w[], size_t w_len) override {
   36|  9.82k|         EC_Point input_point = m_group.get_cofactor() * m_group.OS2ECP(w, w_len);
   37|  9.82k|         input_point.randomize_repr(m_rng);
   38|       |
   39|  9.82k|         const EC_Point S = m_group.blinded_var_point_multiply(input_point, m_l_times_priv, m_rng, m_ws);
   40|       |
   41|  9.82k|         if(S.on_the_curve() == false) {
  ------------------
  |  Branch (41:13): [True: 0, False: 9.82k]
  ------------------
   42|      0|            throw Internal_Error("ECDH agreed value was not on the curve");
   43|      0|         }
   44|  9.82k|         return BigInt::encode_1363(S.get_affine_x(), m_group.get_p_bytes());
   45|  9.82k|      }

_ZN5Botan8PEM_Code6decodeERNS_10DataSourceERNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE:
   62|  11.5k|secure_vector<uint8_t> decode(DataSource& source, std::string& label) {
   63|  11.5k|   const size_t RANDOM_CHAR_LIMIT = 8;
   64|       |
   65|  11.5k|   label.clear();
   66|       |
   67|  11.5k|   const std::string PEM_HEADER1 = "-----BEGIN ";
   68|  11.5k|   const std::string PEM_HEADER2 = "-----";
   69|  11.5k|   size_t position = 0;
   70|       |
   71|   138k|   while(position != PEM_HEADER1.length()) {
  ------------------
  |  Branch (71:10): [True: 127k, False: 11.5k]
  ------------------
   72|   127k|      uint8_t b;
   73|   127k|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (73:10): [True: 0, False: 127k]
  ------------------
   74|      0|         throw Decoding_Error("PEM: No PEM header found");
   75|      0|      }
   76|   127k|      if(static_cast<char>(b) == PEM_HEADER1[position]) {
  ------------------
  |  Branch (76:10): [True: 127k, False: 0]
  ------------------
   77|   127k|         ++position;
   78|   127k|      } else if(position >= RANDOM_CHAR_LIMIT) {
  ------------------
  |  Branch (78:17): [True: 0, False: 0]
  ------------------
   79|      0|         throw Decoding_Error("PEM: Malformed PEM header");
   80|      0|      } else {
   81|      0|         position = 0;
   82|      0|      }
   83|   127k|   }
   84|  11.5k|   position = 0;
   85|   196k|   while(position != PEM_HEADER2.length()) {
  ------------------
  |  Branch (85:10): [True: 184k, False: 11.5k]
  ------------------
   86|   184k|      uint8_t b;
   87|   184k|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (87:10): [True: 0, False: 184k]
  ------------------
   88|      0|         throw Decoding_Error("PEM: No PEM header found");
   89|      0|      }
   90|   184k|      if(static_cast<char>(b) == PEM_HEADER2[position]) {
  ------------------
  |  Branch (90:10): [True: 57.7k, False: 127k]
  ------------------
   91|  57.7k|         ++position;
   92|   127k|      } else if(position) {
  ------------------
  |  Branch (92:17): [True: 0, False: 127k]
  ------------------
   93|      0|         throw Decoding_Error("PEM: Malformed PEM header");
   94|      0|      }
   95|       |
   96|   184k|      if(position == 0) {
  ------------------
  |  Branch (96:10): [True: 127k, False: 57.7k]
  ------------------
   97|   127k|         label += static_cast<char>(b);
   98|   127k|      }
   99|   184k|   }
  100|       |
  101|  11.5k|   std::vector<char> b64;
  102|       |
  103|  11.5k|   const std::string PEM_TRAILER = fmt("-----END {}-----", label);
  104|  11.5k|   position = 0;
  105|  16.5M|   while(position != PEM_TRAILER.length()) {
  ------------------
  |  Branch (105:10): [True: 16.5M, False: 11.5k]
  ------------------
  106|  16.5M|      uint8_t b;
  107|  16.5M|      if(!source.read_byte(b)) {
  ------------------
  |  Branch (107:10): [True: 0, False: 16.5M]
  ------------------
  108|      0|         throw Decoding_Error("PEM: No PEM trailer found");
  109|      0|      }
  110|  16.5M|      if(static_cast<char>(b) == PEM_TRAILER[position]) {
  ------------------
  |  Branch (110:10): [True: 288k, False: 16.2M]
  ------------------
  111|   288k|         ++position;
  112|  16.2M|      } else if(position) {
  ------------------
  |  Branch (112:17): [True: 0, False: 16.2M]
  ------------------
  113|      0|         throw Decoding_Error("PEM: Malformed PEM trailer");
  114|      0|      }
  115|       |
  116|  16.5M|      if(position == 0) {
  ------------------
  |  Branch (116:10): [True: 16.2M, False: 288k]
  ------------------
  117|  16.2M|         b64.push_back(b);
  118|  16.2M|      }
  119|  16.5M|   }
  120|       |
  121|  11.5k|   return base64_decode(b64.data(), b64.size());
  122|  11.5k|}
_ZN5Botan8PEM_Code7matchesERNS_10DataSourceENSt3__117basic_string_viewIcNS3_11char_traitsIcEEEEm:
  137|  5.77k|bool matches(DataSource& source, std::string_view extra, size_t search_range) {
  138|  5.77k|   const std::string PEM_HEADER = fmt("-----BEGIN {}", extra);
  139|       |
  140|  5.77k|   secure_vector<uint8_t> search_buf(search_range);
  141|  5.77k|   const size_t got = source.peek(search_buf.data(), search_buf.size(), 0);
  142|       |
  143|  5.77k|   if(got < PEM_HEADER.length()) {
  ------------------
  |  Branch (143:7): [True: 0, False: 5.77k]
  ------------------
  144|      0|      return false;
  145|      0|   }
  146|       |
  147|  5.77k|   size_t index = 0;
  148|       |
  149|  1.70M|   for(size_t j = 0; j != got; ++j) {
  ------------------
  |  Branch (149:22): [True: 1.69M, False: 5.77k]
  ------------------
  150|  1.69M|      if(static_cast<char>(search_buf[j]) == PEM_HEADER[index]) {
  ------------------
  |  Branch (150:10): [True: 17.3k, False: 1.68M]
  ------------------
  151|  17.3k|         ++index;
  152|  1.68M|      } else {
  153|  1.68M|         index = 0;
  154|  1.68M|      }
  155|       |
  156|  1.69M|      if(index == PEM_HEADER.size()) {
  ------------------
  |  Branch (156:10): [True: 0, False: 1.69M]
  ------------------
  157|      0|         return true;
  158|      0|      }
  159|  1.69M|   }
  160|       |
  161|  5.77k|   return false;
  162|  5.77k|}

_ZN5Botan15load_public_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
   88|  5.77k|                                            [[maybe_unused]] std::span<const uint8_t> key_bits) {
   89|  5.77k|   const std::string oid_str = alg_id.oid().to_formatted_string();
   90|  5.77k|   const std::vector<std::string> alg_info = split_on(oid_str, '/');
   91|  5.77k|   std::string_view alg_name = alg_info[0];
   92|       |
   93|  5.77k|#if defined(BOTAN_HAS_RSA)
   94|  5.77k|   if(alg_name == "RSA") {
  ------------------
  |  Branch (94:7): [True: 5.77k, False: 0]
  ------------------
   95|  5.77k|      return std::make_unique<RSA_PublicKey>(alg_id, key_bits);
   96|  5.77k|   }
   97|      0|#endif
   98|       |
   99|      0|#if defined(BOTAN_HAS_CURVE_25519)
  100|      0|   if(alg_name == "Curve25519") {
  ------------------
  |  Branch (100:7): [True: 0, False: 0]
  ------------------
  101|      0|      return std::make_unique<Curve25519_PublicKey>(alg_id, key_bits);
  102|      0|   }
  103|      0|#endif
  104|       |
  105|      0|#if defined(BOTAN_HAS_MCELIECE)
  106|      0|   if(alg_name == "McEliece") {
  ------------------
  |  Branch (106:7): [True: 0, False: 0]
  ------------------
  107|      0|      return std::make_unique<McEliece_PublicKey>(key_bits);
  108|      0|   }
  109|      0|#endif
  110|       |
  111|      0|#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
  112|      0|   if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
  ------------------
  |  Branch (112:7): [True: 0, False: 0]
  |  Branch (112:30): [True: 0, False: 0]
  ------------------
  113|      0|      return std::make_unique<Kyber_PublicKey>(alg_id, key_bits);
  114|      0|   }
  115|      0|#endif
  116|       |
  117|      0|#if defined(BOTAN_HAS_ECDSA)
  118|      0|   if(alg_name == "ECDSA") {
  ------------------
  |  Branch (118:7): [True: 0, False: 0]
  ------------------
  119|      0|      return std::make_unique<ECDSA_PublicKey>(alg_id, key_bits);
  120|      0|   }
  121|      0|#endif
  122|       |
  123|      0|#if defined(BOTAN_HAS_ECDH)
  124|      0|   if(alg_name == "ECDH") {
  ------------------
  |  Branch (124:7): [True: 0, False: 0]
  ------------------
  125|      0|      return std::make_unique<ECDH_PublicKey>(alg_id, key_bits);
  126|      0|   }
  127|      0|#endif
  128|       |
  129|      0|#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
  130|      0|   if(alg_name == "DH") {
  ------------------
  |  Branch (130:7): [True: 0, False: 0]
  ------------------
  131|      0|      return std::make_unique<DH_PublicKey>(alg_id, key_bits);
  132|      0|   }
  133|      0|#endif
  134|       |
  135|      0|#if defined(BOTAN_HAS_DSA)
  136|      0|   if(alg_name == "DSA") {
  ------------------
  |  Branch (136:7): [True: 0, False: 0]
  ------------------
  137|      0|      return std::make_unique<DSA_PublicKey>(alg_id, key_bits);
  138|      0|   }
  139|      0|#endif
  140|       |
  141|      0|#if defined(BOTAN_HAS_ELGAMAL)
  142|      0|   if(alg_name == "ElGamal") {
  ------------------
  |  Branch (142:7): [True: 0, False: 0]
  ------------------
  143|      0|      return std::make_unique<ElGamal_PublicKey>(alg_id, key_bits);
  144|      0|   }
  145|      0|#endif
  146|       |
  147|      0|#if defined(BOTAN_HAS_ECGDSA)
  148|      0|   if(alg_name == "ECGDSA") {
  ------------------
  |  Branch (148:7): [True: 0, False: 0]
  ------------------
  149|      0|      return std::make_unique<ECGDSA_PublicKey>(alg_id, key_bits);
  150|      0|   }
  151|      0|#endif
  152|       |
  153|      0|#if defined(BOTAN_HAS_ECKCDSA)
  154|      0|   if(alg_name == "ECKCDSA") {
  ------------------
  |  Branch (154:7): [True: 0, False: 0]
  ------------------
  155|      0|      return std::make_unique<ECKCDSA_PublicKey>(alg_id, key_bits);
  156|      0|   }
  157|      0|#endif
  158|       |
  159|      0|#if defined(BOTAN_HAS_ED25519)
  160|      0|   if(alg_name == "Ed25519") {
  ------------------
  |  Branch (160:7): [True: 0, False: 0]
  ------------------
  161|      0|      return std::make_unique<Ed25519_PublicKey>(alg_id, key_bits);
  162|      0|   }
  163|      0|#endif
  164|       |
  165|      0|#if defined(BOTAN_HAS_GOST_34_10_2001)
  166|      0|   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
  ------------------
  |  Branch (166:7): [True: 0, False: 0]
  |  Branch (166:35): [True: 0, False: 0]
  |  Branch (166:72): [True: 0, False: 0]
  ------------------
  167|      0|      return std::make_unique<GOST_3410_PublicKey>(alg_id, key_bits);
  168|      0|   }
  169|      0|#endif
  170|       |
  171|      0|#if defined(BOTAN_HAS_SM2)
  172|      0|   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
  ------------------
  |  Branch (172:7): [True: 0, False: 0]
  |  Branch (172:28): [True: 0, False: 0]
  |  Branch (172:53): [True: 0, False: 0]
  ------------------
  173|      0|      return std::make_unique<SM2_PublicKey>(alg_id, key_bits);
  174|      0|   }
  175|      0|#endif
  176|       |
  177|      0|#if defined(BOTAN_HAS_XMSS_RFC8391)
  178|      0|   if(alg_name == "XMSS") {
  ------------------
  |  Branch (178:7): [True: 0, False: 0]
  ------------------
  179|      0|      return std::make_unique<XMSS_PublicKey>(key_bits);
  180|      0|   }
  181|      0|#endif
  182|       |
  183|      0|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
  184|      0|   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
  ------------------
  |  Branch (184:7): [True: 0, False: 0]
  |  Branch (184:34): [True: 0, False: 0]
  ------------------
  185|      0|      return std::make_unique<Dilithium_PublicKey>(alg_id, key_bits);
  186|      0|   }
  187|      0|#endif
  188|       |
  189|      0|   throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
  190|      0|}
_ZN5Botan16load_private_keyERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
  193|  5.77k|                                              [[maybe_unused]] std::span<const uint8_t> key_bits) {
  194|  5.77k|   const std::string oid_str = alg_id.oid().to_formatted_string();
  195|  5.77k|   const std::vector<std::string> alg_info = split_on(oid_str, '/');
  196|  5.77k|   std::string_view alg_name = alg_info[0];
  197|       |
  198|  5.77k|#if defined(BOTAN_HAS_RSA)
  199|  5.77k|   if(alg_name == "RSA") {
  ------------------
  |  Branch (199:7): [True: 5.77k, False: 0]
  ------------------
  200|  5.77k|      return std::make_unique<RSA_PrivateKey>(alg_id, key_bits);
  201|  5.77k|   }
  202|      0|#endif
  203|       |
  204|      0|#if defined(BOTAN_HAS_CURVE_25519)
  205|      0|   if(alg_name == "Curve25519") {
  ------------------
  |  Branch (205:7): [True: 0, False: 0]
  ------------------
  206|      0|      return std::make_unique<Curve25519_PrivateKey>(alg_id, key_bits);
  207|      0|   }
  208|      0|#endif
  209|       |
  210|      0|#if defined(BOTAN_HAS_ECDSA)
  211|      0|   if(alg_name == "ECDSA") {
  ------------------
  |  Branch (211:7): [True: 0, False: 0]
  ------------------
  212|      0|      return std::make_unique<ECDSA_PrivateKey>(alg_id, key_bits);
  213|      0|   }
  214|      0|#endif
  215|       |
  216|      0|#if defined(BOTAN_HAS_ECDH)
  217|      0|   if(alg_name == "ECDH") {
  ------------------
  |  Branch (217:7): [True: 0, False: 0]
  ------------------
  218|      0|      return std::make_unique<ECDH_PrivateKey>(alg_id, key_bits);
  219|      0|   }
  220|      0|#endif
  221|       |
  222|      0|#if defined(BOTAN_HAS_DIFFIE_HELLMAN)
  223|      0|   if(alg_name == "DH") {
  ------------------
  |  Branch (223:7): [True: 0, False: 0]
  ------------------
  224|      0|      return std::make_unique<DH_PrivateKey>(alg_id, key_bits);
  225|      0|   }
  226|      0|#endif
  227|       |
  228|      0|#if defined(BOTAN_HAS_DSA)
  229|      0|   if(alg_name == "DSA") {
  ------------------
  |  Branch (229:7): [True: 0, False: 0]
  ------------------
  230|      0|      return std::make_unique<DSA_PrivateKey>(alg_id, key_bits);
  231|      0|   }
  232|      0|#endif
  233|       |
  234|      0|#if defined(BOTAN_HAS_KYBER) || defined(BOTAN_HAS_KYBER_90S)
  235|      0|   if(alg_name == "Kyber" || alg_name.starts_with("Kyber-")) {
  ------------------
  |  Branch (235:7): [True: 0, False: 0]
  |  Branch (235:30): [True: 0, False: 0]
  ------------------
  236|      0|      return std::make_unique<Kyber_PrivateKey>(alg_id, key_bits);
  237|      0|   }
  238|      0|#endif
  239|       |
  240|      0|#if defined(BOTAN_HAS_MCELIECE)
  241|      0|   if(alg_name == "McEliece") {
  ------------------
  |  Branch (241:7): [True: 0, False: 0]
  ------------------
  242|      0|      return std::make_unique<McEliece_PrivateKey>(key_bits);
  243|      0|   }
  244|      0|#endif
  245|       |
  246|      0|#if defined(BOTAN_HAS_ECGDSA)
  247|      0|   if(alg_name == "ECGDSA") {
  ------------------
  |  Branch (247:7): [True: 0, False: 0]
  ------------------
  248|      0|      return std::make_unique<ECGDSA_PrivateKey>(alg_id, key_bits);
  249|      0|   }
  250|      0|#endif
  251|       |
  252|      0|#if defined(BOTAN_HAS_ECKCDSA)
  253|      0|   if(alg_name == "ECKCDSA") {
  ------------------
  |  Branch (253:7): [True: 0, False: 0]
  ------------------
  254|      0|      return std::make_unique<ECKCDSA_PrivateKey>(alg_id, key_bits);
  255|      0|   }
  256|      0|#endif
  257|       |
  258|      0|#if defined(BOTAN_HAS_ED25519)
  259|      0|   if(alg_name == "Ed25519") {
  ------------------
  |  Branch (259:7): [True: 0, False: 0]
  ------------------
  260|      0|      return std::make_unique<Ed25519_PrivateKey>(alg_id, key_bits);
  261|      0|   }
  262|      0|#endif
  263|       |
  264|      0|#if defined(BOTAN_HAS_GOST_34_10_2001)
  265|      0|   if(alg_name == "GOST-34.10" || alg_name == "GOST-34.10-2012-256" || alg_name == "GOST-34.10-2012-512") {
  ------------------
  |  Branch (265:7): [True: 0, False: 0]
  |  Branch (265:35): [True: 0, False: 0]
  |  Branch (265:72): [True: 0, False: 0]
  ------------------
  266|      0|      return std::make_unique<GOST_3410_PrivateKey>(alg_id, key_bits);
  267|      0|   }
  268|      0|#endif
  269|       |
  270|      0|#if defined(BOTAN_HAS_SM2)
  271|      0|   if(alg_name == "SM2" || alg_name == "SM2_Sig" || alg_name == "SM2_Enc") {
  ------------------
  |  Branch (271:7): [True: 0, False: 0]
  |  Branch (271:28): [True: 0, False: 0]
  |  Branch (271:53): [True: 0, False: 0]
  ------------------
  272|      0|      return std::make_unique<SM2_PrivateKey>(alg_id, key_bits);
  273|      0|   }
  274|      0|#endif
  275|       |
  276|      0|#if defined(BOTAN_HAS_ELGAMAL)
  277|      0|   if(alg_name == "ElGamal") {
  ------------------
  |  Branch (277:7): [True: 0, False: 0]
  ------------------
  278|      0|      return std::make_unique<ElGamal_PrivateKey>(alg_id, key_bits);
  279|      0|   }
  280|      0|#endif
  281|       |
  282|      0|#if defined(BOTAN_HAS_XMSS_RFC8391)
  283|      0|   if(alg_name == "XMSS") {
  ------------------
  |  Branch (283:7): [True: 0, False: 0]
  ------------------
  284|      0|      return std::make_unique<XMSS_PrivateKey>(key_bits);
  285|      0|   }
  286|      0|#endif
  287|       |
  288|      0|#if defined(BOTAN_HAS_DILITHIUM) || defined(BOTAN_HAS_DILITHIUM_AES)
  289|      0|   if(alg_name == "Dilithium" || alg_name.starts_with("Dilithium-")) {
  ------------------
  |  Branch (289:7): [True: 0, False: 0]
  |  Branch (289:34): [True: 0, False: 0]
  ------------------
  290|      0|      return std::make_unique<Dilithium_PrivateKey>(alg_id, key_bits);
  291|      0|   }
  292|      0|#endif
  293|       |
  294|      0|   throw Decoding_Error(fmt("Unknown or unavailable public key algorithm '{}'", alg_name));
  295|      0|}

_ZN5Botan22create_hex_fingerprintEPKhmNSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   30|  11.5k|std::string create_hex_fingerprint(const uint8_t bits[], size_t bits_len, std::string_view hash_name) {
   31|  11.5k|   auto hash_fn = HashFunction::create_or_throw(hash_name);
   32|  11.5k|   const std::string hex_hash = hex_encode(hash_fn->process(bits, bits_len));
   33|       |
   34|  11.5k|   std::string fprint;
   35|       |
   36|   312k|   for(size_t i = 0; i != hex_hash.size(); i += 2) {
  ------------------
  |  Branch (36:22): [True: 300k, False: 11.5k]
  ------------------
   37|   300k|      if(i != 0) {
  ------------------
  |  Branch (37:10): [True: 288k, False: 11.5k]
  ------------------
   38|   288k|         fprint.push_back(':');
   39|   288k|      }
   40|       |
   41|   300k|      fprint.push_back(hex_hash[i]);
   42|   300k|      fprint.push_back(hex_hash[i + 1]);
   43|   300k|   }
   44|       |
   45|  11.5k|   return fprint;
   46|  11.5k|}

_ZN5Botan6PK_Ops22Key_Agreement_with_KDFC2ENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   51|  9.82k|PK_Ops::Key_Agreement_with_KDF::Key_Agreement_with_KDF(std::string_view kdf) {
   52|  9.82k|   if(kdf != "Raw") {
  ------------------
  |  Branch (52:7): [True: 0, False: 9.82k]
  ------------------
   53|      0|      m_kdf = KDF::create_or_throw(kdf);
   54|      0|   }
   55|  9.82k|}
_ZN5Botan6PK_Ops22Key_Agreement_with_KDF5agreeEmPKhmS3_m:
   58|  9.82k|   size_t key_len, const uint8_t w[], size_t w_len, const uint8_t salt[], size_t salt_len) {
   59|  9.82k|   if(salt_len > 0 && m_kdf == nullptr) {
  ------------------
  |  Branch (59:7): [True: 0, False: 9.82k]
  |  Branch (59:23): [True: 0, False: 0]
  ------------------
   60|      0|      throw Invalid_Argument("PK_Key_Agreement::derive_key requires a KDF to use a salt");
   61|      0|   }
   62|       |
   63|  9.82k|   secure_vector<uint8_t> z = raw_agree(w, w_len);
   64|  9.82k|   if(m_kdf) {
  ------------------
  |  Branch (64:7): [True: 0, False: 9.82k]
  ------------------
   65|      0|      return m_kdf->derive_key(key_len, z, salt, salt_len);
   66|      0|   }
   67|  9.82k|   return z;
   68|  9.82k|}

_ZN5Botan5PKCS88load_keyERNS_10DataSourceE:
  345|  5.77k|std::unique_ptr<Private_Key> load_key(DataSource& source) {
  346|  5.77k|   auto fail_fn = []() -> std::string {
  347|  5.77k|      throw PKCS8_Exception("Internal error: Attempt to read password for unencrypted key");
  348|  5.77k|   };
  349|       |
  350|  5.77k|   return load_key(source, fail_fn, false);
  351|  5.77k|}
pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_18load_keyERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEEb:
  297|  5.77k|                                      bool is_encrypted) {
  298|  5.77k|   AlgorithmIdentifier alg_id;
  299|  5.77k|   secure_vector<uint8_t> pkcs8_key = PKCS8_decode(source, get_pass, alg_id, is_encrypted);
  300|       |
  301|  5.77k|   const std::string alg_name = alg_id.oid().human_name_or_empty();
  302|  5.77k|   if(alg_name.empty()) {
  ------------------
  |  Branch (302:7): [True: 0, False: 5.77k]
  ------------------
  303|      0|      throw PKCS8_Exception(fmt("Unknown algorithm OID {}", alg_id.oid()));
  304|      0|   }
  305|       |
  306|  5.77k|   return load_private_key(alg_id, pkcs8_key);
  307|  5.77k|}
pkcs8.cpp:_ZN5Botan5PKCS812_GLOBAL__N_112PKCS8_decodeERNS_10DataSourceERKNSt3__18functionIFNS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEvEEERNS_19AlgorithmIdentifierEb:
   44|  5.77k|                                    bool is_encrypted) {
   45|  5.77k|   AlgorithmIdentifier pbe_alg_id;
   46|  5.77k|   secure_vector<uint8_t> key_data, key;
   47|       |
   48|  5.77k|   try {
   49|  5.77k|      if(ASN1::maybe_BER(source) && !PEM_Code::matches(source)) {
  ------------------
  |  Branch (49:10): [True: 0, False: 5.77k]
  |  Branch (49:37): [True: 0, False: 0]
  ------------------
   50|      0|         if(is_encrypted) {
  ------------------
  |  Branch (50:13): [True: 0, False: 0]
  ------------------
   51|      0|            key_data = PKCS8_extract(source, pbe_alg_id);
   52|      0|         } else {
   53|       |            // todo read more efficiently
   54|      0|            while(!source.end_of_data()) {
  ------------------
  |  Branch (54:19): [True: 0, False: 0]
  ------------------
   55|      0|               uint8_t b;
   56|      0|               size_t read = source.read_byte(b);
   57|      0|               if(read) {
  ------------------
  |  Branch (57:19): [True: 0, False: 0]
  ------------------
   58|      0|                  key_data.push_back(b);
   59|      0|               }
   60|      0|            }
   61|      0|         }
   62|  5.77k|      } else {
   63|  5.77k|         std::string label;
   64|  5.77k|         key_data = PEM_Code::decode(source, label);
   65|       |
   66|       |         // todo remove autodetect for pem as well?
   67|  5.77k|         if(label == "PRIVATE KEY") {
  ------------------
  |  Branch (67:13): [True: 5.77k, False: 0]
  ------------------
   68|  5.77k|            is_encrypted = false;
   69|  5.77k|         } else if(label == "ENCRYPTED PRIVATE KEY") {
  ------------------
  |  Branch (69:20): [True: 0, False: 0]
  ------------------
   70|      0|            DataSource_Memory key_source(key_data);
   71|      0|            key_data = PKCS8_extract(key_source, pbe_alg_id);
   72|      0|         } else {
   73|      0|            throw PKCS8_Exception(fmt("Unknown PEM label '{}'", label));
   74|      0|         }
   75|  5.77k|      }
   76|       |
   77|  5.77k|      if(key_data.empty()) {
  ------------------
  |  Branch (77:10): [True: 0, False: 5.77k]
  ------------------
   78|      0|         throw PKCS8_Exception("No key data found");
   79|      0|      }
   80|  5.77k|   } catch(Decoding_Error& e) {
   81|      0|      throw Decoding_Error("PKCS #8 private key decoding", e);
   82|      0|   }
   83|       |
   84|  5.77k|   try {
   85|  5.77k|      if(is_encrypted) {
  ------------------
  |  Branch (85:10): [True: 0, False: 5.77k]
  ------------------
   86|      0|         if(pbe_alg_id.oid().to_formatted_string() != "PBE-PKCS5v20") {
  ------------------
  |  Branch (86:13): [True: 0, False: 0]
  ------------------
   87|      0|            throw PKCS8_Exception(fmt("Unknown PBE type {}", pbe_alg_id.oid()));
   88|      0|         }
   89|       |
   90|      0|#if defined(BOTAN_HAS_PKCS5_PBES2)
   91|      0|         key = pbes2_decrypt(key_data, get_passphrase(), pbe_alg_id.parameters());
   92|       |#else
   93|       |         BOTAN_UNUSED(get_passphrase);
   94|       |         throw Decoding_Error("Private key is encrypted but PBES2 was disabled in build");
   95|       |#endif
   96|  5.77k|      } else {
   97|  5.77k|         key = key_data;
   98|  5.77k|      }
   99|       |
  100|  5.77k|      BER_Decoder(key)
  101|  5.77k|         .start_sequence()
  102|  5.77k|         .decode_and_check<size_t>(0, "Unknown PKCS #8 version number")
  103|  5.77k|         .decode(pk_alg_id)
  104|  5.77k|         .decode(key, ASN1_Type::OctetString)
  105|  5.77k|         .discard_remaining()
  106|  5.77k|         .end_cons();
  107|  5.77k|   } catch(std::exception& e) {
  108|      0|      throw Decoding_Error("PKCS #8 private key decoding", e);
  109|      0|   }
  110|  5.77k|   return key;
  111|  5.77k|}

_ZN5Botan16PK_Key_AgreementC2ERKNS_11Private_KeyERNS_21RandomNumberGeneratorENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEESA_:
  176|  9.82k|                                   std::string_view provider) {
  177|  9.82k|   m_op = key.create_key_agreement_op(rng, kdf, provider);
  178|  9.82k|   if(!m_op) {
  ------------------
  |  Branch (178:7): [True: 0, False: 9.82k]
  ------------------
  179|      0|      throw Invalid_Argument(fmt("Key type {} does not support key agreement", key.algo_name()));
  180|      0|   }
  181|  9.82k|}
_ZN5Botan16PK_Key_AgreementD2Ev:
  183|  9.82k|PK_Key_Agreement::~PK_Key_Agreement() = default;
_ZNK5Botan16PK_Key_Agreement10derive_keyEmPKhmS2_m:
  188|  9.82k|   size_t key_len, const uint8_t in[], size_t in_len, const uint8_t salt[], size_t salt_len) const {
  189|  9.82k|   return SymmetricKey(m_op->agree(key_len, in, in_len, salt, salt_len));
  190|  9.82k|}
_ZN5Botan11PK_VerifierC2ERKNS_10Public_KeyERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS7_11char_traitsIcEEEE:
  280|  5.77k|                         std::string_view provider) {
  281|  5.77k|   m_op = key.create_x509_verification_op(signature_algorithm, provider);
  282|       |
  283|  5.77k|   if(!m_op) {
  ------------------
  |  Branch (283:7): [True: 0, False: 5.77k]
  ------------------
  284|      0|      throw Invalid_Argument(fmt("Key type {} does not support X.509 signature verification", key.algo_name()));
  285|      0|   }
  286|       |
  287|  5.77k|   m_sig_format = key.default_x509_signature_format();
  288|  5.77k|   m_parts = key.message_parts();
  289|  5.77k|   m_part_size = key.message_part_size();
  290|  5.77k|   check_der_format_supported(m_sig_format, m_parts);
  291|  5.77k|}
_ZN5Botan11PK_VerifierD2Ev:
  293|  5.77k|PK_Verifier::~PK_Verifier() = default;
_ZNK5Botan11PK_Verifier13hash_functionEv:
  295|  5.77k|std::string PK_Verifier::hash_function() const { return m_op->hash_function(); }
_ZN5Botan11PK_Verifier14verify_messageEPKhmS2_m:
  302|  5.77k|bool PK_Verifier::verify_message(const uint8_t msg[], size_t msg_length, const uint8_t sig[], size_t sig_length) {
  303|  5.77k|   update(msg, msg_length);
  304|  5.77k|   return check_signature(sig, sig_length);
  305|  5.77k|}
_ZN5Botan11PK_Verifier6updateEPKhm:
  307|  5.77k|void PK_Verifier::update(const uint8_t in[], size_t length) { m_op->update(in, length); }
_ZN5Botan11PK_Verifier15check_signatureEPKhm:
  341|  5.77k|bool PK_Verifier::check_signature(const uint8_t sig[], size_t length) {
  342|  5.77k|   try {
  343|  5.77k|      if(m_sig_format == Signature_Format::Standard) {
  ------------------
  |  Branch (343:10): [True: 5.77k, False: 0]
  ------------------
  344|  5.77k|         return m_op->is_valid_signature(sig, length);
  345|  5.77k|      } else if(m_sig_format == Signature_Format::DerSequence) {
  ------------------
  |  Branch (345:17): [True: 0, False: 0]
  ------------------
  346|      0|         bool decoding_success = false;
  347|      0|         std::vector<uint8_t> real_sig;
  348|       |
  349|      0|         try {
  350|      0|            real_sig = decode_der_signature(sig, length, m_parts, m_part_size);
  351|      0|            decoding_success = true;
  352|      0|         } catch(Decoding_Error&) {}
  353|       |
  354|      0|         bool accept = m_op->is_valid_signature(real_sig.data(), real_sig.size());
  355|       |
  356|      0|         return accept && decoding_success;
  ------------------
  |  Branch (356:17): [True: 0, False: 0]
  |  Branch (356:27): [True: 0, False: 0]
  ------------------
  357|      0|      } else {
  358|      0|         throw Internal_Error("PK_Verifier: Invalid signature format enum");
  359|      0|      }
  360|  5.77k|   } catch(Invalid_Argument&) {
  361|      0|      return false;
  362|      0|   } catch(Decoding_Error&) {
  363|      0|      return false;
  364|      0|   } catch(Encoding_Error&) {
  365|      0|      return false;
  366|      0|   }
  367|  5.77k|}
pubkey.cpp:_ZN5BotanL26check_der_format_supportedENS_16Signature_FormatEm:
  192|  5.77k|static void check_der_format_supported(Signature_Format format, size_t parts) {
  193|  5.77k|   if(format != Signature_Format::Standard && parts == 1) {
  ------------------
  |  Branch (193:7): [True: 0, False: 5.77k]
  |  Branch (193:47): [True: 0, False: 0]
  ------------------
  194|      0|      throw Invalid_Argument("This algorithm does not support DER encoding");
  195|      0|   }
  196|  5.77k|}

_ZNK5Botan13RSA_PublicKey11public_dataEv:
  118|  5.77k|std::shared_ptr<const RSA_Public_Data> RSA_PublicKey::public_data() const { return m_public; }
_ZN5Botan13RSA_PublicKey4initEONS_6BigIntES2_:
  134|  11.5k|void RSA_PublicKey::init(BigInt&& n, BigInt&& e) {
  135|  11.5k|   if(n.is_negative() || n.is_even() || n.bits() < 5 /* n >= 3*5 */ || e.is_negative() || e.is_even()) {
  ------------------
  |  Branch (135:7): [True: 0, False: 11.5k]
  |  Branch (135:26): [True: 0, False: 11.5k]
  |  Branch (135:41): [True: 0, False: 11.5k]
  |  Branch (135:72): [True: 0, False: 11.5k]
  |  Branch (135:91): [True: 0, False: 11.5k]
  ------------------
  136|      0|      throw Decoding_Error("Invalid RSA public key parameters");
  137|      0|   }
  138|  11.5k|   m_public = std::make_shared<RSA_Public_Data>(std::move(n), std::move(e));
  139|  11.5k|}
_ZN5Botan13RSA_PublicKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
  141|  5.77k|RSA_PublicKey::RSA_PublicKey(const AlgorithmIdentifier& /*unused*/, std::span<const uint8_t> key_bits) {
  142|  5.77k|   BigInt n, e;
  143|  5.77k|   BER_Decoder(key_bits).start_sequence().decode(n).decode(e).end_cons();
  144|       |
  145|  5.77k|   init(std::move(n), std::move(e));
  146|  5.77k|}
_ZN5Botan14RSA_PrivateKey4initEONS_6BigIntES2_S2_S2_S2_S2_:
  215|  5.77k|void RSA_PrivateKey::init(BigInt&& d, BigInt&& p, BigInt&& q, BigInt&& d1, BigInt&& d2, BigInt&& c) {
  216|  5.77k|   m_private = std::make_shared<RSA_Private_Data>(
  217|  5.77k|      std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c));
  218|  5.77k|}
_ZN5Botan14RSA_PrivateKeyC1ERKNS_19AlgorithmIdentifierENSt3__14spanIKhLm18446744073709551615EEE:
  220|  5.77k|RSA_PrivateKey::RSA_PrivateKey(const AlgorithmIdentifier& /*unused*/, std::span<const uint8_t> key_bits) {
  221|  5.77k|   BigInt n, e, d, p, q, d1, d2, c;
  222|       |
  223|  5.77k|   BER_Decoder(key_bits)
  224|  5.77k|      .start_sequence()
  225|  5.77k|      .decode_and_check<size_t>(0, "Unknown PKCS #1 key format version")
  226|  5.77k|      .decode(n)
  227|  5.77k|      .decode(e)
  228|  5.77k|      .decode(d)
  229|  5.77k|      .decode(p)
  230|  5.77k|      .decode(q)
  231|  5.77k|      .decode(d1)
  232|  5.77k|      .decode(d2)
  233|  5.77k|      .decode(c)
  234|  5.77k|      .end_cons();
  235|       |
  236|  5.77k|   RSA_PublicKey::init(std::move(n), std::move(e));
  237|       |
  238|  5.77k|   RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c));
  239|  5.77k|}
_ZNK5Botan13RSA_PublicKey27create_x509_verification_opERKNS_19AlgorithmIdentifierENSt3__117basic_string_viewIcNS4_11char_traitsIcEEEE:
  755|  5.77k|                                                                                 std::string_view provider) const {
  756|  5.77k|   if(provider == "base" || provider.empty()) {
  ------------------
  |  Branch (756:7): [True: 0, False: 5.77k]
  |  Branch (756:29): [True: 5.77k, False: 0]
  ------------------
  757|  5.77k|      return std::make_unique<RSA_Verify_Operation>(*this, parse_rsa_signature_algorithm(alg_id));
  758|  5.77k|   }
  759|       |
  760|      0|   throw Provider_Not_Found(algo_name(), provider);
  761|  5.77k|}
_ZNK5Botan15RSA_Public_Data5get_nEv:
   46|  5.77k|      const BigInt& get_n() const { return m_n; }
_ZNK5Botan15RSA_Public_Data19public_modulus_bitsEv:
   50|  5.77k|      size_t public_modulus_bits() const { return m_public_modulus_bits; }
rsa.cpp:_ZN5Botan12_GLOBAL__N_129parse_rsa_signature_algorithmERKNS_19AlgorithmIdentifierE:
  706|  5.77k|std::string parse_rsa_signature_algorithm(const AlgorithmIdentifier& alg_id) {
  707|  5.77k|   const auto sig_info = split_on(alg_id.oid().to_formatted_string(), '/');
  708|       |
  709|  5.77k|   if(sig_info.empty() || sig_info.size() != 2 || sig_info[0] != "RSA") {
  ------------------
  |  Branch (709:7): [True: 0, False: 5.77k]
  |  Branch (709:27): [True: 0, False: 5.77k]
  |  Branch (709:51): [True: 0, False: 5.77k]
  ------------------
  710|      0|      throw Decoding_Error("Unknown AlgorithmIdentifier for RSA X.509 signatures");
  711|      0|   }
  712|       |
  713|  5.77k|   std::string padding = sig_info[1];
  714|       |
  715|  5.77k|   if(padding == "EMSA4") {
  ------------------
  |  Branch (715:7): [True: 0, False: 5.77k]
  ------------------
  716|       |      // "MUST contain RSASSA-PSS-params"
  717|      0|      if(alg_id.parameters().empty()) {
  ------------------
  |  Branch (717:10): [True: 0, False: 0]
  ------------------
  718|      0|         throw Decoding_Error("PSS params must be provided");
  719|      0|      }
  720|       |
  721|      0|      PSS_Params pss_params(alg_id.parameters());
  722|       |
  723|       |      // hash_algo must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
  724|      0|      const std::string hash_algo = pss_params.hash_function();
  725|      0|      if(hash_algo != "SHA-1" && hash_algo != "SHA-224" && hash_algo != "SHA-256" && hash_algo != "SHA-384" &&
  ------------------
  |  Branch (725:10): [True: 0, False: 0]
  |  Branch (725:34): [True: 0, False: 0]
  |  Branch (725:60): [True: 0, False: 0]
  |  Branch (725:86): [True: 0, False: 0]
  ------------------
  726|      0|         hash_algo != "SHA-512") {
  ------------------
  |  Branch (726:10): [True: 0, False: 0]
  ------------------
  727|      0|         throw Decoding_Error("Unacceptable hash for PSS signatures");
  728|      0|      }
  729|       |
  730|      0|      if(pss_params.mgf_function() != "MGF1") {
  ------------------
  |  Branch (730:10): [True: 0, False: 0]
  ------------------
  731|      0|         throw Decoding_Error("Unacceptable MGF for PSS signatures");
  732|      0|      }
  733|       |
  734|       |      // For MGF1, it is strongly RECOMMENDED that the underlying hash
  735|       |      // function be the same as the one identified by hashAlgorithm
  736|       |      //
  737|       |      // Must be SHA1, SHA2-224, SHA2-256, SHA2-384 or SHA2-512
  738|      0|      if(pss_params.hash_algid() != pss_params.mgf_hash_algid()) {
  ------------------
  |  Branch (738:10): [True: 0, False: 0]
  ------------------
  739|      0|         throw Decoding_Error("Unacceptable MGF hash for PSS signatures");
  740|      0|      }
  741|       |
  742|      0|      if(pss_params.trailer_field() != 1) {
  ------------------
  |  Branch (742:10): [True: 0, False: 0]
  ------------------
  743|      0|         throw Decoding_Error("Unacceptable trailer field for PSS signatures");
  744|      0|      }
  745|       |
  746|      0|      padding += fmt("({},MGF1,{})", hash_algo, pss_params.salt_length());
  747|      0|   }
  748|       |
  749|  5.77k|   return padding;
  750|  5.77k|}
_ZN5Botan15RSA_Public_DataC2EONS_6BigIntES2_:
   38|  11.5k|            m_public_modulus_bytes(m_n.bytes()) {}
_ZN5Botan16RSA_Private_DataC2EONS_6BigIntES2_S2_S2_S2_S2_:
   76|  5.77k|            m_q_bits(m_q.bits()) {}
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Public_OperationC2ERKNS_13RSA_PublicKeyE:
  587|  5.77k|      explicit RSA_Public_Operation(const RSA_PublicKey& rsa) : m_public(rsa.public_data()) {}
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation20public_modulus_bytesEv:
  600|  5.77k|      size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); }
_ZNK5Botan15RSA_Public_Data20public_modulus_bytesEv:
   52|  5.77k|      size_t public_modulus_bytes() const { return m_public_modulus_bytes; }
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation19public_modulus_bitsEv:
  589|  5.77k|      size_t public_modulus_bits() const { return m_public->public_modulus_bits(); }
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Public_Operation9public_opERKNS_6BigIntE:
  592|  5.77k|      BigInt public_op(const BigInt& m) const {
  593|  5.77k|         if(m >= m_public->get_n()) {
  ------------------
  |  Branch (593:13): [True: 0, False: 5.77k]
  ------------------
  594|      0|            throw Decoding_Error("RSA public op - input is too large");
  595|      0|         }
  596|       |
  597|  5.77k|         return m_public->public_op(m);
  598|  5.77k|      }
_ZNK5Botan15RSA_Public_Data9public_opERKNS_6BigIntE:
   40|  5.77k|      BigInt public_op(const BigInt& m) const {
   41|  5.77k|         const size_t powm_window = 1;
   42|  5.77k|         auto powm_m_n = monty_precompute(m_monty_n, m, powm_window, false);
   43|  5.77k|         return monty_execute_vartime(*powm_m_n, m_e);
   44|  5.77k|      }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_OperationC2ERKNS_13RSA_PublicKeyENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEE:
  638|  5.77k|            RSA_Public_Operation(rsa), m_emsa(EMSA::create_or_throw(padding)) {}
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation6updateEPKhm:
  629|  5.77k|      void update(const uint8_t msg[], size_t msg_len) override { m_emsa->update(msg, msg_len); }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation18is_valid_signatureEPKhm:
  631|  5.77k|      bool is_valid_signature(const uint8_t sig[], size_t sig_len) override {
  632|  5.77k|         const auto msg = m_emsa->raw_data();
  633|  5.77k|         const auto message_repr = recover_message_repr(sig, sig_len);
  634|  5.77k|         return m_emsa->verify(message_repr, msg, public_modulus_bits() - 1);
  635|  5.77k|      }
rsa.cpp:_ZN5Botan12_GLOBAL__N_120RSA_Verify_Operation20recover_message_reprEPKhm:
  643|  5.77k|      std::vector<uint8_t> recover_message_repr(const uint8_t input[], size_t input_len) {
  644|  5.77k|         if(input_len > public_modulus_bytes()) {
  ------------------
  |  Branch (644:13): [True: 0, False: 5.77k]
  ------------------
  645|      0|            throw Decoding_Error("RSA signature too large to be valid for this key");
  646|      0|         }
  647|  5.77k|         BigInt input_bn(input, input_len);
  648|  5.77k|         return BigInt::encode(public_op(input_bn));
  649|  5.77k|      }
rsa.cpp:_ZNK5Botan12_GLOBAL__N_120RSA_Verify_Operation13hash_functionEv:
  640|  5.77k|      std::string hash_function() const override { return m_emsa->hash_function(); }

_ZN5Botan4X5098load_keyERNS_10DataSourceE:
   26|  5.77k|std::unique_ptr<Public_Key> load_key(DataSource& source) {
   27|  5.77k|   try {
   28|  5.77k|      AlgorithmIdentifier alg_id;
   29|  5.77k|      std::vector<uint8_t> key_bits;
   30|       |
   31|  5.77k|      if(ASN1::maybe_BER(source) && !PEM_Code::matches(source)) {
  ------------------
  |  Branch (31:10): [True: 5.77k, False: 0]
  |  Branch (31:37): [True: 5.77k, False: 0]
  ------------------
   32|  5.77k|         BER_Decoder(source).start_sequence().decode(alg_id).decode(key_bits, ASN1_Type::BitString).end_cons();
   33|  5.77k|      } else {
   34|      0|         DataSource_Memory ber(PEM_Code::decode_check_label(source, "PUBLIC KEY"));
   35|       |
   36|      0|         BER_Decoder(ber).start_sequence().decode(alg_id).decode(key_bits, ASN1_Type::BitString).end_cons();
   37|      0|      }
   38|       |
   39|  5.77k|      if(key_bits.empty()) {
  ------------------
  |  Branch (39:10): [True: 0, False: 5.77k]
  ------------------
   40|      0|         throw Decoding_Error("X.509 public key decoding");
   41|      0|      }
   42|       |
   43|  5.77k|      return load_public_key(alg_id, key_bits);
   44|  5.77k|   } catch(Decoding_Error& e) {
   45|      0|      throw Decoding_Error("X.509 public key decoding", e);
   46|      0|   }
   47|  5.77k|}

_ZN5Botan10ChaCha_RNGC2ENSt3__14spanIKhLm18446744073709551615EEE:
   18|      1|ChaCha_RNG::ChaCha_RNG(std::span<const uint8_t> seed) : Stateful_RNG() {
   19|      1|   m_hmac = MessageAuthenticationCode::create_or_throw("HMAC(SHA-256)");
   20|      1|   m_chacha = StreamCipher::create_or_throw("ChaCha(20)");
   21|      1|   clear();
   22|      1|   add_entropy(seed);
   23|      1|}
_ZN5Botan10ChaCha_RNG11clear_stateEv:
   48|      1|void ChaCha_RNG::clear_state() {
   49|      1|   m_hmac->set_key(std::vector<uint8_t>(m_hmac->output_length(), 0x00));
   50|      1|   m_chacha->set_key(m_hmac->final());
   51|      1|}
_ZN5Botan10ChaCha_RNG15generate_outputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE:
   53|   296k|void ChaCha_RNG::generate_output(std::span<uint8_t> output, std::span<const uint8_t> input) {
   54|   296k|   BOTAN_ASSERT_NOMSG(!output.empty());
  ------------------
  |  |   60|   296k|   do {                                                                     \
  |  |   61|   296k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 296k]
  |  |  ------------------
  |  |   62|   296k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   296k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   55|       |
   56|   296k|   if(!input.empty()) {
  ------------------
  |  Branch (56:7): [True: 0, False: 296k]
  ------------------
   57|      0|      update(input);
   58|      0|   }
   59|       |
   60|   296k|   m_chacha->write_keystream(output);
   61|   296k|}
_ZN5Botan10ChaCha_RNG6updateENSt3__14spanIKhLm18446744073709551615EEE:
   63|      1|void ChaCha_RNG::update(std::span<const uint8_t> input) {
   64|      1|   m_hmac->update(input);
   65|      1|   m_chacha->set_key(m_hmac->final());
   66|      1|   const auto mac_key = m_chacha->keystream_bytes(m_hmac->output_length());
   67|      1|   m_hmac->set_key(mac_key);
   68|      1|}
_ZNK5Botan10ChaCha_RNG14security_levelEv:
   70|      1|size_t ChaCha_RNG::security_level() const { return 256; }

_ZN5Botan12Stateful_RNG5clearEv:
   14|      1|void Stateful_RNG::clear() {
   15|      1|   lock_guard_type<recursive_mutex_type> lock(m_mutex);
   16|      1|   m_reseed_counter = 0;
   17|      1|   m_last_pid = 0;
   18|      1|   clear_state();
   19|      1|}
_ZNK5Botan12Stateful_RNG9is_seededEv:
   26|   344k|bool Stateful_RNG::is_seeded() const {
   27|   344k|   lock_guard_type<recursive_mutex_type> lock(m_mutex);
   28|   344k|   return m_reseed_counter > 0;
   29|   344k|}
_ZN5Botan12Stateful_RNG23generate_batched_outputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE:
   38|   296k|void Stateful_RNG::generate_batched_output(std::span<uint8_t> output, std::span<const uint8_t> input) {
   39|   296k|   BOTAN_ASSERT_NOMSG(!output.empty());
  ------------------
  |  |   60|   296k|   do {                                                                     \
  |  |   61|   296k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 296k]
  |  |  ------------------
  |  |   62|   296k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|   296k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   40|       |
   41|   296k|   const size_t max_per_request = max_number_of_bytes_per_request();
   42|       |
   43|   296k|   if(max_per_request == 0)  // no limit
  ------------------
  |  Branch (43:7): [True: 296k, False: 0]
  ------------------
   44|   296k|   {
   45|   296k|      reseed_check();
   46|   296k|      this->generate_output(output, input);
   47|   296k|   } else {
   48|      0|      while(!output.empty()) {
  ------------------
  |  Branch (48:13): [True: 0, False: 0]
  ------------------
   49|      0|         const size_t this_req = std::min(max_per_request, output.size());
   50|       |
   51|      0|         reseed_check();
   52|      0|         this->generate_output(output.subspan(0, this_req), input);
   53|       |
   54|       |         // only include the input for the first iteration
   55|      0|         input = {};
   56|       |
   57|      0|         output = output.subspan(this_req);
   58|      0|      }
   59|      0|   }
   60|   296k|}
_ZN5Botan12Stateful_RNG21fill_bytes_with_inputENSt3__14spanIhLm18446744073709551615EEENS2_IKhLm18446744073709551615EEE:
   62|   296k|void Stateful_RNG::fill_bytes_with_input(std::span<uint8_t> output, std::span<const uint8_t> input) {
   63|   296k|   lock_guard_type<recursive_mutex_type> lock(m_mutex);
   64|       |
   65|   296k|   if(output.empty()) {
  ------------------
  |  Branch (65:7): [True: 1, False: 296k]
  ------------------
   66|       |      // Special case for exclusively adding entropy to the stateful RNG.
   67|      1|      this->update(input);
   68|       |
   69|      1|      if(8 * input.size() >= security_level()) {
  ------------------
  |  Branch (69:10): [True: 1, False: 0]
  ------------------
   70|      1|         reset_reseed_counter();
   71|      1|      }
   72|   296k|   } else {
   73|   296k|      generate_batched_output(output, input);
   74|   296k|   }
   75|   296k|}
_ZN5Botan12Stateful_RNG20reset_reseed_counterEv:
   99|      1|void Stateful_RNG::reset_reseed_counter() {
  100|       |   // Lock is held whenever this function is called
  101|      1|   m_reseed_counter = 1;
  102|      1|}
_ZN5Botan12Stateful_RNG12reseed_checkEv:
  104|   296k|void Stateful_RNG::reseed_check() {
  105|       |   // Lock is held whenever this function is called
  106|       |
  107|   296k|   const uint32_t cur_pid = OS::get_process_id();
  108|       |
  109|   296k|   const bool fork_detected = (m_last_pid > 0) && (cur_pid != m_last_pid);
  ------------------
  |  Branch (109:31): [True: 0, False: 296k]
  |  Branch (109:51): [True: 0, False: 0]
  ------------------
  110|       |
  111|   296k|   if(is_seeded() == false || fork_detected || (m_reseed_interval > 0 && m_reseed_counter >= m_reseed_interval)) {
  ------------------
  |  Branch (111:7): [True: 0, False: 296k]
  |  Branch (111:31): [True: 0, False: 296k]
  |  Branch (111:49): [True: 0, False: 296k]
  |  Branch (111:74): [True: 0, False: 0]
  ------------------
  112|      0|      m_reseed_counter = 0;
  113|      0|      m_last_pid = cur_pid;
  114|       |
  115|      0|      if(m_underlying_rng) {
  ------------------
  |  Branch (115:10): [True: 0, False: 0]
  ------------------
  116|      0|         reseed_from_rng(*m_underlying_rng, security_level());
  117|      0|      }
  118|       |
  119|      0|      if(m_entropy_sources) {
  ------------------
  |  Branch (119:10): [True: 0, False: 0]
  ------------------
  120|      0|         reseed(*m_entropy_sources, security_level());
  121|      0|      }
  122|       |
  123|      0|      if(!is_seeded()) {
  ------------------
  |  Branch (123:10): [True: 0, False: 0]
  ------------------
  124|      0|         if(fork_detected) {
  ------------------
  |  Branch (124:13): [True: 0, False: 0]
  ------------------
  125|      0|            throw Invalid_State("Detected use of fork but cannot reseed DRBG");
  126|      0|         } else {
  127|      0|            throw PRNG_Unseeded(name());
  128|      0|         }
  129|      0|      }
  130|   296k|   } else {
  131|   296k|      BOTAN_ASSERT(m_reseed_counter != 0, "RNG is seeded");
  ------------------
  |  |   51|   296k|   do {                                                                                 \
  |  |   52|   296k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 296k]
  |  |  ------------------
  |  |   53|   296k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   296k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  132|   296k|      m_reseed_counter += 1;
  133|   296k|   }
  134|   296k|}

_ZN5Botan6ChaChaC2Em:
   69|    101|ChaCha::ChaCha(size_t rounds) : m_rounds(rounds) {
   70|    101|   BOTAN_ARG_CHECK(m_rounds == 8 || m_rounds == 12 || m_rounds == 20, "ChaCha only supports 8, 12 or 20 rounds");
  ------------------
  |  |   30|    101|   do {                                                          \
  |  |   31|    404|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 0, False: 101]
  |  |  |  Branch (31:12): [True: 0, False: 101]
  |  |  |  Branch (31:12): [True: 101, False: 0]
  |  |  ------------------
  |  |   32|    101|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    101|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   71|    101|}
_ZN5Botan6ChaCha11parallelismEv:
   73|    102|size_t ChaCha::parallelism() {
   74|    102|#if defined(BOTAN_HAS_CHACHA_AVX512)
   75|    102|   if(CPUID::has_avx512()) {
  ------------------
  |  Branch (75:7): [True: 0, False: 102]
  ------------------
   76|      0|      return 16;
   77|      0|   }
   78|    102|#endif
   79|       |
   80|    102|#if defined(BOTAN_HAS_CHACHA_AVX2)
   81|    102|   if(CPUID::has_avx2()) {
  ------------------
  |  Branch (81:7): [True: 102, False: 0]
  ------------------
   82|    102|      return 8;
   83|    102|   }
   84|      0|#endif
   85|       |
   86|      0|   return 4;
   87|    102|}
_ZN5Botan6ChaCha6chachaEPhmPjm:
  111|  29.4k|void ChaCha::chacha(uint8_t output[], size_t output_blocks, uint32_t state[16], size_t rounds) {
  112|  29.4k|   BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");
  ------------------
  |  |   51|  29.4k|   do {                                                                                 \
  |  |   52|  29.4k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 29.4k]
  |  |  ------------------
  |  |   53|  29.4k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  29.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  113|       |
  114|  29.4k|#if defined(BOTAN_HAS_CHACHA_AVX512)
  115|  29.4k|   if(CPUID::has_avx512()) {
  ------------------
  |  Branch (115:7): [True: 0, False: 29.4k]
  ------------------
  116|      0|      while(output_blocks >= 16) {
  ------------------
  |  Branch (116:13): [True: 0, False: 0]
  ------------------
  117|      0|         ChaCha::chacha_avx512_x16(output, state, rounds);
  118|      0|         output += 16 * 64;
  119|      0|         output_blocks -= 16;
  120|      0|      }
  121|      0|   }
  122|  29.4k|#endif
  123|       |
  124|  29.4k|#if defined(BOTAN_HAS_CHACHA_AVX2)
  125|  29.4k|   if(CPUID::has_avx2()) {
  ------------------
  |  Branch (125:7): [True: 29.4k, False: 0]
  ------------------
  126|  58.9k|      while(output_blocks >= 8) {
  ------------------
  |  Branch (126:13): [True: 29.4k, False: 29.4k]
  ------------------
  127|  29.4k|         ChaCha::chacha_avx2_x8(output, state, rounds);
  128|  29.4k|         output += 8 * 64;
  129|  29.4k|         output_blocks -= 8;
  130|  29.4k|      }
  131|  29.4k|   }
  132|  29.4k|#endif
  133|       |
  134|  29.4k|#if defined(BOTAN_HAS_CHACHA_SIMD32)
  135|  29.4k|   if(CPUID::has_simd_32()) {
  ------------------
  |  Branch (135:7): [True: 29.4k, False: 0]
  ------------------
  136|  29.4k|      while(output_blocks >= 4) {
  ------------------
  |  Branch (136:13): [True: 0, False: 29.4k]
  ------------------
  137|      0|         ChaCha::chacha_simd32_x4(output, state, rounds);
  138|      0|         output += 4 * 64;
  139|      0|         output_blocks -= 4;
  140|      0|      }
  141|  29.4k|   }
  142|  29.4k|#endif
  143|       |
  144|       |   // TODO interleave rounds
  145|  29.4k|   for(size_t i = 0; i != output_blocks; ++i) {
  ------------------
  |  Branch (145:22): [True: 0, False: 29.4k]
  ------------------
  146|      0|      uint32_t x00 = state[0], x01 = state[1], x02 = state[2], x03 = state[3], x04 = state[4], x05 = state[5],
  147|      0|               x06 = state[6], x07 = state[7], x08 = state[8], x09 = state[9], x10 = state[10], x11 = state[11],
  148|      0|               x12 = state[12], x13 = state[13], x14 = state[14], x15 = state[15];
  149|       |
  150|      0|      for(size_t r = 0; r != rounds / 2; ++r) {
  ------------------
  |  Branch (150:25): [True: 0, False: 0]
  ------------------
  151|      0|         chacha_quarter_round(x00, x04, x08, x12);
  152|      0|         chacha_quarter_round(x01, x05, x09, x13);
  153|      0|         chacha_quarter_round(x02, x06, x10, x14);
  154|      0|         chacha_quarter_round(x03, x07, x11, x15);
  155|       |
  156|      0|         chacha_quarter_round(x00, x05, x10, x15);
  157|      0|         chacha_quarter_round(x01, x06, x11, x12);
  158|      0|         chacha_quarter_round(x02, x07, x08, x13);
  159|      0|         chacha_quarter_round(x03, x04, x09, x14);
  160|      0|      }
  161|       |
  162|      0|      x00 += state[0];
  163|      0|      x01 += state[1];
  164|      0|      x02 += state[2];
  165|      0|      x03 += state[3];
  166|      0|      x04 += state[4];
  167|      0|      x05 += state[5];
  168|      0|      x06 += state[6];
  169|      0|      x07 += state[7];
  170|      0|      x08 += state[8];
  171|      0|      x09 += state[9];
  172|      0|      x10 += state[10];
  173|      0|      x11 += state[11];
  174|      0|      x12 += state[12];
  175|      0|      x13 += state[13];
  176|      0|      x14 += state[14];
  177|      0|      x15 += state[15];
  178|       |
  179|      0|      store_le(x00, output + 64 * i + 4 * 0);
  180|      0|      store_le(x01, output + 64 * i + 4 * 1);
  181|      0|      store_le(x02, output + 64 * i + 4 * 2);
  182|      0|      store_le(x03, output + 64 * i + 4 * 3);
  183|      0|      store_le(x04, output + 64 * i + 4 * 4);
  184|      0|      store_le(x05, output + 64 * i + 4 * 5);
  185|      0|      store_le(x06, output + 64 * i + 4 * 6);
  186|      0|      store_le(x07, output + 64 * i + 4 * 7);
  187|      0|      store_le(x08, output + 64 * i + 4 * 8);
  188|      0|      store_le(x09, output + 64 * i + 4 * 9);
  189|      0|      store_le(x10, output + 64 * i + 4 * 10);
  190|      0|      store_le(x11, output + 64 * i + 4 * 11);
  191|      0|      store_le(x12, output + 64 * i + 4 * 12);
  192|      0|      store_le(x13, output + 64 * i + 4 * 13);
  193|      0|      store_le(x14, output + 64 * i + 4 * 14);
  194|      0|      store_le(x15, output + 64 * i + 4 * 15);
  195|       |
  196|      0|      state[12]++;
  197|      0|      state[13] += (state[12] == 0);
  198|      0|   }
  199|  29.4k|}
_ZN5Botan6ChaCha12cipher_bytesEPKhPhm:
  204|    101|void ChaCha::cipher_bytes(const uint8_t in[], uint8_t out[], size_t length) {
  205|    101|   assert_key_material_set();
  206|       |
  207|    150|   while(length >= m_buffer.size() - m_position) {
  ------------------
  |  Branch (207:10): [True: 49, False: 101]
  ------------------
  208|     49|      const size_t available = m_buffer.size() - m_position;
  209|       |
  210|     49|      xor_buf(out, in, &m_buffer[m_position], available);
  211|     49|      chacha(m_buffer.data(), m_buffer.size() / 64, m_state.data(), m_rounds);
  212|       |
  213|     49|      length -= available;
  214|     49|      in += available;
  215|     49|      out += available;
  216|     49|      m_position = 0;
  217|     49|   }
  218|       |
  219|    101|   xor_buf(out, in, &m_buffer[m_position], length);
  220|       |
  221|    101|   m_position += length;
  222|    101|}
_ZN5Botan6ChaCha18generate_keystreamEPhm:
  224|   296k|void ChaCha::generate_keystream(uint8_t out[], size_t length) {
  225|   296k|   assert_key_material_set();
  226|       |
  227|   326k|   while(length >= m_buffer.size() - m_position) {
  ------------------
  |  Branch (227:10): [True: 29.2k, False: 296k]
  ------------------
  228|  29.2k|      const size_t available = m_buffer.size() - m_position;
  229|       |
  230|       |      // TODO: this could write directly to the output buffer
  231|       |      // instead of bouncing it through m_buffer first
  232|  29.2k|      copy_mem(out, &m_buffer[m_position], available);
  233|  29.2k|      chacha(m_buffer.data(), m_buffer.size() / 64, m_state.data(), m_rounds);
  234|       |
  235|  29.2k|      length -= available;
  236|  29.2k|      out += available;
  237|  29.2k|      m_position = 0;
  238|  29.2k|   }
  239|       |
  240|   296k|   copy_mem(out, &m_buffer[m_position], length);
  241|       |
  242|   296k|   m_position += length;
  243|   296k|}
_ZN5Botan6ChaCha16initialize_stateEv:
  245|    208|void ChaCha::initialize_state() {
  246|    208|   static const uint32_t TAU[] = {0x61707865, 0x3120646e, 0x79622d36, 0x6b206574};
  247|       |
  248|    208|   static const uint32_t SIGMA[] = {0x61707865, 0x3320646e, 0x79622d32, 0x6b206574};
  249|       |
  250|    208|   m_state[4] = m_key[0];
  251|    208|   m_state[5] = m_key[1];
  252|    208|   m_state[6] = m_key[2];
  253|    208|   m_state[7] = m_key[3];
  254|       |
  255|    208|   if(m_key.size() == 4) {
  ------------------
  |  Branch (255:7): [True: 0, False: 208]
  ------------------
  256|      0|      m_state[0] = TAU[0];
  257|      0|      m_state[1] = TAU[1];
  258|      0|      m_state[2] = TAU[2];
  259|      0|      m_state[3] = TAU[3];
  260|       |
  261|      0|      m_state[8] = m_key[0];
  262|      0|      m_state[9] = m_key[1];
  263|      0|      m_state[10] = m_key[2];
  264|      0|      m_state[11] = m_key[3];
  265|    208|   } else {
  266|    208|      m_state[0] = SIGMA[0];
  267|    208|      m_state[1] = SIGMA[1];
  268|    208|      m_state[2] = SIGMA[2];
  269|    208|      m_state[3] = SIGMA[3];
  270|       |
  271|    208|      m_state[8] = m_key[4];
  272|    208|      m_state[9] = m_key[5];
  273|    208|      m_state[10] = m_key[6];
  274|    208|      m_state[11] = m_key[7];
  275|    208|   }
  276|       |
  277|    208|   m_state[12] = 0;
  278|    208|   m_state[13] = 0;
  279|    208|   m_state[14] = 0;
  280|    208|   m_state[15] = 0;
  281|       |
  282|    208|   m_position = 0;
  283|    208|}
_ZNK5Botan6ChaCha19has_keying_materialEv:
  285|   297k|bool ChaCha::has_keying_material() const { return !m_state.empty(); }
_ZN5Botan6ChaCha12key_scheduleEPKhm:
  292|    102|void ChaCha::key_schedule(const uint8_t key[], size_t length) {
  293|    102|   m_key.resize(length / 4);
  294|    102|   load_le<uint32_t>(m_key.data(), key, m_key.size());
  295|       |
  296|    102|   m_state.resize(16);
  297|       |
  298|    102|   const size_t chacha_block = 64;
  299|    102|   m_buffer.resize(parallelism() * chacha_block);
  300|       |
  301|    102|   set_iv(nullptr, 0);
  302|    102|}
_ZNK5Botan6ChaCha8key_specEv:
  306|    102|Key_Length_Specification ChaCha::key_spec() const { return Key_Length_Specification(16, 32, 16); }
_ZNK5Botan6ChaCha15valid_iv_lengthEm:
  310|    208|bool ChaCha::valid_iv_length(size_t iv_len) const {
  311|    208|   return (iv_len == 0 || iv_len == 8 || iv_len == 12 || iv_len == 24);
  ------------------
  |  Branch (311:12): [True: 102, False: 106]
  |  Branch (311:27): [True: 0, False: 106]
  |  Branch (311:42): [True: 106, False: 0]
  |  Branch (311:58): [True: 0, False: 0]
  ------------------
  312|    208|}
_ZN5Botan6ChaCha12set_iv_bytesEPKhm:
  314|    208|void ChaCha::set_iv_bytes(const uint8_t iv[], size_t length) {
  315|    208|   assert_key_material_set();
  316|       |
  317|    208|   if(!valid_iv_length(length)) {
  ------------------
  |  Branch (317:7): [True: 0, False: 208]
  ------------------
  318|      0|      throw Invalid_IV_Length(name(), length);
  319|      0|   }
  320|       |
  321|    208|   initialize_state();
  322|       |
  323|    208|   if(length == 0) {
  ------------------
  |  Branch (323:7): [True: 102, False: 106]
  ------------------
  324|       |      // Treat zero length IV same as an all-zero IV
  325|    102|      m_state[14] = 0;
  326|    102|      m_state[15] = 0;
  327|    106|   } else if(length == 8) {
  ------------------
  |  Branch (327:14): [True: 0, False: 106]
  ------------------
  328|      0|      m_state[14] = load_le<uint32_t>(iv, 0);
  329|      0|      m_state[15] = load_le<uint32_t>(iv, 1);
  330|    106|   } else if(length == 12) {
  ------------------
  |  Branch (330:14): [True: 106, False: 0]
  ------------------
  331|    106|      m_state[13] = load_le<uint32_t>(iv, 0);
  332|    106|      m_state[14] = load_le<uint32_t>(iv, 1);
  333|    106|      m_state[15] = load_le<uint32_t>(iv, 2);
  334|    106|   } else if(length == 24) {
  ------------------
  |  Branch (334:14): [True: 0, False: 0]
  ------------------
  335|      0|      m_state[12] = load_le<uint32_t>(iv, 0);
  336|      0|      m_state[13] = load_le<uint32_t>(iv, 1);
  337|      0|      m_state[14] = load_le<uint32_t>(iv, 2);
  338|      0|      m_state[15] = load_le<uint32_t>(iv, 3);
  339|       |
  340|      0|      secure_vector<uint32_t> hc(8);
  341|      0|      hchacha(hc.data(), m_state.data(), m_rounds);
  342|       |
  343|      0|      m_state[4] = hc[0];
  344|      0|      m_state[5] = hc[1];
  345|      0|      m_state[6] = hc[2];
  346|      0|      m_state[7] = hc[3];
  347|      0|      m_state[8] = hc[4];
  348|      0|      m_state[9] = hc[5];
  349|      0|      m_state[10] = hc[6];
  350|      0|      m_state[11] = hc[7];
  351|      0|      m_state[12] = 0;
  352|      0|      m_state[13] = 0;
  353|      0|      m_state[14] = load_le<uint32_t>(iv, 4);
  354|      0|      m_state[15] = load_le<uint32_t>(iv, 5);
  355|      0|   }
  356|       |
  357|    208|   chacha(m_buffer.data(), m_buffer.size() / 64, m_state.data(), m_rounds);
  358|    208|   m_position = 0;
  359|    208|}

_ZN5Botan6ChaCha14chacha_avx2_x8EPhPjm:
   15|  29.4k|void ChaCha::chacha_avx2_x8(uint8_t output[64 * 8], uint32_t state[16], size_t rounds) {
   16|  29.4k|   SIMD_8x32::reset_registers();
   17|       |
   18|  29.4k|   BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");
  ------------------
  |  |   51|  29.4k|   do {                                                                                 \
  |  |   52|  29.4k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 29.4k]
  |  |  ------------------
  |  |   53|  29.4k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  29.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   19|  29.4k|   const SIMD_8x32 CTR0 = SIMD_8x32(0, 1, 2, 3, 4, 5, 6, 7);
   20|       |
   21|  29.4k|   const uint32_t C = 0xFFFFFFFF - state[12];
   22|  29.4k|   const SIMD_8x32 CTR1 = SIMD_8x32(0, C < 1, C < 2, C < 3, C < 4, C < 5, C < 6, C < 7);
   23|       |
   24|  29.4k|   SIMD_8x32 R00 = SIMD_8x32::splat(state[0]);
   25|  29.4k|   SIMD_8x32 R01 = SIMD_8x32::splat(state[1]);
   26|  29.4k|   SIMD_8x32 R02 = SIMD_8x32::splat(state[2]);
   27|  29.4k|   SIMD_8x32 R03 = SIMD_8x32::splat(state[3]);
   28|  29.4k|   SIMD_8x32 R04 = SIMD_8x32::splat(state[4]);
   29|  29.4k|   SIMD_8x32 R05 = SIMD_8x32::splat(state[5]);
   30|  29.4k|   SIMD_8x32 R06 = SIMD_8x32::splat(state[6]);
   31|  29.4k|   SIMD_8x32 R07 = SIMD_8x32::splat(state[7]);
   32|  29.4k|   SIMD_8x32 R08 = SIMD_8x32::splat(state[8]);
   33|  29.4k|   SIMD_8x32 R09 = SIMD_8x32::splat(state[9]);
   34|  29.4k|   SIMD_8x32 R10 = SIMD_8x32::splat(state[10]);
   35|  29.4k|   SIMD_8x32 R11 = SIMD_8x32::splat(state[11]);
   36|  29.4k|   SIMD_8x32 R12 = SIMD_8x32::splat(state[12]) + CTR0;
   37|  29.4k|   SIMD_8x32 R13 = SIMD_8x32::splat(state[13]) + CTR1;
   38|  29.4k|   SIMD_8x32 R14 = SIMD_8x32::splat(state[14]);
   39|  29.4k|   SIMD_8x32 R15 = SIMD_8x32::splat(state[15]);
   40|       |
   41|   324k|   for(size_t r = 0; r != rounds / 2; ++r) {
  ------------------
  |  Branch (41:22): [True: 294k, False: 29.4k]
  ------------------
   42|   294k|      R00 += R04;
   43|   294k|      R01 += R05;
   44|   294k|      R02 += R06;
   45|   294k|      R03 += R07;
   46|       |
   47|   294k|      R12 ^= R00;
   48|   294k|      R13 ^= R01;
   49|   294k|      R14 ^= R02;
   50|   294k|      R15 ^= R03;
   51|       |
   52|   294k|      R12 = R12.rotl<16>();
   53|   294k|      R13 = R13.rotl<16>();
   54|   294k|      R14 = R14.rotl<16>();
   55|   294k|      R15 = R15.rotl<16>();
   56|       |
   57|   294k|      R08 += R12;
   58|   294k|      R09 += R13;
   59|   294k|      R10 += R14;
   60|   294k|      R11 += R15;
   61|       |
   62|   294k|      R04 ^= R08;
   63|   294k|      R05 ^= R09;
   64|   294k|      R06 ^= R10;
   65|   294k|      R07 ^= R11;
   66|       |
   67|   294k|      R04 = R04.rotl<12>();
   68|   294k|      R05 = R05.rotl<12>();
   69|   294k|      R06 = R06.rotl<12>();
   70|   294k|      R07 = R07.rotl<12>();
   71|       |
   72|   294k|      R00 += R04;
   73|   294k|      R01 += R05;
   74|   294k|      R02 += R06;
   75|   294k|      R03 += R07;
   76|       |
   77|   294k|      R12 ^= R00;
   78|   294k|      R13 ^= R01;
   79|   294k|      R14 ^= R02;
   80|   294k|      R15 ^= R03;
   81|       |
   82|   294k|      R12 = R12.rotl<8>();
   83|   294k|      R13 = R13.rotl<8>();
   84|   294k|      R14 = R14.rotl<8>();
   85|   294k|      R15 = R15.rotl<8>();
   86|       |
   87|   294k|      R08 += R12;
   88|   294k|      R09 += R13;
   89|   294k|      R10 += R14;
   90|   294k|      R11 += R15;
   91|       |
   92|   294k|      R04 ^= R08;
   93|   294k|      R05 ^= R09;
   94|   294k|      R06 ^= R10;
   95|   294k|      R07 ^= R11;
   96|       |
   97|   294k|      R04 = R04.rotl<7>();
   98|   294k|      R05 = R05.rotl<7>();
   99|   294k|      R06 = R06.rotl<7>();
  100|   294k|      R07 = R07.rotl<7>();
  101|       |
  102|   294k|      R00 += R05;
  103|   294k|      R01 += R06;
  104|   294k|      R02 += R07;
  105|   294k|      R03 += R04;
  106|       |
  107|   294k|      R15 ^= R00;
  108|   294k|      R12 ^= R01;
  109|   294k|      R13 ^= R02;
  110|   294k|      R14 ^= R03;
  111|       |
  112|   294k|      R15 = R15.rotl<16>();
  113|   294k|      R12 = R12.rotl<16>();
  114|   294k|      R13 = R13.rotl<16>();
  115|   294k|      R14 = R14.rotl<16>();
  116|       |
  117|   294k|      R10 += R15;
  118|   294k|      R11 += R12;
  119|   294k|      R08 += R13;
  120|   294k|      R09 += R14;
  121|       |
  122|   294k|      R05 ^= R10;
  123|   294k|      R06 ^= R11;
  124|   294k|      R07 ^= R08;
  125|   294k|      R04 ^= R09;
  126|       |
  127|   294k|      R05 = R05.rotl<12>();
  128|   294k|      R06 = R06.rotl<12>();
  129|   294k|      R07 = R07.rotl<12>();
  130|   294k|      R04 = R04.rotl<12>();
  131|       |
  132|   294k|      R00 += R05;
  133|   294k|      R01 += R06;
  134|   294k|      R02 += R07;
  135|   294k|      R03 += R04;
  136|       |
  137|   294k|      R15 ^= R00;
  138|   294k|      R12 ^= R01;
  139|   294k|      R13 ^= R02;
  140|   294k|      R14 ^= R03;
  141|       |
  142|   294k|      R15 = R15.rotl<8>();
  143|   294k|      R12 = R12.rotl<8>();
  144|   294k|      R13 = R13.rotl<8>();
  145|   294k|      R14 = R14.rotl<8>();
  146|       |
  147|   294k|      R10 += R15;
  148|   294k|      R11 += R12;
  149|   294k|      R08 += R13;
  150|   294k|      R09 += R14;
  151|       |
  152|   294k|      R05 ^= R10;
  153|   294k|      R06 ^= R11;
  154|   294k|      R07 ^= R08;
  155|   294k|      R04 ^= R09;
  156|       |
  157|   294k|      R05 = R05.rotl<7>();
  158|   294k|      R06 = R06.rotl<7>();
  159|   294k|      R07 = R07.rotl<7>();
  160|   294k|      R04 = R04.rotl<7>();
  161|   294k|   }
  162|       |
  163|  29.4k|   R00 += SIMD_8x32::splat(state[0]);
  164|  29.4k|   R01 += SIMD_8x32::splat(state[1]);
  165|  29.4k|   R02 += SIMD_8x32::splat(state[2]);
  166|  29.4k|   R03 += SIMD_8x32::splat(state[3]);
  167|  29.4k|   R04 += SIMD_8x32::splat(state[4]);
  168|  29.4k|   R05 += SIMD_8x32::splat(state[5]);
  169|  29.4k|   R06 += SIMD_8x32::splat(state[6]);
  170|  29.4k|   R07 += SIMD_8x32::splat(state[7]);
  171|  29.4k|   R08 += SIMD_8x32::splat(state[8]);
  172|  29.4k|   R09 += SIMD_8x32::splat(state[9]);
  173|  29.4k|   R10 += SIMD_8x32::splat(state[10]);
  174|  29.4k|   R11 += SIMD_8x32::splat(state[11]);
  175|  29.4k|   R12 += SIMD_8x32::splat(state[12]) + CTR0;
  176|  29.4k|   R13 += SIMD_8x32::splat(state[13]) + CTR1;
  177|  29.4k|   R14 += SIMD_8x32::splat(state[14]);
  178|  29.4k|   R15 += SIMD_8x32::splat(state[15]);
  179|       |
  180|  29.4k|   SIMD_8x32::transpose(R00, R01, R02, R03, R04, R05, R06, R07);
  181|  29.4k|   SIMD_8x32::transpose(R08, R09, R10, R11, R12, R13, R14, R15);
  182|       |
  183|  29.4k|   R00.store_le(output);
  184|  29.4k|   R08.store_le(output + 32 * 1);
  185|  29.4k|   R01.store_le(output + 32 * 2);
  186|  29.4k|   R09.store_le(output + 32 * 3);
  187|  29.4k|   R02.store_le(output + 32 * 4);
  188|  29.4k|   R10.store_le(output + 32 * 5);
  189|  29.4k|   R03.store_le(output + 32 * 6);
  190|  29.4k|   R11.store_le(output + 32 * 7);
  191|  29.4k|   R04.store_le(output + 32 * 8);
  192|  29.4k|   R12.store_le(output + 32 * 9);
  193|  29.4k|   R05.store_le(output + 32 * 10);
  194|  29.4k|   R13.store_le(output + 32 * 11);
  195|  29.4k|   R06.store_le(output + 32 * 12);
  196|  29.4k|   R14.store_le(output + 32 * 13);
  197|  29.4k|   R07.store_le(output + 32 * 14);
  198|  29.4k|   R15.store_le(output + 32 * 15);
  199|       |
  200|  29.4k|   SIMD_8x32::zero_registers();
  201|       |
  202|  29.4k|   state[12] += 8;
  203|  29.4k|   if(state[12] < 8) {
  ------------------
  |  Branch (203:7): [True: 0, False: 29.4k]
  ------------------
  204|      0|      state[13]++;
  205|      0|   }
  206|  29.4k|}

_ZN5Botan6CTR_BEC2ENSt3__110unique_ptrINS_11BlockCipherENS1_14default_deleteIS3_EEEEm:
   33|    182|      m_pad_pos(0) {
   34|    182|   BOTAN_ARG_CHECK(m_ctr_size >= 4 && m_ctr_size <= m_block_size, "Invalid CTR-BE counter size");
  ------------------
  |  |   30|    182|   do {                                                          \
  |  |   31|    364|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 182, False: 0]
  |  |  |  Branch (31:12): [True: 182, False: 0]
  |  |  ------------------
  |  |   32|    182|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    182|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   35|    182|}
_ZNK5Botan6CTR_BE15valid_iv_lengthEm:
   47|    551|bool CTR_BE::valid_iv_length(size_t iv_len) const { return (iv_len <= m_block_size); }
_ZNK5Botan6CTR_BE8key_specEv:
   51|    364|Key_Length_Specification CTR_BE::key_spec() const { return m_cipher->key_spec(); }
_ZNK5Botan6CTR_BE19has_keying_materialEv:
   57|  1.10k|bool CTR_BE::has_keying_material() const { return m_cipher->has_keying_material(); }
_ZN5Botan6CTR_BE12key_scheduleEPKhm:
   59|    182|void CTR_BE::key_schedule(const uint8_t key[], size_t key_len) {
   60|    182|   m_cipher->set_key(key, key_len);
   61|       |
   62|       |   // Set a default all-zeros IV
   63|    182|   set_iv(nullptr, 0);
   64|    182|}
_ZN5Botan6CTR_BE12cipher_bytesEPKhPhm:
   74|    551|void CTR_BE::cipher_bytes(const uint8_t in[], uint8_t out[], size_t length) {
   75|    551|   assert_key_material_set();
   76|       |
   77|    551|   const uint8_t* pad_bits = &m_pad[0];
   78|    551|   const size_t pad_size = m_pad.size();
   79|       |
   80|    551|   if(m_pad_pos > 0) {
  ------------------
  |  Branch (80:7): [True: 182, False: 369]
  ------------------
   81|    182|      const size_t avail = pad_size - m_pad_pos;
   82|    182|      const size_t take = std::min(length, avail);
   83|    182|      xor_buf(out, in, pad_bits + m_pad_pos, take);
   84|    182|      length -= take;
   85|    182|      in += take;
   86|    182|      out += take;
   87|    182|      m_pad_pos += take;
   88|       |
   89|    182|      if(take == avail) {
  ------------------
  |  Branch (89:10): [True: 72, False: 110]
  ------------------
   90|     72|         add_counter(m_ctr_blocks);
   91|     72|         m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
   92|     72|         m_pad_pos = 0;
   93|     72|      }
   94|    182|   }
   95|       |
   96|  1.57k|   while(length >= pad_size) {
  ------------------
  |  Branch (96:10): [True: 1.02k, False: 551]
  ------------------
   97|  1.02k|      xor_buf(out, in, pad_bits, pad_size);
   98|  1.02k|      length -= pad_size;
   99|  1.02k|      in += pad_size;
  100|  1.02k|      out += pad_size;
  101|       |
  102|  1.02k|      add_counter(m_ctr_blocks);
  103|  1.02k|      m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
  104|  1.02k|   }
  105|       |
  106|    551|   xor_buf(out, in, pad_bits, length);
  107|    551|   m_pad_pos += length;
  108|    551|}
_ZN5Botan6CTR_BE12set_iv_bytesEPKhm:
  139|    551|void CTR_BE::set_iv_bytes(const uint8_t iv[], size_t iv_len) {
  140|    551|   if(!valid_iv_length(iv_len)) {
  ------------------
  |  Branch (140:7): [True: 0, False: 551]
  ------------------
  141|      0|      throw Invalid_IV_Length(name(), iv_len);
  142|      0|   }
  143|       |
  144|    551|   m_iv.resize(m_block_size);
  145|    551|   zeroise(m_iv);
  146|    551|   buffer_insert(m_iv, 0, iv, iv_len);
  147|       |
  148|    551|   seek(0);
  149|    551|}
_ZN5Botan6CTR_BE11add_counterEm:
  151|  1.09k|void CTR_BE::add_counter(const uint64_t counter) {
  152|  1.09k|   const size_t ctr_size = m_ctr_size;
  153|  1.09k|   const size_t ctr_blocks = m_ctr_blocks;
  154|  1.09k|   const size_t BS = m_block_size;
  155|       |
  156|  1.09k|   if(ctr_size == 4) {
  ------------------
  |  Branch (156:7): [True: 1.09k, False: 0]
  ------------------
  157|  1.09k|      const size_t off = (BS - 4);
  158|  1.09k|      const uint32_t low32 = static_cast<uint32_t>(counter + load_be<uint32_t>(&m_counter[off], 0));
  159|       |
  160|  7.33k|      for(size_t i = 0; i != ctr_blocks; ++i) {
  ------------------
  |  Branch (160:25): [True: 6.23k, False: 1.09k]
  ------------------
  161|  6.23k|         store_be(uint32_t(low32 + i), &m_counter[i * BS + off]);
  162|  6.23k|      }
  163|  1.09k|   } else if(ctr_size == 8) {
  ------------------
  |  Branch (163:14): [True: 0, False: 0]
  ------------------
  164|      0|      const size_t off = (BS - 8);
  165|      0|      const uint64_t low64 = counter + load_be<uint64_t>(&m_counter[off], 0);
  166|       |
  167|      0|      for(size_t i = 0; i != ctr_blocks; ++i) {
  ------------------
  |  Branch (167:25): [True: 0, False: 0]
  ------------------
  168|      0|         store_be(uint64_t(low64 + i), &m_counter[i * BS + off]);
  169|      0|      }
  170|      0|   } else if(ctr_size == 16) {
  ------------------
  |  Branch (170:14): [True: 0, False: 0]
  ------------------
  171|      0|      const size_t off = (BS - 16);
  172|      0|      uint64_t b0 = load_be<uint64_t>(&m_counter[off], 0);
  173|      0|      uint64_t b1 = load_be<uint64_t>(&m_counter[off], 1);
  174|      0|      b1 += counter;
  175|      0|      b0 += (b1 < counter) ? 1 : 0;  // carry
  ------------------
  |  Branch (175:13): [True: 0, False: 0]
  ------------------
  176|       |
  177|      0|      for(size_t i = 0; i != ctr_blocks; ++i) {
  ------------------
  |  Branch (177:25): [True: 0, False: 0]
  ------------------
  178|      0|         store_be(b0, &m_counter[i * BS + off]);
  179|      0|         store_be(b1, &m_counter[i * BS + off + 8]);
  180|      0|         b1 += 1;
  181|      0|         b0 += (b1 == 0);  // carry
  182|      0|      }
  183|      0|   } else {
  184|      0|      for(size_t i = 0; i != ctr_blocks; ++i) {
  ------------------
  |  Branch (184:25): [True: 0, False: 0]
  ------------------
  185|      0|         uint64_t local_counter = counter;
  186|      0|         uint16_t carry = static_cast<uint8_t>(local_counter);
  187|      0|         for(size_t j = 0; (carry || local_counter) && j != ctr_size; ++j) {
  ------------------
  |  Branch (187:29): [True: 0, False: 0]
  |  Branch (187:38): [True: 0, False: 0]
  |  Branch (187:56): [True: 0, False: 0]
  ------------------
  188|      0|            const size_t off = i * BS + (BS - 1 - j);
  189|      0|            const uint16_t cnt = static_cast<uint16_t>(m_counter[off]) + carry;
  190|      0|            m_counter[off] = static_cast<uint8_t>(cnt);
  191|      0|            local_counter = (local_counter >> 8);
  192|      0|            carry = (cnt >> 8) + static_cast<uint8_t>(local_counter);
  193|      0|         }
  194|      0|      }
  195|      0|   }
  196|  1.09k|}
_ZN5Botan6CTR_BE4seekEm:
  198|    551|void CTR_BE::seek(uint64_t offset) {
  199|    551|   assert_key_material_set();
  200|       |
  201|    551|   const uint64_t base_counter = m_ctr_blocks * (offset / m_counter.size());
  202|       |
  203|    551|   zeroise(m_counter);
  204|    551|   buffer_insert(m_counter, 0, m_iv);
  205|       |
  206|    551|   const size_t BS = m_block_size;
  207|       |
  208|       |   // Set m_counter blocks to IV, IV + 1, ... IV + n
  209|       |
  210|    551|   if(m_ctr_size == 4 && BS >= 8) {
  ------------------
  |  Branch (210:7): [True: 551, False: 0]
  |  Branch (210:26): [True: 551, False: 0]
  ------------------
  211|    551|      const uint32_t low32 = load_be<uint32_t>(&m_counter[BS - 4], 0);
  212|       |
  213|    551|      if(m_ctr_blocks >= 4 && is_power_of_2(m_ctr_blocks)) {
  ------------------
  |  Branch (213:10): [True: 551, False: 0]
  |  Branch (213:31): [True: 551, False: 0]
  ------------------
  214|    551|         size_t written = 1;
  215|  1.99k|         while(written < m_ctr_blocks) {
  ------------------
  |  Branch (215:16): [True: 1.44k, False: 551]
  ------------------
  216|  1.44k|            copy_mem(&m_counter[written * BS], &m_counter[0], BS * written);
  217|  1.44k|            written *= 2;
  218|  1.44k|         }
  219|    551|      } else {
  220|      0|         for(size_t i = 1; i != m_ctr_blocks; ++i) {
  ------------------
  |  Branch (220:28): [True: 0, False: 0]
  ------------------
  221|      0|            copy_mem(&m_counter[i * BS], &m_counter[0], BS - 4);
  222|      0|         }
  223|      0|      }
  224|       |
  225|  4.23k|      for(size_t i = 1; i != m_ctr_blocks; ++i) {
  ------------------
  |  Branch (225:25): [True: 3.68k, False: 551]
  ------------------
  226|  3.68k|         const uint32_t c = static_cast<uint32_t>(low32 + i);
  227|  3.68k|         store_be(c, &m_counter[(BS - 4) + i * BS]);
  228|  3.68k|      }
  229|    551|   } else {
  230|       |      // do everything sequentially:
  231|      0|      for(size_t i = 1; i != m_ctr_blocks; ++i) {
  ------------------
  |  Branch (231:25): [True: 0, False: 0]
  ------------------
  232|      0|         buffer_insert(m_counter, i * BS, &m_counter[(i - 1) * BS], BS);
  233|       |
  234|      0|         for(size_t j = 0; j != m_ctr_size; ++j) {
  ------------------
  |  Branch (234:28): [True: 0, False: 0]
  ------------------
  235|      0|            if(++m_counter[i * BS + (BS - 1 - j)]) {
  ------------------
  |  Branch (235:16): [True: 0, False: 0]
  ------------------
  236|      0|               break;
  237|      0|            }
  238|      0|         }
  239|      0|      }
  240|      0|   }
  241|       |
  242|    551|   if(base_counter > 0) {
  ------------------
  |  Branch (242:7): [True: 0, False: 551]
  ------------------
  243|      0|      add_counter(base_counter);
  244|      0|   }
  245|       |
  246|    551|   m_cipher->encrypt_n(m_counter.data(), m_pad.data(), m_ctr_blocks);
  247|    551|   m_pad_pos = offset % m_counter.size();
  248|    551|}

_ZN5Botan12StreamCipher6createENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   39|    101|std::unique_ptr<StreamCipher> StreamCipher::create(std::string_view algo_spec, std::string_view provider) {
   40|    101|#if defined(BOTAN_HAS_SHAKE_CIPHER)
   41|    101|   if(algo_spec == "SHAKE-128" || algo_spec == "SHAKE-128-XOF") {
  ------------------
  |  Branch (41:7): [True: 0, False: 101]
  |  Branch (41:35): [True: 0, False: 101]
  ------------------
   42|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (42:10): [True: 0, False: 0]
  |  Branch (42:30): [True: 0, False: 0]
  ------------------
   43|      0|         return std::make_unique<SHAKE_128_Cipher>();
   44|      0|      }
   45|      0|   }
   46|       |
   47|    101|   if(algo_spec == "SHAKE-256" || algo_spec == "SHAKE-256-XOF") {
  ------------------
  |  Branch (47:7): [True: 0, False: 101]
  |  Branch (47:35): [True: 0, False: 101]
  ------------------
   48|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (48:10): [True: 0, False: 0]
  |  Branch (48:30): [True: 0, False: 0]
  ------------------
   49|      0|         return std::make_unique<SHAKE_256_Cipher>();
   50|      0|      }
   51|      0|   }
   52|    101|#endif
   53|       |
   54|    101|#if defined(BOTAN_HAS_CHACHA)
   55|    101|   if(algo_spec == "ChaCha20") {
  ------------------
  |  Branch (55:7): [True: 0, False: 101]
  ------------------
   56|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (56:10): [True: 0, False: 0]
  |  Branch (56:30): [True: 0, False: 0]
  ------------------
   57|      0|         return std::make_unique<ChaCha>(20);
   58|      0|      }
   59|      0|   }
   60|    101|#endif
   61|       |
   62|    101|#if defined(BOTAN_HAS_SALSA20)
   63|    101|   if(algo_spec == "Salsa20") {
  ------------------
  |  Branch (63:7): [True: 0, False: 101]
  ------------------
   64|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (64:10): [True: 0, False: 0]
  |  Branch (64:30): [True: 0, False: 0]
  ------------------
   65|      0|         return std::make_unique<Salsa20>();
   66|      0|      }
   67|      0|   }
   68|    101|#endif
   69|       |
   70|    101|   const SCAN_Name req(algo_spec);
   71|       |
   72|    101|#if defined(BOTAN_HAS_CTR_BE)
   73|    101|   if((req.algo_name() == "CTR-BE" || req.algo_name() == "CTR") && req.arg_count_between(1, 2)) {
  ------------------
  |  Branch (73:7): [True: 0, False: 101]
  |  Branch (73:8): [True: 0, False: 101]
  |  Branch (73:39): [True: 0, False: 101]
  |  Branch (73:68): [True: 0, False: 0]
  ------------------
   74|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (74:10): [True: 0, False: 0]
  |  Branch (74:30): [True: 0, False: 0]
  ------------------
   75|      0|         auto cipher = BlockCipher::create(req.arg(0));
   76|      0|         if(cipher) {
  ------------------
  |  Branch (76:13): [True: 0, False: 0]
  ------------------
   77|      0|            size_t ctr_size = req.arg_as_integer(1, cipher->block_size());
   78|      0|            return std::make_unique<CTR_BE>(std::move(cipher), ctr_size);
   79|      0|         }
   80|      0|      }
   81|      0|   }
   82|    101|#endif
   83|       |
   84|    101|#if defined(BOTAN_HAS_CHACHA)
   85|    101|   if(req.algo_name() == "ChaCha") {
  ------------------
  |  Branch (85:7): [True: 101, False: 0]
  ------------------
   86|    101|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (86:10): [True: 101, False: 0]
  |  Branch (86:30): [True: 0, False: 0]
  ------------------
   87|    101|         return std::make_unique<ChaCha>(req.arg_as_integer(0, 20));
   88|    101|      }
   89|    101|   }
   90|      0|#endif
   91|       |
   92|      0|#if defined(BOTAN_HAS_OFB)
   93|      0|   if(req.algo_name() == "OFB" && req.arg_count() == 1) {
  ------------------
  |  Branch (93:7): [True: 0, False: 0]
  |  Branch (93:7): [True: 0, False: 0]
  |  Branch (93:35): [True: 0, False: 0]
  ------------------
   94|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (94:10): [True: 0, False: 0]
  |  Branch (94:30): [True: 0, False: 0]
  ------------------
   95|      0|         if(auto cipher = BlockCipher::create(req.arg(0))) {
  ------------------
  |  Branch (95:18): [True: 0, False: 0]
  ------------------
   96|      0|            return std::make_unique<OFB>(std::move(cipher));
   97|      0|         }
   98|      0|      }
   99|      0|   }
  100|      0|#endif
  101|       |
  102|      0|#if defined(BOTAN_HAS_RC4)
  103|       |
  104|      0|   if(req.algo_name() == "RC4" || req.algo_name() == "ARC4" || req.algo_name() == "MARK-4") {
  ------------------
  |  Branch (104:7): [True: 0, False: 0]
  |  Branch (104:7): [True: 0, False: 0]
  |  Branch (104:35): [True: 0, False: 0]
  |  Branch (104:64): [True: 0, False: 0]
  ------------------
  105|      0|      const size_t skip = (req.algo_name() == "MARK-4") ? 256 : req.arg_as_integer(0, 0);
  ------------------
  |  Branch (105:27): [True: 0, False: 0]
  ------------------
  106|       |
  107|      0|      if(provider.empty() || provider == "base") {
  ------------------
  |  Branch (107:10): [True: 0, False: 0]
  |  Branch (107:30): [True: 0, False: 0]
  ------------------
  108|      0|         return std::make_unique<RC4>(skip);
  109|      0|      }
  110|      0|   }
  111|       |
  112|      0|#endif
  113|       |
  114|      0|   BOTAN_UNUSED(req);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  115|      0|   BOTAN_UNUSED(provider);
  ------------------
  |  |  118|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  116|       |
  117|      0|   return nullptr;
  118|      0|}
_ZN5Botan12StreamCipher15create_or_throwENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
  121|      1|std::unique_ptr<StreamCipher> StreamCipher::create_or_throw(std::string_view algo, std::string_view provider) {
  122|      1|   if(auto sc = StreamCipher::create(algo, provider)) {
  ------------------
  |  Branch (122:12): [True: 1, False: 0]
  ------------------
  123|      1|      return sc;
  124|      1|   }
  125|      0|   throw Lookup_Error("Stream cipher", algo, provider);
  126|      1|}

_ZN5Botan19Credentials_Manager15find_cert_chainERKNSt3__16vectorINS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS6_IS8_EEEERKNS2_INS_19AlgorithmIdentifierENS6_ISD_EEEERKNS2_INS_7X509_DNENS6_ISI_EEEERKS8_SO_:
   35|  63.5k|   const std::string& context) {
   36|  63.5k|   return cert_chain(key_types, cert_signature_schemes, type, context);
   37|  63.5k|}
_ZN5Botan19Credentials_Manager22cert_chain_single_typeERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEERKNS1_6vectorINS_19AlgorithmIdentifierENS5_ISB_EEEES9_S9_:
   50|  63.5k|   const std::string& context) {
   51|  63.5k|   return find_cert_chain({cert_key_type}, cert_signature_schemes, std::vector<X509_DN>(), type, context);
   52|  63.5k|}
_ZN5Botan19Credentials_Manager31trusted_certificate_authoritiesERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEES9_:
   61|  20.8k|                                                                                     const std::string& /*unused*/) {
   62|  20.8k|   return std::vector<Certificate_Store*>();
   63|  20.8k|}

_ZN5Botan3TLS17make_hello_randomERNS_21RandomNumberGeneratorERNS0_9CallbacksERKNS0_6PolicyE:
   41|  41.9k|std::vector<uint8_t> make_hello_random(RandomNumberGenerator& rng, Callbacks& cb, const Policy& policy) {
   42|  41.9k|   auto buf = rng.random_vec<std::vector<uint8_t>>(32);
   43|       |
   44|  41.9k|   if(policy.hash_hello_random()) {
  ------------------
  |  Branch (44:7): [True: 41.9k, False: 0]
  ------------------
   45|  41.9k|      auto sha256 = HashFunction::create_or_throw("SHA-256");
   46|  41.9k|      sha256->update(buf);
   47|  41.9k|      sha256->final(buf);
   48|  41.9k|   }
   49|       |
   50|       |   // TLS 1.3 does not require the insertion of a timestamp in the client hello
   51|       |   // random. When offering both TLS 1.2 and 1.3 we nevertheless comply with the
   52|       |   // legacy specification.
   53|  41.9k|   if(policy.include_time_in_hello_random() && (policy.allow_tls12() || policy.allow_dtls12())) {
  ------------------
  |  Branch (53:7): [True: 41.9k, False: 0]
  |  Branch (53:49): [True: 41.9k, False: 0]
  |  Branch (53:73): [True: 0, False: 0]
  ------------------
   54|  41.9k|      const uint32_t time32 = static_cast<uint32_t>(std::chrono::system_clock::to_time_t(cb.tls_current_timestamp()));
   55|       |
   56|  41.9k|      store_be(time32, buf.data());
   57|  41.9k|   }
   58|       |
   59|  41.9k|   return buf;
   60|  41.9k|}
_ZN5Botan3TLS12Client_HelloD2Ev:
  171|  25.0k|Client_Hello::~Client_Hello() = default;
_ZN5Botan3TLS12Client_HelloC2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE:
  178|  25.0k|Client_Hello::Client_Hello(std::unique_ptr<Client_Hello_Internal> data) : m_data(std::move(data)) {
  179|  25.0k|   BOTAN_ASSERT_NONNULL(m_data);
  ------------------
  |  |   87|  25.0k|   do {                                                                                   \
  |  |   88|  25.0k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 25.0k]
  |  |  ------------------
  |  |   89|  25.0k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  25.0k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  180|  25.0k|}
_ZNK5Botan3TLS12Client_Hello14legacy_versionEv:
  184|  25.0k|Protocol_Version Client_Hello::legacy_version() const { return m_data->legacy_version(); }
_ZNK5Botan3TLS12Client_Hello6randomEv:
  186|  28.0k|const std::vector<uint8_t>& Client_Hello::random() const { return m_data->random(); }
_ZNK5Botan3TLS12Client_Hello10session_idEv:
  188|  18.7k|const Session_ID& Client_Hello::session_id() const { return m_data->session_id(); }
_ZNK5Botan3TLS12Client_Hello19compression_methodsEv:
  190|  25.0k|const std::vector<uint8_t>& Client_Hello::compression_methods() const { return m_data->comp_methods(); }
_ZNK5Botan3TLS12Client_Hello12ciphersuitesEv:
  192|  21.1k|const std::vector<uint16_t>& Client_Hello::ciphersuites() const { return m_data->ciphersuites(); }
_ZNK5Botan3TLS12Client_Hello15extension_typesEv:
  194|  19.2k|std::set<Extension_Code> Client_Hello::extension_types() const { return m_data->extensions().extension_types(); }
_ZNK5Botan3TLS12Client_Hello10extensionsEv:
  196|  21.2k|const Extensions& Client_Hello::extensions() const { return m_data->extensions(); }
_ZNK5Botan3TLS12Client_Hello17cookie_input_dataEv:
  235|  3.80k|std::vector<uint8_t> Client_Hello::cookie_input_data() const {
  236|  3.80k|   BOTAN_STATE_CHECK(!m_data->hello_cookie_input_bits().empty());
  ------------------
  |  |   42|  3.80k|   do {                                                         \
  |  |   43|  3.80k|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 0, False: 3.80k]
  |  |  ------------------
  |  |   44|  3.80k|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|  3.80k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  237|       |
  238|  3.80k|   return m_data->hello_cookie_input_bits();
  239|  3.80k|}
_ZNK5Botan3TLS12Client_Hello13offered_suiteEt:
  244|  25.0k|bool Client_Hello::offered_suite(uint16_t ciphersuite) const {
  245|  25.0k|   return std::find(m_data->ciphersuites().cbegin(), m_data->ciphersuites().cend(), ciphersuite) !=
  246|  25.0k|          m_data->ciphersuites().cend();
  247|  25.0k|}
_ZNK5Botan3TLS12Client_Hello17signature_schemesEv:
  249|  20.8k|std::vector<Signature_Scheme> Client_Hello::signature_schemes() const {
  250|  20.8k|   if(Signature_Algorithms* sigs = m_data->extensions().get<Signature_Algorithms>()) {
  ------------------
  |  Branch (250:29): [True: 273, False: 20.5k]
  ------------------
  251|    273|      return sigs->supported_schemes();
  252|    273|   }
  253|  20.5k|   return {};
  254|  20.8k|}
_ZNK5Botan3TLS12Client_Hello29certificate_signature_schemesEv:
  256|  21.1k|std::vector<Signature_Scheme> Client_Hello::certificate_signature_schemes() const {
  257|       |   // RFC 8446 4.2.3
  258|       |   //   If no "signature_algorithms_cert" extension is present, then the
  259|       |   //   "signature_algorithms" extension also applies to signatures appearing
  260|       |   //   in certificates.
  261|  21.1k|   if(Signature_Algorithms_Cert* sigs = m_data->extensions().get<Signature_Algorithms_Cert>()) {
  ------------------
  |  Branch (261:34): [True: 497, False: 20.6k]
  ------------------
  262|    497|      return sigs->supported_schemes();
  263|  20.6k|   } else {
  264|  20.6k|      return signature_schemes();
  265|  20.6k|   }
  266|  21.1k|}
_ZNK5Botan3TLS12Client_Hello20supported_ecc_curvesEv:
  268|  40.4k|std::vector<Group_Params> Client_Hello::supported_ecc_curves() const {
  269|  40.4k|   if(Supported_Groups* groups = m_data->extensions().get<Supported_Groups>()) {
  ------------------
  |  Branch (269:25): [True: 38.8k, False: 1.64k]
  ------------------
  270|  38.8k|      return groups->ec_groups();
  271|  38.8k|   }
  272|  1.64k|   return {};
  273|  40.4k|}
_ZNK5Botan3TLS15Client_Hello_1228prefers_compressed_ec_pointsEv:
  282|  18.6k|bool Client_Hello_12::prefers_compressed_ec_points() const {
  283|  18.6k|   if(Supported_Point_Formats* ecc_formats = m_data->extensions().get<Supported_Point_Formats>()) {
  ------------------
  |  Branch (283:32): [True: 583, False: 18.1k]
  ------------------
  284|    583|      return ecc_formats->prefers_compressed();
  285|    583|   }
  286|  18.1k|   return false;
  287|  18.6k|}
_ZNK5Botan3TLS12Client_Hello12sni_hostnameEv:
  289|  57.6k|std::string Client_Hello::sni_hostname() const {
  290|  57.6k|   if(Server_Name_Indicator* sni = m_data->extensions().get<Server_Name_Indicator>()) {
  ------------------
  |  Branch (290:30): [True: 3.75k, False: 53.8k]
  ------------------
  291|  3.75k|      return sni->host_name();
  292|  3.75k|   }
  293|  53.8k|   return "";
  294|  57.6k|}
_ZNK5Botan3TLS15Client_Hello_1220secure_renegotiationEv:
  296|  42.1k|bool Client_Hello_12::secure_renegotiation() const { return m_data->extensions().has<Renegotiation_Extension>(); }
_ZNK5Botan3TLS15Client_Hello_1218renegotiation_infoEv:
  298|  10.4k|std::vector<uint8_t> Client_Hello_12::renegotiation_info() const {
  299|  10.4k|   if(Renegotiation_Extension* reneg = m_data->extensions().get<Renegotiation_Extension>()) {
  ------------------
  |  Branch (299:32): [True: 10.4k, False: 0]
  ------------------
  300|  10.4k|      return reneg->renegotiation_info();
  301|  10.4k|   }
  302|      0|   return {};
  303|  10.4k|}
_ZNK5Botan3TLS12Client_Hello18supported_versionsEv:
  305|  25.0k|std::vector<Protocol_Version> Client_Hello::supported_versions() const {
  306|  25.0k|   if(Supported_Versions* versions = m_data->extensions().get<Supported_Versions>()) {
  ------------------
  |  Branch (306:27): [True: 354, False: 24.6k]
  ------------------
  307|    354|      return versions->versions();
  308|    354|   }
  309|  24.6k|   return {};
  310|  25.0k|}
_ZNK5Botan3TLS15Client_Hello_1223supports_session_ticketEv:
  312|  20.9k|bool Client_Hello_12::supports_session_ticket() const { return m_data->extensions().has<Session_Ticket_Extension>(); }
_ZNK5Botan3TLS15Client_Hello_1214session_ticketEv:
  314|  21.1k|Session_Ticket Client_Hello_12::session_ticket() const {
  315|  21.1k|   if(auto* ticket = m_data->extensions().get<Session_Ticket_Extension>()) {
  ------------------
  |  Branch (315:13): [True: 2.93k, False: 18.2k]
  ------------------
  316|  2.93k|      return ticket->contents();
  317|  2.93k|   }
  318|  18.2k|   return {};
  319|  21.1k|}
_ZNK5Botan3TLS15Client_Hello_1214session_handleEv:
  321|  21.1k|std::optional<Session_Handle> Client_Hello_12::session_handle() const {
  322|       |   // RFC 5077 3.4
  323|       |   //    If a ticket is presented by the client, the server MUST NOT attempt
  324|       |   //    to use the Session ID in the ClientHello for stateful session
  325|       |   //    resumption.
  326|  21.1k|   if(auto ticket = session_ticket(); !ticket.empty()) {
  ------------------
  |  Branch (326:39): [True: 2.40k, False: 18.7k]
  ------------------
  327|  2.40k|      return ticket;
  328|  18.7k|   } else if(const auto& id = session_id(); !id.empty()) {
  ------------------
  |  Branch (328:45): [True: 45, False: 18.7k]
  ------------------
  329|     45|      return id;
  330|  18.7k|   } else {
  331|  18.7k|      return std::nullopt;
  332|  18.7k|   }
  333|  21.1k|}
_ZNK5Botan3TLS12Client_Hello13supports_alpnEv:
  335|  22.9k|bool Client_Hello::supports_alpn() const { return m_data->extensions().has<Application_Layer_Protocol_Notification>(); }
_ZNK5Botan3TLS15Client_Hello_1231supports_extended_master_secretEv:
  337|  20.9k|bool Client_Hello_12::supports_extended_master_secret() const {
  338|  20.9k|   return m_data->extensions().has<Extended_Master_Secret>();
  339|  20.9k|}
_ZNK5Botan3TLS15Client_Hello_1228supports_cert_status_messageEv:
  341|  21.1k|bool Client_Hello_12::supports_cert_status_message() const {
  342|  21.1k|   return m_data->extensions().has<Certificate_Status_Request>();
  343|  21.1k|}
_ZNK5Botan3TLS15Client_Hello_1225supports_encrypt_then_macEv:
  345|  16.6k|bool Client_Hello_12::supports_encrypt_then_mac() const { return m_data->extensions().has<Encrypt_then_MAC>(); }
_ZNK5Botan3TLS12Client_Hello14next_protocolsEv:
  349|  1.76k|std::vector<std::string> Client_Hello::next_protocols() const {
  350|  1.76k|   if(auto alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
  ------------------
  |  Branch (350:12): [True: 1.76k, False: 0]
  ------------------
  351|  1.76k|      return alpn->protocols();
  352|  1.76k|   }
  353|      0|   return {};
  354|  1.76k|}
_ZNK5Botan3TLS12Client_Hello6cookieEv:
  363|  3.80k|const std::vector<uint8_t>& Client_Hello::cookie() const { return m_data->hello_cookie(); }
_ZN5Botan3TLS15Client_Hello_12C2ENSt3__110unique_ptrINS0_21Client_Hello_InternalENS2_14default_deleteIS4_EEEE:
  384|  25.0k|Client_Hello_12::Client_Hello_12(std::unique_ptr<Client_Hello_Internal> data) : Client_Hello(std::move(data)) {
  385|  25.0k|   if(offered_suite(static_cast<uint16_t>(TLS_EMPTY_RENEGOTIATION_INFO_SCSV))) {
  ------------------
  |  Branch (385:7): [True: 10.4k, False: 14.5k]
  ------------------
  386|  10.4k|      if(Renegotiation_Extension* reneg = m_data->extensions().get<Renegotiation_Extension>()) {
  ------------------
  |  Branch (386:35): [True: 168, False: 10.3k]
  ------------------
  387|    168|         if(!reneg->renegotiation_info().empty()) {
  ------------------
  |  Branch (387:13): [True: 1, False: 167]
  ------------------
  388|      1|            throw TLS_Exception(Alert::HandshakeFailure, "Client sent renegotiation SCSV and non-empty extension");
  389|      1|         }
  390|  10.3k|      } else {
  391|       |         // add fake extension
  392|  10.3k|         m_data->extensions().add(new Renegotiation_Extension());
  393|  10.3k|      }
  394|  10.4k|   }
  395|  25.0k|}
_ZN5Botan3TLS15Client_Hello_12C2ERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
  400|  26.0k|      Client_Hello_12(std::make_unique<Client_Hello_Internal>(buf)) {}
_ZNK5Botan3TLS21Client_Hello_Internal14legacy_versionEv:
  138|  25.0k|      Protocol_Version legacy_version() const { return m_legacy_version; }
_ZNK5Botan3TLS21Client_Hello_Internal6randomEv:
  142|  28.0k|      const std::vector<uint8_t>& random() const { return m_random; }
_ZNK5Botan3TLS21Client_Hello_Internal10session_idEv:
  140|  18.7k|      const Session_ID& session_id() const { return m_session_id; }
_ZNK5Botan3TLS21Client_Hello_Internal12comp_methodsEv:
  146|  25.0k|      const std::vector<uint8_t>& comp_methods() const { return m_comp_methods; }
_ZNK5Botan3TLS21Client_Hello_Internal12ciphersuitesEv:
  144|  96.3k|      const std::vector<uint16_t>& ciphersuites() const { return m_suites; }
_ZN5Botan3TLS21Client_Hello_Internal10extensionsEv:
  154|   423k|      Extensions& extensions() { return m_extensions; }
_ZNK5Botan3TLS21Client_Hello_Internal12hello_cookieEv:
  148|  3.80k|      const std::vector<uint8_t>& hello_cookie() const { return m_hello_cookie; }
_ZNK5Botan3TLS21Client_Hello_Internal23hello_cookie_input_bitsEv:
  150|  7.61k|      const std::vector<uint8_t>& hello_cookie_input_bits() const { return m_cookie_input_bits; }
_ZN5Botan3TLS21Client_Hello_InternalC2ERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
   71|  26.0k|      Client_Hello_Internal(const std::vector<uint8_t>& buf) {
   72|  26.0k|         if(buf.size() < 41) {
  ------------------
  |  Branch (72:13): [True: 24, False: 26.0k]
  ------------------
   73|     24|            throw Decoding_Error("Client_Hello: Packet corrupted");
   74|     24|         }
   75|       |
   76|  26.0k|         TLS_Data_Reader reader("ClientHello", buf);
   77|       |
   78|  26.0k|         const uint8_t major_version = reader.get_byte();
   79|  26.0k|         const uint8_t minor_version = reader.get_byte();
   80|       |
   81|  26.0k|         m_legacy_version = Protocol_Version(major_version, minor_version);
   82|  26.0k|         m_random = reader.get_fixed<uint8_t>(32);
   83|  26.0k|         m_session_id = Session_ID(reader.get_range<uint8_t>(1, 0, 32));
   84|       |
   85|  26.0k|         if(m_legacy_version.is_datagram_protocol()) {
  ------------------
  |  Branch (85:13): [True: 4.05k, False: 22.0k]
  ------------------
   86|  4.05k|            auto sha256 = HashFunction::create_or_throw("SHA-256");
   87|  4.05k|            sha256->update(reader.get_data_read_so_far());
   88|       |
   89|  4.05k|            m_hello_cookie = reader.get_range<uint8_t>(1, 0, 255);
   90|       |
   91|  4.05k|            sha256->update(reader.get_remaining());
   92|  4.05k|            m_cookie_input_bits = sha256->final_stdvec();
   93|  4.05k|         }
   94|       |
   95|  26.0k|         m_suites = reader.get_range_vector<uint16_t>(2, 1, 32767);
   96|  26.0k|         m_comp_methods = reader.get_range_vector<uint8_t>(1, 1, 255);
   97|       |
   98|  26.0k|         m_extensions.deserialize(reader, Connection_Side::Client, Handshake_Type::ClientHello);
   99|  26.0k|      }

_ZNK5Botan3TLS8Finished9serializeEv:
   48|    245|std::vector<uint8_t> Finished::serialize() const { return m_verification_data; }
_ZN5Botan3TLS8FinishedC2ERKNSt3__16vectorIhNS2_9allocatorIhEEEE:
   50|    245|Finished::Finished(const std::vector<uint8_t>& buf) : m_verification_data(buf) {}
_ZN5Botan3TLS11Finished_12C2ERNS0_12Handshake_IOERNS0_15Handshake_StateENS0_15Connection_SideE:
   54|    245|Finished_12::Finished_12(Handshake_IO& io, Handshake_State& state, Connection_Side side) {
   55|    245|   m_verification_data = finished_compute_verify_12(state, side);
   56|    245|   state.hash().update(io.send(*this));
   57|    245|}
_ZNK5Botan3TLS11Finished_126verifyERKNS0_15Handshake_StateENS0_15Connection_SideE:
   59|    245|bool Finished_12::verify(const Handshake_State& state, Connection_Side side) const {
   60|    245|   std::vector<uint8_t> computed_verify = finished_compute_verify_12(state, side);
   61|       |
   62|    245|#if defined(BOTAN_UNSAFE_FUZZER_MODE)
   63|    245|   return true;
   64|       |#else
   65|       |   return (m_verification_data.size() == computed_verify.size()) &&
   66|       |          constant_time_compare(m_verification_data.data(), computed_verify.data(), computed_verify.size());
   67|       |#endif
   68|    245|}
msg_finished.cpp:_ZN5Botan3TLS12_GLOBAL__N_126finished_compute_verify_12ERKNS0_15Handshake_StateENS0_15Connection_SideE:
   27|    490|std::vector<uint8_t> finished_compute_verify_12(const Handshake_State& state, Connection_Side side) {
   28|    490|   const uint8_t TLS_CLIENT_LABEL[] = {
   29|    490|      0x63, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x20, 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64};
   30|       |
   31|    490|   const uint8_t TLS_SERVER_LABEL[] = {
   32|    490|      0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64};
   33|       |
   34|    490|   auto prf = state.protocol_specific_prf();
   35|       |
   36|    490|   std::vector<uint8_t> input;
   37|    490|   std::vector<uint8_t> label;
   38|    490|   label += (side == Connection_Side::Client) ? std::make_pair(TLS_CLIENT_LABEL, sizeof(TLS_CLIENT_LABEL))
  ------------------
  |  Branch (38:13): [True: 245, False: 245]
  ------------------
   39|    490|                                              : std::make_pair(TLS_SERVER_LABEL, sizeof(TLS_SERVER_LABEL));
   40|       |
   41|    490|   input += state.hash().final(state.ciphersuite().prf_algo());
   42|       |
   43|    490|   return unlock(prf->derive_key(12, state.session_keys().master_secret(), input, label));
   44|    490|}

_ZN5Botan3TLS12Server_HelloC2ENSt3__110unique_ptrINS0_21Server_Hello_InternalENS2_14default_deleteIS4_EEEE:
  167|  20.9k|Server_Hello::Server_Hello(std::unique_ptr<Server_Hello_Internal> data) : m_data(std::move(data)) {}
_ZN5Botan3TLS12Server_HelloD2Ev:
  172|  20.9k|Server_Hello::~Server_Hello() = default;
_ZNK5Botan3TLS12Server_Hello9serializeEv:
  177|  20.9k|std::vector<uint8_t> Server_Hello::serialize() const {
  178|  20.9k|   std::vector<uint8_t> buf;
  179|  20.9k|   buf.reserve(1024);  // working around GCC warning
  180|       |
  181|  20.9k|   buf.push_back(m_data->legacy_version().major_version());
  182|  20.9k|   buf.push_back(m_data->legacy_version().minor_version());
  183|  20.9k|   buf += m_data->random();
  184|       |
  185|  20.9k|   append_tls_length_value(buf, m_data->session_id().get(), 1);
  186|       |
  187|  20.9k|   buf.push_back(get_byte<0>(m_data->ciphersuite()));
  188|  20.9k|   buf.push_back(get_byte<1>(m_data->ciphersuite()));
  189|       |
  190|  20.9k|   buf.push_back(m_data->comp_method());
  191|       |
  192|  20.9k|   buf += m_data->extensions().serialize(Connection_Side::Server);
  193|       |
  194|  20.9k|   return buf;
  195|  20.9k|}
_ZNK5Botan3TLS12Server_Hello4typeEv:
  197|  62.9k|Handshake_Type Server_Hello::type() const { return Handshake_Type::ServerHello; }
_ZNK5Botan3TLS12Server_Hello14legacy_versionEv:
  199|    245|Protocol_Version Server_Hello::legacy_version() const { return m_data->legacy_version(); }
_ZNK5Botan3TLS12Server_Hello6randomEv:
  201|  28.0k|const std::vector<uint8_t>& Server_Hello::random() const { return m_data->random(); }
_ZNK5Botan3TLS12Server_Hello18compression_methodEv:
  203|    760|uint8_t Server_Hello::compression_method() const { return m_data->comp_method(); }
_ZNK5Botan3TLS12Server_Hello10session_idEv:
  205|    612|const Session_ID& Server_Hello::session_id() const { return m_data->session_id(); }
_ZNK5Botan3TLS12Server_Hello11ciphersuiteEv:
  207|  21.2k|uint16_t Server_Hello::ciphersuite() const { return m_data->ciphersuite(); }
_ZN5Botan3TLS15Server_Hello_12C2ERNS0_12Handshake_IOERNS0_14Handshake_HashERKNS0_6PolicyERNS0_9CallbacksERNS_21RandomNumberGeneratorERKNSt3__16vectorIhNSD_9allocatorIhEEEERKNS0_15Client_Hello_12ERKNS1_8SettingsENSD_17basic_string_viewIcNSD_11char_traitsIcEEEE:
  228|  20.9k|         uint8_t(0))) {
  229|  20.9k|   if(client_hello.supports_extended_master_secret()) {
  ------------------
  |  Branch (229:7): [True: 1.33k, False: 19.6k]
  ------------------
  230|  1.33k|      m_data->extensions().add(new Extended_Master_Secret);
  231|  1.33k|   }
  232|       |
  233|       |   // Sending the extension back does not commit us to sending a stapled response
  234|  20.9k|   if(client_hello.supports_cert_status_message() && policy.support_cert_status_message()) {
  ------------------
  |  Branch (234:7): [True: 581, False: 20.4k]
  |  Branch (234:54): [True: 581, False: 0]
  ------------------
  235|    581|      m_data->extensions().add(new Certificate_Status_Request);
  236|    581|   }
  237|       |
  238|  20.9k|   if(!next_protocol.empty() && client_hello.supports_alpn()) {
  ------------------
  |  Branch (238:7): [True: 1.73k, False: 19.2k]
  |  Branch (238:33): [True: 1.73k, False: 0]
  ------------------
  239|  1.73k|      m_data->extensions().add(new Application_Layer_Protocol_Notification(next_protocol));
  240|  1.73k|   }
  241|       |
  242|  20.9k|   const auto c = Ciphersuite::by_id(m_data->ciphersuite());
  243|       |
  244|  20.9k|   if(c && c->cbc_ciphersuite() && client_hello.supports_encrypt_then_mac() && policy.negotiate_encrypt_then_mac()) {
  ------------------
  |  Branch (244:7): [True: 20.9k, False: 0]
  |  Branch (244:12): [True: 16.6k, False: 4.34k]
  |  Branch (244:36): [True: 816, False: 15.8k]
  |  Branch (244:80): [True: 816, False: 0]
  ------------------
  245|    816|      m_data->extensions().add(new Encrypt_then_MAC);
  246|    816|   }
  247|       |
  248|  20.9k|   if(c && c->ecc_ciphersuite() && client_hello.extension_types().contains(Extension_Code::EcPointFormats)) {
  ------------------
  |  Branch (248:7): [True: 20.9k, False: 0]
  |  Branch (248:7): [True: 584, False: 20.4k]
  |  Branch (248:12): [True: 19.2k, False: 1.70k]
  |  Branch (248:36): [True: 584, False: 18.7k]
  ------------------
  249|    584|      m_data->extensions().add(new Supported_Point_Formats(policy.use_ecc_point_compression()));
  250|    584|   }
  251|       |
  252|  20.9k|   if(client_hello.secure_renegotiation()) {
  ------------------
  |  Branch (252:7): [True: 10.4k, False: 10.5k]
  ------------------
  253|  10.4k|      m_data->extensions().add(new Renegotiation_Extension(reneg_info));
  254|  10.4k|   }
  255|       |
  256|  20.9k|   if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket()) {
  ------------------
  |  Branch (256:7): [True: 2.89k, False: 18.0k]
  |  Branch (256:49): [True: 0, False: 2.89k]
  ------------------
  257|      0|      m_data->extensions().add(new Session_Ticket_Extension());
  258|      0|   }
  259|       |
  260|  20.9k|   if(m_data->legacy_version().is_datagram_protocol()) {
  ------------------
  |  Branch (260:7): [True: 0, False: 20.9k]
  ------------------
  261|      0|      const std::vector<uint16_t> server_srtp = policy.srtp_profiles();
  262|      0|      const std::vector<uint16_t> client_srtp = client_hello.srtp_profiles();
  263|       |
  264|      0|      if(!server_srtp.empty() && !client_srtp.empty()) {
  ------------------
  |  Branch (264:10): [True: 0, False: 0]
  |  Branch (264:34): [True: 0, False: 0]
  ------------------
  265|      0|         uint16_t shared = 0;
  266|       |         // always using server preferences for now
  267|      0|         for(auto s_srtp : server_srtp) {
  ------------------
  |  Branch (267:26): [True: 0, False: 0]
  ------------------
  268|      0|            for(auto c_srtp : client_srtp) {
  ------------------
  |  Branch (268:29): [True: 0, False: 0]
  ------------------
  269|      0|               if(shared == 0 && s_srtp == c_srtp) {
  ------------------
  |  Branch (269:19): [True: 0, False: 0]
  |  Branch (269:34): [True: 0, False: 0]
  ------------------
  270|      0|                  shared = s_srtp;
  271|      0|               }
  272|      0|            }
  273|      0|         }
  274|       |
  275|      0|         if(shared) {
  ------------------
  |  Branch (275:13): [True: 0, False: 0]
  ------------------
  276|      0|            m_data->extensions().add(new SRTP_Protection_Profiles(shared));
  277|      0|         }
  278|      0|      }
  279|      0|   }
  280|       |
  281|  20.9k|   cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Server, type());
  282|       |
  283|  20.9k|   hash.update(io.send(*this));
  284|  20.9k|}
_ZNK5Botan3TLS15Server_Hello_1220secure_renegotiationEv:
  346|  20.9k|bool Server_Hello_12::secure_renegotiation() const { return m_data->extensions().has<Renegotiation_Extension>(); }
_ZNK5Botan3TLS15Server_Hello_1218renegotiation_infoEv:
  348|  10.4k|std::vector<uint8_t> Server_Hello_12::renegotiation_info() const {
  349|  10.4k|   if(Renegotiation_Extension* reneg = m_data->extensions().get<Renegotiation_Extension>()) {
  ------------------
  |  Branch (349:32): [True: 10.4k, False: 0]
  ------------------
  350|  10.4k|      return reneg->renegotiation_info();
  351|  10.4k|   }
  352|      0|   return std::vector<uint8_t>();
  353|  10.4k|}
_ZNK5Botan3TLS15Server_Hello_1231supports_extended_master_secretEv:
  355|  14.8k|bool Server_Hello_12::supports_extended_master_secret() const {
  356|  14.8k|   return m_data->extensions().has<Extended_Master_Secret>();
  357|  14.8k|}
_ZNK5Botan3TLS15Server_Hello_1225supports_encrypt_then_macEv:
  359|  1.00k|bool Server_Hello_12::supports_encrypt_then_mac() const { return m_data->extensions().has<Encrypt_then_MAC>(); }
_ZNK5Botan3TLS15Server_Hello_1223supports_session_ticketEv:
  365|    735|bool Server_Hello_12::supports_session_ticket() const { return m_data->extensions().has<Session_Ticket_Extension>(); }
_ZNK5Botan3TLS15Server_Hello_1212srtp_profileEv:
  367|    245|uint16_t Server_Hello_12::srtp_profile() const {
  368|    245|   if(auto srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
  ------------------
  |  Branch (368:12): [True: 0, False: 245]
  ------------------
  369|      0|      auto prof = srtp->profiles();
  370|      0|      if(prof.size() != 1 || prof[0] == 0) {
  ------------------
  |  Branch (370:10): [True: 0, False: 0]
  |  Branch (370:30): [True: 0, False: 0]
  ------------------
  371|      0|         throw Decoding_Error("Server sent malformed DTLS-SRTP extension");
  372|      0|      }
  373|      0|      return prof[0];
  374|      0|   }
  375|       |
  376|    245|   return 0;
  377|    245|}
_ZN5Botan3TLS17Server_Hello_DoneC2ERNS0_12Handshake_IOERNS0_14Handshake_HashE:
  408|  20.8k|Server_Hello_Done::Server_Hello_Done(Handshake_IO& io, Handshake_Hash& hash) { hash.update(io.send(*this)); }
_ZNK5Botan3TLS17Server_Hello_Done9serializeEv:
  422|  20.8k|std::vector<uint8_t> Server_Hello_Done::serialize() const { return std::vector<uint8_t>(); }
_ZNK5Botan3TLS21Server_Hello_Internal14legacy_versionEv:
  140|  63.2k|      Protocol_Version legacy_version() const { return m_legacy_version; }
_ZNK5Botan3TLS21Server_Hello_Internal6randomEv:
  144|  49.0k|      const std::vector<uint8_t>& random() const { return m_random; }
_ZNK5Botan3TLS21Server_Hello_Internal10session_idEv:
  142|  21.6k|      const Session_ID& session_id() const { return m_session_id; }
_ZNK5Botan3TLS21Server_Hello_Internal11ciphersuiteEv:
  146|  84.2k|      uint16_t ciphersuite() const { return m_ciphersuite; }
_ZNK5Botan3TLS21Server_Hello_Internal11comp_methodEv:
  148|  21.7k|      uint8_t comp_method() const { return m_comp_method; }
_ZN5Botan3TLS21Server_Hello_Internal10extensionsEv:
  154|   105k|      Extensions& extensions() { return m_extensions; }
msg_server_hello.cpp:_ZN5Botan3TLS12_GLOBAL__N_124make_server_hello_randomERNS_21RandomNumberGeneratorENS0_16Protocol_VersionERNS0_9CallbacksERKNS0_6PolicyE:
   46|  20.9k|                                              const Policy& policy) {
   47|  20.9k|   BOTAN_UNUSED(offered_version);
  ------------------
  |  |  118|  20.9k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   48|  20.9k|   auto random = make_hello_random(rng, cb, policy);
   49|       |
   50|       |   // RFC 8446 4.1.3
   51|       |   //    TLS 1.3 has a downgrade protection mechanism embedded in the server's
   52|       |   //    random value. TLS 1.3 servers which negotiate TLS 1.2 or below in
   53|       |   //    response to a ClientHello MUST set the last 8 bytes of their Random
   54|       |   //    value specially in their ServerHello.
   55|       |   //
   56|       |   //    If negotiating TLS 1.2, TLS 1.3 servers MUST set the last 8 bytes of
   57|       |   //    their Random value to the bytes: [DOWNGRADE_TLS12]
   58|  20.9k|   if(offered_version.is_pre_tls_13() && policy.allow_tls13()) {
  ------------------
  |  Branch (58:7): [True: 20.9k, False: 0]
  |  Branch (58:42): [True: 0, False: 20.9k]
  ------------------
   59|      0|      constexpr size_t downgrade_signal_length = sizeof(DOWNGRADE_TLS12);
   60|      0|      BOTAN_ASSERT_NOMSG(random.size() >= downgrade_signal_length);
  ------------------
  |  |   60|      0|   do {                                                                     \
  |  |   61|      0|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   62|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   61|      0|      auto lastbytes = random.data() + random.size() - downgrade_signal_length;
   62|      0|      store_be(DOWNGRADE_TLS12, lastbytes);
   63|      0|   }
   64|       |
   65|  20.9k|   return random;
   66|  20.9k|}
_ZN5Botan3TLS21Server_Hello_InternalC2ENS0_16Protocol_VersionENS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEES8_thb:
  125|  20.9k|            m_comp_method(cm) {}

_ZN5Botan3TLS14Certificate_12C2ERNS0_12Handshake_IOERNS0_14Handshake_HashERKNSt3__16vectorINS_16X509_CertificateENS6_9allocatorIS8_EEEE:
   25|    177|      m_certs(cert_list) {
   26|    177|   hash.update(io.send(*this));
   27|    177|}
_ZNK5Botan3TLS14Certificate_129serializeEv:
   82|    177|std::vector<uint8_t> Certificate_12::serialize() const {
   83|    177|   std::vector<uint8_t> buf(3);
   84|       |
   85|    177|   for(const auto& cert : m_certs) {
  ------------------
  |  Branch (85:25): [True: 177, False: 177]
  ------------------
   86|    177|      const auto raw_cert = cert.BER_encode();
   87|    177|      const size_t cert_size = raw_cert.size();
   88|    708|      for(size_t j = 0; j != 3; ++j) {
  ------------------
  |  Branch (88:25): [True: 531, False: 177]
  ------------------
   89|    531|         buf.push_back(get_byte_var(j + 1, static_cast<uint32_t>(cert_size)));
   90|    531|      }
   91|    177|      buf += raw_cert;
   92|    177|   }
   93|       |
   94|    177|   const size_t buf_size = buf.size() - 3;
   95|    708|   for(size_t i = 0; i != 3; ++i) {
  ------------------
  |  Branch (95:22): [True: 531, False: 177]
  ------------------
   96|    531|      buf[i] = get_byte_var(i + 1, static_cast<uint32_t>(buf_size));
   97|    531|   }
   98|       |
   99|    177|   return buf;
  100|    177|}

_ZN5Botan3TLS19Client_Key_ExchangeC2ERKNSt3__16vectorIhNS2_9allocatorIhEEEERKNS0_15Handshake_StateEPKNS_11Private_KeyERNS_19Credentials_ManagerERKNS0_6PolicyERNS_21RandomNumberGeneratorE:
  188|  15.4k|                                         RandomNumberGenerator& rng) {
  189|  15.4k|   const Kex_Algo kex_algo = state.ciphersuite().kex_method();
  190|       |
  191|  15.4k|   if(kex_algo == Kex_Algo::STATIC_RSA) {
  ------------------
  |  Branch (191:7): [True: 0, False: 15.4k]
  ------------------
  192|      0|      BOTAN_ASSERT(state.server_certs() && !state.server_certs()->cert_chain().empty(),
  ------------------
  |  |   51|      0|   do {                                                                                 \
  |  |   52|      0|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 0, False: 0]
  |  |  |  Branch (52:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   53|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  193|      0|                   "RSA key exchange negotiated so server sent a certificate");
  194|       |
  195|      0|      if(!server_rsa_kex_key) {
  ------------------
  |  Branch (195:10): [True: 0, False: 0]
  ------------------
  196|      0|         throw Internal_Error("Expected RSA kex but no server kex key set");
  197|      0|      }
  198|       |
  199|      0|      if(server_rsa_kex_key->algo_name() != "RSA") {
  ------------------
  |  Branch (199:10): [True: 0, False: 0]
  ------------------
  200|      0|         throw Internal_Error("Expected RSA key but got " + server_rsa_kex_key->algo_name());
  201|      0|      }
  202|       |
  203|      0|      TLS_Data_Reader reader("ClientKeyExchange", contents);
  204|      0|      const std::vector<uint8_t> encrypted_pre_master = reader.get_range<uint8_t>(2, 0, 65535);
  205|      0|      reader.assert_done();
  206|       |
  207|      0|      PK_Decryptor_EME decryptor(*server_rsa_kex_key, rng, "PKCS1v15");
  208|       |
  209|      0|      const uint8_t client_major = state.client_hello()->legacy_version().major_version();
  210|      0|      const uint8_t client_minor = state.client_hello()->legacy_version().minor_version();
  211|       |
  212|       |      /*
  213|       |      * PK_Decryptor::decrypt_or_random will return a random value if
  214|       |      * either the length does not match the expected value or if the
  215|       |      * version number embedded in the PMS does not match the one sent
  216|       |      * in the client hello.
  217|       |      */
  218|      0|      const size_t expected_plaintext_size = 48;
  219|      0|      const size_t expected_content_size = 2;
  220|      0|      const uint8_t expected_content_bytes[expected_content_size] = {client_major, client_minor};
  221|      0|      const uint8_t expected_content_pos[expected_content_size] = {0, 1};
  222|       |
  223|      0|      m_pre_master = decryptor.decrypt_or_random(encrypted_pre_master.data(),
  224|      0|                                                 encrypted_pre_master.size(),
  225|      0|                                                 expected_plaintext_size,
  226|      0|                                                 rng,
  227|      0|                                                 expected_content_bytes,
  228|      0|                                                 expected_content_pos,
  229|      0|                                                 expected_content_size);
  230|  15.4k|   } else {
  231|  15.4k|      TLS_Data_Reader reader("ClientKeyExchange", contents);
  232|       |
  233|  15.4k|      SymmetricKey psk;
  234|       |
  235|  15.4k|      if(key_exchange_is_psk(kex_algo)) {
  ------------------
  |  Branch (235:10): [True: 15.4k, False: 0]
  ------------------
  236|  15.4k|         const std::string psk_identity = reader.get_string(2, 0, 65535);
  237|       |
  238|  15.4k|         psk = creds.psk("tls-server", state.client_hello()->sni_hostname(), psk_identity);
  239|       |
  240|  15.4k|         if(psk.length() == 0) {
  ------------------
  |  Branch (240:13): [True: 0, False: 15.4k]
  ------------------
  241|      0|            if(policy.hide_unknown_users()) {
  ------------------
  |  Branch (241:16): [True: 0, False: 0]
  ------------------
  242|      0|               psk = SymmetricKey(rng, 16);
  243|      0|            } else {
  244|      0|               throw TLS_Exception(Alert::UnknownPSKIdentity, "No PSK for identifier " + psk_identity);
  245|      0|            }
  246|      0|         }
  247|  15.4k|      }
  248|       |
  249|  15.4k|      if(kex_algo == Kex_Algo::PSK) {
  ------------------
  |  Branch (249:10): [True: 496, False: 14.9k]
  ------------------
  250|    496|         std::vector<uint8_t> zeros(psk.length());
  251|    496|         append_tls_length_value(m_pre_master, zeros, 2);
  252|    496|         append_tls_length_value(m_pre_master, psk.bits_of(), 2);
  253|  14.9k|      } else if(kex_algo == Kex_Algo::DH || kex_algo == Kex_Algo::ECDH || kex_algo == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (253:17): [True: 13, False: 14.9k]
  |  Branch (253:45): [True: 0, False: 14.9k]
  |  Branch (253:75): [True: 14.9k, False: 0]
  ------------------
  254|  14.9k|         const PK_Key_Agreement_Key& ka_key = state.server_kex()->server_kex_key();
  255|       |
  256|  14.9k|         const std::vector<uint8_t> client_pubkey = (ka_key.algo_name() == "DH")
  ------------------
  |  Branch (256:53): [True: 0, False: 14.9k]
  ------------------
  257|  14.9k|                                                       ? reader.get_range<uint8_t>(2, 0, 65535)
  258|  14.9k|                                                       : reader.get_range<uint8_t>(1, 1, 255);
  259|       |
  260|  14.9k|         const auto shared_group = state.server_kex()->shared_group();
  261|  14.9k|         BOTAN_STATE_CHECK(shared_group && shared_group.value() != Group_Params::NONE);
  ------------------
  |  |   42|  14.9k|   do {                                                         \
  |  |   43|  29.7k|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:12): [True: 14.8k, False: 10]
  |  |  |  Branch (43:12): [True: 14.8k, False: 0]
  |  |  ------------------
  |  |   44|  14.9k|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|  14.9k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  262|       |
  263|  14.9k|         try {
  264|  14.9k|            auto shared_secret =
  265|  14.9k|               state.callbacks().tls_ephemeral_key_agreement(shared_group.value(), ka_key, client_pubkey, rng, policy);
  266|       |
  267|  14.9k|            if(ka_key.algo_name() == "DH") {
  ------------------
  |  Branch (267:16): [True: 0, False: 14.9k]
  ------------------
  268|      0|               shared_secret = CT::strip_leading_zeros(shared_secret);
  269|      0|            }
  270|       |
  271|  14.9k|            if(kex_algo == Kex_Algo::ECDH || kex_algo == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (271:16): [True: 5.84k, False: 9.06k]
  |  Branch (271:46): [True: 9.06k, False: 0]
  ------------------
  272|       |               // RFC 8422 - 5.11.
  273|       |               //   With X25519 and X448, a receiving party MUST check whether the
  274|       |               //   computed premaster secret is the all-zero value and abort the
  275|       |               //   handshake if so, as described in Section 6 of [RFC7748].
  276|  9.06k|               BOTAN_ASSERT_NOMSG(state.server_kex()->params().size() >= 3);
  ------------------
  |  |   60|  9.06k|   do {                                                                     \
  |  |   61|  9.06k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 9.06k]
  |  |  ------------------
  |  |   62|  9.06k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  9.06k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  277|  9.06k|               Group_Params group = static_cast<Group_Params>(state.server_kex()->params().at(2));
  278|  9.06k|               if(group == Group_Params::X25519 && CT::all_zeros(shared_secret.data(), shared_secret.size()).is_set()) {
  ------------------
  |  Branch (278:19): [True: 0, False: 9.06k]
  |  Branch (278:19): [True: 0, False: 9.06k]
  |  Branch (278:52): [True: 0, False: 0]
  ------------------
  279|      0|                  throw TLS_Exception(Alert::DecryptError, "Bad X25519 key exchange");
  280|      0|               }
  281|  9.06k|            }
  282|       |
  283|  14.9k|            if(kex_algo == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (283:16): [True: 9.06k, False: 5.84k]
  ------------------
  284|  9.06k|               append_tls_length_value(m_pre_master, shared_secret, 2);
  285|  9.06k|               append_tls_length_value(m_pre_master, psk.bits_of(), 2);
  286|  9.06k|            } else {
  287|  5.84k|               m_pre_master = shared_secret;
  288|  5.84k|            }
  289|  14.9k|         } catch(Invalid_Argument& e) {
  290|    148|            throw TLS_Exception(Alert::IllegalParameter, e.what());
  291|    148|         } catch(TLS_Exception& e) {
  292|       |            // NOLINTNEXTLINE(cert-err60-cpp)
  293|      1|            throw e;
  294|  5.68k|         } catch(std::exception&) {
  295|       |            /*
  296|       |            * Something failed in the DH/ECDH computation. To avoid possible
  297|       |            * attacks which are based on triggering and detecting some edge
  298|       |            * failure condition, randomize the pre-master output and carry on,
  299|       |            * allowing the protocol to fail later in the finished checks.
  300|       |            */
  301|  5.68k|            rng.random_vec(m_pre_master, ka_key.public_value().size());
  302|  5.68k|         }
  303|       |
  304|  14.7k|         reader.assert_done();
  305|  14.7k|      } else {
  306|     13|         throw Internal_Error("Client_Key_Exchange: Unknown key exchange negotiated");
  307|     13|      }
  308|  15.4k|   }
  309|  15.4k|}

_ZN5Botan3TLS20Hello_Verify_RequestC2ERKNSt3__16vectorIhNS2_9allocatorIhEEEENS2_17basic_string_viewIcNS2_11char_traitsIcEEEERKNS_11OctetStringE:
   34|  3.80k|                                           const SymmetricKey& secret_key) {
   35|  3.80k|   auto hmac = MessageAuthenticationCode::create_or_throw("HMAC(SHA-256)");
   36|  3.80k|   hmac->set_key(secret_key);
   37|       |
   38|  3.80k|   hmac->update_be(static_cast<uint64_t>(client_hello_bits.size()));
   39|  3.80k|   hmac->update(client_hello_bits);
   40|  3.80k|   hmac->update_be(static_cast<uint64_t>(client_identity.size()));
   41|  3.80k|   hmac->update(client_identity);
   42|       |
   43|  3.80k|   m_cookie.resize(hmac->output_length());
   44|  3.80k|   hmac->final(m_cookie.data());
   45|  3.80k|}
_ZNK5Botan3TLS20Hello_Verify_Request9serializeEv:
   47|  3.80k|std::vector<uint8_t> Hello_Verify_Request::serialize() const {
   48|       |   /* DTLS 1.2 server implementations SHOULD use DTLS version 1.0
   49|       |      regardless of the version of TLS that is expected to be
   50|       |      negotiated (RFC 6347, section 4.2.1)
   51|       |   */
   52|       |
   53|  3.80k|   Protocol_Version format_version(254, 255);  // DTLS 1.0
   54|       |
   55|  3.80k|   std::vector<uint8_t> bits;
   56|  3.80k|   bits.push_back(format_version.major_version());
   57|  3.80k|   bits.push_back(format_version.minor_version());
   58|  3.80k|   bits.push_back(static_cast<uint8_t>(m_cookie.size()));
   59|  3.80k|   bits += m_cookie;
   60|  3.80k|   return bits;
   61|  3.80k|}

_ZN5Botan3TLS19Server_Key_ExchangeC2ERNS0_12Handshake_IOERNS0_15Handshake_StateERKNS0_6PolicyERNS_19Credentials_ManagerERNS_21RandomNumberGeneratorEPKNS_11Private_KeyE:
   37|  20.8k|                                         const Private_Key* signing_key) {
   38|  20.8k|   const std::string hostname = state.client_hello()->sni_hostname();
   39|  20.8k|   const Kex_Algo kex_algo = state.ciphersuite().kex_method();
   40|       |
   41|  20.8k|   if(kex_algo == Kex_Algo::PSK || kex_algo == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (41:7): [True: 1.52k, False: 19.2k]
  |  Branch (41:36): [True: 19.2k, False: 0]
  ------------------
   42|  20.8k|      std::string identity_hint = creds.psk_identity_hint("tls-server", hostname);
   43|       |
   44|  20.8k|      append_tls_length_value(m_params, identity_hint, 2);
   45|  20.8k|   }
   46|       |
   47|  20.8k|   if(kex_algo == Kex_Algo::DH) {
  ------------------
  |  Branch (47:7): [True: 0, False: 20.8k]
  ------------------
   48|      0|      const std::vector<Group_Params> dh_groups = state.client_hello()->supported_dh_groups();
   49|       |
   50|      0|      m_shared_group = Group_Params::NONE;
   51|       |
   52|       |      /*
   53|       |      If the client does not send any DH groups in the supported groups
   54|       |      extension, but does offer DH ciphersuites, we select a group arbitrarily
   55|       |      */
   56|       |
   57|      0|      if(dh_groups.empty()) {
  ------------------
  |  Branch (57:10): [True: 0, False: 0]
  ------------------
   58|      0|         m_shared_group = policy.default_dh_group();
   59|      0|      } else {
   60|      0|         m_shared_group = policy.choose_key_exchange_group(dh_groups, {});
   61|      0|      }
   62|       |
   63|      0|      if(m_shared_group.value() == Group_Params::NONE) {
  ------------------
  |  Branch (63:10): [True: 0, False: 0]
  ------------------
   64|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Could not agree on a DH group with the client");
   65|      0|      }
   66|       |
   67|      0|      BOTAN_ASSERT(group_param_is_dh(m_shared_group.value()), "DH ciphersuite is using a finite field group");
  ------------------
  |  |   51|      0|   do {                                                                                 \
  |  |   52|      0|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   53|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   68|       |
   69|       |      // Note: TLS 1.2 allows defining and using arbitrary DH groups (additional
   70|       |      //       to the named and standardized ones). This API doesn't allow the
   71|       |      //       server to make use of that at the moment. TLS 1.3 does not
   72|       |      //       provide this flexibility!
   73|       |      //
   74|       |      // A possible implementation strategy in case one would ever need that:
   75|       |      // `Policy::default_dh_group()` could return a `std::variant<Group_Params,
   76|       |      // DL_Group>`, allowing it to define arbitrary groups.
   77|      0|      m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
   78|      0|      auto dh = dynamic_cast<DH_PrivateKey*>(m_kex_key.get());
   79|      0|      if(!dh) {
  ------------------
  |  Branch (79:10): [True: 0, False: 0]
  ------------------
   80|      0|         throw TLS_Exception(Alert::InternalError, "Application did not provide a Diffie-Hellman key");
   81|      0|      }
   82|       |
   83|      0|      append_tls_length_value(m_params, BigInt::encode(dh->get_int_field("p")), 2);
   84|      0|      append_tls_length_value(m_params, BigInt::encode(dh->get_int_field("g")), 2);
   85|      0|      append_tls_length_value(m_params, dh->public_value(), 2);
   86|  20.8k|   } else if(kex_algo == Kex_Algo::ECDH || kex_algo == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (86:14): [True: 0, False: 20.8k]
  |  Branch (86:44): [True: 19.2k, False: 1.52k]
  ------------------
   87|  19.2k|      const std::vector<Group_Params> ec_groups = state.client_hello()->supported_ecc_curves();
   88|       |
   89|  19.2k|      if(ec_groups.empty()) {
  ------------------
  |  Branch (89:10): [True: 0, False: 19.2k]
  ------------------
   90|      0|         throw Internal_Error("Client sent no ECC extension but we negotiated ECDH");
   91|      0|      }
   92|       |
   93|  19.2k|      m_shared_group = policy.choose_key_exchange_group(ec_groups, {});
   94|       |
   95|  19.2k|      if(m_shared_group.value() == Group_Params::NONE) {
  ------------------
  |  Branch (95:10): [True: 0, False: 19.2k]
  ------------------
   96|      0|         throw TLS_Exception(Alert::HandshakeFailure, "No shared ECC group with client");
   97|      0|      }
   98|       |
   99|  19.2k|      std::vector<uint8_t> ecdh_public_val;
  100|       |
  101|  19.2k|      if(m_shared_group.value() == Group_Params::X25519) {
  ------------------
  |  Branch (101:10): [True: 604, False: 18.6k]
  ------------------
  102|    604|         m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
  103|    604|         if(!m_kex_key) {
  ------------------
  |  Branch (103:13): [True: 0, False: 604]
  ------------------
  104|      0|            throw TLS_Exception(Alert::InternalError, "Application did not provide a X25519 key");
  105|      0|         }
  106|    604|         ecdh_public_val = m_kex_key->public_value();
  107|  18.6k|      } else {
  108|  18.6k|         m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
  109|  18.6k|         auto ecdh = dynamic_cast<ECDH_PrivateKey*>(m_kex_key.get());
  110|  18.6k|         if(!ecdh) {
  ------------------
  |  Branch (110:13): [True: 0, False: 18.6k]
  ------------------
  111|      0|            throw TLS_Exception(Alert::InternalError, "Application did not provide a EC-Diffie-Hellman key");
  112|      0|         }
  113|       |
  114|       |         // follow client's preference for point compression
  115|  18.6k|         ecdh_public_val =
  116|  18.6k|            ecdh->public_value(state.client_hello()->prefers_compressed_ec_points() ? EC_Point_Format::Compressed
  ------------------
  |  Branch (116:32): [True: 6, False: 18.6k]
  ------------------
  117|  18.6k|                                                                                    : EC_Point_Format::Uncompressed);
  118|  18.6k|      }
  119|       |
  120|  19.2k|      const uint16_t named_curve_id = static_cast<uint16_t>(m_shared_group.value());
  121|  19.2k|      m_params.push_back(3);  // named curve
  122|  19.2k|      m_params.push_back(get_byte<0>(named_curve_id));
  123|  19.2k|      m_params.push_back(get_byte<1>(named_curve_id));
  124|       |
  125|  19.2k|      append_tls_length_value(m_params, ecdh_public_val, 1);
  126|  19.2k|   } else if(kex_algo != Kex_Algo::PSK) {
  ------------------
  |  Branch (126:14): [True: 0, False: 1.52k]
  ------------------
  127|      0|      throw Internal_Error("Server_Key_Exchange: Unknown kex type " + kex_method_to_string(kex_algo));
  128|      0|   }
  129|       |
  130|  20.8k|   if(state.ciphersuite().signature_used()) {
  ------------------
  |  Branch (130:7): [True: 0, False: 20.8k]
  ------------------
  131|      0|      BOTAN_ASSERT(signing_key, "Signing key was set");
  ------------------
  |  |   51|      0|   do {                                                                                 \
  |  |   52|      0|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   53|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  132|       |
  133|      0|      std::pair<std::string, Signature_Format> format = state.choose_sig_format(*signing_key, m_scheme, false, policy);
  134|       |
  135|      0|      std::vector<uint8_t> buf = state.client_hello()->random();
  136|       |
  137|      0|      buf += state.server_hello()->random();
  138|      0|      buf += params();
  139|       |
  140|      0|      m_signature = state.callbacks().tls_sign_message(*signing_key, rng, format.first, format.second, buf);
  141|      0|   }
  142|       |
  143|  20.8k|   state.hash().update(io.send(*this));
  144|  20.8k|}
_ZNK5Botan3TLS19Server_Key_Exchange9serializeEv:
  193|  20.8k|std::vector<uint8_t> Server_Key_Exchange::serialize() const {
  194|  20.8k|   std::vector<uint8_t> buf = params();
  195|       |
  196|  20.8k|   if(!m_signature.empty()) {
  ------------------
  |  Branch (196:7): [True: 0, False: 20.8k]
  ------------------
  197|      0|      if(m_scheme.is_set()) {
  ------------------
  |  Branch (197:10): [True: 0, False: 0]
  ------------------
  198|      0|         buf.push_back(get_byte<0>(m_scheme.wire_code()));
  199|      0|         buf.push_back(get_byte<1>(m_scheme.wire_code()));
  200|      0|      }
  201|       |
  202|      0|      append_tls_length_value(buf, m_signature, 2);
  203|      0|   }
  204|       |
  205|  20.8k|   return buf;
  206|  20.8k|}
_ZNK5Botan3TLS19Server_Key_Exchange14server_kex_keyEv:
  235|  14.9k|const PK_Key_Agreement_Key& Server_Key_Exchange::server_kex_key() const {
  236|  14.9k|   BOTAN_ASSERT_NONNULL(m_kex_key);
  ------------------
  |  |   87|  14.9k|   do {                                                                                   \
  |  |   88|  14.9k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 14.9k]
  |  |  ------------------
  |  |   89|  14.9k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  14.9k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  237|  14.9k|   return *m_kex_key;
  238|  14.9k|}

_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_ModeC2ENS_10Cipher_DirENSt3__110unique_ptrINS_11BlockCipherENS3_14default_deleteIS5_EEEENS4_INS_25MessageAuthenticationCodeENS6_IS9_EEEEmmNS0_16Protocol_VersionEb:
   37|    287|      m_use_encrypt_then_mac(use_encrypt_then_mac) {
   38|    287|   m_tag_size = mac->output_length();
   39|    287|   m_block_size = cipher->block_size();
   40|       |
   41|    287|   m_iv_size = m_block_size;
   42|       |
   43|    287|   m_is_datagram = version.is_datagram_protocol();
   44|       |
   45|    287|   m_mac = std::move(mac);
   46|       |
   47|    287|   auto null_padding = std::make_unique<Null_Padding>();
   48|    287|   if(dir == Cipher_Dir::Encryption) {
  ------------------
  |  Branch (48:7): [True: 98, False: 189]
  ------------------
   49|     98|      m_cbc = std::make_unique<CBC_Encryption>(std::move(cipher), std::move(null_padding));
   50|    189|   } else {
   51|    189|      m_cbc = std::make_unique<CBC_Decryption>(std::move(cipher), std::move(null_padding));
   52|    189|   }
   53|    287|}
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode18valid_nonce_lengthEm:
   77|    210|bool TLS_CBC_HMAC_AEAD_Mode::valid_nonce_length(size_t nl) const {
   78|    210|   if(m_cbc_state.empty()) {
  ------------------
  |  Branch (78:7): [True: 184, False: 26]
  ------------------
   79|    184|      return nl == block_size();
   80|    184|   }
   81|     26|   return nl == iv_size();
   82|    210|}
_ZNK5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode8key_specEv:
   84|    287|Key_Length_Specification TLS_CBC_HMAC_AEAD_Mode::key_spec() const {
   85|    287|   return Key_Length_Specification(m_cipher_keylen + m_mac_keylen);
   86|    287|}
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode12key_scheduleEPKhm:
   92|    287|void TLS_CBC_HMAC_AEAD_Mode::key_schedule(const uint8_t key[], size_t keylen) {
   93|       |   // Both keys are of fixed length specified by the ciphersuite
   94|       |
   95|    287|   if(keylen != m_cipher_keylen + m_mac_keylen) {
  ------------------
  |  Branch (95:7): [True: 0, False: 287]
  ------------------
   96|      0|      throw Invalid_Key_Length(name(), keylen);
   97|      0|   }
   98|       |
   99|    287|   mac().set_key(&key[0], m_mac_keylen);
  100|    287|   cbc().set_key(&key[m_mac_keylen], m_cipher_keylen);
  101|    287|}
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode9start_msgEPKhm:
  103|    210|void TLS_CBC_HMAC_AEAD_Mode::start_msg(const uint8_t nonce[], size_t nonce_len) {
  104|    210|   if(!valid_nonce_length(nonce_len)) {
  ------------------
  |  Branch (104:7): [True: 0, False: 210]
  ------------------
  105|      0|      throw Invalid_IV_Length(name(), nonce_len);
  106|      0|   }
  107|       |
  108|    210|   m_msg.clear();
  109|       |
  110|    210|   if(nonce_len > 0) {
  ------------------
  |  Branch (110:7): [True: 210, False: 0]
  ------------------
  111|    210|      m_cbc_state.assign(nonce, nonce + nonce_len);
  112|    210|   }
  113|    210|}
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode11process_msgEPhm:
  115|    210|size_t TLS_CBC_HMAC_AEAD_Mode::process_msg(uint8_t buf[], size_t sz) {
  116|    210|   m_msg.insert(m_msg.end(), buf, buf + sz);
  117|    210|   return 0;
  118|    210|}
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode19assoc_data_with_lenEt:
  120|     73|std::vector<uint8_t> TLS_CBC_HMAC_AEAD_Mode::assoc_data_with_len(uint16_t len) {
  121|     73|   std::vector<uint8_t> ad = m_ad;
  122|     73|   BOTAN_ASSERT(ad.size() == 13, "Expected AAD size");
  ------------------
  |  |   51|     73|   do {                                                                                 \
  |  |   52|     73|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 73]
  |  |  ------------------
  |  |   53|     73|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     73|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  123|     73|   ad[11] = get_byte<0>(len);
  124|     73|   ad[12] = get_byte<1>(len);
  125|     73|   return ad;
  126|     73|}
_ZN5Botan3TLS22TLS_CBC_HMAC_AEAD_Mode21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
  128|    210|void TLS_CBC_HMAC_AEAD_Mode::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
  129|    210|   BOTAN_ARG_CHECK(idx == 0, "TLS 1.2 CBC/HMAC: cannot handle non-zero index in set_associated_data_n");
  ------------------
  |  |   30|    210|   do {                                                          \
  |  |   31|    210|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 210]
  |  |  ------------------
  |  |   32|    210|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    210|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  130|    210|   if(ad.size() != 13) {
  ------------------
  |  Branch (130:7): [True: 0, False: 210]
  ------------------
  131|      0|      throw Invalid_Argument("Invalid TLS AEAD associated data length");
  132|      0|   }
  133|    210|   m_ad.assign(ad.begin(), ad.end());
  134|    210|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption21set_associated_data_nEmNSt3__14spanIKhLm18446744073709551615EEE:
  136|    124|void TLS_CBC_HMAC_AEAD_Encryption::set_associated_data_n(size_t idx, std::span<const uint8_t> ad) {
  137|    124|   TLS_CBC_HMAC_AEAD_Mode::set_associated_data_n(idx, ad);
  138|       |
  139|    124|   if(use_encrypt_then_mac()) {
  ------------------
  |  Branch (139:7): [True: 12, False: 112]
  ------------------
  140|       |      // AAD hack for EtM
  141|       |      // EtM uses ciphertext size instead of plaintext size for AEAD input
  142|     12|      const uint16_t pt_size = make_uint16(assoc_data()[11], assoc_data()[12]);
  143|     12|      const uint16_t enc_size = static_cast<uint16_t>(round_up(iv_size() + pt_size + 1, block_size()));
  144|     12|      assoc_data()[11] = get_byte<0, uint16_t>(enc_size);
  145|     12|      assoc_data()[12] = get_byte<1, uint16_t>(enc_size);
  146|     12|   }
  147|    124|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption18cbc_encrypt_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEmm:
  151|    124|                                                      size_t padding_length) {
  152|       |   // We always do short padding:
  153|    124|   BOTAN_ASSERT_NOMSG(padding_length <= 16);
  ------------------
  |  |   60|    124|   do {                                                                     \
  |  |   61|    124|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 124]
  |  |  ------------------
  |  |   62|    124|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    124|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  154|       |
  155|    124|   buffer.resize(buffer.size() + padding_length);
  156|       |
  157|    124|   const uint8_t padding_val = static_cast<uint8_t>(padding_length - 1);
  158|       |
  159|    124|   CT::poison(&padding_val, 1);
  160|    124|   CT::poison(&padding_length, 1);
  161|    124|   CT::poison(buffer.data(), buffer.size());
  162|       |
  163|    124|   const size_t last_block_starts = buffer.size() - block_size();
  164|    124|   const size_t padding_starts = buffer.size() - padding_length;
  165|  1.89k|   for(size_t i = last_block_starts; i != buffer.size(); ++i) {
  ------------------
  |  Branch (165:38): [True: 1.76k, False: 124]
  ------------------
  166|  1.76k|      auto add_padding = CT::Mask<uint8_t>(CT::Mask<size_t>::is_gte(i, padding_starts));
  167|  1.76k|      buffer[i] = add_padding.select(padding_val, buffer[i]);
  168|  1.76k|   }
  169|       |
  170|    124|   CT::unpoison(padding_val);
  171|    124|   CT::unpoison(padding_length);
  172|    124|   CT::unpoison(buffer.data(), buffer.size());
  173|       |
  174|    124|   cbc().start(cbc_state());
  175|    124|   cbc().process(&buffer[offset], buffer.size() - offset);
  176|       |
  177|    124|   cbc_state().assign(buffer.data() + (buffer.size() - block_size()), buffer.data() + buffer.size());
  178|    124|}
_ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption13output_lengthEm:
  180|    124|size_t TLS_CBC_HMAC_AEAD_Encryption::output_length(size_t input_length) const {
  181|    124|   return round_up(input_length + 1 + (use_encrypt_then_mac() ? 0 : tag_size()), block_size()) +
  ------------------
  |  Branch (181:40): [True: 12, False: 112]
  ------------------
  182|    124|          (use_encrypt_then_mac() ? tag_size() : 0);
  ------------------
  |  Branch (182:12): [True: 12, False: 112]
  ------------------
  183|    124|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Encryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  185|    124|void TLS_CBC_HMAC_AEAD_Encryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  186|    124|   update(buffer, offset);
  187|       |
  188|    124|   const size_t msg_size = msg().size();
  189|       |
  190|    124|   const size_t input_size = msg_size + 1 + (use_encrypt_then_mac() ? 0 : tag_size());
  ------------------
  |  Branch (190:46): [True: 12, False: 112]
  ------------------
  191|    124|   const size_t enc_size = round_up(input_size, block_size());
  192|    124|   BOTAN_DEBUG_ASSERT(enc_size % block_size() == 0);
  ------------------
  |  |   99|    124|      do {                          \
  |  |  100|    124|      } while(0)
  |  |  ------------------
  |  |  |  Branch (100:15): [Folded - Ignored]
  |  |  ------------------
  ------------------
  193|       |
  194|    124|   const uint8_t padding_val = static_cast<uint8_t>(enc_size - input_size);
  195|    124|   const size_t padding_length = static_cast<size_t>(padding_val) + 1;
  196|       |
  197|    124|   buffer.reserve(offset + msg_size + padding_length + tag_size());
  198|    124|   buffer.resize(offset + msg_size);
  199|    124|   copy_mem(&buffer[offset], msg().data(), msg_size);
  200|       |
  201|    124|   mac().update(assoc_data());
  202|       |
  203|    124|   if(use_encrypt_then_mac()) {
  ------------------
  |  Branch (203:7): [True: 12, False: 112]
  ------------------
  204|     12|      if(iv_size() > 0) {
  ------------------
  |  Branch (204:10): [True: 12, False: 0]
  ------------------
  205|     12|         mac().update(cbc_state());
  206|     12|      }
  207|       |
  208|     12|      cbc_encrypt_record(buffer, offset, padding_length);
  209|     12|      mac().update(&buffer[offset], enc_size);
  210|     12|      buffer.resize(buffer.size() + tag_size());
  211|     12|      mac().final(&buffer[buffer.size() - tag_size()]);
  212|    112|   } else {
  213|    112|      mac().update(&buffer[offset], msg_size);
  214|    112|      buffer.resize(buffer.size() + tag_size());
  215|    112|      mac().final(&buffer[buffer.size() - tag_size()]);
  216|    112|      cbc_encrypt_record(buffer, offset, padding_length);
  217|    112|   }
  218|    124|}
_ZN5Botan3TLS21check_tls_cbc_paddingEPKhm:
  231|     72|uint16_t check_tls_cbc_padding(const uint8_t record[], size_t record_len) {
  232|     72|   if(record_len == 0 || record_len > 0xFFFF) {
  ------------------
  |  Branch (232:7): [True: 0, False: 72]
  |  Branch (232:26): [True: 0, False: 72]
  ------------------
  233|      0|      return 0;
  234|      0|   }
  235|       |
  236|     72|   const uint16_t rec16 = static_cast<uint16_t>(record_len);
  237|       |
  238|       |   /*
  239|       |   * TLS v1.0 and up require all the padding bytes be the same value
  240|       |   * and allows up to 255 bytes.
  241|       |   */
  242|       |
  243|     72|   const uint16_t to_check = std::min<uint16_t>(256, static_cast<uint16_t>(record_len));
  244|     72|   const uint8_t pad_byte = record[record_len - 1];
  245|     72|   const uint16_t pad_bytes = 1 + pad_byte;
  246|       |
  247|     72|   auto pad_invalid = CT::Mask<uint16_t>::is_lt(rec16, pad_bytes);
  248|       |
  249|  14.4k|   for(uint16_t i = rec16 - to_check; i != rec16; ++i) {
  ------------------
  |  Branch (249:39): [True: 14.3k, False: 72]
  ------------------
  250|  14.3k|      const uint16_t offset = rec16 - i;
  251|  14.3k|      const auto in_pad_range = CT::Mask<uint16_t>::is_lte(offset, pad_bytes);
  252|  14.3k|      const auto pad_correct = CT::Mask<uint16_t>::is_equal(record[i], pad_byte);
  253|  14.3k|      pad_invalid |= in_pad_range & ~pad_correct;
  254|  14.3k|   }
  255|       |
  256|     72|   return pad_invalid.if_not_set_return(pad_bytes);
  257|     72|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption18cbc_decrypt_recordEPhm:
  259|     72|void TLS_CBC_HMAC_AEAD_Decryption::cbc_decrypt_record(uint8_t record_contents[], size_t record_len) {
  260|     72|   if(record_len == 0 || record_len % block_size() != 0) {
  ------------------
  |  Branch (260:7): [True: 0, False: 72]
  |  Branch (260:26): [True: 0, False: 72]
  ------------------
  261|      0|      throw Decoding_Error("Received TLS CBC ciphertext with invalid length");
  262|      0|   }
  263|       |
  264|     72|   cbc().start(cbc_state());
  265|     72|   cbc_state().assign(record_contents + record_len - block_size(), record_contents + record_len);
  266|       |
  267|     72|   cbc().process(record_contents, record_len);
  268|     72|}
_ZNK5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption13output_lengthEm:
  270|     86|size_t TLS_CBC_HMAC_AEAD_Decryption::output_length(size_t /*input_length*/) const {
  271|       |   /*
  272|       |   * We don't know this because the padding is arbitrary
  273|       |   */
  274|     86|   return 0;
  275|     86|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption31perform_additional_compressionsEmm:
  319|     72|void TLS_CBC_HMAC_AEAD_Decryption::perform_additional_compressions(size_t plen, size_t padlen) {
  320|     72|   uint16_t block_size;
  321|     72|   uint16_t max_bytes_in_first_block;
  322|     72|   if(mac().name() == "HMAC(SHA-384)") {
  ------------------
  |  Branch (322:7): [True: 7, False: 65]
  ------------------
  323|      7|      block_size = 128;
  324|      7|      max_bytes_in_first_block = 111;
  325|     65|   } else {
  326|     65|      block_size = 64;
  327|     65|      max_bytes_in_first_block = 55;
  328|     65|   }
  329|       |   // number of maximum MACed bytes
  330|     72|   const uint16_t L1 = static_cast<uint16_t>(13 + plen - tag_size());
  331|       |   // number of current MACed bytes (L1 - padlen)
  332|       |   // Here the Lucky 13 paper is different because the padlen length in the paper
  333|       |   // does not count the last message byte.
  334|     72|   const uint16_t L2 = static_cast<uint16_t>(13 + plen - padlen - tag_size());
  335|       |   // From the paper, for SHA-256/SHA-1 compute: ceil((L1-55)/64) and ceil((L2-55)/64)
  336|       |   // ceil((L1-55)/64) = floor((L1+64-1-55)/64)
  337|       |   // Here we compute number of compressions for SHA-* in general
  338|     72|   const uint16_t max_compresssions = ((L1 + block_size - 1 - max_bytes_in_first_block) / block_size);
  339|     72|   const uint16_t current_compressions = ((L2 + block_size - 1 - max_bytes_in_first_block) / block_size);
  340|       |   // number of additional compressions we have to perform
  341|     72|   const uint16_t add_compressions = max_compresssions - current_compressions;
  342|     72|   const uint16_t equal = CT::Mask<uint16_t>::is_equal(max_compresssions, current_compressions).if_set_return(1);
  343|       |   // We compute the data length we need to achieve the number of compressions.
  344|       |   // If there are no compressions, we just add 55/111 dummy bytes so that no
  345|       |   // compression is performed.
  346|     72|   const uint16_t data_len = block_size * add_compressions + equal * max_bytes_in_first_block;
  347|     72|   std::vector<uint8_t> data(data_len);
  348|     72|   mac().update(data);
  349|       |   // we do not need to clear the MAC since the connection is broken anyway
  350|     72|}
_ZN5Botan3TLS28TLS_CBC_HMAC_AEAD_Decryption10finish_msgERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  352|     86|void TLS_CBC_HMAC_AEAD_Decryption::finish_msg(secure_vector<uint8_t>& buffer, size_t offset) {
  353|     86|   update(buffer, offset);
  354|     86|   buffer.resize(offset);
  355|       |
  356|     86|   const size_t record_len = msg().size();
  357|     86|   uint8_t* record_contents = msg().data();
  358|       |
  359|       |   // This early exit does not leak info because all the values compared are public
  360|     86|   if(record_len < tag_size() || (record_len - (use_encrypt_then_mac() ? tag_size() : 0)) % block_size() != 0) {
  ------------------
  |  Branch (360:7): [True: 0, False: 86]
  |  Branch (360:34): [True: 13, False: 73]
  |  Branch (360:49): [True: 2, False: 84]
  ------------------
  361|     13|      throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure");
  362|     13|   }
  363|       |
  364|     73|   if(use_encrypt_then_mac()) {
  ------------------
  |  Branch (364:7): [True: 1, False: 72]
  ------------------
  365|      1|      const size_t enc_size = record_len - tag_size();
  366|      1|      const size_t enc_iv_size = enc_size + iv_size();
  367|       |
  368|      1|      BOTAN_ASSERT_NOMSG(enc_iv_size <= 0xFFFF);
  ------------------
  |  |   60|      1|   do {                                                                     \
  |  |   61|      1|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 1]
  |  |  ------------------
  |  |   62|      1|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|      1|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  369|       |
  370|      1|      mac().update(assoc_data_with_len(static_cast<uint16_t>(enc_iv_size)));
  371|      1|      if(iv_size() > 0) {
  ------------------
  |  Branch (371:10): [True: 1, False: 0]
  ------------------
  372|      1|         mac().update(cbc_state());
  373|      1|      }
  374|      1|      mac().update(record_contents, enc_size);
  375|       |
  376|      1|      std::vector<uint8_t> mac_buf(tag_size());
  377|      1|      mac().final(mac_buf.data());
  378|       |
  379|      1|      const size_t mac_offset = enc_size;
  380|       |
  381|      1|      const bool mac_ok = constant_time_compare(&record_contents[mac_offset], mac_buf.data(), tag_size());
  382|       |
  383|      1|      if(!mac_ok) {
  ------------------
  |  Branch (383:10): [True: 1, False: 0]
  ------------------
  384|      1|         throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure");
  385|      1|      }
  386|       |
  387|      0|      cbc_decrypt_record(record_contents, enc_size);
  388|       |
  389|       |      // 0 if padding was invalid, otherwise 1 + padding_bytes
  390|      0|      const uint16_t pad_size = check_tls_cbc_padding(record_contents, enc_size);
  391|       |
  392|       |      // No oracle here, whoever sent us this had the key since MAC check passed
  393|      0|      if(pad_size == 0) {
  ------------------
  |  Branch (393:10): [True: 0, False: 0]
  ------------------
  394|      0|         throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure");
  395|      0|      }
  396|       |
  397|      0|      const uint8_t* plaintext_block = &record_contents[0];
  398|      0|      const size_t plaintext_length = enc_size - pad_size;
  399|       |
  400|      0|      buffer.insert(buffer.end(), plaintext_block, plaintext_block + plaintext_length);
  401|     72|   } else {
  402|     72|      cbc_decrypt_record(record_contents, record_len);
  403|       |
  404|     72|      CT::poison(record_contents, record_len);
  405|       |
  406|       |      // 0 if padding was invalid, otherwise 1 + padding_bytes
  407|     72|      uint16_t pad_size = check_tls_cbc_padding(record_contents, record_len);
  408|       |
  409|       |      /*
  410|       |      This mask is zero if there is not enough room in the packet to get a valid MAC.
  411|       |
  412|       |      We have to accept empty packets, since otherwise we are not compatible
  413|       |      with how OpenSSL's countermeasure for fixing BEAST in TLS 1.0 CBC works
  414|       |      (sending empty records, instead of 1/(n-1) splitting)
  415|       |      */
  416|       |
  417|       |      // We know the cast cannot overflow as pad_size <= 256 && tag_size <= 32
  418|     72|      const auto size_ok_mask =
  419|     72|         CT::Mask<uint16_t>::is_lte(static_cast<uint16_t>(tag_size() + pad_size), static_cast<uint16_t>(record_len));
  420|       |
  421|     72|      pad_size = size_ok_mask.if_set_return(pad_size);
  422|       |
  423|     72|      CT::unpoison(record_contents, record_len);
  424|       |
  425|       |      /*
  426|       |      This is unpoisoned sooner than it should. The pad_size leaks to plaintext_length and
  427|       |      then to the timing channel in the MAC computation described in the Lucky 13 paper.
  428|       |      */
  429|     72|      CT::unpoison(pad_size);
  430|       |
  431|     72|      const uint8_t* plaintext_block = &record_contents[0];
  432|     72|      const uint16_t plaintext_length = static_cast<uint16_t>(record_len - tag_size() - pad_size);
  433|       |
  434|     72|      mac().update(assoc_data_with_len(plaintext_length));
  435|     72|      mac().update(plaintext_block, plaintext_length);
  436|       |
  437|     72|      std::vector<uint8_t> mac_buf(tag_size());
  438|     72|      mac().final(mac_buf.data());
  439|       |
  440|     72|      const size_t mac_offset = record_len - (tag_size() + pad_size);
  441|       |
  442|     72|      const bool mac_ok = constant_time_compare(&record_contents[mac_offset], mac_buf.data(), tag_size());
  443|       |
  444|     72|      const auto ok_mask = size_ok_mask & CT::Mask<uint16_t>::expand(mac_ok) & CT::Mask<uint16_t>::expand(pad_size);
  445|       |
  446|     72|      CT::unpoison(ok_mask);
  447|       |
  448|     72|      if(ok_mask.is_set()) {
  ------------------
  |  Branch (448:10): [True: 0, False: 72]
  ------------------
  449|      0|         buffer.insert(buffer.end(), plaintext_block, plaintext_block + plaintext_length);
  450|     72|      } else {
  451|     72|         perform_additional_compressions(record_len, pad_size);
  452|       |
  453|       |         /*
  454|       |         * In DTLS case we have to finish computing the MAC since we require the
  455|       |         * MAC state be reset for future packets. This extra timing channel may
  456|       |         * be exploitable in a Lucky13 variant.
  457|       |         */
  458|     72|         if(is_datagram_protocol()) {
  ------------------
  |  Branch (458:13): [True: 0, False: 72]
  ------------------
  459|      0|            mac().final(mac_buf);
  460|      0|         }
  461|     72|         throw TLS_Exception(Alert::BadRecordMac, "Message authentication failure");
  462|     72|      }
  463|     72|   }
  464|     73|}

_ZN5Botan3TLS15Channel_Impl_12C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_21RandomNumberGeneratorEEERKNS3_IKNS0_6PolicyEEEbbm:
   36|  5.77k|      m_has_been_closed(false) {
   37|  5.77k|   BOTAN_ASSERT_NONNULL(m_callbacks);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   38|  5.77k|   BOTAN_ASSERT_NONNULL(m_session_manager);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   39|  5.77k|   BOTAN_ASSERT_NONNULL(m_rng);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   40|  5.77k|   BOTAN_ASSERT_NONNULL(m_policy);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   41|       |
   42|       |   /* epoch 0 is plaintext, thus null cipher state */
   43|  5.77k|   m_write_cipher_states[0] = nullptr;
   44|  5.77k|   m_read_cipher_states[0] = nullptr;
   45|       |
   46|  5.77k|   m_writebuf.reserve(reserved_io_buffer_size);
   47|  5.77k|   m_readbuf.reserve(reserved_io_buffer_size);
   48|  5.77k|}
_ZN5Botan3TLS15Channel_Impl_1211reset_stateEv:
   50|  3.41k|void Channel_Impl_12::reset_state() {
   51|  3.41k|   m_active_state.reset();
   52|  3.41k|   m_pending_state.reset();
   53|  3.41k|   m_readbuf.clear();
   54|  3.41k|   m_write_cipher_states.clear();
   55|  3.41k|   m_read_cipher_states.clear();
   56|  3.41k|}
_ZN5Botan3TLS15Channel_Impl_12D2Ev:
   73|  5.77k|Channel_Impl_12::~Channel_Impl_12() = default;
_ZNK5Botan3TLS15Channel_Impl_1216sequence_numbersEv:
   75|   143k|Connection_Sequence_Numbers& Channel_Impl_12::sequence_numbers() const {
   76|   143k|   BOTAN_ASSERT(m_sequence_numbers, "Have a sequence numbers object");
  ------------------
  |  |   51|   143k|   do {                                                                                 \
  |  |   52|   143k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 143k]
  |  |  ------------------
  |  |   53|   143k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|   143k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   77|   143k|   return *m_sequence_numbers;
   78|   143k|}
_ZNK5Botan3TLS15Channel_Impl_1223read_cipher_state_epochEt:
   80|    419|std::shared_ptr<Connection_Cipher_State> Channel_Impl_12::read_cipher_state_epoch(uint16_t epoch) const {
   81|    419|   auto i = m_read_cipher_states.find(epoch);
   82|    419|   if(i == m_read_cipher_states.end()) {
  ------------------
  |  Branch (82:7): [True: 92, False: 327]
  ------------------
   83|     92|      throw Internal_Error("TLS::Channel_Impl_12 No read cipherstate for epoch " + std::to_string(epoch));
   84|     92|   }
   85|    327|   return i->second;
   86|    419|}
_ZNK5Botan3TLS15Channel_Impl_1224write_cipher_state_epochEt:
   88|  70.3k|std::shared_ptr<Connection_Cipher_State> Channel_Impl_12::write_cipher_state_epoch(uint16_t epoch) const {
   89|  70.3k|   auto i = m_write_cipher_states.find(epoch);
   90|  70.3k|   if(i == m_write_cipher_states.end()) {
  ------------------
  |  Branch (90:7): [True: 0, False: 70.3k]
  ------------------
   91|      0|      throw Internal_Error("TLS::Channel_Impl_12 No write cipherstate for epoch " + std::to_string(epoch));
   92|      0|   }
   93|  70.3k|   return i->second;
   94|  70.3k|}
_ZN5Botan3TLS15Channel_Impl_1222create_handshake_stateENS0_16Protocol_VersionE:
  103|  24.0k|Handshake_State& Channel_Impl_12::create_handshake_state(Protocol_Version version) {
  104|  24.0k|   if(pending_state()) {
  ------------------
  |  Branch (104:7): [True: 0, False: 24.0k]
  ------------------
  105|      0|      throw Internal_Error("create_handshake_state called during handshake");
  106|      0|   }
  107|       |
  108|  24.0k|   if(auto active = active_state()) {
  ------------------
  |  Branch (108:12): [True: 0, False: 24.0k]
  ------------------
  109|      0|      Protocol_Version active_version = active->version();
  110|       |
  111|      0|      if(active_version.is_datagram_protocol() != version.is_datagram_protocol()) {
  ------------------
  |  Branch (111:10): [True: 0, False: 0]
  ------------------
  112|      0|         throw TLS_Exception(Alert::ProtocolVersion,
  113|      0|                             "Active state using version " + active_version.to_string() + " cannot change to " +
  114|      0|                                version.to_string() + " in pending");
  115|      0|      }
  116|      0|   }
  117|       |
  118|  24.0k|   if(!m_sequence_numbers) {
  ------------------
  |  Branch (118:7): [True: 5.47k, False: 18.5k]
  ------------------
  119|  5.47k|      if(version.is_datagram_protocol()) {
  ------------------
  |  Branch (119:10): [True: 708, False: 4.76k]
  ------------------
  120|    708|         m_sequence_numbers = std::make_unique<Datagram_Sequence_Numbers>();
  121|  4.76k|      } else {
  122|  4.76k|         m_sequence_numbers = std::make_unique<Stream_Sequence_Numbers>();
  123|  4.76k|      }
  124|  5.47k|   }
  125|       |
  126|  24.0k|   using namespace std::placeholders;
  127|       |
  128|  24.0k|   std::unique_ptr<Handshake_IO> io;
  129|  24.0k|   if(version.is_datagram_protocol()) {
  ------------------
  |  Branch (129:7): [True: 708, False: 23.3k]
  ------------------
  130|    708|      io =
  131|    708|         std::make_unique<Datagram_Handshake_IO>(std::bind(&Channel_Impl_12::send_record_under_epoch, this, _1, _2, _3),
  132|    708|                                                 sequence_numbers(),
  133|    708|                                                 static_cast<uint16_t>(policy().dtls_default_mtu()),
  134|    708|                                                 policy().dtls_initial_timeout(),
  135|    708|                                                 policy().dtls_maximum_timeout());
  136|  23.3k|   } else {
  137|  23.3k|      io = std::make_unique<Stream_Handshake_IO>(std::bind(&Channel_Impl_12::send_record, this, _1, _2));
  138|  23.3k|   }
  139|       |
  140|  24.0k|   m_pending_state = new_handshake_state(std::move(io));
  141|       |
  142|  24.0k|   if(auto active = active_state()) {
  ------------------
  |  Branch (142:12): [True: 0, False: 24.0k]
  ------------------
  143|      0|      m_pending_state->set_version(active->version());
  144|      0|   }
  145|       |
  146|  24.0k|   return *m_pending_state;
  147|  24.0k|}
_ZN5Botan3TLS15Channel_Impl_1225change_cipher_spec_readerENS0_15Connection_SideE:
  178|    515|void Channel_Impl_12::change_cipher_spec_reader(Connection_Side side) {
  179|    515|   auto pending = pending_state();
  180|       |
  181|    515|   BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello");
  ------------------
  |  |   51|    515|   do {                                                                                 \
  |  |   52|  1.03k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 515, False: 0]
  |  |  |  Branch (52:12): [True: 515, False: 0]
  |  |  ------------------
  |  |   53|    515|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    515|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  182|       |
  183|    515|   if(pending->server_hello()->compression_method() != 0) {
  ------------------
  |  Branch (183:7): [True: 0, False: 515]
  ------------------
  184|      0|      throw Internal_Error("Negotiated unknown compression algorithm");
  185|      0|   }
  186|       |
  187|    515|   sequence_numbers().new_read_cipher_state();
  188|       |
  189|    515|   const uint16_t epoch = sequence_numbers().current_read_epoch();
  190|       |
  191|    515|   BOTAN_ASSERT(!m_read_cipher_states.contains(epoch), "No read cipher state currently set for next epoch");
  ------------------
  |  |   51|    515|   do {                                                                                 \
  |  |   52|    515|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 515]
  |  |  ------------------
  |  |   53|    515|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    515|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  192|       |
  193|       |   // flip side as we are reading
  194|    515|   std::shared_ptr<Connection_Cipher_State> read_state(
  195|    515|      new Connection_Cipher_State(pending->version(),
  196|    515|                                  (side == Connection_Side::Client) ? Connection_Side::Server : Connection_Side::Client,
  ------------------
  |  Branch (196:35): [True: 0, False: 515]
  ------------------
  197|    515|                                  false,
  198|    515|                                  pending->ciphersuite(),
  199|    515|                                  pending->session_keys(),
  200|    515|                                  pending->server_hello()->supports_encrypt_then_mac()));
  201|       |
  202|    515|   m_read_cipher_states[epoch] = read_state;
  203|    515|}
_ZN5Botan3TLS15Channel_Impl_1225change_cipher_spec_writerENS0_15Connection_SideE:
  205|    245|void Channel_Impl_12::change_cipher_spec_writer(Connection_Side side) {
  206|    245|   auto pending = pending_state();
  207|       |
  208|    245|   BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello");
  ------------------
  |  |   51|    245|   do {                                                                                 \
  |  |   52|    490|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 245, False: 0]
  |  |  |  Branch (52:12): [True: 245, False: 0]
  |  |  ------------------
  |  |   53|    245|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    245|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|       |
  210|    245|   if(pending->server_hello()->compression_method() != 0) {
  ------------------
  |  Branch (210:7): [True: 0, False: 245]
  ------------------
  211|      0|      throw Internal_Error("Negotiated unknown compression algorithm");
  212|      0|   }
  213|       |
  214|    245|   sequence_numbers().new_write_cipher_state();
  215|       |
  216|    245|   const uint16_t epoch = sequence_numbers().current_write_epoch();
  217|       |
  218|    245|   BOTAN_ASSERT(!m_write_cipher_states.contains(epoch), "No write cipher state currently set for next epoch");
  ------------------
  |  |   51|    245|   do {                                                                                 \
  |  |   52|    245|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 245]
  |  |  ------------------
  |  |   53|    245|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    245|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  219|       |
  220|    245|   std::shared_ptr<Connection_Cipher_State> write_state(
  221|    245|      new Connection_Cipher_State(pending->version(),
  222|    245|                                  side,
  223|    245|                                  true,
  224|    245|                                  pending->ciphersuite(),
  225|    245|                                  pending->session_keys(),
  226|    245|                                  pending->server_hello()->supports_encrypt_then_mac()));
  227|       |
  228|    245|   m_write_cipher_states[epoch] = write_state;
  229|    245|}
_ZNK5Botan3TLS15Channel_Impl_129is_closedEv:
  238|  3.78k|bool Channel_Impl_12::is_closed() const { return m_has_been_closed; }
_ZN5Botan3TLS15Channel_Impl_1216activate_sessionEv:
  240|    245|void Channel_Impl_12::activate_session() {
  241|    245|   std::swap(m_active_state, m_pending_state);
  242|    245|   m_pending_state.reset();
  243|       |
  244|    245|   if(!m_active_state->version().is_datagram_protocol()) {
  ------------------
  |  Branch (244:7): [True: 245, False: 0]
  ------------------
  245|       |      // TLS is easy just remove all but the current state
  246|    245|      const uint16_t current_epoch = sequence_numbers().current_write_epoch();
  247|       |
  248|    245|      const auto not_current_epoch = [current_epoch](uint16_t epoch) { return (epoch != current_epoch); };
  249|       |
  250|    245|      map_remove_if(not_current_epoch, m_write_cipher_states);
  251|    245|      map_remove_if(not_current_epoch, m_read_cipher_states);
  252|    245|   }
  253|       |
  254|    245|   callbacks().tls_session_activated();
  255|    245|}
_ZN5Botan3TLS15Channel_Impl_129from_peerENSt3__14spanIKhLm18446744073709551615EEE:
  257|  5.77k|size_t Channel_Impl_12::from_peer(std::span<const uint8_t> data) {
  258|  5.77k|   const bool allow_epoch0_restart = m_is_datagram && m_is_server && policy().allow_dtls_epoch0_restart();
  ------------------
  |  Branch (258:38): [True: 862, False: 4.91k]
  |  Branch (258:55): [True: 862, False: 0]
  |  Branch (258:70): [True: 0, False: 862]
  ------------------
  259|       |
  260|  5.77k|   auto input = data.data();
  261|  5.77k|   auto input_size = data.size();
  262|       |
  263|  5.77k|   try {
  264|  71.3k|      while(input_size) {
  ------------------
  |  Branch (264:13): [True: 66.4k, False: 4.90k]
  ------------------
  265|  66.4k|         size_t consumed = 0;
  266|       |
  267|  66.4k|         auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); };
  268|       |
  269|  66.4k|         const Record_Header record = read_record(m_is_datagram,
  270|  66.4k|                                                  m_readbuf,
  271|  66.4k|                                                  input,
  272|  66.4k|                                                  input_size,
  273|  66.4k|                                                  consumed,
  274|  66.4k|                                                  m_record_buf,
  275|  66.4k|                                                  m_sequence_numbers.get(),
  276|  66.4k|                                                  get_epoch,
  277|  66.4k|                                                  allow_epoch0_restart);
  278|       |
  279|  66.4k|         const size_t needed = record.needed();
  280|       |
  281|  66.4k|         BOTAN_ASSERT(consumed > 0, "Got to eat something");
  ------------------
  |  |   51|  66.4k|   do {                                                                                 \
  |  |   52|  66.4k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 66.4k]
  |  |  ------------------
  |  |   53|  66.4k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  66.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  282|       |
  283|  66.4k|         BOTAN_ASSERT(consumed <= input_size, "Record reader consumed sane amount");
  ------------------
  |  |   51|  66.4k|   do {                                                                                 \
  |  |   52|  66.4k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 66.4k]
  |  |  ------------------
  |  |   53|  66.4k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  66.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  284|       |
  285|  66.4k|         input += consumed;
  286|  66.4k|         input_size -= consumed;
  287|       |
  288|  66.4k|         BOTAN_ASSERT(input_size == 0 || needed == 0, "Got a full record or consumed all input");
  ------------------
  |  |   51|  66.4k|   do {                                                                                 \
  |  |   52|   127k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 5.23k, False: 61.1k]
  |  |  |  Branch (52:12): [True: 61.1k, False: 0]
  |  |  ------------------
  |  |   53|  66.4k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  66.4k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  289|       |
  290|  66.4k|         if(input_size == 0 && needed != 0) {
  ------------------
  |  Branch (290:13): [True: 4.53k, False: 61.8k]
  |  Branch (290:32): [True: 506, False: 4.02k]
  ------------------
  291|    506|            return needed;  // need more data to complete record
  292|    506|         }
  293|       |
  294|       |         // Ignore invalid records in DTLS
  295|  65.8k|         if(m_is_datagram && record.type() == Record_Type::Invalid) {
  ------------------
  |  Branch (295:13): [True: 1.49k, False: 64.4k]
  |  Branch (295:30): [True: 262, False: 1.23k]
  ------------------
  296|    262|            return 0;
  297|    262|         }
  298|       |
  299|  65.6k|         if(m_record_buf.size() > MAX_PLAINTEXT_SIZE) {
  ------------------
  |  Branch (299:13): [True: 0, False: 65.6k]
  ------------------
  300|      0|            throw TLS_Exception(Alert::RecordOverflow, "TLS plaintext record is larger than allowed maximum");
  301|      0|         }
  302|       |
  303|  65.6k|         const bool epoch0_restart = m_is_datagram && record.epoch() == 0 && active_state();
  ------------------
  |  Branch (303:38): [True: 1.23k, False: 64.4k]
  |  Branch (303:55): [True: 1.23k, False: 0]
  |  Branch (303:78): [True: 0, False: 1.23k]
  ------------------
  304|  65.6k|         BOTAN_ASSERT_IMPLICATION(epoch0_restart, allow_epoch0_restart, "Allowed state");
  ------------------
  |  |   78|  65.6k|   do {                                                                                          \
  |  |   79|  65.6k|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 65.6k]
  |  |  |  Branch (79:21): [True: 0, False: 0]
  |  |  ------------------
  |  |   80|  65.6k|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  65.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  305|       |
  306|  65.6k|         const bool initial_record = epoch0_restart || (!pending_state() && !active_state());
  ------------------
  |  Branch (306:38): [True: 703, False: 64.9k]
  |  Branch (306:57): [True: 25.0k, False: 39.8k]
  |  Branch (306:77): [True: 25.0k, False: 0]
  ------------------
  307|       |
  308|  65.6k|         if(record.type() != Record_Type::Alert) {
  ------------------
  |  Branch (308:13): [True: 45.2k, False: 20.3k]
  ------------------
  309|  45.2k|            if(initial_record) {
  ------------------
  |  Branch (309:16): [True: 24.0k, False: 21.1k]
  ------------------
  310|       |               // For initial records just check for basic sanity
  311|  24.0k|               if(record.version().major_version() != 3 && record.version().major_version() != 0xFE) {
  ------------------
  |  Branch (311:19): [True: 765, False: 23.3k]
  |  Branch (311:19): [True: 14, False: 24.0k]
  |  Branch (311:60): [True: 14, False: 751]
  ------------------
  312|     14|                  throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version in initial record");
  313|     14|               }
  314|  24.0k|            } else if(auto pending = pending_state()) {
  ------------------
  |  Branch (314:28): [True: 21.1k, False: 0]
  ------------------
  315|  21.1k|               if(pending->server_hello() != nullptr && record.version() != pending->version()) {
  ------------------
  |  Branch (315:19): [True: 15.7k, False: 5.43k]
  |  Branch (315:19): [True: 2, False: 21.1k]
  |  Branch (315:57): [True: 2, False: 15.7k]
  ------------------
  316|      2|                  throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version");
  317|      2|               }
  318|  21.1k|            } else if(auto active = active_state()) {
  ------------------
  |  Branch (318:28): [True: 0, False: 0]
  ------------------
  319|      0|               if(record.version() != active->version()) {
  ------------------
  |  Branch (319:19): [True: 0, False: 0]
  ------------------
  320|      0|                  throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version");
  321|      0|               }
  322|      0|            }
  323|  45.2k|         }
  324|       |
  325|  65.6k|         if(record.type() == Record_Type::Handshake || record.type() == Record_Type::ChangeCipherSpec) {
  ------------------
  |  Branch (325:13): [True: 45.4k, False: 20.1k]
  |  Branch (325:56): [True: 436, False: 19.7k]
  ------------------
  326|  45.1k|            if(m_has_been_closed) {
  ------------------
  |  Branch (326:16): [True: 2, False: 45.1k]
  ------------------
  327|      2|               throw TLS_Exception(Alert::UnexpectedMessage, "Received handshake data after connection closure");
  328|      2|            }
  329|  45.1k|            process_handshake_ccs(m_record_buf, record.sequence(), record.type(), record.version(), epoch0_restart);
  330|  45.1k|         } else if(record.type() == Record_Type::ApplicationData) {
  ------------------
  |  Branch (330:20): [True: 11, False: 20.4k]
  ------------------
  331|     11|            if(m_has_been_closed) {
  ------------------
  |  Branch (331:16): [True: 2, False: 9]
  ------------------
  332|      2|               throw TLS_Exception(Alert::UnexpectedMessage, "Received application data after connection closure");
  333|      2|            }
  334|      9|            if(pending_state() != nullptr) {
  ------------------
  |  Branch (334:16): [True: 7, False: 2]
  ------------------
  335|      7|               throw TLS_Exception(Alert::UnexpectedMessage, "Can't interleave application and handshake data");
  336|      7|            }
  337|      2|            process_application_data(record.sequence(), m_record_buf);
  338|  20.4k|         } else if(record.type() == Record_Type::Alert) {
  ------------------
  |  Branch (338:20): [True: 19.6k, False: 781]
  ------------------
  339|  19.6k|            process_alert(m_record_buf);
  340|  19.6k|         } else if(record.type() != Record_Type::Invalid) {
  ------------------
  |  Branch (340:20): [True: 78, False: 703]
  ------------------
  341|     78|            throw Unexpected_Message("Unexpected record type " + std::to_string(static_cast<size_t>(record.type())) +
  342|     78|                                     " from counterparty");
  343|     78|         }
  344|  65.6k|      }
  345|       |
  346|  4.90k|      return 0;  // on a record boundary
  347|  5.77k|   } catch(TLS_Exception& e) {
  348|  1.24k|      send_fatal_alert(e.type());
  349|  1.24k|      throw;
  350|  1.24k|   } catch(Invalid_Authentication_Tag&) {
  351|    231|      send_fatal_alert(Alert::BadRecordMac);
  352|    231|      throw;
  353|  1.75k|   } catch(Decoding_Error&) {
  354|  1.75k|      send_fatal_alert(Alert::DecodeError);
  355|  1.75k|      throw;
  356|  1.75k|   } catch(...) {
  357|    182|      send_fatal_alert(Alert::InternalError);
  358|    182|      throw;
  359|    182|   }
  360|  5.77k|}
_ZN5Botan3TLS15Channel_Impl_1221process_handshake_ccsERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEmNS0_11Record_TypeENS0_16Protocol_VersionEb:
  366|  45.1k|                                            bool epoch0_restart) {
  367|  45.1k|   if(!m_pending_state) {
  ------------------
  |  Branch (367:7): [True: 24.0k, False: 21.1k]
  ------------------
  368|       |      // No pending handshake, possibly new:
  369|  24.0k|      if(record_version.is_datagram_protocol() && !epoch0_restart) {
  ------------------
  |  Branch (369:10): [True: 708, False: 23.3k]
  |  Branch (369:51): [True: 708, False: 0]
  ------------------
  370|    708|         if(m_sequence_numbers) {
  ------------------
  |  Branch (370:13): [True: 0, False: 708]
  ------------------
  371|       |            /*
  372|       |            * Might be a peer retransmit under epoch - 1 in which
  373|       |            * case we must retransmit last flight
  374|       |            */
  375|      0|            sequence_numbers().read_accept(record_sequence);
  376|       |
  377|      0|            const uint16_t epoch = record_sequence >> 48;
  378|       |
  379|      0|            if(epoch == sequence_numbers().current_read_epoch()) {
  ------------------
  |  Branch (379:16): [True: 0, False: 0]
  ------------------
  380|      0|               create_handshake_state(record_version);
  381|      0|            } else if(epoch == sequence_numbers().current_read_epoch() - 1) {
  ------------------
  |  Branch (381:23): [True: 0, False: 0]
  ------------------
  382|      0|               BOTAN_ASSERT(m_active_state, "Have active state here");
  ------------------
  |  |   51|      0|   do {                                                                                 \
  |  |   52|      0|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   53|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  383|      0|               m_active_state->handshake_io().add_record(record.data(), record.size(), record_type, record_sequence);
  384|      0|            }
  385|    708|         } else {
  386|    708|            create_handshake_state(record_version);
  387|    708|         }
  388|  23.3k|      } else {
  389|  23.3k|         create_handshake_state(record_version);
  390|  23.3k|      }
  391|  24.0k|   }
  392|       |
  393|       |   // May have been created in above conditional
  394|  45.1k|   if(m_pending_state) {
  ------------------
  |  Branch (394:7): [True: 45.1k, False: 0]
  ------------------
  395|  45.1k|      m_pending_state->handshake_io().add_record(record.data(), record.size(), record_type, record_sequence);
  396|       |
  397|  87.3k|      while(auto pending = m_pending_state.get()) {
  ------------------
  |  Branch (397:18): [True: 84.7k, False: 2.57k]
  ------------------
  398|  84.7k|         auto msg = pending->get_next_handshake_msg();
  399|       |
  400|  84.7k|         if(msg.first == Handshake_Type::None) {  // no full handshake yet
  ------------------
  |  Branch (400:13): [True: 42.3k, False: 42.4k]
  ------------------
  401|  42.3k|            break;
  402|  42.3k|         }
  403|       |
  404|  42.4k|         process_handshake_msg(active_state(), *pending, msg.first, msg.second, epoch0_restart);
  405|       |
  406|  42.4k|         if(!m_pending_state) {
  ------------------
  |  Branch (406:13): [True: 245, False: 42.1k]
  ------------------
  407|    245|            break;
  408|    245|         }
  409|  42.4k|      }
  410|  45.1k|   }
  411|  45.1k|}
_ZN5Botan3TLS15Channel_Impl_1224process_application_dataEmRKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  413|      2|void Channel_Impl_12::process_application_data(uint64_t seq_no, const secure_vector<uint8_t>& record) {
  414|      2|   if(!active_state()) {
  ------------------
  |  Branch (414:7): [True: 2, False: 0]
  ------------------
  415|      2|      throw Unexpected_Message("Application data before handshake done");
  416|      2|   }
  417|       |
  418|      0|   callbacks().tls_record_received(seq_no, record);
  419|      0|}
_ZN5Botan3TLS15Channel_Impl_1213process_alertERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
  421|  19.6k|void Channel_Impl_12::process_alert(const secure_vector<uint8_t>& record) {
  422|  19.6k|   Alert alert_msg(record);
  423|       |
  424|  19.6k|   if(alert_msg.type() == Alert::NoRenegotiation) {
  ------------------
  |  Branch (424:7): [True: 19.0k, False: 633]
  ------------------
  425|  19.0k|      m_pending_state.reset();
  426|  19.0k|   }
  427|       |
  428|  19.6k|   callbacks().tls_alert(alert_msg);
  429|       |
  430|  19.6k|   if(alert_msg.is_fatal()) {
  ------------------
  |  Branch (430:7): [True: 630, False: 19.0k]
  ------------------
  431|    630|      if(auto active = active_state()) {
  ------------------
  |  Branch (431:15): [True: 0, False: 630]
  ------------------
  432|      0|         const auto& session_id = active->server_hello()->session_id();
  433|      0|         if(!session_id.empty()) {
  ------------------
  |  Branch (433:13): [True: 0, False: 0]
  ------------------
  434|      0|            session_manager().remove(session_id);
  435|      0|         }
  436|      0|      }
  437|    630|   }
  438|       |
  439|  19.6k|   if(alert_msg.type() == Alert::CloseNotify) {
  ------------------
  |  Branch (439:7): [True: 377, False: 19.2k]
  ------------------
  440|       |      // TLS 1.2 requires us to immediately react with our "close_notify",
  441|       |      // the return value of the application's callback has no effect on that.
  442|    377|      callbacks().tls_peer_closed_connection();
  443|    377|      send_warning_alert(Alert::CloseNotify);  // reply in kind
  444|    377|   }
  445|       |
  446|  19.6k|   if(alert_msg.type() == Alert::CloseNotify || alert_msg.is_fatal()) {
  ------------------
  |  Branch (446:7): [True: 404, False: 19.2k]
  |  Branch (446:49): [True: 259, False: 19.0k]
  ------------------
  447|    636|      m_has_been_closed = true;
  448|    636|   }
  449|  19.6k|}
_ZN5Botan3TLS15Channel_Impl_1212write_recordEPNS0_23Connection_Cipher_StateEtNS0_11Record_TypeEPKhm:
  455|  70.3k|                                   size_t length) {
  456|  70.3k|   BOTAN_ASSERT(m_pending_state || m_active_state, "Some connection state exists");
  ------------------
  |  |   51|  70.3k|   do {                                                                                 \
  |  |   52|  70.5k|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:12): [True: 70.2k, False: 144]
  |  |  |  Branch (52:12): [True: 122, False: 22]
  |  |  ------------------
  |  |   53|  70.3k|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|  70.3k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  457|       |
  458|  70.3k|   const Protocol_Version record_version =
  459|  70.3k|      (m_pending_state) ? (m_pending_state->version()) : (m_active_state->version());
  ------------------
  |  Branch (459:7): [True: 70.2k, False: 144]
  ------------------
  460|       |
  461|  70.3k|   const uint64_t next_seq = sequence_numbers().next_write_sequence(epoch);
  462|       |
  463|  70.3k|   if(cipher_state == nullptr) {
  ------------------
  |  Branch (463:7): [True: 69.9k, False: 389]
  ------------------
  464|  69.9k|      TLS::write_unencrypted_record(m_writebuf, record_type, record_version, next_seq, input, length);
  465|  69.9k|   } else {
  466|    389|      TLS::write_record(m_writebuf, record_type, record_version, next_seq, input, length, *cipher_state, rng());
  467|    389|   }
  468|       |
  469|  70.3k|   callbacks().tls_emit_data(m_writebuf);
  470|  70.3k|}
_ZN5Botan3TLS15Channel_Impl_1217send_record_arrayEtNS0_11Record_TypeEPKhm:
  472|  70.3k|void Channel_Impl_12::send_record_array(uint16_t epoch, Record_Type type, const uint8_t input[], size_t length) {
  473|  70.3k|   if(length == 0) {
  ------------------
  |  Branch (473:7): [True: 0, False: 70.3k]
  ------------------
  474|      0|      return;
  475|      0|   }
  476|       |
  477|  70.3k|   auto cipher_state = write_cipher_state_epoch(epoch);
  478|       |
  479|   140k|   while(length) {
  ------------------
  |  Branch (479:10): [True: 70.3k, False: 70.3k]
  ------------------
  480|  70.3k|      const size_t sending = std::min<size_t>(length, MAX_PLAINTEXT_SIZE);
  481|  70.3k|      write_record(cipher_state.get(), epoch, type, input, sending);
  482|       |
  483|  70.3k|      input += sending;
  484|  70.3k|      length -= sending;
  485|  70.3k|   }
  486|  70.3k|}
_ZN5Botan3TLS15Channel_Impl_1211send_recordENS0_11Record_TypeERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  488|  70.3k|void Channel_Impl_12::send_record(Record_Type record_type, const std::vector<uint8_t>& record) {
  489|  70.3k|   send_record_array(sequence_numbers().current_write_epoch(), record_type, record.data(), record.size());
  490|  70.3k|}
_ZN5Botan3TLS15Channel_Impl_1223send_record_under_epochEtNS0_11Record_TypeERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  494|     31|                                              const std::vector<uint8_t>& record) {
  495|     31|   send_record_array(epoch, record_type, record.data(), record.size());
  496|     31|}
_ZN5Botan3TLS15Channel_Impl_1210send_alertERKNS0_5AlertE:
  506|  3.78k|void Channel_Impl_12::send_alert(const Alert& alert) {
  507|  3.78k|   const bool ready_to_send_anything = !is_closed() && m_sequence_numbers;
  ------------------
  |  Branch (507:40): [True: 3.41k, False: 376]
  |  Branch (507:56): [True: 3.27k, False: 137]
  ------------------
  508|  3.78k|   if(alert.is_valid() && ready_to_send_anything) {
  ------------------
  |  Branch (508:7): [True: 3.78k, False: 0]
  |  Branch (508:27): [True: 3.27k, False: 513]
  ------------------
  509|  3.27k|      try {
  510|  3.27k|         send_record(Record_Type::Alert, alert.serialize());
  511|  3.27k|      } catch(...) { /* swallow it */
  512|     22|      }
  513|  3.27k|   }
  514|       |
  515|  3.78k|   if(alert.type() == Alert::NoRenegotiation) {
  ------------------
  |  Branch (515:7): [True: 0, False: 3.78k]
  ------------------
  516|      0|      m_pending_state.reset();
  517|      0|   }
  518|       |
  519|  3.78k|   if(alert.is_fatal()) {
  ------------------
  |  Branch (519:7): [True: 3.41k, False: 377]
  ------------------
  520|  3.41k|      if(auto active = active_state()) {
  ------------------
  |  Branch (520:15): [True: 122, False: 3.28k]
  ------------------
  521|    122|         const auto& session_id = active->server_hello()->session_id();
  522|    122|         if(!session_id.empty()) {
  ------------------
  |  Branch (522:13): [True: 122, False: 0]
  ------------------
  523|    122|            session_manager().remove(Session_ID(session_id));
  524|    122|         }
  525|    122|      }
  526|  3.41k|      reset_state();
  527|  3.41k|   }
  528|       |
  529|  3.78k|   if(alert.type() == Alert::CloseNotify || alert.is_fatal()) {
  ------------------
  |  Branch (529:7): [True: 377, False: 3.41k]
  |  Branch (529:45): [True: 3.41k, False: 0]
  ------------------
  530|  3.78k|      m_has_been_closed = true;
  531|  3.78k|   }
  532|  3.78k|}
_ZN5Botan3TLS15Channel_Impl_1226secure_renegotiation_checkEPKNS0_15Client_Hello_12E:
  534|  21.1k|void Channel_Impl_12::secure_renegotiation_check(const Client_Hello_12* client_hello) {
  535|  21.1k|   const bool secure_renegotiation = client_hello->secure_renegotiation();
  536|       |
  537|  21.1k|   if(auto active = active_state()) {
  ------------------
  |  Branch (537:12): [True: 0, False: 21.1k]
  ------------------
  538|      0|      const bool active_sr = active->client_hello()->secure_renegotiation();
  539|       |
  540|      0|      if(active_sr != secure_renegotiation) {
  ------------------
  |  Branch (540:10): [True: 0, False: 0]
  ------------------
  541|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Client changed its mind about secure renegotiation");
  542|      0|      }
  543|      0|   }
  544|       |
  545|  21.1k|   if(secure_renegotiation) {
  ------------------
  |  Branch (545:7): [True: 10.4k, False: 10.7k]
  ------------------
  546|  10.4k|      const std::vector<uint8_t>& data = client_hello->renegotiation_info();
  547|       |
  548|  10.4k|      if(data != secure_renegotiation_data_for_client_hello()) {
  ------------------
  |  Branch (548:10): [True: 1, False: 10.4k]
  ------------------
  549|      1|         throw TLS_Exception(Alert::HandshakeFailure, "Client sent bad values for secure renegotiation");
  550|      1|      }
  551|  10.4k|   }
  552|  21.1k|}
_ZN5Botan3TLS15Channel_Impl_1226secure_renegotiation_checkEPKNS0_15Server_Hello_12E:
  554|  20.9k|void Channel_Impl_12::secure_renegotiation_check(const Server_Hello_12* server_hello) {
  555|  20.9k|   const bool secure_renegotiation = server_hello->secure_renegotiation();
  556|       |
  557|  20.9k|   if(auto active = active_state()) {
  ------------------
  |  Branch (557:12): [True: 0, False: 20.9k]
  ------------------
  558|      0|      const bool active_sr = active->server_hello()->secure_renegotiation();
  559|       |
  560|      0|      if(active_sr != secure_renegotiation) {
  ------------------
  |  Branch (560:10): [True: 0, False: 0]
  ------------------
  561|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Server changed its mind about secure renegotiation");
  562|      0|      }
  563|      0|   }
  564|       |
  565|  20.9k|   if(secure_renegotiation) {
  ------------------
  |  Branch (565:7): [True: 10.4k, False: 10.5k]
  ------------------
  566|  10.4k|      const std::vector<uint8_t>& data = server_hello->renegotiation_info();
  567|       |
  568|  10.4k|      if(data != secure_renegotiation_data_for_server_hello()) {
  ------------------
  |  Branch (568:10): [True: 0, False: 10.4k]
  ------------------
  569|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Server sent bad values for secure renegotiation");
  570|      0|      }
  571|  10.4k|   }
  572|  20.9k|}
_ZNK5Botan3TLS15Channel_Impl_1242secure_renegotiation_data_for_client_helloEv:
  574|  10.4k|std::vector<uint8_t> Channel_Impl_12::secure_renegotiation_data_for_client_hello() const {
  575|  10.4k|   if(auto active = active_state()) {
  ------------------
  |  Branch (575:12): [True: 0, False: 10.4k]
  ------------------
  576|      0|      return active->client_finished()->verify_data();
  577|      0|   }
  578|  10.4k|   return std::vector<uint8_t>();
  579|  10.4k|}
_ZNK5Botan3TLS15Channel_Impl_1242secure_renegotiation_data_for_server_helloEv:
  581|  31.4k|std::vector<uint8_t> Channel_Impl_12::secure_renegotiation_data_for_server_hello() const {
  582|  31.4k|   if(auto active = active_state()) {
  ------------------
  |  Branch (582:12): [True: 0, False: 31.4k]
  ------------------
  583|      0|      std::vector<uint8_t> buf = active->client_finished()->verify_data();
  584|      0|      buf += active->server_finished()->verify_data();
  585|      0|      return buf;
  586|      0|   }
  587|       |
  588|  31.4k|   return std::vector<uint8_t>();
  589|  31.4k|}
tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_1216activate_sessionEvENK3$_0clEt:
  248|    980|      const auto not_current_epoch = [current_epoch](uint16_t epoch) { return (epoch != current_epoch); };
tls_channel_impl_12.cpp:_ZZN5Botan3TLS15Channel_Impl_129from_peerENSt3__14spanIKhLm18446744073709551615EEEENK3$_1clEt:
  267|    419|         auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); };

_ZNK5Botan3TLS14Handshake_Hash5finalENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   17|  1.67k|secure_vector<uint8_t> Handshake_Hash::final(std::string_view mac_algo) const {
   18|  1.67k|   std::string hash_algo(mac_algo);
   19|  1.67k|   if(hash_algo == "SHA-1") {
  ------------------
  |  Branch (19:7): [True: 435, False: 1.24k]
  ------------------
   20|    435|      hash_algo = "SHA-256";
   21|    435|   }
   22|       |
   23|  1.67k|   auto hash = HashFunction::create_or_throw(hash_algo);
   24|  1.67k|   hash->update(m_data);
   25|  1.67k|   return hash->final();
   26|  1.67k|}

_ZNK5Botan3TLS19Stream_Handshake_IO22initial_record_versionEv:
   36|  23.3k|Protocol_Version Stream_Handshake_IO::initial_record_version() const { return Protocol_Version::TLS_V12; }
_ZN5Botan3TLS19Stream_Handshake_IO10add_recordEPKhmNS0_11Record_TypeEm:
   41|  44.1k|                                     uint64_t /*sequence_number*/) {
   42|  44.1k|   if(record_type == Record_Type::Handshake) {
  ------------------
  |  Branch (42:7): [True: 43.7k, False: 398]
  ------------------
   43|  43.7k|      m_queue.insert(m_queue.end(), record, record + record_len);
   44|  43.7k|   } else if(record_type == Record_Type::ChangeCipherSpec) {
  ------------------
  |  Branch (44:14): [True: 398, False: 0]
  ------------------
   45|    398|      if(record_len != 1 || record[0] != 1) {
  ------------------
  |  Branch (45:10): [True: 4, False: 394]
  |  Branch (45:29): [True: 13, False: 381]
  ------------------
   46|     17|         throw Decoding_Error("Invalid ChangeCipherSpec");
   47|     17|      }
   48|       |
   49|       |      // Pretend it's a regular handshake message of zero length
   50|    381|      const uint8_t ccs_hs[] = {static_cast<uint8_t>(Handshake_Type::HandshakeCCS), 0, 0, 0};
   51|    381|      m_queue.insert(m_queue.end(), ccs_hs, ccs_hs + sizeof(ccs_hs));
   52|    381|   } else {
   53|      0|      throw Decoding_Error("Unknown message type " + std::to_string(static_cast<size_t>(record_type)) +
   54|      0|                           " in handshake processing");
   55|      0|   }
   56|  44.1k|}
_ZN5Botan3TLS19Stream_Handshake_IO15get_next_recordEb:
   58|  83.8k|std::pair<Handshake_Type, std::vector<uint8_t>> Stream_Handshake_IO::get_next_record(bool /*expecting_ccs*/) {
   59|  83.8k|   if(m_queue.size() >= 4) {
  ------------------
  |  Branch (59:7): [True: 49.8k, False: 33.9k]
  ------------------
   60|  49.8k|      const size_t length = 4 + make_uint32(0, m_queue[1], m_queue[2], m_queue[3]);
   61|       |
   62|  49.8k|      if(m_queue.size() >= length) {
  ------------------
  |  Branch (62:10): [True: 42.3k, False: 7.50k]
  ------------------
   63|  42.3k|         Handshake_Type type = static_cast<Handshake_Type>(m_queue[0]);
   64|       |
   65|  42.3k|         if(type == Handshake_Type::None) {
  ------------------
  |  Branch (65:13): [True: 2, False: 42.3k]
  ------------------
   66|      2|            throw Decoding_Error("Invalid handshake message type");
   67|      2|         }
   68|       |
   69|  42.3k|         std::vector<uint8_t> contents(m_queue.begin() + 4, m_queue.begin() + length);
   70|       |
   71|  42.3k|         m_queue.erase(m_queue.begin(), m_queue.begin() + length);
   72|       |
   73|  42.3k|         return std::make_pair(type, contents);
   74|  42.3k|      }
   75|  49.8k|   }
   76|       |
   77|  41.4k|   return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
   78|  83.8k|}
_ZNK5Botan3TLS19Stream_Handshake_IO6formatERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeE:
   80|   108k|std::vector<uint8_t> Stream_Handshake_IO::format(const std::vector<uint8_t>& msg, Handshake_Type type) const {
   81|   108k|   std::vector<uint8_t> send_buf(4 + msg.size());
   82|       |
   83|   108k|   const size_t buf_size = msg.size();
   84|       |
   85|   108k|   send_buf[0] = static_cast<uint8_t>(type);
   86|       |
   87|   108k|   store_be24(&send_buf[1], buf_size);
   88|       |
   89|   108k|   if(!msg.empty()) {
  ------------------
  |  Branch (89:7): [True: 87.6k, False: 20.8k]
  ------------------
   90|  87.6k|      copy_mem(&send_buf[4], msg.data(), msg.size());
   91|  87.6k|   }
   92|       |
   93|   108k|   return send_buf;
   94|   108k|}
_ZN5Botan3TLS19Stream_Handshake_IO4sendERKNS0_17Handshake_MessageE:
  100|  67.0k|std::vector<uint8_t> Stream_Handshake_IO::send(const Handshake_Message& msg) {
  101|  67.0k|   const std::vector<uint8_t> msg_bits = msg.serialize();
  102|       |
  103|  67.0k|   if(msg.type() == Handshake_Type::HandshakeCCS) {
  ------------------
  |  Branch (103:7): [True: 245, False: 66.8k]
  ------------------
  104|    245|      m_send_hs(Record_Type::ChangeCipherSpec, msg_bits);
  105|    245|      return std::vector<uint8_t>();  // not included in handshake hashes
  106|    245|   }
  107|       |
  108|  66.8k|   auto buf = format(msg_bits, msg.wire_type());
  109|  66.8k|   m_send_hs(Record_Type::Handshake, buf);
  110|  66.8k|   return buf;
  111|  67.0k|}
_ZNK5Botan3TLS21Datagram_Handshake_IO22initial_record_versionEv:
  113|    708|Protocol_Version Datagram_Handshake_IO::initial_record_version() const { return Protocol_Version::DTLS_V12; }
_ZNK5Botan3TLS21Datagram_Handshake_IO14have_more_dataEv:
  141|     32|bool Datagram_Handshake_IO::have_more_data() const { return false; }
_ZN5Botan3TLS21Datagram_Handshake_IO10add_recordEPKhmNS0_11Record_TypeEm:
  167|  1.03k|                                       uint64_t record_sequence) {
  168|  1.03k|   const uint16_t epoch = static_cast<uint16_t>(record_sequence >> 48);
  169|       |
  170|  1.03k|   if(record_type == Record_Type::ChangeCipherSpec) {
  ------------------
  |  Branch (170:7): [True: 37, False: 994]
  ------------------
  171|     37|      if(record_len != 1 || record[0] != 1) {
  ------------------
  |  Branch (171:10): [True: 8, False: 29]
  |  Branch (171:29): [True: 7, False: 22]
  ------------------
  172|     15|         throw Decoding_Error("Invalid ChangeCipherSpec");
  173|     15|      }
  174|       |
  175|       |      // TODO: check this is otherwise empty
  176|     22|      m_ccs_epochs.insert(epoch);
  177|     22|      return;
  178|     37|   }
  179|       |
  180|    994|   const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
  181|       |
  182|  3.01k|   while(record_len) {
  ------------------
  |  Branch (182:10): [True: 2.30k, False: 712]
  ------------------
  183|  2.30k|      if(record_len < DTLS_HANDSHAKE_HEADER_LEN) {
  ------------------
  |  Branch (183:10): [True: 228, False: 2.07k]
  ------------------
  184|    228|         return;  // completely bogus? at least degenerate/weird
  185|    228|      }
  186|       |
  187|  2.07k|      const Handshake_Type msg_type = static_cast<Handshake_Type>(record[0]);
  188|  2.07k|      const size_t msg_len = load_be24(&record[1]);
  189|  2.07k|      const uint16_t message_seq = load_be<uint16_t>(&record[4], 0);
  190|  2.07k|      const size_t fragment_offset = load_be24(&record[6]);
  191|  2.07k|      const size_t fragment_length = load_be24(&record[9]);
  192|       |
  193|  2.07k|      const size_t total_size = DTLS_HANDSHAKE_HEADER_LEN + fragment_length;
  194|       |
  195|  2.07k|      if(record_len < total_size) {
  ------------------
  |  Branch (195:10): [True: 54, False: 2.01k]
  ------------------
  196|     54|         throw Decoding_Error("Bad lengths in DTLS header");
  197|     54|      }
  198|       |
  199|  2.01k|      if(message_seq >= m_in_message_seq) {
  ------------------
  |  Branch (199:10): [True: 1.63k, False: 382]
  ------------------
  200|  1.63k|         m_messages[message_seq].add_fragment(
  201|  1.63k|            &record[DTLS_HANDSHAKE_HEADER_LEN], fragment_length, fragment_offset, epoch, msg_type, msg_len);
  202|  1.63k|      } else {
  203|       |         // TODO: detect retransmitted flight
  204|    382|      }
  205|       |
  206|  2.01k|      record += total_size;
  207|  2.01k|      record_len -= total_size;
  208|  2.01k|   }
  209|    994|}
_ZN5Botan3TLS21Datagram_Handshake_IO15get_next_recordEb:
  211|    917|std::pair<Handshake_Type, std::vector<uint8_t>> Datagram_Handshake_IO::get_next_record(bool expecting_ccs) {
  212|       |   // Expecting a message means the last flight is concluded
  213|    917|   if(!m_flights.rbegin()->empty()) {
  ------------------
  |  Branch (213:7): [True: 3, False: 914]
  ------------------
  214|      3|      m_flights.push_back(std::vector<uint16_t>());
  215|      3|   }
  216|       |
  217|    917|   if(expecting_ccs) {
  ------------------
  |  Branch (217:7): [True: 0, False: 917]
  ------------------
  218|      0|      if(!m_messages.empty()) {
  ------------------
  |  Branch (218:10): [True: 0, False: 0]
  ------------------
  219|      0|         const uint16_t current_epoch = m_messages.begin()->second.epoch();
  220|       |
  221|      0|         if(m_ccs_epochs.contains(current_epoch)) {
  ------------------
  |  Branch (221:13): [True: 0, False: 0]
  ------------------
  222|      0|            return std::make_pair(Handshake_Type::HandshakeCCS, std::vector<uint8_t>());
  223|      0|         }
  224|      0|      }
  225|      0|      return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
  226|      0|   }
  227|       |
  228|    917|   auto i = m_messages.find(m_in_message_seq);
  229|       |
  230|    917|   if(i == m_messages.end() || !i->second.complete()) {
  ------------------
  |  Branch (230:7): [True: 680, False: 237]
  |  Branch (230:7): [True: 841, False: 76]
  |  Branch (230:32): [True: 161, False: 76]
  ------------------
  231|    841|      return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
  232|    841|   }
  233|       |
  234|     76|   m_in_message_seq += 1;
  235|       |
  236|     76|   return i->second.message();
  237|    917|}
_ZN5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly12add_fragmentEPKhmmtNS0_14Handshake_TypeEm:
  244|  1.63k|                                                               size_t msg_length) {
  245|  1.63k|   if(complete()) {
  ------------------
  |  Branch (245:7): [True: 324, False: 1.31k]
  ------------------
  246|    324|      return;  // already have entire message, ignore this
  247|    324|   }
  248|       |
  249|  1.31k|   if(m_msg_type == Handshake_Type::None) {
  ------------------
  |  Branch (249:7): [True: 1.18k, False: 125]
  ------------------
  250|  1.18k|      m_epoch = epoch;
  251|  1.18k|      m_msg_type = msg_type;
  252|  1.18k|      m_msg_length = msg_length;
  253|  1.18k|   }
  254|       |
  255|  1.31k|   if(msg_type != m_msg_type || msg_length != m_msg_length || epoch != m_epoch) {
  ------------------
  |  Branch (255:7): [True: 15, False: 1.29k]
  |  Branch (255:33): [True: 18, False: 1.28k]
  |  Branch (255:63): [True: 0, False: 1.28k]
  ------------------
  256|     33|      throw Decoding_Error("Inconsistent values in fragmented DTLS handshake header");
  257|     33|   }
  258|       |
  259|  1.28k|   if(fragment_offset > m_msg_length) {
  ------------------
  |  Branch (259:7): [True: 20, False: 1.26k]
  ------------------
  260|     20|      throw Decoding_Error("Fragment offset past end of message");
  261|     20|   }
  262|       |
  263|  1.26k|   if(fragment_offset + fragment_length > m_msg_length) {
  ------------------
  |  Branch (263:7): [True: 13, False: 1.24k]
  ------------------
  264|     13|      throw Decoding_Error("Fragment overlaps past end of message");
  265|     13|   }
  266|       |
  267|  1.24k|   if(fragment_offset == 0 && fragment_length == m_msg_length) {
  ------------------
  |  Branch (267:7): [True: 657, False: 590]
  |  Branch (267:31): [True: 223, False: 434]
  ------------------
  268|    223|      m_fragments.clear();
  269|    223|      m_message.assign(fragment, fragment + fragment_length);
  270|  1.02k|   } else {
  271|       |      /*
  272|       |      * FIXME. This is a pretty lame way to do defragmentation, huge
  273|       |      * overhead with a tree node per byte.
  274|       |      *
  275|       |      * Also should confirm that all overlaps have no changes,
  276|       |      * otherwise we expose ourselves to the classic fingerprinting
  277|       |      * and IDS evasion attacks on IP fragmentation.
  278|       |      */
  279|  13.4k|      for(size_t i = 0; i != fragment_length; ++i) {
  ------------------
  |  Branch (279:25): [True: 12.4k, False: 1.02k]
  ------------------
  280|  12.4k|         m_fragments[fragment_offset + i] = fragment[i];
  281|  12.4k|      }
  282|       |
  283|  1.02k|      if(m_fragments.size() == m_msg_length) {
  ------------------
  |  Branch (283:10): [True: 85, False: 939]
  ------------------
  284|     85|         m_message.resize(m_msg_length);
  285|  2.53k|         for(size_t i = 0; i != m_msg_length; ++i) {
  ------------------
  |  Branch (285:28): [True: 2.44k, False: 85]
  ------------------
  286|  2.44k|            m_message[i] = m_fragments[i];
  287|  2.44k|         }
  288|     85|         m_fragments.clear();
  289|     85|      }
  290|  1.02k|   }
  291|  1.24k|}
_ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly8completeEv:
  293|  1.95k|bool Datagram_Handshake_IO::Handshake_Reassembly::complete() const {
  294|  1.95k|   return (m_msg_type != Handshake_Type::None && m_message.size() == m_msg_length);
  ------------------
  |  Branch (294:12): [True: 714, False: 1.23k]
  |  Branch (294:50): [True: 476, False: 238]
  ------------------
  295|  1.95k|}
_ZNK5Botan3TLS21Datagram_Handshake_IO20Handshake_Reassembly7messageEv:
  297|     76|std::pair<Handshake_Type, std::vector<uint8_t>> Datagram_Handshake_IO::Handshake_Reassembly::message() const {
  298|     76|   if(!complete()) {
  ------------------
  |  Branch (298:7): [True: 0, False: 76]
  ------------------
  299|      0|      throw Internal_Error("Datagram_Handshake_IO - message not complete");
  300|      0|   }
  301|       |
  302|     76|   return std::make_pair(m_msg_type, m_message);
  303|     76|}
_ZNK5Botan3TLS21Datagram_Handshake_IO15format_fragmentEPKhmttNS0_14Handshake_TypeEt:
  310|     63|                                                            uint16_t msg_sequence) const {
  311|     63|   std::vector<uint8_t> send_buf(12 + frag_len);
  312|       |
  313|     63|   send_buf[0] = static_cast<uint8_t>(type);
  314|       |
  315|     63|   store_be24(&send_buf[1], msg_len);
  316|       |
  317|     63|   store_be(msg_sequence, &send_buf[4]);
  318|       |
  319|     63|   store_be24(&send_buf[6], frag_offset);
  320|     63|   store_be24(&send_buf[9], frag_len);
  321|       |
  322|     63|   if(frag_len > 0) {
  ------------------
  |  Branch (322:7): [True: 57, False: 6]
  ------------------
  323|     57|      copy_mem(&send_buf[12], fragment, frag_len);
  324|     57|   }
  325|       |
  326|     63|   return send_buf;
  327|     63|}
_ZNK5Botan3TLS21Datagram_Handshake_IO12format_w_seqERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeEt:
  331|     63|                                                         uint16_t msg_sequence) const {
  332|     63|   return format_fragment(msg.data(), msg.size(), 0, static_cast<uint16_t>(msg.size()), type, msg_sequence);
  333|     63|}
_ZNK5Botan3TLS21Datagram_Handshake_IO6formatERKNSt3__16vectorIhNS2_9allocatorIhEEEENS0_14Handshake_TypeE:
  335|     32|std::vector<uint8_t> Datagram_Handshake_IO::format(const std::vector<uint8_t>& msg, Handshake_Type type) const {
  336|     32|   return format_w_seq(msg, type, m_in_message_seq - 1);
  337|     32|}
_ZN5Botan3TLS21Datagram_Handshake_IO4sendERKNS0_17Handshake_MessageE:
  339|     31|std::vector<uint8_t> Datagram_Handshake_IO::send(const Handshake_Message& msg) {
  340|     31|   return this->send_under_epoch(msg, m_seqs.current_write_epoch());
  341|     31|}
_ZN5Botan3TLS21Datagram_Handshake_IO16send_under_epochERKNS0_17Handshake_MessageEt:
  343|     31|std::vector<uint8_t> Datagram_Handshake_IO::send_under_epoch(const Handshake_Message& msg, uint16_t epoch) {
  344|     31|   const std::vector<uint8_t> msg_bits = msg.serialize();
  345|     31|   const Handshake_Type msg_type = msg.type();
  346|       |
  347|     31|   if(msg_type == Handshake_Type::HandshakeCCS) {
  ------------------
  |  Branch (347:7): [True: 0, False: 31]
  ------------------
  348|      0|      m_send_hs(epoch, Record_Type::ChangeCipherSpec, msg_bits);
  349|      0|      return std::vector<uint8_t>();  // not included in handshake hashes
  350|     31|   } else if(msg_type == Handshake_Type::HelloVerifyRequest) {
  ------------------
  |  Branch (350:14): [True: 18, False: 13]
  ------------------
  351|       |      // This message is not included in the handshake hashes
  352|     18|      send_message(m_out_message_seq, epoch, msg_type, msg_bits);
  353|     18|      m_out_message_seq += 1;
  354|     18|      return std::vector<uint8_t>();
  355|     18|   }
  356|       |
  357|       |   // Note: not saving CCS, instead we know it was there due to change in epoch
  358|     13|   m_flights.rbegin()->push_back(m_out_message_seq);
  359|     13|   m_flight_data[m_out_message_seq] = Message_Info(epoch, msg_type, msg_bits);
  360|       |
  361|     13|   m_out_message_seq += 1;
  362|     13|   m_last_write = steady_clock_ms();
  363|     13|   m_next_timeout = m_initial_timeout;
  364|       |
  365|     13|   return send_message(m_out_message_seq - 1, epoch, msg_type, msg_bits);
  366|     31|}
_ZN5Botan3TLS21Datagram_Handshake_IO12send_messageEttNS0_14Handshake_TypeERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  371|     31|                                                         const std::vector<uint8_t>& msg_bits) {
  372|     31|   const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
  373|       |
  374|     31|   auto no_fragment = format_w_seq(msg_bits, msg_type, msg_seq);
  375|       |
  376|     31|   if(no_fragment.size() + DTLS_HEADER_SIZE <= m_mtu) {
  ------------------
  |  Branch (376:7): [True: 31, False: 0]
  ------------------
  377|     31|      m_send_hs(epoch, Record_Type::Handshake, no_fragment);
  378|     31|   } else {
  379|      0|      size_t frag_offset = 0;
  380|       |
  381|       |      /**
  382|       |      * Largest possible overhead is for SHA-384 CBC ciphers, with 16 byte IV,
  383|       |      * 16+ for padding and 48 bytes for MAC. 128 is probably a strict
  384|       |      * over-estimate here. When CBC ciphers are removed this can be reduced
  385|       |      * since AEAD modes have no padding, at most 16 byte mac, and smaller
  386|       |      * per-record nonce.
  387|       |      */
  388|      0|      const size_t ciphersuite_overhead = (epoch > 0) ? 128 : 0;
  ------------------
  |  Branch (388:43): [True: 0, False: 0]
  ------------------
  389|      0|      const size_t header_overhead = DTLS_HEADER_SIZE + DTLS_HANDSHAKE_HEADER_LEN;
  390|       |
  391|      0|      if(m_mtu <= (header_overhead + ciphersuite_overhead)) {
  ------------------
  |  Branch (391:10): [True: 0, False: 0]
  ------------------
  392|      0|         throw Invalid_Argument("DTLS MTU is too small to send headers");
  393|      0|      }
  394|       |
  395|      0|      const size_t max_rec_size = m_mtu - (header_overhead + ciphersuite_overhead);
  396|       |
  397|      0|      while(frag_offset != msg_bits.size()) {
  ------------------
  |  Branch (397:13): [True: 0, False: 0]
  ------------------
  398|      0|         const size_t frag_len = std::min<size_t>(msg_bits.size() - frag_offset, max_rec_size);
  399|       |
  400|      0|         const std::vector<uint8_t> frag = format_fragment(&msg_bits[frag_offset],
  401|      0|                                                           frag_len,
  402|      0|                                                           static_cast<uint16_t>(frag_offset),
  403|      0|                                                           static_cast<uint16_t>(msg_bits.size()),
  404|      0|                                                           msg_type,
  405|      0|                                                           msg_seq);
  406|       |
  407|      0|         m_send_hs(epoch, Record_Type::Handshake, frag);
  408|       |
  409|      0|         frag_offset += frag_len;
  410|      0|      }
  411|      0|   }
  412|       |
  413|     31|   return no_fragment;
  414|     31|}
tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_110store_be24EPhm:
   23|   108k|void store_be24(uint8_t out[3], size_t val) {
   24|   108k|   out[0] = get_byte<1>(static_cast<uint32_t>(val));
   25|   108k|   out[1] = get_byte<2>(static_cast<uint32_t>(val));
   26|   108k|   out[2] = get_byte<3>(static_cast<uint32_t>(val));
   27|   108k|}
tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_115steady_clock_msEv:
   29|     13|uint64_t steady_clock_ms() {
   30|     13|   return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now().time_since_epoch())
   31|     13|      .count();
   32|     13|}
tls_handshake_io.cpp:_ZN5Botan3TLS12_GLOBAL__N_19load_be24EPKh:
   21|  6.21k|inline size_t load_be24(const uint8_t q[3]) { return make_uint32(0, q[0], q[1], q[2]); }

_ZN5Botan3TLS24handshake_type_to_stringENS0_14Handshake_TypeE:
   21|    310|const char* handshake_type_to_string(Handshake_Type type) {
   22|    310|   switch(type) {
  ------------------
  |  Branch (22:11): [True: 0, False: 310]
  ------------------
   23|      3|      case Handshake_Type::HelloVerifyRequest:
  ------------------
  |  Branch (23:7): [True: 3, False: 307]
  ------------------
   24|      3|         return "hello_verify_request";
   25|       |
   26|     43|      case Handshake_Type::HelloRequest:
  ------------------
  |  Branch (26:7): [True: 43, False: 267]
  ------------------
   27|     43|         return "hello_request";
   28|       |
   29|    128|      case Handshake_Type::ClientHello:
  ------------------
  |  Branch (29:7): [True: 128, False: 182]
  ------------------
   30|    128|         return "client_hello";
   31|       |
   32|      4|      case Handshake_Type::ServerHello:
  ------------------
  |  Branch (32:7): [True: 4, False: 306]
  ------------------
   33|      4|         return "server_hello";
   34|       |
   35|      4|      case Handshake_Type::HelloRetryRequest:
  ------------------
  |  Branch (35:7): [True: 4, False: 306]
  ------------------
   36|      4|         return "hello_retry_request";
   37|       |
   38|      5|      case Handshake_Type::Certificate:
  ------------------
  |  Branch (38:7): [True: 5, False: 305]
  ------------------
   39|      5|         return "certificate";
   40|       |
   41|      5|      case Handshake_Type::CertificateUrl:
  ------------------
  |  Branch (41:7): [True: 5, False: 305]
  ------------------
   42|      5|         return "certificate_url";
   43|       |
   44|      5|      case Handshake_Type::CertificateStatus:
  ------------------
  |  Branch (44:7): [True: 5, False: 305]
  ------------------
   45|      5|         return "certificate_status";
   46|       |
   47|      4|      case Handshake_Type::ServerKeyExchange:
  ------------------
  |  Branch (47:7): [True: 4, False: 306]
  ------------------
   48|      4|         return "server_key_exchange";
   49|       |
   50|      2|      case Handshake_Type::CertificateRequest:
  ------------------
  |  Branch (50:7): [True: 2, False: 308]
  ------------------
   51|      2|         return "certificate_request";
   52|       |
   53|      3|      case Handshake_Type::ServerHelloDone:
  ------------------
  |  Branch (53:7): [True: 3, False: 307]
  ------------------
   54|      3|         return "server_hello_done";
   55|       |
   56|      2|      case Handshake_Type::CertificateVerify:
  ------------------
  |  Branch (56:7): [True: 2, False: 308]
  ------------------
   57|      2|         return "certificate_verify";
   58|       |
   59|     42|      case Handshake_Type::ClientKeyExchange:
  ------------------
  |  Branch (59:7): [True: 42, False: 268]
  ------------------
   60|     42|         return "client_key_exchange";
   61|       |
   62|      4|      case Handshake_Type::NewSessionTicket:
  ------------------
  |  Branch (62:7): [True: 4, False: 306]
  ------------------
   63|      4|         return "new_session_ticket";
   64|       |
   65|     38|      case Handshake_Type::HandshakeCCS:
  ------------------
  |  Branch (65:7): [True: 38, False: 272]
  ------------------
   66|     38|         return "change_cipher_spec";
   67|       |
   68|      8|      case Handshake_Type::Finished:
  ------------------
  |  Branch (68:7): [True: 8, False: 302]
  ------------------
   69|      8|         return "finished";
   70|       |
   71|      2|      case Handshake_Type::EndOfEarlyData:
  ------------------
  |  Branch (71:7): [True: 2, False: 308]
  ------------------
   72|      2|         return "end_of_early_data";
   73|       |
   74|      5|      case Handshake_Type::EncryptedExtensions:
  ------------------
  |  Branch (74:7): [True: 5, False: 305]
  ------------------
   75|      5|         return "encrypted_extensions";
   76|       |
   77|      3|      case Handshake_Type::KeyUpdate:
  ------------------
  |  Branch (77:7): [True: 3, False: 307]
  ------------------
   78|      3|         return "key_update";
   79|       |
   80|      0|      case Handshake_Type::None:
  ------------------
  |  Branch (80:7): [True: 0, False: 310]
  ------------------
   81|      0|         return "invalid";
   82|    310|   }
   83|       |
   84|      0|   throw TLS_Exception(Alert::UnexpectedMessage,
   85|      0|                       "Unknown TLS handshake message type " + std::to_string(static_cast<size_t>(type)));
   86|    310|}
_ZN5Botan3TLS15Handshake_StateD2Ev:
   91|  24.0k|Handshake_State::~Handshake_State() = default;
_ZN5Botan3TLS15Handshake_StateC2ENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEERNS0_9CallbacksE:
   94|  24.0k|      m_callbacks(cb), m_handshake_io(std::move(io)), m_version(m_handshake_io->initial_record_version()) {}
_ZN5Botan3TLS15Handshake_State12note_messageERKNS0_17Handshake_MessageE:
   96|   102k|void Handshake_State::note_message(const Handshake_Message& msg) { m_callbacks.tls_inspect_handshake_msg(msg); }
_ZN5Botan3TLS15Handshake_State12client_helloEPNS0_15Client_Hello_12E:
  107|  28.8k|void Handshake_State::client_hello(Client_Hello_12* client_hello) {
  108|  28.8k|   if(client_hello == nullptr) {
  ------------------
  |  Branch (108:7): [True: 3.80k, False: 25.0k]
  ------------------
  109|  3.80k|      m_client_hello.reset();
  110|  3.80k|      hash().reset();
  111|  25.0k|   } else {
  112|  25.0k|      m_client_hello.reset(client_hello);
  113|  25.0k|      note_message(*m_client_hello);
  114|  25.0k|   }
  115|  28.8k|}
_ZN5Botan3TLS15Handshake_State12server_helloEPNS0_15Server_Hello_12E:
  117|  20.9k|void Handshake_State::server_hello(Server_Hello_12* server_hello) {
  118|  20.9k|   m_server_hello.reset(server_hello);
  119|  20.9k|   m_ciphersuite = Ciphersuite::by_id(m_server_hello->ciphersuite());
  120|  20.9k|   note_message(*m_server_hello);
  121|  20.9k|}
_ZN5Botan3TLS15Handshake_State12server_certsEPNS0_14Certificate_12E:
  123|    177|void Handshake_State::server_certs(Certificate_12* server_certs) {
  124|    177|   m_server_certs.reset(server_certs);
  125|    177|   note_message(*m_server_certs);
  126|    177|}
_ZN5Botan3TLS15Handshake_State10server_kexEPNS0_19Server_Key_ExchangeE:
  133|  20.8k|void Handshake_State::server_kex(Server_Key_Exchange* server_kex) {
  134|  20.8k|   m_server_kex.reset(server_kex);
  135|  20.8k|   note_message(*m_server_kex);
  136|  20.8k|}
_ZN5Botan3TLS15Handshake_State17server_hello_doneEPNS0_17Server_Hello_DoneE:
  143|  20.8k|void Handshake_State::server_hello_done(Server_Hello_Done* server_hello_done) {
  144|  20.8k|   m_server_hello_done.reset(server_hello_done);
  145|  20.8k|   note_message(*m_server_hello_done);
  146|  20.8k|}
_ZN5Botan3TLS15Handshake_State10client_kexEPNS0_19Client_Key_ExchangeE:
  153|  14.6k|void Handshake_State::client_kex(Client_Key_Exchange* client_kex) {
  154|  14.6k|   m_client_kex.reset(client_kex);
  155|  14.6k|   note_message(*m_client_kex);
  156|  14.6k|}
_ZN5Botan3TLS15Handshake_State15server_finishedEPNS0_11Finished_12E:
  173|    245|void Handshake_State::server_finished(Finished_12* server_finished) {
  174|    245|   m_server_finished.reset(server_finished);
  175|    245|   note_message(*m_server_finished);
  176|    245|}
_ZN5Botan3TLS15Handshake_State15client_finishedEPNS0_11Finished_12E:
  178|    245|void Handshake_State::client_finished(Finished_12* client_finished) {
  179|    245|   m_client_finished.reset(client_finished);
  180|    245|   note_message(*m_client_finished);
  181|    245|}
_ZNK5Botan3TLS15Handshake_State11ciphersuiteEv:
  183|   139k|const Ciphersuite& Handshake_State::ciphersuite() const {
  184|   139k|   if(!m_ciphersuite.has_value()) {
  ------------------
  |  Branch (184:7): [True: 0, False: 139k]
  ------------------
  185|      0|      throw Invalid_State("Cipher suite is not set");
  186|      0|   }
  187|   139k|   return m_ciphersuite.value();
  188|   139k|}
_ZN5Botan3TLS15Handshake_State11set_versionERKNS0_16Protocol_VersionE:
  190|  25.0k|void Handshake_State::set_version(const Protocol_Version& version) { m_version = version; }
_ZN5Botan3TLS15Handshake_State20compute_session_keysEv:
  192|  14.6k|void Handshake_State::compute_session_keys() {
  193|  14.6k|   m_session_keys = Session_Keys(this, client_kex()->pre_master_secret(), false);
  194|  14.6k|}
_ZN5Botan3TLS15Handshake_State21confirm_transition_toENS0_14Handshake_TypeE:
  200|  42.4k|void Handshake_State::confirm_transition_to(Handshake_Type handshake_msg) {
  201|  42.4k|   m_transitions.confirm_transition_to(handshake_msg);
  202|  42.4k|}
_ZN5Botan3TLS15Handshake_State17set_expected_nextENS0_14Handshake_TypeE:
  204|  64.8k|void Handshake_State::set_expected_next(Handshake_Type handshake_msg) {
  205|  64.8k|   m_transitions.set_expected_next(handshake_msg);
  206|  64.8k|}
_ZNK5Botan3TLS15Handshake_State22received_handshake_msgENS0_14Handshake_TypeE:
  208|  15.4k|bool Handshake_State::received_handshake_msg(Handshake_Type handshake_msg) const {
  209|  15.4k|   return m_transitions.received_handshake_msg(handshake_msg);
  210|  15.4k|}
_ZN5Botan3TLS15Handshake_State22get_next_handshake_msgEv:
  212|  84.7k|std::pair<Handshake_Type, std::vector<uint8_t>> Handshake_State::get_next_handshake_msg() {
  213|  84.7k|   return m_handshake_io->get_next_record(m_transitions.change_cipher_spec_expected());
  214|  84.7k|}
_ZNK5Botan3TLS15Handshake_State21protocol_specific_prfEv:
  224|  15.1k|std::unique_ptr<KDF> Handshake_State::protocol_specific_prf() const {
  225|  15.1k|   const std::string prf_algo = ciphersuite().prf_algo();
  226|       |
  227|  15.1k|   if(prf_algo == "MD5" || prf_algo == "SHA-1") {
  ------------------
  |  Branch (227:7): [True: 0, False: 15.1k]
  |  Branch (227:28): [True: 9.30k, False: 5.81k]
  ------------------
  228|  9.30k|      return KDF::create_or_throw("TLS-12-PRF(SHA-256)");
  229|  9.30k|   }
  230|       |
  231|  5.81k|   return KDF::create_or_throw("TLS-12-PRF(" + prf_algo + ")");
  232|  15.1k|}

_ZN5Botan3TLS23Connection_Cipher_StateC2ENS0_16Protocol_VersionENS0_15Connection_SideEbRKNS0_11CiphersuiteERKNS0_12Session_KeysEb:
   33|    760|                                                 bool uses_encrypt_then_mac) {
   34|    760|   m_nonce_format = suite.nonce_format();
   35|    760|   m_nonce_bytes_from_record = suite.nonce_bytes_from_record(version);
   36|    760|   m_nonce_bytes_from_handshake = suite.nonce_bytes_from_handshake();
   37|       |
   38|    760|   const secure_vector<uint8_t>& aead_key = keys.aead_key(side);
   39|    760|   m_nonce = keys.nonce(side);
   40|       |
   41|    760|   BOTAN_ASSERT_NOMSG(m_nonce.size() == m_nonce_bytes_from_handshake);
  ------------------
  |  |   60|    760|   do {                                                                     \
  |  |   61|    760|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 760]
  |  |  ------------------
  |  |   62|    760|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    760|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   42|       |
   43|    760|   if(nonce_format() == Nonce_Format::CBC_MODE) {
  ------------------
  |  Branch (43:7): [True: 287, False: 473]
  ------------------
   44|    287|#if defined(BOTAN_HAS_TLS_CBC)
   45|       |      // legacy CBC+HMAC mode
   46|    287|      auto mac = MessageAuthenticationCode::create_or_throw("HMAC(" + suite.mac_algo() + ")");
   47|    287|      auto cipher = BlockCipher::create_or_throw(suite.cipher_algo());
   48|       |
   49|    287|      if(our_side) {
  ------------------
  |  Branch (49:10): [True: 98, False: 189]
  ------------------
   50|     98|         m_aead = std::make_unique<TLS_CBC_HMAC_AEAD_Encryption>(std::move(cipher),
   51|     98|                                                                 std::move(mac),
   52|     98|                                                                 suite.cipher_keylen(),
   53|     98|                                                                 suite.mac_keylen(),
   54|     98|                                                                 version,
   55|     98|                                                                 uses_encrypt_then_mac);
   56|    189|      } else {
   57|    189|         m_aead = std::make_unique<TLS_CBC_HMAC_AEAD_Decryption>(std::move(cipher),
   58|    189|                                                                 std::move(mac),
   59|    189|                                                                 suite.cipher_keylen(),
   60|    189|                                                                 suite.mac_keylen(),
   61|    189|                                                                 version,
   62|    189|                                                                 uses_encrypt_then_mac);
   63|    189|      }
   64|       |
   65|       |#else
   66|       |      BOTAN_UNUSED(uses_encrypt_then_mac);
   67|       |      throw Internal_Error("Negotiated disabled TLS CBC+HMAC ciphersuite");
   68|       |#endif
   69|    473|   } else {
   70|    473|      m_aead =
   71|    473|         AEAD_Mode::create_or_throw(suite.cipher_algo(), our_side ? Cipher_Dir::Encryption : Cipher_Dir::Decryption);
  ------------------
  |  Branch (71:58): [True: 147, False: 326]
  ------------------
   72|    473|   }
   73|       |
   74|    760|   m_aead->set_key(aead_key);
   75|    760|}
_ZN5Botan3TLS23Connection_Cipher_State10aead_nonceEmRNS_21RandomNumberGeneratorE:
   77|    367|std::vector<uint8_t> Connection_Cipher_State::aead_nonce(uint64_t seq, RandomNumberGenerator& rng) {
   78|    367|   switch(m_nonce_format) {
  ------------------
  |  Branch (78:11): [True: 0, False: 367]
  ------------------
   79|    124|      case Nonce_Format::CBC_MODE: {
  ------------------
  |  Branch (79:7): [True: 124, False: 243]
  ------------------
   80|    124|         if(!m_nonce.empty()) {
  ------------------
  |  Branch (80:13): [True: 98, False: 26]
  ------------------
   81|     98|            std::vector<uint8_t> nonce;
   82|     98|            nonce.swap(m_nonce);
   83|     98|            return nonce;
   84|     98|         }
   85|     26|         std::vector<uint8_t> nonce(nonce_bytes_from_record());
   86|     26|         rng.randomize(nonce.data(), nonce.size());
   87|     26|         return nonce;
   88|    124|      }
   89|    131|      case Nonce_Format::AEAD_XOR_12: {
  ------------------
  |  Branch (89:7): [True: 131, False: 236]
  ------------------
   90|    131|         std::vector<uint8_t> nonce(12);
   91|    131|         store_be(seq, nonce.data() + 4);
   92|    131|         xor_buf(nonce, m_nonce.data(), m_nonce.size());
   93|    131|         return nonce;
   94|    124|      }
   95|    112|      case Nonce_Format::AEAD_IMPLICIT_4: {
  ------------------
  |  Branch (95:7): [True: 112, False: 255]
  ------------------
   96|    112|         BOTAN_ASSERT_NOMSG(m_nonce.size() == 4);
  ------------------
  |  |   60|    112|   do {                                                                     \
  |  |   61|    112|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 112]
  |  |  ------------------
  |  |   62|    112|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    112|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   97|    112|         std::vector<uint8_t> nonce(12);
   98|    112|         copy_mem(&nonce[0], m_nonce.data(), 4);
   99|    112|         store_be(seq, &nonce[nonce_bytes_from_handshake()]);
  100|    112|         return nonce;
  101|    124|      }
  102|    367|   }
  103|       |
  104|      0|   throw Invalid_State("Unknown nonce format specified");
  105|    367|}
_ZN5Botan3TLS23Connection_Cipher_State10aead_nonceEPKhmm:
  107|    327|std::vector<uint8_t> Connection_Cipher_State::aead_nonce(const uint8_t record[], size_t record_len, uint64_t seq) {
  108|    327|   switch(m_nonce_format) {
  ------------------
  |  Branch (108:11): [True: 0, False: 327]
  ------------------
  109|     90|      case Nonce_Format::CBC_MODE: {
  ------------------
  |  Branch (109:7): [True: 90, False: 237]
  ------------------
  110|     90|         if(nonce_bytes_from_record() == 0 && !m_nonce.empty()) {
  ------------------
  |  Branch (110:13): [True: 0, False: 90]
  |  Branch (110:47): [True: 0, False: 0]
  ------------------
  111|      0|            std::vector<uint8_t> nonce;
  112|      0|            nonce.swap(m_nonce);
  113|      0|            return nonce;
  114|      0|         }
  115|     90|         if(record_len < nonce_bytes_from_record()) {
  ------------------
  |  Branch (115:13): [True: 2, False: 88]
  ------------------
  116|      2|            throw Decoding_Error("Invalid CBC packet too short to be valid");
  117|      2|         }
  118|     88|         std::vector<uint8_t> nonce(record, record + nonce_bytes_from_record());
  119|     88|         return nonce;
  120|     90|      }
  121|    104|      case Nonce_Format::AEAD_XOR_12: {
  ------------------
  |  Branch (121:7): [True: 104, False: 223]
  ------------------
  122|    104|         std::vector<uint8_t> nonce(12);
  123|    104|         store_be(seq, nonce.data() + 4);
  124|    104|         xor_buf(nonce, m_nonce.data(), m_nonce.size());
  125|    104|         return nonce;
  126|     90|      }
  127|    133|      case Nonce_Format::AEAD_IMPLICIT_4: {
  ------------------
  |  Branch (127:7): [True: 133, False: 194]
  ------------------
  128|    133|         BOTAN_ASSERT_NOMSG(m_nonce.size() == 4);
  ------------------
  |  |   60|    133|   do {                                                                     \
  |  |   61|    133|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 133]
  |  |  ------------------
  |  |   62|    133|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|    133|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  129|    133|         if(record_len < nonce_bytes_from_record()) {
  ------------------
  |  Branch (129:13): [True: 1, False: 132]
  ------------------
  130|      1|            throw Decoding_Error("Invalid AEAD packet too short to be valid");
  131|      1|         }
  132|    132|         std::vector<uint8_t> nonce(12);
  133|    132|         copy_mem(&nonce[0], m_nonce.data(), 4);
  134|    132|         copy_mem(&nonce[nonce_bytes_from_handshake()], record, nonce_bytes_from_record());
  135|    132|         return nonce;
  136|    133|      }
  137|    327|   }
  138|       |
  139|      0|   throw Invalid_State("Unknown nonce format specified");
  140|    327|}
_ZN5Botan3TLS23Connection_Cipher_State9format_adEmNS0_11Record_TypeENS0_16Protocol_VersionEt:
  145|    684|                                                        uint16_t msg_length) {
  146|    684|   std::vector<uint8_t> ad(13);
  147|       |
  148|    684|   store_be(msg_sequence, &ad[0]);
  149|    684|   ad[8] = static_cast<uint8_t>(msg_type);
  150|    684|   ad[9] = version.major_version();
  151|    684|   ad[10] = version.minor_version();
  152|    684|   ad[11] = get_byte<0>(msg_length);
  153|    684|   ad[12] = get_byte<1>(msg_length);
  154|       |
  155|    684|   return ad;
  156|    684|}
_ZN5Botan3TLS24write_unencrypted_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEmPKhm:
  191|  69.9k|                              size_t message_len) {
  192|  69.9k|   if(record_type == Record_Type::ApplicationData) {
  ------------------
  |  Branch (192:7): [True: 0, False: 69.9k]
  ------------------
  193|      0|      throw Internal_Error("Writing an unencrypted TLS application data record");
  194|      0|   }
  195|  69.9k|   write_record_header(output, record_type, version, record_sequence);
  196|  69.9k|   append_u16_len(output, message_len);
  197|  69.9k|   output.insert(output.end(), message, message + message_len);
  198|  69.9k|}
_ZN5Botan3TLS12write_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEmPKhmRNS0_23Connection_Cipher_StateERNS_21RandomNumberGeneratorE:
  207|    367|                  RandomNumberGenerator& rng) {
  208|    367|   write_record_header(output, record_type, version, record_sequence);
  209|       |
  210|    367|   AEAD_Mode& aead = cs.aead();
  211|    367|   std::vector<uint8_t> aad = cs.format_ad(record_sequence, record_type, version, static_cast<uint16_t>(message_len));
  212|       |
  213|    367|   const size_t ctext_size = aead.output_length(message_len);
  214|       |
  215|    367|   const size_t rec_size = ctext_size + cs.nonce_bytes_from_record();
  216|       |
  217|    367|   aead.set_associated_data(aad);
  218|       |
  219|    367|   const std::vector<uint8_t> nonce = cs.aead_nonce(record_sequence, rng);
  220|       |
  221|    367|   append_u16_len(output, rec_size);
  222|       |
  223|    367|   if(cs.nonce_bytes_from_record() > 0) {
  ------------------
  |  Branch (223:7): [True: 236, False: 131]
  ------------------
  224|    236|      if(cs.nonce_format() == Nonce_Format::CBC_MODE) {
  ------------------
  |  Branch (224:10): [True: 124, False: 112]
  ------------------
  225|    124|         output += nonce;
  226|    124|      } else {
  227|    112|         output += std::make_pair(&nonce[cs.nonce_bytes_from_handshake()], cs.nonce_bytes_from_record());
  228|    112|      }
  229|    236|   }
  230|       |
  231|    367|   const size_t header_size = output.size();
  232|    367|   output += std::make_pair(message, message_len);
  233|       |
  234|    367|   aead.start(nonce);
  235|    367|   aead.finish(output, header_size);
  236|       |
  237|    367|   BOTAN_ASSERT(output.size() < MAX_CIPHERTEXT_SIZE, "Produced ciphertext larger than protocol allows");
  ------------------
  |  |   51|    367|   do {                                                                                 \
  |  |   52|    367|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 367]
  |  |  ------------------
  |  |   53|    367|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    367|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  238|    367|}
_ZN5Botan3TLS11read_recordEbRNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS6_PNS0_27Connection_Sequence_NumbersERKNS1_8functionIFNS1_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEEb:
  499|  66.4k|                          bool allow_epoch0_restart) {
  500|  66.4k|   if(is_datagram) {
  ------------------
  |  Branch (500:7): [True: 1.49k, False: 64.9k]
  ------------------
  501|  1.49k|      return read_dtls_record(
  502|  1.49k|         readbuf, input, input_len, consumed, recbuf, sequence_numbers, get_cipherstate, allow_epoch0_restart);
  503|  64.9k|   } else {
  504|  64.9k|      return read_tls_record(readbuf, input, input_len, consumed, recbuf, sequence_numbers, get_cipherstate);
  505|  64.9k|   }
  506|  66.4k|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_119write_record_headerERNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_11Record_TypeENS0_16Protocol_VersionEm:
  170|  70.3k|                         uint64_t record_sequence) {
  171|  70.3k|   output.clear();
  172|       |
  173|  70.3k|   output.push_back(static_cast<uint8_t>(record_type));
  174|  70.3k|   output.push_back(version.major_version());
  175|  70.3k|   output.push_back(version.minor_version());
  176|       |
  177|  70.3k|   if(version.is_datagram_protocol()) {
  ------------------
  |  Branch (177:7): [True: 4.12k, False: 66.2k]
  ------------------
  178|  37.1k|      for(size_t i = 0; i != 8; ++i) {
  ------------------
  |  Branch (178:25): [True: 33.0k, False: 4.12k]
  ------------------
  179|  33.0k|         output.push_back(get_byte_var(i, record_sequence));
  180|  33.0k|      }
  181|  4.12k|   }
  182|  70.3k|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114append_u16_lenERNSt3__16vectorIhNS_16secure_allocatorIhEEEEm:
  160|  70.3k|inline void append_u16_len(secure_vector<uint8_t>& output, size_t len_field) {
  161|  70.3k|   const uint16_t len16 = static_cast<uint16_t>(len_field);
  162|  70.3k|   BOTAN_ASSERT_EQUAL(len_field, len16, "No truncation");
  ------------------
  |  |   69|  70.3k|   do {                                                                                                \
  |  |   70|  70.3k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 70.3k]
  |  |  ------------------
  |  |   71|  70.3k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  70.3k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  163|  70.3k|   output.push_back(get_byte<0>(len16));
  164|  70.3k|   output.push_back(get_byte<1>(len16));
  165|  70.3k|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_116read_dtls_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS7_PNS0_27Connection_Sequence_NumbersERKNS2_8functionIFNS2_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEEb:
  413|  1.49k|                               bool allow_epoch0_restart) {
  414|  1.49k|   if(readbuf.size() < DTLS_HEADER_SIZE)  // header incomplete?
  ------------------
  |  Branch (414:7): [True: 1.49k, False: 0]
  ------------------
  415|  1.49k|   {
  416|  1.49k|      if(fill_buffer_to(readbuf, input, input_len, consumed, DTLS_HEADER_SIZE)) {
  ------------------
  |  Branch (416:10): [True: 20, False: 1.47k]
  ------------------
  417|     20|         readbuf.clear();
  418|     20|         return Record_Header(0);
  419|     20|      }
  420|       |
  421|  1.47k|      BOTAN_ASSERT_EQUAL(readbuf.size(), DTLS_HEADER_SIZE, "Have an entire header");
  ------------------
  |  |   69|  1.47k|   do {                                                                                                \
  |  |   70|  1.47k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 1.47k]
  |  |  ------------------
  |  |   71|  1.47k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  1.47k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  422|  1.47k|   }
  423|       |
  424|  1.47k|   const Protocol_Version version(readbuf[1], readbuf[2]);
  425|       |
  426|  1.47k|   if(version.is_datagram_protocol() == false) {
  ------------------
  |  Branch (426:7): [True: 11, False: 1.46k]
  ------------------
  427|     11|      readbuf.clear();
  428|     11|      return Record_Header(0);
  429|     11|   }
  430|       |
  431|  1.46k|   const size_t record_size = make_uint16(readbuf[DTLS_HEADER_SIZE - 2], readbuf[DTLS_HEADER_SIZE - 1]);
  432|       |
  433|  1.46k|   if(record_size > MAX_CIPHERTEXT_SIZE) {
  ------------------
  |  Branch (433:7): [True: 3, False: 1.46k]
  ------------------
  434|       |      // Too large to be valid, ignore it
  435|      3|      readbuf.clear();
  436|      3|      return Record_Header(0);
  437|      3|   }
  438|       |
  439|  1.46k|   if(fill_buffer_to(readbuf, input, input_len, consumed, DTLS_HEADER_SIZE + record_size)) {
  ------------------
  |  Branch (439:7): [True: 45, False: 1.41k]
  ------------------
  440|       |      // Truncated packet?
  441|     45|      readbuf.clear();
  442|     45|      return Record_Header(0);
  443|     45|   }
  444|       |
  445|  1.41k|   BOTAN_ASSERT_EQUAL(static_cast<size_t>(DTLS_HEADER_SIZE) + record_size, readbuf.size(), "Have the full record");
  ------------------
  |  |   69|  1.41k|   do {                                                                                                \
  |  |   70|  1.41k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 1.41k]
  |  |  ------------------
  |  |   71|  1.41k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  1.41k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  446|       |
  447|  1.41k|   const Record_Type type = static_cast<Record_Type>(readbuf[0]);
  448|       |
  449|  1.41k|   const uint64_t sequence = load_be<uint64_t>(&readbuf[3], 0);
  450|  1.41k|   const uint16_t epoch = (sequence >> 48);
  451|       |
  452|  1.41k|   const bool already_seen = sequence_numbers && sequence_numbers->already_seen(sequence);
  ------------------
  |  Branch (452:30): [True: 521, False: 895]
  |  Branch (452:50): [True: 86, False: 435]
  ------------------
  453|       |
  454|  1.41k|   if(already_seen && !(epoch == 0 && allow_epoch0_restart)) {
  ------------------
  |  Branch (454:7): [True: 86, False: 1.33k]
  |  Branch (454:25): [True: 86, False: 0]
  |  Branch (454:39): [True: 0, False: 86]
  ------------------
  455|     86|      readbuf.clear();
  456|     86|      return Record_Header(0);
  457|     86|   }
  458|       |
  459|  1.33k|   if(epoch == 0)  // Unencrypted initial handshake
  ------------------
  |  Branch (459:7): [True: 1.23k, False: 92]
  ------------------
  460|  1.23k|   {
  461|  1.23k|      recbuf.assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_size);
  462|  1.23k|      readbuf.clear();
  463|  1.23k|      if(sequence_numbers) {
  ------------------
  |  Branch (463:10): [True: 374, False: 864]
  ------------------
  464|    374|         sequence_numbers->read_accept(sequence);
  465|    374|      }
  466|  1.23k|      return Record_Header(sequence, version, type);
  467|  1.23k|   }
  468|       |
  469|     92|   try {
  470|       |      // Otherwise, decrypt, check MAC, return plaintext
  471|     92|      auto cs = get_cipherstate(epoch);
  472|       |
  473|     92|      BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
  ------------------
  |  |   51|     92|   do {                                                                                 \
  |  |   52|     92|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 92]
  |  |  ------------------
  |  |   53|     92|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     92|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  474|       |
  475|     92|      decrypt_record(recbuf, &readbuf[DTLS_HEADER_SIZE], record_size, sequence, version, type, *cs);
  476|     92|   } catch(std::exception&) {
  477|     92|      readbuf.clear();
  478|     92|      return Record_Header(0);
  479|     92|   }
  480|       |
  481|      0|   if(sequence_numbers) {
  ------------------
  |  Branch (481:7): [True: 0, False: 0]
  ------------------
  482|      0|      sequence_numbers->read_accept(sequence);
  483|      0|   }
  484|       |
  485|      0|   readbuf.clear();
  486|      0|   return Record_Header(sequence, version, type);
  487|     92|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114fill_buffer_toERNSt3__16vectorIhNS_16secure_allocatorIhEEEERPKhRmSB_m:
  243|   132k|   secure_vector<uint8_t>& readbuf, const uint8_t*& input, size_t& input_size, size_t& input_consumed, size_t desired) {
  244|   132k|   if(readbuf.size() >= desired) {
  ------------------
  |  Branch (244:7): [True: 721, False: 131k]
  ------------------
  245|    721|      return 0;  // already have it
  246|    721|   }
  247|       |
  248|   131k|   const size_t taken = std::min(input_size, desired - readbuf.size());
  249|       |
  250|   131k|   readbuf.insert(readbuf.end(), input, input + taken);
  251|   131k|   input_consumed += taken;
  252|   131k|   input_size -= taken;
  253|   131k|   input += taken;
  254|       |
  255|   131k|   return (desired - readbuf.size());  // how many bytes do we still need?
  256|   132k|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_114decrypt_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPhmmNS0_16Protocol_VersionENS0_11Record_TypeERNS0_23Connection_Cipher_StateE:
  264|    327|                    Connection_Cipher_State& cs) {
  265|    327|   AEAD_Mode& aead = cs.aead();
  266|       |
  267|    327|   const std::vector<uint8_t> nonce = cs.aead_nonce(record_contents, record_len, record_sequence);
  268|    327|   const uint8_t* msg = &record_contents[cs.nonce_bytes_from_record()];
  269|    327|   const size_t msg_length = record_len - cs.nonce_bytes_from_record();
  270|       |
  271|       |   /*
  272|       |   * This early rejection is based just on public information (length of the
  273|       |   * encrypted packet) and so does not leak any information. We used to use
  274|       |   * decode_error here which really is more appropriate, but that confuses some
  275|       |   * tools which are attempting automated detection of padding oracles,
  276|       |   * including older versions of TLS-Attacker.
  277|       |   */
  278|    327|   if(msg_length < aead.minimum_final_size()) {
  ------------------
  |  Branch (278:7): [True: 7, False: 320]
  ------------------
  279|      7|      throw TLS_Exception(Alert::BadRecordMac, "AEAD packet is shorter than the tag");
  280|      7|   }
  281|       |
  282|    320|   const size_t ptext_size = aead.output_length(msg_length);
  283|       |
  284|    320|   aead.set_associated_data(
  285|    320|      cs.format_ad(record_sequence, record_type, record_version, static_cast<uint16_t>(ptext_size)));
  286|       |
  287|    320|   aead.start(nonce);
  288|       |
  289|    320|   output.assign(msg, msg + msg_length);
  290|    320|   aead.finish(output, 0);
  291|    320|}
tls_record.cpp:_ZN5Botan3TLS12_GLOBAL__N_115read_tls_recordERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhmRmS7_PNS0_27Connection_Sequence_NumbersERKNS2_8functionIFNS2_10shared_ptrINS0_23Connection_Cipher_StateEEEtEEE:
  299|  64.9k|                              const get_cipherstate_fn& get_cipherstate) {
  300|  64.9k|   if(readbuf.size() < TLS_HEADER_SIZE)  // header incomplete?
  ------------------
  |  Branch (300:7): [True: 64.9k, False: 0]
  ------------------
  301|  64.9k|   {
  302|  64.9k|      if(size_t needed = fill_buffer_to(readbuf, input, input_len, consumed, TLS_HEADER_SIZE)) {
  ------------------
  |  Branch (302:17): [True: 265, False: 64.6k]
  ------------------
  303|    265|         return Record_Header(needed);
  304|    265|      }
  305|       |
  306|  64.6k|      BOTAN_ASSERT_EQUAL(readbuf.size(), TLS_HEADER_SIZE, "Have an entire header");
  ------------------
  |  |   69|  64.6k|   do {                                                                                                \
  |  |   70|  64.6k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 64.6k]
  |  |  ------------------
  |  |   71|  64.6k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  64.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  307|  64.6k|   }
  308|       |
  309|       |   /*
  310|       |   Verify that the record type and record version are within some expected
  311|       |   range, so we can quickly reject totally invalid packets.
  312|       |
  313|       |   The version check is a little hacky but given how TLS 1.3 versioning works
  314|       |   this is probably safe
  315|       |
  316|       |   - The first byte is the record version which in TLS 1.2 is always in [20..23)
  317|       |   - The second byte is the TLS major version which is effectively fossilized at 3
  318|       |   - The third byte is the TLS minor version which (due to TLS 1.3 versioning changes)
  319|       |     will never be more than 3 (signifying TLS 1.2)
  320|       |   */
  321|  64.6k|   const bool bad_record_type = readbuf[0] < 20 || readbuf[0] > 23;
  ------------------
  |  Branch (321:33): [True: 130, False: 64.5k]
  |  Branch (321:52): [True: 185, False: 64.3k]
  ------------------
  322|  64.6k|   const bool bad_record_version = readbuf[1] != 3 || readbuf[2] >= 4;
  ------------------
  |  Branch (322:36): [True: 312, False: 64.3k]
  |  Branch (322:55): [True: 26, False: 64.3k]
  ------------------
  323|       |
  324|  64.6k|   if(bad_record_type || bad_record_version) {
  ------------------
  |  Branch (324:7): [True: 315, False: 64.3k]
  |  Branch (324:26): [True: 43, False: 64.2k]
  ------------------
  325|       |      // We know we read up to at least the 5 byte TLS header
  326|    358|      const std::string first5 = std::string(reinterpret_cast<const char*>(readbuf.data()), 5);
  327|       |
  328|    358|      if(first5 == "GET /" || first5 == "PUT /" || first5 == "POST " || first5 == "HEAD ") {
  ------------------
  |  Branch (328:10): [True: 1, False: 357]
  |  Branch (328:31): [True: 2, False: 355]
  |  Branch (328:52): [True: 1, False: 354]
  |  Branch (328:73): [True: 2, False: 352]
  ------------------
  329|      6|         throw TLS_Exception(Alert::ProtocolVersion, "Client sent plaintext HTTP request instead of TLS handshake");
  330|      6|      }
  331|       |
  332|    352|      if(first5 == "CONNE") {
  ------------------
  |  Branch (332:10): [True: 4, False: 348]
  ------------------
  333|      4|         throw TLS_Exception(Alert::ProtocolVersion,
  334|      4|                             "Client sent plaintext HTTP proxy CONNECT request instead of TLS handshake");
  335|      4|      }
  336|       |
  337|    348|      std::ostringstream oss;
  338|    348|      oss << "TLS record ";
  339|    348|      if(bad_record_type) {
  ------------------
  |  Branch (339:10): [True: 305, False: 43]
  ------------------
  340|    305|         oss << "type";
  341|    305|      } else {
  342|     43|         oss << "version";
  343|     43|      }
  344|    348|      oss << " had unexpected value";
  345|       |
  346|    348|      throw TLS_Exception(Alert::ProtocolVersion, oss.str());
  347|    352|   }
  348|       |
  349|  64.2k|   const Protocol_Version version(readbuf[1], readbuf[2]);
  350|       |
  351|  64.2k|   if(version.is_datagram_protocol()) {
  ------------------
  |  Branch (351:7): [True: 0, False: 64.2k]
  ------------------
  352|      0|      throw TLS_Exception(Alert::ProtocolVersion, "Expected TLS but got a record with DTLS version");
  353|      0|   }
  354|       |
  355|  64.2k|   const size_t record_size = make_uint16(readbuf[TLS_HEADER_SIZE - 2], readbuf[TLS_HEADER_SIZE - 1]);
  356|       |
  357|  64.2k|   if(record_size > MAX_CIPHERTEXT_SIZE) {
  ------------------
  |  Branch (357:7): [True: 7, False: 64.2k]
  ------------------
  358|      7|      throw TLS_Exception(Alert::RecordOverflow, "Received a record that exceeds maximum size");
  359|      7|   }
  360|       |
  361|  64.2k|   if(record_size == 0) {
  ------------------
  |  Branch (361:7): [True: 11, False: 64.2k]
  ------------------
  362|     11|      throw TLS_Exception(Alert::DecodeError, "Received a completely empty record");
  363|     11|   }
  364|       |
  365|  64.2k|   if(size_t needed = fill_buffer_to(readbuf, input, input_len, consumed, TLS_HEADER_SIZE + record_size)) {
  ------------------
  |  Branch (365:14): [True: 241, False: 64.0k]
  ------------------
  366|    241|      return Record_Header(needed);
  367|    241|   }
  368|       |
  369|  64.0k|   BOTAN_ASSERT_EQUAL(static_cast<size_t>(TLS_HEADER_SIZE) + record_size, readbuf.size(), "Have the full record");
  ------------------
  |  |   69|  64.0k|   do {                                                                                                \
  |  |   70|  64.0k|      if((expr1) != (expr2))                                                                           \
  |  |  ------------------
  |  |  |  Branch (70:10): [True: 0, False: 64.0k]
  |  |  ------------------
  |  |   71|  64.0k|         Botan::assertion_failure(#expr1 " == " #expr2, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   72|  64.0k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (72:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  370|       |
  371|  64.0k|   const Record_Type type = static_cast<Record_Type>(readbuf[0]);
  372|       |
  373|  64.0k|   uint16_t epoch = 0;
  374|       |
  375|  64.0k|   uint64_t sequence = 0;
  376|  64.0k|   if(sequence_numbers) {
  ------------------
  |  Branch (376:7): [True: 58.6k, False: 5.37k]
  ------------------
  377|  58.6k|      sequence = sequence_numbers->next_read_sequence();
  378|  58.6k|      epoch = sequence_numbers->current_read_epoch();
  379|  58.6k|   } else {
  380|       |      // server initial handshake case
  381|  5.37k|      epoch = 0;
  382|  5.37k|   }
  383|       |
  384|  64.0k|   if(epoch == 0)  // Unencrypted initial handshake
  ------------------
  |  Branch (384:7): [True: 63.7k, False: 327]
  ------------------
  385|  63.7k|   {
  386|  63.7k|      recbuf.assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_size);
  387|  63.7k|      readbuf.clear();
  388|  63.7k|      return Record_Header(sequence, version, type);
  389|  63.7k|   }
  390|       |
  391|       |   // Otherwise, decrypt, check MAC, return plaintext
  392|    327|   auto cs = get_cipherstate(epoch);
  393|       |
  394|    327|   BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
  ------------------
  |  |   51|    327|   do {                                                                                 \
  |  |   52|    327|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 327]
  |  |  ------------------
  |  |   53|    327|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    327|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  395|       |
  396|    327|   decrypt_record(recbuf, &readbuf[TLS_HEADER_SIZE], record_size, sequence, version, type, *cs);
  397|       |
  398|    327|   if(sequence_numbers) {
  ------------------
  |  Branch (398:7): [True: 0, False: 327]
  ------------------
  399|      0|      sequence_numbers->read_accept(sequence);
  400|      0|   }
  401|       |
  402|    327|   readbuf.clear();
  403|    327|   return Record_Header(sequence, version, type);
  404|  64.0k|}

_ZN5Botan3TLS14Server_Impl_12C2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_IKNS0_6PolicyEEERKNS3_INS_21RandomNumberGeneratorEEEbm:
  223|  5.77k|      Channel_Impl_12(callbacks, session_manager, rng, policy, true, is_datagram, io_buf_sz), m_creds(creds) {
  224|  5.77k|   BOTAN_ASSERT_NONNULL(m_creds);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  225|  5.77k|}
_ZN5Botan3TLS14Server_Impl_1219new_handshake_stateENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEE:
  237|  24.0k|std::unique_ptr<Handshake_State> Server_Impl_12::new_handshake_state(std::unique_ptr<Handshake_IO> io) {
  238|  24.0k|   auto state = std::make_unique<Server_Handshake_State>(std::move(io), callbacks());
  239|  24.0k|   state->set_expected_next(Handshake_Type::ClientHello);
  240|  24.0k|   return state;
  241|  24.0k|}
_ZNK5Botan3TLS14Server_Impl_1219get_peer_cert_chainERKNS0_15Handshake_StateE:
  243|    245|std::vector<X509_Certificate> Server_Impl_12::get_peer_cert_chain(const Handshake_State& state_base) const {
  244|    245|   const Server_Handshake_State& state = dynamic_cast<const Server_Handshake_State&>(state_base);
  245|    245|   if(!state.resume_peer_certs().empty()) {
  ------------------
  |  Branch (245:7): [True: 0, False: 245]
  ------------------
  246|      0|      return state.resume_peer_certs();
  247|      0|   }
  248|       |
  249|    245|   if(state.client_certs()) {
  ------------------
  |  Branch (249:7): [True: 0, False: 245]
  ------------------
  250|      0|      return state.client_certs()->cert_chain();
  251|      0|   }
  252|    245|   return std::vector<X509_Certificate>();
  253|    245|}
_ZN5Botan3TLS14Server_Impl_1224process_client_hello_msgEPKNS0_15Handshake_StateERNS0_22Server_Handshake_StateERKNSt3__16vectorIhNS7_9allocatorIhEEEEb:
  325|  26.1k|                                              bool epoch0_restart) {
  326|  26.1k|   BOTAN_ASSERT_IMPLICATION(epoch0_restart, active_state != nullptr, "Can't restart with a dead connection");
  ------------------
  |  |   78|  26.1k|   do {                                                                                          \
  |  |   79|  26.1k|      if((expr1) && !(expr2))                                                                    \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 26.1k]
  |  |  |  Branch (79:21): [True: 0, False: 0]
  |  |  ------------------
  |  |   80|  26.1k|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |   81|  26.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  327|       |
  328|  26.1k|   const bool initial_handshake = epoch0_restart || !active_state;
  ------------------
  |  Branch (328:35): [True: 0, False: 26.1k]
  |  Branch (328:53): [True: 26.1k, False: 0]
  ------------------
  329|       |
  330|  26.1k|   if(initial_handshake == false && policy().allow_client_initiated_renegotiation() == false) {
  ------------------
  |  Branch (330:7): [True: 0, False: 26.1k]
  |  Branch (330:37): [True: 0, False: 0]
  ------------------
  331|      0|      if(policy().abort_connection_on_undesired_renegotiation()) {
  ------------------
  |  Branch (331:10): [True: 0, False: 0]
  ------------------
  332|      0|         throw TLS_Exception(Alert::NoRenegotiation, "Server policy prohibits renegotiation");
  333|      0|      } else {
  334|      0|         send_warning_alert(Alert::NoRenegotiation);
  335|      0|      }
  336|      0|      return;
  337|      0|   }
  338|       |
  339|  26.1k|   if(!policy().allow_insecure_renegotiation() && !(initial_handshake || secure_renegotiation_supported())) {
  ------------------
  |  Branch (339:7): [True: 26.1k, False: 0]
  |  Branch (339:53): [True: 26.1k, False: 0]
  |  Branch (339:74): [True: 0, False: 0]
  ------------------
  340|      0|      send_warning_alert(Alert::NoRenegotiation);
  341|      0|      return;
  342|      0|   }
  343|       |
  344|  26.1k|   if(pending_state.handshake_io().have_more_data()) {
  ------------------
  |  Branch (344:7): [True: 23, False: 26.0k]
  ------------------
  345|     23|      throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after ClientHello");
  346|     23|   }
  347|       |
  348|  26.0k|   pending_state.client_hello(new Client_Hello_12(contents));
  349|  26.0k|   const Protocol_Version client_offer = pending_state.client_hello()->legacy_version();
  350|  26.0k|   const bool datagram = client_offer.is_datagram_protocol();
  351|       |
  352|  26.0k|   if(datagram) {
  ------------------
  |  Branch (352:7): [True: 3.84k, False: 22.2k]
  ------------------
  353|  3.84k|      if(client_offer.major_version() == 0xFF) {
  ------------------
  |  Branch (353:10): [True: 6, False: 3.83k]
  ------------------
  354|      6|         throw TLS_Exception(Alert::ProtocolVersion, "Client offered DTLS version with major version 0xFF");
  355|      6|      }
  356|  22.2k|   } else {
  357|  22.2k|      if(client_offer.major_version() < 3) {
  ------------------
  |  Branch (357:10): [True: 11, False: 22.2k]
  ------------------
  358|     11|         throw TLS_Exception(Alert::ProtocolVersion, "Client offered TLS version with major version under 3");
  359|     11|      }
  360|  22.2k|      if(client_offer.major_version() == 3 && client_offer.minor_version() == 0) {
  ------------------
  |  Branch (360:10): [True: 127, False: 22.0k]
  |  Branch (360:47): [True: 1, False: 126]
  ------------------
  361|      1|         throw TLS_Exception(Alert::ProtocolVersion, "Client offered SSLv3 which is not supported");
  362|      1|      }
  363|  22.2k|   }
  364|       |
  365|       |   /*
  366|       |   * BoGo test suite expects that we will send the hello verify with a record
  367|       |   * version matching the version that is eventually negotiated. This is wrong
  368|       |   * but harmless, so go with it. Also doing the version negotiation step first
  369|       |   * allows to immediately close the connection with an alert if the client has
  370|       |   * offered a version that we are not going to negotiate anyway, instead of
  371|       |   * making them first do the cookie exchange and then telling them no.
  372|       |   *
  373|       |   * There is no issue with amplification here, since the alert is just 2 bytes.
  374|       |   */
  375|  26.0k|   const Protocol_Version negotiated_version =
  376|  26.0k|      select_version(policy(),
  377|  26.0k|                     client_offer,
  378|  26.0k|                     active_state ? active_state->version() : Protocol_Version(),
  ------------------
  |  Branch (378:22): [True: 0, False: 26.0k]
  ------------------
  379|  26.0k|                     pending_state.client_hello()->supported_versions());
  380|       |
  381|  26.0k|   pending_state.set_version(negotiated_version);
  382|       |
  383|  26.0k|   const auto compression_methods = pending_state.client_hello()->compression_methods();
  384|  26.0k|   if(!value_exists(compression_methods, uint8_t(0))) {
  ------------------
  |  Branch (384:7): [True: 30, False: 26.0k]
  ------------------
  385|     30|      throw TLS_Exception(Alert::IllegalParameter, "Client did not offer NULL compression");
  386|     30|   }
  387|       |
  388|  26.0k|   if(initial_handshake && datagram) {
  ------------------
  |  Branch (388:7): [True: 24.9k, False: 1.05k]
  |  Branch (388:28): [True: 3.80k, False: 21.1k]
  ------------------
  389|  3.80k|      SymmetricKey cookie_secret;
  390|       |
  391|  3.80k|      try {
  392|  3.80k|         cookie_secret = m_creds->psk("tls-server", "dtls-cookie-secret", "");
  393|  3.80k|      } catch(...) {}
  394|       |
  395|  3.80k|      if(!cookie_secret.empty()) {
  ------------------
  |  Branch (395:10): [True: 3.80k, False: 0]
  ------------------
  396|  3.80k|         const std::string client_identity = callbacks().tls_peer_network_identity();
  397|  3.80k|         Hello_Verify_Request verify(pending_state.client_hello()->cookie_input_data(), client_identity, cookie_secret);
  398|       |
  399|  3.80k|         if(pending_state.client_hello()->cookie() != verify.cookie()) {
  ------------------
  |  Branch (399:13): [True: 3.80k, False: 0]
  ------------------
  400|  3.80k|            if(epoch0_restart) {
  ------------------
  |  Branch (400:16): [True: 0, False: 3.80k]
  ------------------
  401|      0|               pending_state.handshake_io().send_under_epoch(verify, 0);
  402|  3.80k|            } else {
  403|  3.80k|               pending_state.handshake_io().send(verify);
  404|  3.80k|            }
  405|       |
  406|  3.80k|            pending_state.client_hello(static_cast<Client_Hello_12*>(nullptr));
  407|  3.80k|            pending_state.set_expected_next(Handshake_Type::ClientHello);
  408|  3.80k|            return;
  409|  3.80k|         }
  410|  3.80k|      } else if(epoch0_restart) {
  ------------------
  |  Branch (410:17): [True: 0, False: 0]
  ------------------
  411|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Reuse of DTLS association requires DTLS cookie secret be set");
  412|      0|      }
  413|  3.80k|   }
  414|       |
  415|  22.2k|   if(epoch0_restart) {
  ------------------
  |  Branch (415:7): [True: 0, False: 22.2k]
  ------------------
  416|       |      // If we reached here then we were able to verify the cookie
  417|      0|      reset_active_association_state();
  418|      0|   }
  419|       |
  420|  22.2k|   secure_renegotiation_check(pending_state.client_hello());
  421|       |
  422|  22.2k|   callbacks().tls_examine_extensions(
  423|  22.2k|      pending_state.client_hello()->extensions(), Connection_Side::Client, Handshake_Type::ClientHello);
  424|       |
  425|  22.2k|   const auto session_handle = pending_state.client_hello()->session_handle();
  426|       |
  427|  22.2k|   std::optional<Session> session_info;
  428|  22.2k|   if(pending_state.allow_session_resumption() && session_handle.has_value()) {
  ------------------
  |  Branch (428:7): [True: 21.1k, False: 1.05k]
  |  Branch (428:51): [True: 2.45k, False: 18.7k]
  ------------------
  429|  2.45k|      session_info = check_for_resume(
  430|  2.45k|         session_handle.value(), session_manager(), callbacks(), policy(), pending_state.client_hello());
  431|  2.45k|   }
  432|       |
  433|  22.2k|   m_next_protocol = "";
  434|  22.2k|   if(pending_state.client_hello()->supports_alpn()) {
  ------------------
  |  Branch (434:7): [True: 1.76k, False: 20.4k]
  ------------------
  435|  1.76k|      m_next_protocol = callbacks().tls_server_choose_app_protocol(pending_state.client_hello()->next_protocols());
  436|  1.76k|   }
  437|       |
  438|  22.2k|   if(session_info.has_value()) {
  ------------------
  |  Branch (438:7): [True: 0, False: 22.2k]
  ------------------
  439|      0|      this->session_resume(pending_state, {session_info.value(), session_handle.value()});
  440|      0|   } else  // new session
  441|  22.2k|   {
  442|  22.2k|      this->session_create(pending_state);
  443|  22.2k|   }
  444|  22.2k|}
_ZN5Botan3TLS14Server_Impl_1231process_client_key_exchange_msgERNS0_22Server_Handshake_StateERKNSt3__16vectorIhNS4_9allocatorIhEEEE:
  459|  15.4k|                                                     const std::vector<uint8_t>& contents) {
  460|  15.4k|   if(pending_state.received_handshake_msg(Handshake_Type::Certificate) && !pending_state.client_certs()->empty()) {
  ------------------
  |  Branch (460:7): [True: 0, False: 15.4k]
  |  Branch (460:76): [True: 0, False: 0]
  ------------------
  461|      0|      pending_state.set_expected_next(Handshake_Type::CertificateVerify);
  462|  15.4k|   } else {
  463|  15.4k|      pending_state.set_expected_next(Handshake_Type::HandshakeCCS);
  464|  15.4k|   }
  465|       |
  466|  15.4k|   pending_state.client_kex(
  467|  15.4k|      new Client_Key_Exchange(contents, pending_state, pending_state.server_rsa_kex_key(), *m_creds, policy(), rng()));
  468|       |
  469|  15.4k|   pending_state.compute_session_keys();
  470|  15.4k|}
_ZN5Botan3TLS14Server_Impl_1230process_change_cipher_spec_msgERNS0_22Server_Handshake_StateE:
  472|    515|void Server_Impl_12::process_change_cipher_spec_msg(Server_Handshake_State& pending_state) {
  473|    515|   pending_state.set_expected_next(Handshake_Type::Finished);
  474|    515|   change_cipher_spec_reader(Connection_Side::Server);
  475|    515|}
_ZN5Botan3TLS14Server_Impl_1220process_finished_msgERNS0_22Server_Handshake_StateENS0_14Handshake_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEE:
  524|    246|                                          const std::vector<uint8_t>& contents) {
  525|    246|   pending_state.set_expected_next(Handshake_Type::None);
  526|       |
  527|    246|   if(pending_state.handshake_io().have_more_data()) {
  ------------------
  |  Branch (527:7): [True: 1, False: 245]
  ------------------
  528|      1|      throw TLS_Exception(Alert::UnexpectedMessage, "Have data remaining in buffer after Finished");
  529|      1|   }
  530|       |
  531|    245|   pending_state.client_finished(new Finished_12(contents));
  532|       |
  533|    245|   if(!pending_state.client_finished()->verify(pending_state, Connection_Side::Client)) {
  ------------------
  |  Branch (533:7): [True: 0, False: 245]
  ------------------
  534|      0|      throw TLS_Exception(Alert::DecryptError, "Finished message didn't verify");
  535|      0|   }
  536|       |
  537|    245|   if(!pending_state.server_finished()) {
  ------------------
  |  Branch (537:7): [True: 245, False: 0]
  ------------------
  538|       |      // already sent finished if resuming, so this is a new session
  539|       |
  540|    245|      pending_state.hash().update(pending_state.handshake_io().format(contents, type));
  541|       |
  542|    245|      Session session_info(pending_state.session_keys().master_secret(),
  543|    245|                           pending_state.server_hello()->legacy_version(),
  544|    245|                           pending_state.server_hello()->ciphersuite(),
  545|    245|                           Connection_Side::Server,
  546|    245|                           pending_state.server_hello()->supports_extended_master_secret(),
  547|    245|                           pending_state.server_hello()->supports_encrypt_then_mac(),
  548|    245|                           get_peer_cert_chain(pending_state),
  549|    245|                           Server_Information(pending_state.client_hello()->sni_hostname()),
  550|    245|                           pending_state.server_hello()->srtp_profile(),
  551|    245|                           callbacks().tls_current_timestamp());
  552|       |
  553|       |      // Give the application a chance for a final veto before fully
  554|       |      // establishing the connection.
  555|    245|      callbacks().tls_session_established([&] {
  556|    245|         Session_Summary summary(session_info, pending_state.is_a_resumption());
  557|    245|         summary.set_session_id(pending_state.server_hello()->session_id());
  558|    245|         return summary;
  559|    245|      }());
  560|       |
  561|    245|      if(callbacks().tls_should_persist_resumption_information(session_info)) {
  ------------------
  |  Branch (561:10): [True: 245, False: 0]
  ------------------
  562|    245|         auto handle = session_manager().establish(session_info,
  563|    245|                                                   pending_state.server_hello()->session_id(),
  564|    245|                                                   !pending_state.server_hello()->supports_session_ticket());
  565|       |
  566|    245|         if(pending_state.server_hello()->supports_session_ticket() && handle.has_value() && handle->is_ticket()) {
  ------------------
  |  Branch (566:13): [True: 0, False: 245]
  |  Branch (566:72): [True: 0, False: 0]
  |  Branch (566:94): [True: 0, False: 0]
  ------------------
  567|      0|            pending_state.new_session_ticket(new New_Session_Ticket_12(pending_state.handshake_io(),
  568|      0|                                                                       pending_state.hash(),
  569|      0|                                                                       handle->ticket().value(),
  570|      0|                                                                       policy().session_ticket_lifetime()));
  571|      0|         }
  572|    245|      }
  573|       |
  574|    245|      if(!pending_state.new_session_ticket() && pending_state.server_hello()->supports_session_ticket()) {
  ------------------
  |  Branch (574:10): [True: 245, False: 0]
  |  Branch (574:49): [True: 0, False: 245]
  ------------------
  575|      0|         pending_state.new_session_ticket(
  576|      0|            new New_Session_Ticket_12(pending_state.handshake_io(), pending_state.hash()));
  577|      0|      }
  578|       |
  579|    245|      pending_state.handshake_io().send(Change_Cipher_Spec());
  580|       |
  581|    245|      change_cipher_spec_writer(Connection_Side::Server);
  582|       |
  583|    245|      pending_state.server_finished(
  584|    245|         new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));
  585|    245|   }
  586|       |
  587|    245|   activate_session();
  588|    245|}
_ZN5Botan3TLS14Server_Impl_1221process_handshake_msgEPKNS0_15Handshake_StateERS2_NS0_14Handshake_TypeERKNSt3__16vectorIhNS7_9allocatorIhEEEEb:
  597|  42.4k|                                           bool epoch0_restart) {
  598|  42.4k|   Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
  599|  42.4k|   state.confirm_transition_to(type);
  600|       |
  601|       |   /*
  602|       |   * The change cipher spec message isn't technically a handshake
  603|       |   * message so it's not included in the hash. The finished and
  604|       |   * certificate verify messages are verified based on the current
  605|       |   * state of the hash *before* this message so we delay adding them
  606|       |   * to the hash computation until we've processed them below.
  607|       |   */
  608|  42.4k|   if(type != Handshake_Type::HandshakeCCS && type != Handshake_Type::Finished &&
  ------------------
  |  Branch (608:7): [True: 41.7k, False: 671]
  |  Branch (608:47): [True: 41.5k, False: 246]
  ------------------
  609|  42.4k|      type != Handshake_Type::CertificateVerify) {
  ------------------
  |  Branch (609:7): [True: 41.5k, False: 0]
  ------------------
  610|  41.5k|      state.hash().update(state.handshake_io().format(contents, type));
  611|  41.5k|   }
  612|       |
  613|  42.4k|   switch(type) {
  614|  26.1k|      case Handshake_Type::ClientHello:
  ------------------
  |  Branch (614:7): [True: 26.1k, False: 16.3k]
  ------------------
  615|  26.1k|         return this->process_client_hello_msg(active_state, state, contents, epoch0_restart);
  616|       |
  617|      0|      case Handshake_Type::Certificate:
  ------------------
  |  Branch (617:7): [True: 0, False: 42.4k]
  ------------------
  618|      0|         return this->process_certificate_msg(state, contents);
  619|       |
  620|  15.4k|      case Handshake_Type::ClientKeyExchange:
  ------------------
  |  Branch (620:7): [True: 15.4k, False: 27.0k]
  ------------------
  621|  15.4k|         return this->process_client_key_exchange_msg(state, contents);
  622|       |
  623|      0|      case Handshake_Type::CertificateVerify:
  ------------------
  |  Branch (623:7): [True: 0, False: 42.4k]
  ------------------
  624|      0|         return this->process_certificate_verify_msg(state, type, contents);
  625|       |
  626|    515|      case Handshake_Type::HandshakeCCS:
  ------------------
  |  Branch (626:7): [True: 515, False: 41.9k]
  ------------------
  627|    515|         return this->process_change_cipher_spec_msg(state);
  628|       |
  629|    246|      case Handshake_Type::Finished:
  ------------------
  |  Branch (629:7): [True: 246, False: 42.1k]
  ------------------
  630|    246|         return this->process_finished_msg(state, type, contents);
  631|       |
  632|      0|      default:
  ------------------
  |  Branch (632:7): [True: 0, False: 42.4k]
  ------------------
  633|      0|         throw Unexpected_Message("Unknown handshake message received");
  634|  42.4k|   }
  635|  42.4k|}
_ZN5Botan3TLS14Server_Impl_1214session_createERNS0_22Server_Handshake_StateE:
  702|  21.1k|void Server_Impl_12::session_create(Server_Handshake_State& pending_state) {
  703|  21.1k|   std::map<std::string, std::vector<X509_Certificate>> cert_chains;
  704|       |
  705|  21.1k|   const std::string sni_hostname = pending_state.client_hello()->sni_hostname();
  706|       |
  707|       |   // RFC 8446 1.3
  708|       |   //    The "signature_algorithms_cert" extension allows a client to indicate
  709|       |   //    which signature algorithms it can validate in X.509 certificates.
  710|       |   //
  711|       |   // RFC 8446 4.2.3
  712|       |   //     TLS 1.2 implementations SHOULD also process this extension.
  713|  21.1k|   const auto cert_signature_schemes = pending_state.client_hello()->certificate_signature_schemes();
  714|  21.1k|   cert_chains = get_server_certs(sni_hostname, cert_signature_schemes, *m_creds);
  715|       |
  716|  21.1k|   if(!sni_hostname.empty() && cert_chains.empty()) {
  ------------------
  |  Branch (716:7): [True: 72, False: 21.1k]
  |  Branch (716:32): [True: 0, False: 72]
  ------------------
  717|      0|      cert_chains = get_server_certs("", cert_signature_schemes, *m_creds);
  718|       |
  719|       |      /*
  720|       |      * Only send the unrecognized_name alert if we couldn't
  721|       |      * find any certs for the requested name but did find at
  722|       |      * least one cert to use in general. That avoids sending an
  723|       |      * unrecognized_name when a server is configured for purely
  724|       |      * anonymous/PSK operation.
  725|       |      */
  726|      0|      if(!cert_chains.empty()) {
  ------------------
  |  Branch (726:10): [True: 0, False: 0]
  ------------------
  727|      0|         send_warning_alert(Alert::UnrecognizedName);
  728|      0|      }
  729|      0|   }
  730|       |
  731|  21.1k|   const uint16_t ciphersuite =
  732|  21.1k|      choose_ciphersuite(policy(), pending_state.version(), cert_chains, *pending_state.client_hello());
  733|       |
  734|  21.1k|   Server_Hello_12::Settings srv_settings(Session_ID(make_hello_random(rng(), callbacks(), policy())),
  735|  21.1k|                                          pending_state.version(),
  736|  21.1k|                                          ciphersuite,
  737|  21.1k|                                          session_manager().emits_session_tickets());
  738|       |
  739|  21.1k|   pending_state.server_hello(new Server_Hello_12(pending_state.handshake_io(),
  740|  21.1k|                                                  pending_state.hash(),
  741|  21.1k|                                                  policy(),
  742|  21.1k|                                                  callbacks(),
  743|  21.1k|                                                  rng(),
  744|  21.1k|                                                  secure_renegotiation_data_for_server_hello(),
  745|  21.1k|                                                  *pending_state.client_hello(),
  746|  21.1k|                                                  srv_settings,
  747|  21.1k|                                                  m_next_protocol));
  748|       |
  749|  21.1k|   secure_renegotiation_check(pending_state.server_hello());
  750|       |
  751|  21.1k|   const Ciphersuite& pending_suite = pending_state.ciphersuite();
  752|       |
  753|  21.1k|   std::shared_ptr<Private_Key> private_key;
  754|       |
  755|  21.1k|   if(pending_suite.signature_used() || pending_suite.kex_method() == Kex_Algo::STATIC_RSA) {
  ------------------
  |  Branch (755:7): [True: 273, False: 20.9k]
  |  Branch (755:41): [True: 87, False: 20.8k]
  ------------------
  756|    177|      const std::string algo_used = pending_suite.signature_used() ? pending_suite.sig_algo() : "RSA";
  ------------------
  |  Branch (756:37): [True: 90, False: 87]
  ------------------
  757|       |
  758|    177|      BOTAN_ASSERT(!cert_chains[algo_used].empty(), "Attempting to send empty certificate chain");
  ------------------
  |  |   51|    177|   do {                                                                                 \
  |  |   52|    177|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 177]
  |  |  ------------------
  |  |   53|    177|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|    177|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  759|       |
  760|    177|      pending_state.server_certs(
  761|    177|         new Certificate_12(pending_state.handshake_io(), pending_state.hash(), cert_chains[algo_used]));
  762|       |
  763|    177|      if(pending_state.client_hello()->supports_cert_status_message() && pending_state.is_a_resumption() == false) {
  ------------------
  |  Branch (763:10): [True: 27, False: 150]
  |  Branch (763:74): [True: 27, False: 0]
  ------------------
  764|     27|         auto* csr = pending_state.client_hello()->extensions().get<Certificate_Status_Request>();
  765|       |         // csr is non-null if client_hello()->supports_cert_status_message()
  766|     27|         BOTAN_ASSERT_NOMSG(csr != nullptr);
  ------------------
  |  |   60|     27|   do {                                                                     \
  |  |   61|     27|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 27]
  |  |  ------------------
  |  |   62|     27|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|     27|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  767|     27|         const auto resp_bytes = callbacks().tls_provide_cert_status(cert_chains[algo_used], *csr);
  768|     27|         if(!resp_bytes.empty()) {
  ------------------
  |  Branch (768:13): [True: 0, False: 27]
  ------------------
  769|      0|            pending_state.server_cert_status(
  770|      0|               new Certificate_Status(pending_state.handshake_io(), pending_state.hash(), resp_bytes));
  771|      0|         }
  772|     27|      }
  773|       |
  774|    177|      private_key = m_creds->private_key_for(pending_state.server_certs()->cert_chain()[0], "tls-server", sni_hostname);
  775|       |
  776|    177|      if(!private_key) {
  ------------------
  |  Branch (776:10): [True: 177, False: 0]
  ------------------
  777|    177|         throw Internal_Error("No private key located for associated server cert");
  778|    177|      }
  779|    177|   }
  780|       |
  781|  20.9k|   if(pending_suite.kex_method() == Kex_Algo::STATIC_RSA) {
  ------------------
  |  Branch (781:7): [True: 0, False: 20.9k]
  ------------------
  782|      0|      pending_state.set_server_rsa_kex_key(private_key);
  783|  20.9k|   } else {
  784|  20.9k|      pending_state.server_kex(new Server_Key_Exchange(
  785|  20.9k|         pending_state.handshake_io(), pending_state, policy(), *m_creds, rng(), private_key.get()));
  786|  20.9k|   }
  787|       |
  788|  20.9k|   auto trusted_CAs = m_creds->trusted_certificate_authorities("tls-server", sni_hostname);
  789|       |
  790|  20.9k|   std::vector<X509_DN> client_auth_CAs;
  791|       |
  792|  20.9k|   for(auto* store : trusted_CAs) {
  ------------------
  |  Branch (792:20): [True: 0, False: 20.9k]
  ------------------
  793|      0|      auto subjects = store->all_subjects();
  794|      0|      client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
  795|      0|   }
  796|       |
  797|  20.9k|   const bool request_cert = (client_auth_CAs.empty() == false) || policy().request_client_certificate_authentication();
  ------------------
  |  Branch (797:30): [True: 183, False: 20.8k]
  |  Branch (797:68): [True: 0, False: 20.8k]
  ------------------
  798|       |
  799|  20.9k|   if(request_cert && pending_state.ciphersuite().signature_used()) {
  ------------------
  |  Branch (799:7): [True: 0, False: 20.9k]
  |  Branch (799:23): [True: 0, False: 0]
  ------------------
  800|      0|      pending_state.cert_req(
  801|      0|         new Certificate_Request_12(pending_state.handshake_io(), pending_state.hash(), policy(), client_auth_CAs));
  802|       |
  803|       |      /*
  804|       |      SSLv3 allowed clients to skip the Certificate message entirely
  805|       |      if they wanted. In TLS v1.0 and later clients must send a
  806|       |      (possibly empty) Certificate message
  807|       |      */
  808|      0|      pending_state.set_expected_next(Handshake_Type::Certificate);
  809|  20.9k|   } else {
  810|  20.9k|      pending_state.set_expected_next(Handshake_Type::ClientKeyExchange);
  811|  20.9k|   }
  812|       |
  813|  20.9k|   pending_state.server_hello_done(new Server_Hello_Done(pending_state.handshake_io(), pending_state.hash()));
  814|  20.9k|}
_ZNK5Botan3TLS22Server_Handshake_State17resume_peer_certsEv:
   35|    245|      const std::vector<X509_Certificate>& resume_peer_certs() const { return m_resume_peer_certs; }
tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_114select_versionERKNS0_6PolicyENS0_16Protocol_VersionES5_RKNSt3__16vectorIS5_NS6_9allocatorIS5_EEEE:
  269|  25.0k|                                const std::vector<Protocol_Version>& supported_versions) {
  270|  25.0k|   const bool is_datagram = client_offer.is_datagram_protocol();
  271|  25.0k|   const bool initial_handshake = (active_version.valid() == false);
  272|       |
  273|  25.0k|   if(!supported_versions.empty()) {
  ------------------
  |  Branch (273:7): [True: 354, False: 24.6k]
  ------------------
  274|    354|      if(is_datagram) {
  ------------------
  |  Branch (274:10): [True: 332, False: 22]
  ------------------
  275|    332|         if(policy.allow_dtls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::DTLS_V12))) {
  ------------------
  |  Branch (275:13): [True: 332, False: 0]
  |  Branch (275:13): [True: 313, False: 19]
  |  Branch (275:38): [True: 313, False: 19]
  ------------------
  276|    313|            return Protocol_Version::DTLS_V12;
  277|    313|         }
  278|     19|         throw TLS_Exception(Alert::ProtocolVersion, "No shared DTLS version");
  279|    332|      } else {
  280|     22|         if(policy.allow_tls12() && value_exists(supported_versions, Protocol_Version(Protocol_Version::TLS_V12))) {
  ------------------
  |  Branch (280:13): [True: 22, False: 0]
  |  Branch (280:13): [True: 14, False: 8]
  |  Branch (280:37): [True: 14, False: 8]
  ------------------
  281|     14|            return Protocol_Version::TLS_V12;
  282|     14|         }
  283|      8|         throw TLS_Exception(Alert::ProtocolVersion, "No shared TLS version");
  284|     22|      }
  285|    354|   }
  286|       |
  287|  24.6k|   if(!initial_handshake) {
  ------------------
  |  Branch (287:7): [True: 0, False: 24.6k]
  ------------------
  288|       |      /*
  289|       |      * If this is a renegotiation, and the client has offered a
  290|       |      * later version than what it initially negotiated, negotiate
  291|       |      * the old version. This matches OpenSSL's behavior. If the
  292|       |      * client is offering a version earlier than what it initially
  293|       |      * negotiated, reject as a probable attack.
  294|       |      */
  295|      0|      if(active_version > client_offer) {
  ------------------
  |  Branch (295:10): [True: 0, False: 0]
  ------------------
  296|      0|         throw TLS_Exception(
  297|      0|            Alert::ProtocolVersion,
  298|      0|            "Client negotiated " + active_version.to_string() + " then renegotiated with " + client_offer.to_string());
  299|      0|      } else {
  300|      0|         return active_version;
  301|      0|      }
  302|      0|   }
  303|       |
  304|  24.6k|   if(is_datagram) {
  ------------------
  |  Branch (304:7): [True: 3.50k, False: 21.1k]
  ------------------
  305|  3.50k|      if(policy.allow_dtls12() && client_offer >= Protocol_Version::DTLS_V12) {
  ------------------
  |  Branch (305:10): [True: 3.50k, False: 0]
  |  Branch (305:10): [True: 3.50k, False: 2]
  |  Branch (305:35): [True: 3.50k, False: 2]
  ------------------
  306|  3.50k|         return Protocol_Version::DTLS_V12;
  307|  3.50k|      }
  308|  21.1k|   } else {
  309|  21.1k|      if(policy.allow_tls12() && client_offer >= Protocol_Version::TLS_V12) {
  ------------------
  |  Branch (309:10): [True: 21.1k, False: 0]
  |  Branch (309:10): [True: 21.1k, False: 1]
  |  Branch (309:34): [True: 21.1k, False: 1]
  ------------------
  310|  21.1k|         return Protocol_Version::TLS_V12;
  311|  21.1k|      }
  312|  21.1k|   }
  313|       |
  314|      3|   throw TLS_Exception(Alert::ProtocolVersion,
  315|      3|                       "Client version " + client_offer.to_string() + " is unacceptable by policy");
  316|  24.6k|}
_ZNK5Botan3TLS22Server_Handshake_State24allow_session_resumptionEv:
   29|  21.1k|      bool allow_session_resumption() const { return m_allow_session_resumption; }
tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_116check_for_resumeERKNS0_14Session_HandleERNS0_15Session_ManagerERNS0_9CallbacksERKNS0_6PolicyEPKNS0_15Client_Hello_12E:
   64|  2.45k|                                        const Client_Hello_12* client_hello) {
   65|  2.45k|   auto session = session_manager.retrieve(handle_to_resume, cb, policy);
   66|  2.45k|   if(!session.has_value()) {
  ------------------
  |  Branch (66:7): [True: 2.45k, False: 0]
  ------------------
   67|  2.45k|      return std::nullopt;
   68|  2.45k|   }
   69|       |
   70|       |   // wrong version
   71|      0|   if(client_hello->legacy_version() != session->version()) {
  ------------------
  |  Branch (71:7): [True: 0, False: 0]
  ------------------
   72|      0|      return std::nullopt;
   73|      0|   }
   74|       |
   75|       |   // client didn't send original ciphersuite
   76|      0|   if(!value_exists(client_hello->ciphersuites(), session->ciphersuite_code())) {
  ------------------
  |  Branch (76:7): [True: 0, False: 0]
  ------------------
   77|      0|      return std::nullopt;
   78|      0|   }
   79|       |
   80|       |   // client sent a different SNI hostname
   81|      0|   if(!client_hello->sni_hostname().empty() && client_hello->sni_hostname() != session->server_info().hostname()) {
  ------------------
  |  Branch (81:7): [True: 0, False: 0]
  |  Branch (81:7): [True: 0, False: 0]
  |  Branch (81:48): [True: 0, False: 0]
  ------------------
   82|      0|      return std::nullopt;
   83|      0|   }
   84|       |
   85|       |   // Checking extended_master_secret on resume (RFC 7627 section 5.3)
   86|      0|   if(client_hello->supports_extended_master_secret() != session->supports_extended_master_secret()) {
  ------------------
  |  Branch (86:7): [True: 0, False: 0]
  ------------------
   87|      0|      if(!session->supports_extended_master_secret()) {
  ------------------
  |  Branch (87:10): [True: 0, False: 0]
  ------------------
   88|      0|         return std::nullopt;  // force new handshake with extended master secret
   89|      0|      } else {
   90|       |         /*
   91|       |         Client previously negotiated session with extended master secret,
   92|       |         but has now attempted to resume without the extension: abort
   93|       |         */
   94|      0|         throw TLS_Exception(Alert::HandshakeFailure, "Client resumed extended ms session without sending extension");
   95|      0|      }
   96|      0|   }
   97|       |
   98|       |   // Checking encrypt_then_mac on resume (RFC 7366 section 3.1)
   99|      0|   if(!client_hello->supports_encrypt_then_mac() && session->supports_encrypt_then_mac()) {
  ------------------
  |  Branch (99:7): [True: 0, False: 0]
  |  Branch (99:53): [True: 0, False: 0]
  ------------------
  100|       |      /*
  101|       |      Client previously negotiated session with Encrypt-then-MAC,
  102|       |      but has now attempted to resume without the extension: abort
  103|       |      */
  104|      0|      throw TLS_Exception(Alert::HandshakeFailure, "Client resumed Encrypt-then-MAC session without sending extension");
  105|      0|   }
  106|       |
  107|      0|   return session;
  108|      0|}
_ZN5Botan3TLS22Server_Handshake_State18server_rsa_kex_keyEv:
   25|  15.4k|      Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key.get(); }
tls_server_impl_12.cpp:_ZZN5Botan3TLS14Server_Impl_1220process_finished_msgERNS0_22Server_Handshake_StateENS0_14Handshake_TypeERKNSt3__16vectorIhNS5_9allocatorIhEEEEENK3$_0clEv:
  555|    245|      callbacks().tls_session_established([&] {
  556|    245|         Session_Summary summary(session_info, pending_state.is_a_resumption());
  557|    245|         summary.set_session_id(pending_state.server_hello()->session_id());
  558|    245|         return summary;
  559|    245|      }());
tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_116get_server_certsENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEERKNS2_6vectorINS0_16Signature_SchemeENS2_9allocatorIS8_EEEERNS_19Credentials_ManagerE:
  197|  21.1k|   std::string_view hostname, const std::vector<Signature_Scheme>& cert_sig_schemes, Credentials_Manager& creds) {
  198|  21.1k|   const char* cert_types[] = {"RSA", "ECDSA", "DSA", nullptr};
  199|       |
  200|  21.1k|   std::map<std::string, std::vector<X509_Certificate>> cert_chains;
  201|       |
  202|  84.7k|   for(size_t i = 0; cert_types[i]; ++i) {
  ------------------
  |  Branch (202:22): [True: 63.5k, False: 21.1k]
  ------------------
  203|  63.5k|      const std::vector<X509_Certificate> certs = creds.cert_chain_single_type(
  204|  63.5k|         cert_types[i], to_algorithm_identifiers(cert_sig_schemes), "tls-server", std::string(hostname));
  205|       |
  206|  63.5k|      if(!certs.empty()) {
  ------------------
  |  Branch (206:10): [True: 21.1k, False: 42.3k]
  ------------------
  207|  21.1k|         cert_chains[cert_types[i]] = certs;
  208|  21.1k|      }
  209|  63.5k|   }
  210|       |
  211|  21.1k|   return cert_chains;
  212|  21.1k|}
tls_server_impl_12.cpp:_ZN5Botan3TLS12_GLOBAL__N_118choose_ciphersuiteERKNS0_6PolicyENS0_16Protocol_VersionERKNSt3__13mapINS6_12basic_stringIcNS6_11char_traitsIcEENS6_9allocatorIcEEEENS6_6vectorINS_16X509_CertificateENSB_ISF_EEEENS6_4lessISD_EENSB_INS6_4pairIKSD_SH_EEEEEERKNS0_15Client_Hello_12E:
  116|  21.1k|                            const Client_Hello_12& client_hello) {
  117|  21.1k|   const bool our_choice = policy.server_uses_own_ciphersuite_preferences();
  118|  21.1k|   const std::vector<uint16_t>& client_suites = client_hello.ciphersuites();
  119|  21.1k|   const std::vector<uint16_t> server_suites = policy.ciphersuite_list(version);
  120|       |
  121|  21.1k|   if(server_suites.empty()) {
  ------------------
  |  Branch (121:7): [True: 0, False: 21.1k]
  ------------------
  122|      0|      throw TLS_Exception(Alert::HandshakeFailure, "Policy forbids us from negotiating any ciphersuite");
  123|      0|   }
  124|       |
  125|  21.1k|   const bool have_shared_ecc_curve =
  126|  21.1k|      (policy.choose_key_exchange_group(client_hello.supported_ecc_curves(), {}) != Group_Params::NONE);
  127|       |
  128|       |   /*
  129|       |   Walk down one list in preference order
  130|       |   */
  131|  21.1k|   std::vector<uint16_t> pref_list = server_suites;
  132|  21.1k|   std::vector<uint16_t> other_list = client_suites;
  133|       |
  134|  21.1k|   if(!our_choice) {
  ------------------
  |  Branch (134:7): [True: 0, False: 21.1k]
  ------------------
  135|      0|      std::swap(pref_list, other_list);
  136|      0|   }
  137|       |
  138|  1.07M|   for(auto suite_id : pref_list) {
  ------------------
  |  Branch (138:22): [True: 1.07M, False: 123]
  ------------------
  139|  1.07M|      if(!value_exists(other_list, suite_id)) {
  ------------------
  |  Branch (139:10): [True: 1.04M, False: 21.8k]
  ------------------
  140|  1.04M|         continue;
  141|  1.04M|      }
  142|       |
  143|  21.8k|      const auto suite = Ciphersuite::by_id(suite_id);
  144|       |
  145|  21.8k|      if(!suite.has_value() || !suite->valid()) {
  ------------------
  |  Branch (145:10): [True: 0, False: 21.8k]
  |  Branch (145:32): [True: 0, False: 21.8k]
  ------------------
  146|      0|         continue;
  147|      0|      }
  148|       |
  149|  21.8k|      if(have_shared_ecc_curve == false && suite->ecc_ciphersuite()) {
  ------------------
  |  Branch (149:10): [True: 2.41k, False: 19.4k]
  |  Branch (149:44): [True: 703, False: 1.70k]
  ------------------
  150|    703|         continue;
  151|    703|      }
  152|       |
  153|       |      // For non-anon ciphersuites
  154|  21.1k|      if(suite->signature_used()) {
  ------------------
  |  Branch (154:10): [True: 236, False: 20.9k]
  ------------------
  155|    236|         const std::string sig_algo = suite->sig_algo();
  156|       |
  157|       |         // Do we have any certificates for this sig?
  158|    236|         if(!cert_chains.contains(sig_algo)) {
  ------------------
  |  Branch (158:13): [True: 86, False: 150]
  ------------------
  159|     86|            continue;
  160|     86|         }
  161|       |
  162|    150|         const std::vector<Signature_Scheme> allowed = policy.allowed_signature_schemes();
  163|       |
  164|    150|         std::vector<Signature_Scheme> client_sig_methods = client_hello.signature_schemes();
  165|       |
  166|       |         /*
  167|       |         Contrary to the wording of draft-ietf-tls-md5-sha1-deprecate we do
  168|       |         not enforce that clients do not offer support SHA-1 or MD5
  169|       |         signatures; we just ignore it.
  170|       |         */
  171|    150|         bool we_support_some_hash_by_client = false;
  172|       |
  173|  9.82k|         for(Signature_Scheme scheme : client_sig_methods) {
  ------------------
  |  Branch (173:38): [True: 9.82k, False: 150]
  ------------------
  174|  9.82k|            if(!scheme.is_available()) {
  ------------------
  |  Branch (174:16): [True: 7.38k, False: 2.43k]
  ------------------
  175|  7.38k|               continue;
  176|  7.38k|            }
  177|       |
  178|  2.43k|            if(scheme.algorithm_name() == suite->sig_algo() &&
  ------------------
  |  Branch (178:16): [True: 2.21k, False: 221]
  |  Branch (178:16): [True: 2.21k, False: 221]
  ------------------
  179|  2.43k|               policy.allowed_signature_hash(scheme.hash_function_name())) {
  ------------------
  |  Branch (179:16): [True: 2.21k, False: 0]
  ------------------
  180|  2.21k|               we_support_some_hash_by_client = true;
  181|  2.21k|            }
  182|  2.43k|         }
  183|       |
  184|    150|         if(we_support_some_hash_by_client == false) {
  ------------------
  |  Branch (184:13): [True: 60, False: 90]
  ------------------
  185|     60|            throw TLS_Exception(Alert::HandshakeFailure,
  186|     60|                                "Policy does not accept any hash function supported by client");
  187|     60|         }
  188|    150|      }
  189|       |
  190|  20.9k|      return suite_id;
  191|  21.1k|   }
  192|       |
  193|    123|   throw TLS_Exception(Alert::HandshakeFailure, "Can't agree on a ciphersuite with client");
  194|  21.1k|}
_ZNK5Botan3TLS22Server_Handshake_State15is_a_resumptionEv:
   41|    272|      bool is_a_resumption() const { return m_is_a_resumption; }
_ZN5Botan3TLS22Server_Handshake_StateC2ENSt3__110unique_ptrINS0_12Handshake_IOENS2_14default_deleteIS4_EEEERNS0_9CallbacksE:
   23|  24.0k|      Server_Handshake_State(std::unique_ptr<Handshake_IO> io, Callbacks& cb) : Handshake_State(std::move(io), cb) {}

_ZN5Botan3TLS12Session_KeysC2EPKNS0_15Handshake_StateERKNSt3__16vectorIhNS_16secure_allocatorIhEEEEb:
   21|  14.6k|                           bool resuming) {
   22|  14.6k|   const size_t cipher_keylen = state->ciphersuite().cipher_keylen();
   23|  14.6k|   const size_t mac_keylen = state->ciphersuite().mac_keylen();
   24|  14.6k|   const size_t cipher_nonce_bytes = state->ciphersuite().nonce_bytes_from_handshake();
   25|       |
   26|  14.6k|   const bool extended_master_secret = state->server_hello()->supports_extended_master_secret();
   27|       |
   28|  14.6k|   const size_t prf_gen = 2 * (mac_keylen + cipher_keylen + cipher_nonce_bytes);
   29|       |
   30|  14.6k|   const uint8_t MASTER_SECRET_MAGIC[] = {0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74};
   31|       |
   32|  14.6k|   const uint8_t EXT_MASTER_SECRET_MAGIC[] = {0x65, 0x78, 0x74, 0x65, 0x6E, 0x64, 0x65, 0x64, 0x20, 0x6D, 0x61,
   33|  14.6k|                                              0x73, 0x74, 0x65, 0x72, 0x20, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74};
   34|       |
   35|  14.6k|   const uint8_t KEY_GEN_MAGIC[] = {0x6B, 0x65, 0x79, 0x20, 0x65, 0x78, 0x70, 0x61, 0x6E, 0x73, 0x69, 0x6F, 0x6E};
   36|       |
   37|  14.6k|   auto prf = state->protocol_specific_prf();
   38|       |
   39|  14.6k|   if(resuming) {
  ------------------
  |  Branch (39:7): [True: 0, False: 14.6k]
  ------------------
   40|       |      // This is actually the master secret saved as part of the session
   41|      0|      m_master_sec = pre_master_secret;
   42|  14.6k|   } else {
   43|  14.6k|      std::vector<uint8_t> salt;
   44|  14.6k|      std::vector<uint8_t> label;
   45|  14.6k|      if(extended_master_secret) {
  ------------------
  |  Branch (45:10): [True: 1.18k, False: 13.4k]
  ------------------
   46|  1.18k|         label.assign(EXT_MASTER_SECRET_MAGIC, EXT_MASTER_SECRET_MAGIC + sizeof(EXT_MASTER_SECRET_MAGIC));
   47|  1.18k|         salt += state->hash().final(state->ciphersuite().prf_algo());
   48|  13.4k|      } else {
   49|  13.4k|         label.assign(MASTER_SECRET_MAGIC, MASTER_SECRET_MAGIC + sizeof(MASTER_SECRET_MAGIC));
   50|  13.4k|         salt += state->client_hello()->random();
   51|  13.4k|         salt += state->server_hello()->random();
   52|  13.4k|      }
   53|       |
   54|  14.6k|      m_master_sec = prf->derive_key(48, pre_master_secret, salt, label);
   55|  14.6k|   }
   56|       |
   57|  14.6k|   std::vector<uint8_t> salt;
   58|  14.6k|   std::vector<uint8_t> label;
   59|  14.6k|   label.assign(KEY_GEN_MAGIC, KEY_GEN_MAGIC + sizeof(KEY_GEN_MAGIC));
   60|  14.6k|   salt += state->server_hello()->random();
   61|  14.6k|   salt += state->client_hello()->random();
   62|       |
   63|  14.6k|   const secure_vector<uint8_t> prf_output = prf->derive_key(
   64|  14.6k|      prf_gen, m_master_sec.data(), m_master_sec.size(), salt.data(), salt.size(), label.data(), label.size());
   65|       |
   66|  14.6k|   const uint8_t* key_data = prf_output.data();
   67|       |
   68|  14.6k|   m_c_aead.resize(mac_keylen + cipher_keylen);
   69|  14.6k|   m_s_aead.resize(mac_keylen + cipher_keylen);
   70|       |
   71|  14.6k|   copy_mem(&m_c_aead[0], key_data, mac_keylen);
   72|  14.6k|   copy_mem(&m_s_aead[0], key_data + mac_keylen, mac_keylen);
   73|       |
   74|  14.6k|   copy_mem(&m_c_aead[mac_keylen], key_data + 2 * mac_keylen, cipher_keylen);
   75|  14.6k|   copy_mem(&m_s_aead[mac_keylen], key_data + 2 * mac_keylen + cipher_keylen, cipher_keylen);
   76|       |
   77|  14.6k|   m_c_nonce.resize(cipher_nonce_bytes);
   78|  14.6k|   m_s_nonce.resize(cipher_nonce_bytes);
   79|       |
   80|  14.6k|   copy_mem(&m_c_nonce[0], key_data + 2 * (mac_keylen + cipher_keylen), cipher_nonce_bytes);
   81|  14.6k|   copy_mem(&m_s_nonce[0], key_data + 2 * (mac_keylen + cipher_keylen) + cipher_nonce_bytes, cipher_nonce_bytes);
   82|  14.6k|}

_ZN5Botan3TLS9Key_ShareC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE:
  391|    243|Key_Share::Key_Share(TLS_Data_Reader& reader, uint16_t extension_size, Handshake_Type message_type) {
  392|    243|   if(message_type == Handshake_Type::ClientHello) {
  ------------------
  |  Branch (392:7): [True: 243, False: 0]
  ------------------
  393|    243|      m_impl = std::make_unique<Key_Share_Impl>(Key_Share_ClientHello(reader, extension_size));
  394|    243|   } else if(message_type == Handshake_Type::HelloRetryRequest)  // Connection_Side::Server
  ------------------
  |  Branch (394:14): [True: 0, False: 0]
  ------------------
  395|      0|   {
  396|      0|      m_impl = std::make_unique<Key_Share_Impl>(Key_Share_HelloRetryRequest(reader, extension_size));
  397|      0|   } else if(message_type == Handshake_Type::ServerHello)  // Connection_Side::Server
  ------------------
  |  Branch (397:14): [True: 0, False: 0]
  ------------------
  398|      0|   {
  399|      0|      m_impl = std::make_unique<Key_Share_Impl>(Key_Share_ServerHello(reader, extension_size));
  400|      0|   } else {
  401|      0|      throw Invalid_Argument(std::string("cannot create a Key_Share extension for message of type: ") +
  402|      0|                             handshake_type_to_string(message_type));
  403|      0|   }
  404|    243|}
_ZN5Botan3TLS9Key_ShareD2Ev:
  418|    202|Key_Share::~Key_Share() = default;
tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC2ERNS0_15TLS_Data_ReaderEt:
  161|    243|      Key_Share_ClientHello(TLS_Data_Reader& reader, uint16_t /* extension_size */) {
  162|       |         // This construction is a crutch to make working with the incoming
  163|       |         // TLS_Data_Reader bearable. Currently, this reader spans the entire
  164|       |         // Client_Hello message. Hence, if offset or length fields are skewed
  165|       |         // or maliciously fabricated, it is possible to read further than the
  166|       |         // bounds of the current extension.
  167|       |         // Note that this aplies to many locations in the code base.
  168|       |         //
  169|       |         // TODO: Overhaul the TLS_Data_Reader to allow for cheap "sub-readers"
  170|       |         //       that enforce read bounds of sub-structures while parsing.
  171|    243|         const auto client_key_share_length = reader.get_uint16_t();
  172|    243|         const auto read_bytes_so_far_begin = reader.read_so_far();
  173|    243|         auto remaining = [&] {
  174|    243|            const auto read_so_far = reader.read_so_far() - read_bytes_so_far_begin;
  175|    243|            BOTAN_STATE_CHECK(read_so_far <= client_key_share_length);
  176|    243|            return client_key_share_length - read_so_far;
  177|    243|         };
  178|       |
  179|    710|         while(reader.has_remaining() && remaining() > 0) {
  ------------------
  |  Branch (179:16): [True: 477, False: 233]
  |  Branch (179:42): [True: 471, False: 6]
  ------------------
  180|    471|            if(remaining() < 4) {
  ------------------
  |  Branch (180:16): [True: 1, False: 470]
  ------------------
  181|      1|               throw TLS_Exception(Alert::DecodeError, "Not enough data to read another KeyShareEntry");
  182|      1|            }
  183|       |
  184|    470|            Key_Share_Entry new_entry(reader);
  185|       |
  186|       |            // RFC 8446 4.2.8
  187|       |            //    Clients MUST NOT offer multiple KeyShareEntry values for the same
  188|       |            //    group. [...]
  189|       |            //    Servers MAY check for violations of these rules and abort the
  190|       |            //    handshake with an "illegal_parameter" alert if one is violated.
  191|    470|            if(std::find_if(m_client_shares.begin(), m_client_shares.end(), [&](const auto& entry) {
  ------------------
  |  Branch (191:16): [True: 3, False: 467]
  ------------------
  192|    470|                  return entry.group() == new_entry.group();
  193|    470|               }) != m_client_shares.end()) {
  194|      3|               throw TLS_Exception(Alert::IllegalParameter, "Received multiple key share entries for the same group");
  195|      3|            }
  196|       |
  197|    467|            m_client_shares.emplace_back(std::move(new_entry));
  198|    467|         }
  199|       |
  200|    239|         if((reader.read_so_far() - read_bytes_so_far_begin) != client_key_share_length) {
  ------------------
  |  Branch (200:13): [True: 14, False: 225]
  ------------------
  201|     14|            throw Decoding_Error("Read bytes are not equal client KeyShare length");
  202|     14|         }
  203|    239|      }
tls_extensions_key_share.cpp:_ZZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC1ERNS0_15TLS_Data_ReaderEtENKUlvE_clEv:
  173|    948|         auto remaining = [&] {
  174|    948|            const auto read_so_far = reader.read_so_far() - read_bytes_so_far_begin;
  175|    948|            BOTAN_STATE_CHECK(read_so_far <= client_key_share_length);
  ------------------
  |  |   42|    948|   do {                                                         \
  |  |   43|    948|      if(!(expr))                                               \
  |  |  ------------------
  |  |  |  Branch (43:10): [True: 5, False: 943]
  |  |  ------------------
  |  |   44|    948|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   45|    948|   } while(0)
  |  |  ------------------
  |  |  |  Branch (45:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  176|    948|            return client_key_share_length - read_so_far;
  177|    948|         };
tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_115Key_Share_EntryC2ERNS0_15TLS_Data_ReaderE:
   38|    470|      Key_Share_Entry(TLS_Data_Reader& reader) {
   39|       |         // TODO check that the group actually exists before casting...
   40|    470|         m_group = static_cast<Named_Group>(reader.get_uint16_t());
   41|    470|         m_key_exchange = reader.get_tls_length_value(2);
   42|    470|      }
tls_extensions_key_share.cpp:_ZZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC1ERNS0_15TLS_Data_ReaderEtENKUlRKT_E_clINS1_15Key_Share_EntryEEEDaS7_:
  191|    405|            if(std::find_if(m_client_shares.begin(), m_client_shares.end(), [&](const auto& entry) {
  192|    405|                  return entry.group() == new_entry.group();
  193|    405|               }) != m_client_shares.end()) {
tls_extensions_key_share.cpp:_ZNK5Botan3TLS12_GLOBAL__N_115Key_Share_Entry5groupEv:
   84|    810|      Named_Group group() const { return m_group; }
tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloD2Ev:
  228|    606|      ~Key_Share_ClientHello() = default;
tls_extensions_key_share.cpp:_ZN5Botan3TLS12_GLOBAL__N_121Key_Share_ClientHelloC2EOS2_:
  233|    404|      Key_Share_ClientHello(Key_Share_ClientHello&&) = default;
tls_extensions_key_share.cpp:_ZN5Botan3TLS9Key_Share14Key_Share_ImplC2ENSt3__17variantIJNS0_12_GLOBAL__N_121Key_Share_ClientHelloENS5_21Key_Share_ServerHelloENS5_27Key_Share_HelloRetryRequestEEEE:
  386|    202|      Key_Share_Impl(Key_Share_Type ks) : key_share(std::move(ks)) {}

_ZN5Botan3TLS3PSKC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE:
   56|     68|PSK::PSK(TLS_Data_Reader& reader, uint16_t extension_size, Handshake_Type message_type) {
   57|     68|   if(message_type == Handshake_Type::ServerHello) {
  ------------------
  |  Branch (57:7): [True: 0, False: 68]
  ------------------
   58|      0|      if(extension_size != 2) {
  ------------------
  |  Branch (58:10): [True: 0, False: 0]
  ------------------
   59|      0|         throw TLS_Exception(Alert::DecodeError, "Server provided a malformed PSK extension");
   60|      0|      }
   61|       |
   62|      0|      m_impl = std::make_unique<PSK_Internal>(
   63|      0|         Server_PSK{.selected_identity = reader.get_uint16_t(), .session_to_resume = std::nullopt});
   64|     68|   } else if(message_type == Handshake_Type::ClientHello) {
  ------------------
  |  Branch (64:14): [True: 68, False: 0]
  ------------------
   65|     68|      std::vector<Client_PSK> psks;
   66|       |
   67|     68|      const auto identities_length = reader.get_uint16_t();
   68|     68|      const auto identities_offset = reader.read_so_far();
   69|       |
   70|    805|      while(reader.has_remaining() && (reader.read_so_far() - identities_offset) < identities_length) {
  ------------------
  |  Branch (70:13): [True: 780, False: 25]
  |  Branch (70:39): [True: 737, False: 43]
  ------------------
   71|    737|         auto identity = Opaque_Session_Handle(reader.get_tls_length_value(2));
   72|    737|         const auto obfuscated_ticket_age = reader.get_uint32_t();
   73|       |
   74|    737|         psks.emplace_back(Client_PSK{
   75|    737|            .ticket = Ticket(std::move(identity), obfuscated_ticket_age), .binder = {}, .cipher_state = nullptr});
   76|    737|      }
   77|       |
   78|     68|      if(psks.empty()) {
  ------------------
  |  Branch (78:10): [True: 2, False: 66]
  ------------------
   79|      2|         throw TLS_Exception(Alert::DecodeError, "Empty PSK list");
   80|      2|      }
   81|       |
   82|     66|      if(reader.read_so_far() - identities_offset != identities_length) {
  ------------------
  |  Branch (82:10): [True: 14, False: 52]
  ------------------
   83|     14|         throw TLS_Exception(Alert::DecodeError, "Inconsistent PSK identity list");
   84|     14|      }
   85|       |
   86|     52|      const auto binders_length = reader.get_uint16_t();
   87|     52|      const auto binders_offset = reader.read_so_far();
   88|       |
   89|     52|      if(binders_length == 0) {
  ------------------
  |  Branch (89:10): [True: 1, False: 51]
  ------------------
   90|      1|         throw TLS_Exception(Alert::DecodeError, "Empty PSK binders list");
   91|      1|      }
   92|       |
   93|    186|      for(auto& psk : psks) {
  ------------------
  |  Branch (93:21): [True: 186, False: 48]
  ------------------
   94|    186|         if(!reader.has_remaining() || reader.read_so_far() - binders_offset >= binders_length) {
  ------------------
  |  Branch (94:13): [True: 2, False: 184]
  |  Branch (94:40): [True: 1, False: 183]
  ------------------
   95|      3|            throw TLS_Exception(Alert::IllegalParameter, "Not enough PSK binders");
   96|      3|         }
   97|       |
   98|    183|         psk.binder = reader.get_tls_length_value(1);
   99|    183|      }
  100|       |
  101|     48|      if(reader.read_so_far() - binders_offset != binders_length) {
  ------------------
  |  Branch (101:10): [True: 10, False: 38]
  ------------------
  102|     10|         throw TLS_Exception(Alert::IllegalParameter, "Too many PSK binders");
  103|     10|      }
  104|       |
  105|     38|      m_impl = std::make_unique<PSK_Internal>(std::move(psks));
  106|     38|   } else {
  107|      0|      throw TLS_Exception(Alert::DecodeError, "Found a PSK extension in an unexpected handshake message");
  108|      0|   }
  109|     68|}
_ZN5Botan3TLS3PSKD2Ev:
  151|     13|PSK::~PSK() = default;
tls_extensions_psk.cpp:_ZN5Botan3TLS3PSK12PSK_InternalC2ENSt3__16vectorINS0_12_GLOBAL__N_110Client_PSKENS3_9allocatorIS6_EEEE:
   51|     13|      PSK_Internal(std::vector<Client_PSK> clt_psks) : psk(std::move(clt_psks)) {}

_ZN5Botan3TLS5AlertC2ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEE:
   14|  19.6k|Alert::Alert(const secure_vector<uint8_t>& buf) {
   15|  19.6k|   if(buf.size() != 2) {
  ------------------
  |  Branch (15:7): [True: 14, False: 19.6k]
  ------------------
   16|     14|      throw Decoding_Error("Bad size (" + std::to_string(buf.size()) + ") for TLS alert message");
   17|     14|   }
   18|       |
   19|  19.6k|   if(buf[0] == 1) {
  ------------------
  |  Branch (19:7): [True: 19.0k, False: 643]
  ------------------
   20|  19.0k|      m_fatal = false;
   21|  19.0k|   } else if(buf[0] == 2) {
  ------------------
  |  Branch (21:14): [True: 630, False: 13]
  ------------------
   22|    630|      m_fatal = true;
   23|    630|   } else {
   24|     13|      throw TLS_Exception(Alert::IllegalParameter, "Bad code for TLS alert level");
   25|     13|   }
   26|       |
   27|  19.6k|   const uint8_t dc = buf[1];
   28|       |
   29|  19.6k|   m_type_code = static_cast<Type>(dc);
   30|  19.6k|}
_ZNK5Botan3TLS5Alert9serializeEv:
   32|  3.27k|std::vector<uint8_t> Alert::serialize() const {
   33|  3.27k|   return std::vector<uint8_t>({static_cast<uint8_t>(is_fatal() ? 2 : 1), static_cast<uint8_t>(type())});
  ------------------
  |  Branch (33:54): [True: 3.27k, False: 3]
  ------------------
   34|  3.27k|}

_ZN5Botan3TLS18kdf_algo_to_stringENS0_8KDF_AlgoE:
   15|  16.8k|std::string kdf_algo_to_string(KDF_Algo algo) {
   16|  16.8k|   switch(algo) {
  ------------------
  |  Branch (16:11): [True: 0, False: 16.8k]
  ------------------
   17|  9.76k|      case KDF_Algo::SHA_1:
  ------------------
  |  Branch (17:7): [True: 9.76k, False: 7.13k]
  ------------------
   18|  9.76k|         return "SHA-1";
   19|  4.04k|      case KDF_Algo::SHA_256:
  ------------------
  |  Branch (19:7): [True: 4.04k, False: 12.8k]
  ------------------
   20|  4.04k|         return "SHA-256";
   21|  3.08k|      case KDF_Algo::SHA_384:
  ------------------
  |  Branch (21:7): [True: 3.08k, False: 13.8k]
  ------------------
   22|  3.08k|         return "SHA-384";
   23|  16.8k|   }
   24|       |
   25|      0|   throw Invalid_State("kdf_algo_to_string unknown enum value");
   26|  16.8k|}
_ZN5Botan3TLS20kex_method_to_stringENS0_8Kex_AlgoE:
   28|    245|std::string kex_method_to_string(Kex_Algo method) {
   29|    245|   switch(method) {
  ------------------
  |  Branch (29:11): [True: 0, False: 245]
  ------------------
   30|      0|      case Kex_Algo::STATIC_RSA:
  ------------------
  |  Branch (30:7): [True: 0, False: 245]
  ------------------
   31|      0|         return "RSA";
   32|      0|      case Kex_Algo::DH:
  ------------------
  |  Branch (32:7): [True: 0, False: 245]
  ------------------
   33|      0|         return "DH";
   34|      0|      case Kex_Algo::ECDH:
  ------------------
  |  Branch (34:7): [True: 0, False: 245]
  ------------------
   35|      0|         return "ECDH";
   36|     77|      case Kex_Algo::PSK:
  ------------------
  |  Branch (36:7): [True: 77, False: 168]
  ------------------
   37|     77|         return "PSK";
   38|    168|      case Kex_Algo::ECDHE_PSK:
  ------------------
  |  Branch (38:7): [True: 168, False: 77]
  ------------------
   39|    168|         return "ECDHE_PSK";
   40|      0|      case Kex_Algo::DHE_PSK:
  ------------------
  |  Branch (40:7): [True: 0, False: 245]
  ------------------
   41|      0|         return "DHE_PSK";
   42|      0|      case Kex_Algo::UNDEFINED:
  ------------------
  |  Branch (42:7): [True: 0, False: 245]
  ------------------
   43|      0|         return "UNDEFINED";
   44|    245|   }
   45|       |
   46|      0|   throw Invalid_State("kex_method_to_string unknown enum value");
   47|    245|}
_ZN5Botan3TLS21auth_method_to_stringENS0_11Auth_MethodE:
   81|  2.75k|std::string auth_method_to_string(Auth_Method method) {
   82|  2.75k|   switch(method) {
  ------------------
  |  Branch (82:11): [True: 0, False: 2.75k]
  ------------------
   83|  2.67k|      case Auth_Method::RSA:
  ------------------
  |  Branch (83:7): [True: 2.67k, False: 86]
  ------------------
   84|  2.67k|         return "RSA";
   85|      6|      case Auth_Method::ECDSA:
  ------------------
  |  Branch (85:7): [True: 6, False: 2.75k]
  ------------------
   86|      6|         return "ECDSA";
   87|      0|      case Auth_Method::IMPLICIT:
  ------------------
  |  Branch (87:7): [True: 0, False: 2.75k]
  ------------------
   88|      0|         return "IMPLICIT";
   89|     80|      case Auth_Method::UNDEFINED:
  ------------------
  |  Branch (89:7): [True: 80, False: 2.67k]
  ------------------
   90|     80|         return "UNDEFINED";
   91|  2.75k|   }
   92|       |
   93|      0|   throw Invalid_State("auth_method_to_string unknown enum value");
   94|  2.75k|}
_ZN5Botan3TLS17group_param_is_dhENS0_12Group_ParamsE:
  113|   156k|bool group_param_is_dh(Group_Params group) {
  114|   156k|   uint16_t group_id = static_cast<uint16_t>(group);
  115|   156k|   return (group_id >= 256 && group_id < 512);
  ------------------
  |  Branch (115:12): [True: 111k, False: 44.9k]
  |  Branch (115:31): [True: 25.7k, False: 85.9k]
  ------------------
  116|   156k|}
_ZN5Botan3TLS21group_param_to_stringENS0_12Group_ParamsE:
  160|  33.5k|std::string group_param_to_string(Group_Params group) {
  161|  33.5k|   switch(group) {
  162|  3.42k|      case Group_Params::SECP256R1:
  ------------------
  |  Branch (162:7): [True: 3.42k, False: 30.1k]
  ------------------
  163|  3.42k|         return "secp256r1";
  164|  4.17k|      case Group_Params::SECP384R1:
  ------------------
  |  Branch (164:7): [True: 4.17k, False: 29.3k]
  ------------------
  165|  4.17k|         return "secp384r1";
  166|  10.7k|      case Group_Params::SECP521R1:
  ------------------
  |  Branch (166:7): [True: 10.7k, False: 22.8k]
  ------------------
  167|  10.7k|         return "secp521r1";
  168|  3.28k|      case Group_Params::BRAINPOOL256R1:
  ------------------
  |  Branch (168:7): [True: 3.28k, False: 30.2k]
  ------------------
  169|  3.28k|         return "brainpool256r1";
  170|  4.07k|      case Group_Params::BRAINPOOL384R1:
  ------------------
  |  Branch (170:7): [True: 4.07k, False: 29.5k]
  ------------------
  171|  4.07k|         return "brainpool384r1";
  172|  7.90k|      case Group_Params::BRAINPOOL512R1:
  ------------------
  |  Branch (172:7): [True: 7.90k, False: 25.6k]
  ------------------
  173|  7.90k|         return "brainpool512r1";
  174|      0|      case Group_Params::X25519:
  ------------------
  |  Branch (174:7): [True: 0, False: 33.5k]
  ------------------
  175|      0|         return "x25519";
  176|       |
  177|      0|      case Group_Params::FFDHE_2048:
  ------------------
  |  Branch (177:7): [True: 0, False: 33.5k]
  ------------------
  178|      0|         return "ffdhe/ietf/2048";
  179|      0|      case Group_Params::FFDHE_3072:
  ------------------
  |  Branch (179:7): [True: 0, False: 33.5k]
  ------------------
  180|      0|         return "ffdhe/ietf/3072";
  181|      0|      case Group_Params::FFDHE_4096:
  ------------------
  |  Branch (181:7): [True: 0, False: 33.5k]
  ------------------
  182|      0|         return "ffdhe/ietf/4096";
  183|      0|      case Group_Params::FFDHE_6144:
  ------------------
  |  Branch (183:7): [True: 0, False: 33.5k]
  ------------------
  184|      0|         return "ffdhe/ietf/6144";
  185|      0|      case Group_Params::FFDHE_8192:
  ------------------
  |  Branch (185:7): [True: 0, False: 33.5k]
  ------------------
  186|      0|         return "ffdhe/ietf/8192";
  187|       |
  188|      0|      default:
  ------------------
  |  Branch (188:7): [True: 0, False: 33.5k]
  ------------------
  189|      0|         return "";
  190|  33.5k|   }
  191|  33.5k|}

_ZN5Botan3TLS9Callbacks25tls_inspect_handshake_msgERKNS0_17Handshake_MessageE:
   30|   102k|void TLS::Callbacks::tls_inspect_handshake_msg(const Handshake_Message& /*unused*/) {
   31|       |   // default is no op
   32|   102k|}
_ZN5Botan3TLS9Callbacks25tls_peer_network_identityEv:
   36|  3.80k|std::string TLS::Callbacks::tls_peer_network_identity() { return ""; }
_ZN5Botan3TLS9Callbacks21tls_current_timestampEv:
   38|  42.2k|std::chrono::system_clock::time_point TLS::Callbacks::tls_current_timestamp() {
   39|  42.2k|   return std::chrono::system_clock::now();
   40|  42.2k|}
_ZN5Botan3TLS9Callbacks21tls_modify_extensionsERNS0_10ExtensionsENS0_15Connection_SideENS0_14Handshake_TypeE:
   44|  20.9k|                                           Handshake_Type /*unused*/) {}
_ZN5Botan3TLS9Callbacks22tls_examine_extensionsERKNS0_10ExtensionsENS0_15Connection_SideENS0_14Handshake_TypeE:
   48|  21.1k|                                            Handshake_Type /*unused*/) {}
_ZN5Botan3TLS9Callbacks41tls_should_persist_resumption_informationERKNS0_7SessionE:
   50|    245|bool TLS::Callbacks::tls_should_persist_resumption_information(const Session& session) {
   51|       |   // RFC 5077 3.3
   52|       |   //    The ticket_lifetime_hint field contains a hint from the server about
   53|       |   //    how long the ticket should be stored. A value of zero is reserved to
   54|       |   //    indicate that the lifetime of the ticket is unspecified.
   55|       |   //
   56|       |   // RFC 8446 4.6.1
   57|       |   //    [A ticket_lifetime] of zero indicates that the ticket should be discarded
   58|       |   //    immediately.
   59|       |   //
   60|       |   // By default we opt to keep all sessions, except for TLS 1.3 with a lifetime
   61|       |   // hint of zero.
   62|    245|   return session.lifetime_hint().count() > 0 || session.version().is_pre_tls_13();
  ------------------
  |  Branch (62:11): [True: 245, False: 0]
  |  Branch (62:50): [True: 0, False: 0]
  ------------------
   63|    245|}
_ZN5Botan3TLS9Callbacks26tls_generate_ephemeral_keyERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERNS_21RandomNumberGeneratorE:
  151|  19.2k|   const std::variant<TLS::Group_Params, DL_Group>& group, RandomNumberGenerator& rng) {
  152|  19.2k|   if(is_dh_group(group)) {
  ------------------
  |  Branch (152:7): [True: 0, False: 19.2k]
  ------------------
  153|      0|      const DL_Group dl_group = get_dl_group(group);
  154|      0|      return std::make_unique<DH_PrivateKey>(rng, dl_group);
  155|      0|   }
  156|       |
  157|  19.2k|   BOTAN_ASSERT_NOMSG(std::holds_alternative<TLS::Group_Params>(group));
  ------------------
  |  |   60|  19.2k|   do {                                                                     \
  |  |   61|  19.2k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 19.2k]
  |  |  ------------------
  |  |   62|  19.2k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  19.2k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  158|  19.2k|   const auto group_params = std::get<TLS::Group_Params>(group);
  159|       |
  160|  19.2k|   if(is_ecdh(group_params)) {
  ------------------
  |  Branch (160:7): [True: 18.6k, False: 604]
  ------------------
  161|  18.6k|      const EC_Group ec_group(group_param_to_string(group_params));
  162|  18.6k|      return std::make_unique<ECDH_PrivateKey>(rng, ec_group);
  163|  18.6k|   }
  164|       |
  165|    604|#if defined(BOTAN_HAS_CURVE_25519)
  166|    604|   if(is_x25519(group_params)) {
  ------------------
  |  Branch (166:7): [True: 604, False: 0]
  ------------------
  167|    604|      return std::make_unique<X25519_PrivateKey>(rng);
  168|    604|   }
  169|      0|#endif
  170|       |
  171|      0|   throw TLS_Exception(Alert::DecodeError, "cannot create a key offering without a group definition");
  172|    604|}
_ZN5Botan3TLS9Callbacks27tls_ephemeral_key_agreementERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERKNS_20PK_Key_Agreement_KeyERKNS2_6vectorIhNS2_9allocatorIhEEEERNS_21RandomNumberGeneratorERKNS0_6PolicyE:
  179|  14.8k|   const Policy& policy) {
  180|  14.8k|   auto agree = [&](const PK_Key_Agreement_Key& sk, const auto& pk) {
  181|  14.8k|      PK_Key_Agreement ka(sk, rng, "Raw");
  182|  14.8k|      return ka.derive_key(0, pk.public_value()).bits_of();
  183|  14.8k|   };
  184|       |
  185|  14.8k|   if(is_dh_group(group)) {
  ------------------
  |  Branch (185:7): [True: 0, False: 14.8k]
  ------------------
  186|       |      // TLS 1.2 allows specifying arbitrary DL_Group parameters in-lieu of
  187|       |      // a standardized DH group identifier.
  188|      0|      const auto dl_group = get_dl_group(group);
  189|       |
  190|      0|      auto Y = BigInt::decode(public_value);
  191|       |
  192|       |      /*
  193|       |       * A basic check for key validity. As we do not know q here we
  194|       |       * cannot check that Y is in the right subgroup. However since
  195|       |       * our key is ephemeral there does not seem to be any
  196|       |       * advantage to bogus keys anyway.
  197|       |       */
  198|      0|      if(Y <= 1 || Y >= dl_group.get_p() - 1) {
  ------------------
  |  Branch (198:10): [True: 0, False: 0]
  |  Branch (198:10): [True: 0, False: 0]
  |  Branch (198:20): [True: 0, False: 0]
  ------------------
  199|      0|         throw TLS_Exception(Alert::IllegalParameter, "Server sent bad DH key for DHE exchange");
  200|      0|      }
  201|       |
  202|      0|      DH_PublicKey peer_key(dl_group, Y);
  203|      0|      policy.check_peer_key_acceptable(peer_key);
  204|       |
  205|      0|      return agree(private_key, peer_key);
  206|      0|   }
  207|       |
  208|  14.8k|   BOTAN_ASSERT_NOMSG(std::holds_alternative<TLS::Group_Params>(group));
  ------------------
  |  |   60|  14.8k|   do {                                                                     \
  |  |   61|  14.8k|      if(!(expr))                                                           \
  |  |  ------------------
  |  |  |  Branch (61:10): [True: 0, False: 14.8k]
  |  |  ------------------
  |  |   62|  14.8k|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   63|  14.8k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (63:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  209|  14.8k|   const auto group_params = std::get<TLS::Group_Params>(group);
  210|       |
  211|  14.8k|   if(is_ecdh(group_params)) {
  ------------------
  |  Branch (211:7): [True: 14.8k, False: 1]
  ------------------
  212|  14.8k|      const EC_Group ec_group(group_param_to_string(group_params));
  213|  14.8k|      ECDH_PublicKey peer_key(ec_group, ec_group.OS2ECP(public_value));
  214|  14.8k|      policy.check_peer_key_acceptable(peer_key);
  215|       |
  216|  14.8k|      return agree(private_key, peer_key);
  217|  14.8k|   }
  218|       |
  219|      1|#if defined(BOTAN_HAS_CURVE_25519)
  220|      1|   if(is_x25519(group_params)) {
  ------------------
  |  Branch (220:7): [True: 1, False: 0]
  ------------------
  221|      1|      if(public_value.size() != 32) {
  ------------------
  |  Branch (221:10): [True: 1, False: 0]
  ------------------
  222|      1|         throw TLS_Exception(Alert::HandshakeFailure, "Invalid X25519 key size");
  223|      1|      }
  224|       |
  225|      0|      Curve25519_PublicKey peer_key(public_value);
  226|      0|      policy.check_peer_key_acceptable(peer_key);
  227|       |
  228|      0|      return agree(private_key, peer_key);
  229|      1|   }
  230|      0|#endif
  231|       |
  232|      0|   throw TLS_Exception(Alert::IllegalParameter, "Did not recognize the key exchange group");
  233|      1|}
tls_callbacks.cpp:_ZN5Botan12_GLOBAL__N_111is_dh_groupERKNSt3__17variantIJNS_3TLS12Group_ParamsENS_8DL_GroupEEEE:
  132|  34.1k|bool is_dh_group(const std::variant<TLS::Group_Params, DL_Group>& group) {
  133|  34.1k|   return std::holds_alternative<DL_Group>(group) || is_dh(std::get<TLS::Group_Params>(group));
  ------------------
  |  Branch (133:11): [True: 0, False: 34.1k]
  |  Branch (133:54): [True: 0, False: 34.1k]
  ------------------
  134|  34.1k|}
tls_callbacks.cpp:_ZZN5Botan3TLS9Callbacks27tls_ephemeral_key_agreementERKNSt3__17variantIJNS0_12Group_ParamsENS_8DL_GroupEEEERKNS_20PK_Key_Agreement_KeyERKNS2_6vectorIhNS2_9allocatorIhEEEERNS_21RandomNumberGeneratorERKNS0_6PolicyEENK3$_2clINS_14ECDH_PublicKeyEEEDaSB_RKT_:
  180|  9.82k|   auto agree = [&](const PK_Key_Agreement_Key& sk, const auto& pk) {
  181|  9.82k|      PK_Key_Agreement ka(sk, rng, "Raw");
  182|  9.82k|      return ka.derive_key(0, pk.public_value()).bits_of();
  183|  9.82k|   };

_ZNK5Botan3TLS11Ciphersuite26nonce_bytes_from_handshakeEv:
   19|  15.3k|size_t Ciphersuite::nonce_bytes_from_handshake() const {
   20|  15.3k|   switch(m_nonce_format) {
  ------------------
  |  Branch (20:11): [True: 0, False: 15.3k]
  ------------------
   21|  13.0k|      case Nonce_Format::CBC_MODE: {
  ------------------
  |  Branch (21:7): [True: 13.0k, False: 2.37k]
  ------------------
   22|  13.0k|         if(cipher_algo() == "3DES") {
  ------------------
  |  Branch (22:13): [True: 1.99k, False: 11.0k]
  ------------------
   23|  1.99k|            return 8;
   24|  11.0k|         } else {
   25|  11.0k|            return 16;
   26|  11.0k|         }
   27|  13.0k|      }
   28|    692|      case Nonce_Format::AEAD_IMPLICIT_4:
  ------------------
  |  Branch (28:7): [True: 692, False: 14.6k]
  ------------------
   29|    692|         return 4;
   30|  1.68k|      case Nonce_Format::AEAD_XOR_12:
  ------------------
  |  Branch (30:7): [True: 1.68k, False: 13.7k]
  ------------------
   31|  1.68k|         return 12;
   32|  15.3k|   }
   33|       |
   34|      0|   throw Invalid_State("In Ciphersuite::nonce_bytes_from_handshake invalid enum value");
   35|  15.3k|}
_ZNK5Botan3TLS11Ciphersuite23nonce_bytes_from_recordENS0_16Protocol_VersionE:
   37|    760|size_t Ciphersuite::nonce_bytes_from_record(Protocol_Version version) const {
   38|    760|   BOTAN_UNUSED(version);
  ------------------
  |  |  118|    760|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   39|    760|   switch(m_nonce_format) {
  ------------------
  |  Branch (39:11): [True: 0, False: 760]
  ------------------
   40|    287|      case Nonce_Format::CBC_MODE:
  ------------------
  |  Branch (40:7): [True: 287, False: 473]
  ------------------
   41|    287|         return cipher_algo() == "3DES" ? 8 : 16;
  ------------------
  |  Branch (41:17): [True: 87, False: 200]
  ------------------
   42|    236|      case Nonce_Format::AEAD_IMPLICIT_4:
  ------------------
  |  Branch (42:7): [True: 236, False: 524]
  ------------------
   43|    236|         return 8;
   44|    237|      case Nonce_Format::AEAD_XOR_12:
  ------------------
  |  Branch (44:7): [True: 237, False: 523]
  ------------------
   45|    237|         return 0;
   46|    760|   }
   47|       |
   48|      0|   throw Invalid_State("In Ciphersuite::nonce_bytes_from_handshake invalid enum value");
   49|    760|}
_ZNK5Botan3TLS11Ciphersuite15psk_ciphersuiteEv:
   56|    245|bool Ciphersuite::psk_ciphersuite() const {
   57|    245|   return kex_method() == Kex_Algo::PSK || kex_method() == Kex_Algo::ECDHE_PSK;
  ------------------
  |  Branch (57:11): [True: 77, False: 168]
  |  Branch (57:44): [True: 168, False: 0]
  ------------------
   58|    245|}
_ZNK5Botan3TLS11Ciphersuite15ecc_ciphersuiteEv:
   60|  23.4k|bool Ciphersuite::ecc_ciphersuite() const {
   61|  23.4k|   return kex_method() == Kex_Algo::ECDH || kex_method() == Kex_Algo::ECDHE_PSK || auth_method() == Auth_Method::ECDSA;
  ------------------
  |  Branch (61:11): [True: 653, False: 22.7k]
  |  Branch (61:45): [True: 19.3k, False: 3.41k]
  |  Branch (61:84): [True: 0, False: 3.41k]
  ------------------
   62|  23.4k|}
_ZNK5Botan3TLS11Ciphersuite15cbc_ciphersuiteEv:
   78|  20.9k|bool Ciphersuite::cbc_ciphersuite() const { return (mac_algo() != "AEAD"); }
_ZNK5Botan3TLS11Ciphersuite14signature_usedEv:
   82|  63.1k|bool Ciphersuite::signature_used() const { return auth_method() != Auth_Method::IMPLICIT; }
_ZN5Botan3TLS11Ciphersuite5by_idEt:
   84|  64.0k|std::optional<Ciphersuite> Ciphersuite::by_id(uint16_t suite) {
   85|  64.0k|   const std::vector<Ciphersuite>& all_suites = all_known_ciphersuites();
   86|  64.0k|   auto s = std::lower_bound(all_suites.begin(), all_suites.end(), suite);
   87|       |
   88|  64.0k|   if(s != all_suites.end() && s->ciphersuite_code() == suite) {
  ------------------
  |  Branch (88:7): [True: 64.0k, False: 0]
  |  Branch (88:7): [True: 64.0k, False: 0]
  |  Branch (88:32): [True: 64.0k, False: 0]
  ------------------
   89|  64.0k|      return *s;
   90|  64.0k|   }
   91|       |
   92|      0|   return std::nullopt;  // some unknown ciphersuite
   93|  64.0k|}
_ZNK5Botan3TLS11Ciphersuite9is_usableEv:
  117|     94|bool Ciphersuite::is_usable() const {
  118|     94|   if(!m_cipher_keylen) {  // uninitialized object
  ------------------
  |  Branch (118:7): [True: 0, False: 94]
  ------------------
  119|      0|      return false;
  120|      0|   }
  121|       |
  122|     94|   if(!have_hash(prf_algo())) {
  ------------------
  |  Branch (122:7): [True: 0, False: 94]
  ------------------
  123|      0|      return false;
  124|      0|   }
  125|       |
  126|       |#if !defined(BOTAN_HAS_TLS_CBC)
  127|       |   if(cbc_ciphersuite())
  128|       |      return false;
  129|       |#endif
  130|       |
  131|     94|   if(mac_algo() == "AEAD") {
  ------------------
  |  Branch (131:7): [True: 64, False: 30]
  ------------------
  132|     64|      if(cipher_algo() == "ChaCha20Poly1305") {
  ------------------
  |  Branch (132:10): [True: 6, False: 58]
  ------------------
  133|       |#if !defined(BOTAN_HAS_AEAD_CHACHA20_POLY1305)
  134|       |         return false;
  135|       |#endif
  136|     58|      } else {
  137|     58|         auto cipher_and_mode = split_on(cipher_algo(), '/');
  138|     58|         BOTAN_ASSERT(cipher_and_mode.size() == 2, "Expected format for AEAD algo");
  ------------------
  |  |   51|     58|   do {                                                                                 \
  |  |   52|     58|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 58]
  |  |  ------------------
  |  |   53|     58|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|     58|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  139|     58|         if(!have_cipher(cipher_and_mode[0])) {
  ------------------
  |  Branch (139:13): [True: 0, False: 58]
  ------------------
  140|      0|            return false;
  141|      0|         }
  142|       |
  143|     58|         const auto mode = cipher_and_mode[1];
  144|       |
  145|       |#if !defined(BOTAN_HAS_AEAD_CCM)
  146|       |         if(mode == "CCM" || mode == "CCM-8")
  147|       |            return false;
  148|       |#endif
  149|       |
  150|       |#if !defined(BOTAN_HAS_AEAD_GCM)
  151|       |         if(mode == "GCM")
  152|       |            return false;
  153|       |#endif
  154|       |
  155|       |#if !defined(BOTAN_HAS_AEAD_OCB)
  156|       |         if(mode == "OCB(12)" || mode == "OCB")
  157|       |            return false;
  158|       |#endif
  159|     58|      }
  160|     64|   } else {
  161|       |      // Old non-AEAD schemes
  162|     30|      if(!have_cipher(cipher_algo())) {
  ------------------
  |  Branch (162:10): [True: 0, False: 30]
  ------------------
  163|      0|         return false;
  164|      0|      }
  165|     30|      if(!have_hash(mac_algo())) {  // HMAC
  ------------------
  |  Branch (165:10): [True: 0, False: 30]
  ------------------
  166|      0|         return false;
  167|      0|      }
  168|     30|   }
  169|       |
  170|     94|   if(kex_method() == Kex_Algo::ECDH || kex_method() == Kex_Algo::ECDHE_PSK) {
  ------------------
  |  Branch (170:7): [True: 30, False: 64]
  |  Branch (170:41): [True: 11, False: 53]
  ------------------
  171|       |#if !defined(BOTAN_HAS_ECDH)
  172|       |      return false;
  173|       |#endif
  174|     53|   } else if(kex_method() == Kex_Algo::DH) {
  ------------------
  |  Branch (174:14): [True: 16, False: 37]
  ------------------
  175|       |#if !defined(BOTAN_HAS_DIFFIE_HELLMAN)
  176|       |      return false;
  177|       |#endif
  178|     16|   }
  179|       |
  180|     94|   if(auth_method() == Auth_Method::ECDSA) {
  ------------------
  |  Branch (180:7): [True: 17, False: 77]
  ------------------
  181|       |#if !defined(BOTAN_HAS_ECDSA)
  182|       |      return false;
  183|       |#endif
  184|     77|   } else if(auth_method() == Auth_Method::RSA) {
  ------------------
  |  Branch (184:14): [True: 29, False: 48]
  ------------------
  185|       |#if !defined(BOTAN_HAS_RSA)
  186|       |      return false;
  187|       |#endif
  188|     29|   }
  189|       |
  190|     94|   return true;
  191|     94|}
tls_ciphersuite.cpp:_ZN5Botan3TLS12_GLOBAL__N_19have_hashENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  109|    124|bool have_hash(std::string_view prf) { return (!HashFunction::providers(prf).empty()); }
tls_ciphersuite.cpp:_ZN5Botan3TLS12_GLOBAL__N_111have_cipherENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  111|     88|bool have_cipher(std::string_view cipher) {
  112|     88|   return (!BlockCipher::providers(cipher).empty()) || (!StreamCipher::providers(cipher).empty());
  ------------------
  |  Branch (112:11): [True: 88, False: 0]
  |  Branch (112:56): [True: 0, False: 0]
  ------------------
  113|     88|}

_ZN5Botan3TLS10Extensions3addENSt3__110unique_ptrINS0_9ExtensionENS2_14default_deleteIS4_EEEE:
  101|   187k|void Extensions::add(std::unique_ptr<Extension> extn) {
  102|   187k|   if(has(extn->type())) {
  ------------------
  |  Branch (102:7): [True: 0, False: 187k]
  ------------------
  103|      0|      throw Invalid_Argument("cannot add the same extension twice: " +
  104|      0|                             std::to_string(static_cast<uint16_t>(extn->type())));
  105|      0|   }
  106|       |
  107|   187k|   m_extensions.emplace_back(extn.release());
  108|   187k|}
_ZN5Botan3TLS10Extensions11deserializeERNS0_15TLS_Data_ReaderENS0_15Connection_SideENS0_14Handshake_TypeE:
  110|  25.9k|void Extensions::deserialize(TLS_Data_Reader& reader, const Connection_Side from, const Handshake_Type message_type) {
  111|  25.9k|   if(reader.has_remaining()) {
  ------------------
  |  Branch (111:7): [True: 22.2k, False: 3.68k]
  ------------------
  112|  22.2k|      const uint16_t all_extn_size = reader.get_uint16_t();
  113|       |
  114|  22.2k|      if(reader.remaining_bytes() != all_extn_size) {
  ------------------
  |  Branch (114:10): [True: 20, False: 22.2k]
  ------------------
  115|     20|         throw Decoding_Error("Bad extension size");
  116|     20|      }
  117|       |
  118|   184k|      while(reader.has_remaining()) {
  ------------------
  |  Branch (118:13): [True: 162k, False: 22.2k]
  ------------------
  119|   162k|         const uint16_t extension_code = reader.get_uint16_t();
  120|   162k|         const uint16_t extension_size = reader.get_uint16_t();
  121|       |
  122|   162k|         const auto type = static_cast<Extension_Code>(extension_code);
  123|       |
  124|   162k|         if(this->has(type)) {
  ------------------
  |  Branch (124:13): [True: 11, False: 162k]
  ------------------
  125|     11|            throw TLS_Exception(TLS::Alert::DecodeError, "Peer sent duplicated extensions");
  126|     11|         }
  127|       |
  128|       |         // TODO offer a function on reader that returns a byte range as a reference
  129|       |         // to avoid this copy of the extension data
  130|   162k|         const std::vector<uint8_t> extn_data = reader.get_fixed<uint8_t>(extension_size);
  131|   162k|         TLS_Data_Reader extn_reader("Extension", extn_data);
  132|   162k|         this->add(make_extension(extn_reader, type, from, message_type));
  133|   162k|         extn_reader.assert_done();
  134|   162k|      }
  135|  22.2k|   }
  136|  25.9k|}
_ZNK5Botan3TLS10Extensions9serializeENS0_15Connection_SideE:
  174|  20.9k|std::vector<uint8_t> Extensions::serialize(Connection_Side whoami) const {
  175|  20.9k|   std::vector<uint8_t> buf(2);  // 2 bytes for length field
  176|       |
  177|  20.9k|   for(const auto& extn : m_extensions) {
  ------------------
  |  Branch (177:25): [True: 15.4k, False: 20.9k]
  ------------------
  178|  15.4k|      if(extn->empty()) {
  ------------------
  |  Branch (178:10): [True: 0, False: 15.4k]
  ------------------
  179|      0|         continue;
  180|      0|      }
  181|       |
  182|  15.4k|      const uint16_t extn_code = static_cast<uint16_t>(extn->type());
  183|       |
  184|  15.4k|      const std::vector<uint8_t> extn_val = extn->serialize(whoami);
  185|       |
  186|  15.4k|      buf.push_back(get_byte<0>(extn_code));
  187|  15.4k|      buf.push_back(get_byte<1>(extn_code));
  188|       |
  189|  15.4k|      buf.push_back(get_byte<0>(static_cast<uint16_t>(extn_val.size())));
  190|  15.4k|      buf.push_back(get_byte<1>(static_cast<uint16_t>(extn_val.size())));
  191|       |
  192|  15.4k|      buf += extn_val;
  193|  15.4k|   }
  194|       |
  195|  20.9k|   const uint16_t extn_size = static_cast<uint16_t>(buf.size() - 2);
  196|       |
  197|  20.9k|   buf[0] = get_byte<0>(extn_size);
  198|  20.9k|   buf[1] = get_byte<1>(extn_size);
  199|       |
  200|       |   // avoid sending a completely empty extensions block
  201|  20.9k|   if(buf.size() == 2) {
  ------------------
  |  Branch (201:7): [True: 9.03k, False: 11.9k]
  ------------------
  202|  9.03k|      return std::vector<uint8_t>();
  203|  9.03k|   }
  204|       |
  205|  11.9k|   return buf;
  206|  20.9k|}
_ZNK5Botan3TLS10Extensions15extension_typesEv:
  208|  19.2k|std::set<Extension_Code> Extensions::extension_types() const {
  209|  19.2k|   std::set<Extension_Code> offers;
  210|  19.2k|   std::transform(
  211|  19.2k|      m_extensions.cbegin(), m_extensions.cend(), std::inserter(offers, offers.begin()), [](const auto& ext) {
  212|  19.2k|         return ext->type();
  213|  19.2k|      });
  214|  19.2k|   return offers;
  215|  19.2k|}
_ZN5Botan3TLS17Unknown_ExtensionC2ENS0_14Extension_CodeERNS0_15TLS_Data_ReaderEt:
  218|   129k|      m_type(type), m_value(reader.get_fixed<uint8_t>(extension_size)) {}
_ZN5Botan3TLS21Server_Name_IndicatorC2ERNS0_15TLS_Data_ReaderEt:
  222|  1.74k|Server_Name_Indicator::Server_Name_Indicator(TLS_Data_Reader& reader, uint16_t extension_size) {
  223|       |   /*
  224|       |   * This is used by the server to confirm that it knew the name
  225|       |   */
  226|  1.74k|   if(extension_size == 0) {
  ------------------
  |  Branch (226:7): [True: 1.35k, False: 393]
  ------------------
  227|  1.35k|      return;
  228|  1.35k|   }
  229|       |
  230|    393|   uint16_t name_bytes = reader.get_uint16_t();
  231|       |
  232|    393|   if(name_bytes + 2 != extension_size) {
  ------------------
  |  Branch (232:7): [True: 26, False: 367]
  ------------------
  233|     26|      throw Decoding_Error("Bad encoding of SNI extension");
  234|     26|   }
  235|       |
  236|    627|   while(name_bytes) {
  ------------------
  |  Branch (236:10): [True: 260, False: 367]
  ------------------
  237|    260|      uint8_t name_type = reader.get_byte();
  238|    260|      name_bytes--;
  239|       |
  240|    260|      if(name_type == 0)  // DNS
  ------------------
  |  Branch (240:10): [True: 131, False: 129]
  ------------------
  241|    131|      {
  242|    131|         m_sni_host_name = reader.get_string(2, 1, 65535);
  243|    131|         name_bytes -= static_cast<uint16_t>(2 + m_sni_host_name.size());
  244|    131|      } else  // some other unknown name type
  245|    129|      {
  246|    129|         reader.discard_next(name_bytes);
  247|    129|         name_bytes = 0;
  248|    129|      }
  249|    260|   }
  250|    367|}
_ZN5Botan3TLS23Renegotiation_ExtensionC2ERNS0_15TLS_Data_ReaderEt:
  278|    295|      m_reneg_data(reader.get_range<uint8_t>(1, 0, 255)) {
  279|    295|   if(m_reneg_data.size() + 1 != extension_size) {
  ------------------
  |  Branch (279:7): [True: 2, False: 293]
  ------------------
  280|      2|      throw Decoding_Error("Bad encoding for secure renegotiation extn");
  281|      2|   }
  282|    295|}
_ZNK5Botan3TLS23Renegotiation_Extension9serializeENS0_15Connection_SideE:
  284|  10.4k|std::vector<uint8_t> Renegotiation_Extension::serialize(Connection_Side /*whoami*/) const {
  285|  10.4k|   std::vector<uint8_t> buf;
  286|  10.4k|   append_tls_length_value(buf, m_reneg_data, 1);
  287|  10.4k|   return buf;
  288|  10.4k|}
_ZN5Botan3TLS39Application_Layer_Protocol_NotificationC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE:
  292|  1.81k|                                                                                 Connection_Side from) {
  293|  1.81k|   if(extension_size == 0) {
  ------------------
  |  Branch (293:7): [True: 1.51k, False: 298]
  ------------------
  294|  1.51k|      return;  // empty extension
  295|  1.51k|   }
  296|       |
  297|    298|   const uint16_t name_bytes = reader.get_uint16_t();
  298|       |
  299|    298|   size_t bytes_remaining = extension_size - 2;
  300|       |
  301|    298|   if(name_bytes != bytes_remaining) {
  ------------------
  |  Branch (301:7): [True: 8, False: 290]
  ------------------
  302|      8|      throw Decoding_Error("Bad encoding of ALPN extension, bad length field");
  303|      8|   }
  304|       |
  305|  1.55k|   while(bytes_remaining) {
  ------------------
  |  Branch (305:10): [True: 1.26k, False: 284]
  ------------------
  306|  1.26k|      const std::string p = reader.get_string(1, 0, 255);
  307|       |
  308|  1.26k|      if(bytes_remaining < p.size() + 1) {
  ------------------
  |  Branch (308:10): [True: 0, False: 1.26k]
  ------------------
  309|      0|         throw Decoding_Error("Bad encoding of ALPN, length field too long");
  310|      0|      }
  311|       |
  312|  1.26k|      if(p.empty()) {
  ------------------
  |  Branch (312:10): [True: 6, False: 1.26k]
  ------------------
  313|      6|         throw Decoding_Error("Empty ALPN protocol not allowed");
  314|      6|      }
  315|       |
  316|  1.26k|      bytes_remaining -= (p.size() + 1);
  317|       |
  318|  1.26k|      m_protocols.push_back(p);
  319|  1.26k|   }
  320|       |
  321|       |   // RFC 7301 3.1
  322|       |   //    The "extension_data" field of the [...] extension is structured the
  323|       |   //    same as described above for the client "extension_data", except that
  324|       |   //    the "ProtocolNameList" MUST contain exactly one "ProtocolName".
  325|    284|   if(from == Connection_Side::Server && m_protocols.size() != 1) {
  ------------------
  |  Branch (325:7): [True: 0, False: 284]
  |  Branch (325:42): [True: 0, False: 0]
  ------------------
  326|      0|      throw TLS_Exception(
  327|      0|         Alert::DecodeError,
  328|      0|         "Server sent " + std::to_string(m_protocols.size()) + " protocols in ALPN extension response");
  329|      0|   }
  330|    284|}
_ZNK5Botan3TLS39Application_Layer_Protocol_Notification9serializeENS0_15Connection_SideE:
  337|  1.73k|std::vector<uint8_t> Application_Layer_Protocol_Notification::serialize(Connection_Side /*whoami*/) const {
  338|  1.73k|   std::vector<uint8_t> buf(2);
  339|       |
  340|  1.73k|   for(auto&& p : m_protocols) {
  ------------------
  |  Branch (340:17): [True: 1.73k, False: 1.73k]
  ------------------
  341|  1.73k|      if(p.length() >= 256) {
  ------------------
  |  Branch (341:10): [True: 0, False: 1.73k]
  ------------------
  342|      0|         throw TLS_Exception(Alert::InternalError, "ALPN name too long");
  343|      0|      }
  344|  1.73k|      if(!p.empty()) {
  ------------------
  |  Branch (344:10): [True: 1.73k, False: 0]
  ------------------
  345|  1.73k|         append_tls_length_value(buf, cast_char_ptr_to_uint8(p.data()), p.size(), 1);
  346|  1.73k|      }
  347|  1.73k|   }
  348|       |
  349|  1.73k|   buf[0] = get_byte<0>(static_cast<uint16_t>(buf.size() - 2));
  350|  1.73k|   buf[1] = get_byte<1>(static_cast<uint16_t>(buf.size() - 2));
  351|       |
  352|  1.73k|   return buf;
  353|  1.73k|}
_ZNK5Botan3TLS16Supported_Groups9ec_groupsEv:
  359|  38.8k|std::vector<Group_Params> Supported_Groups::ec_groups() const {
  360|  38.8k|   std::vector<Group_Params> ec;
  361|   156k|   for(auto g : m_groups) {
  ------------------
  |  Branch (361:15): [True: 156k, False: 38.8k]
  ------------------
  362|   156k|      if(group_param_is_dh(g) == false) {
  ------------------
  |  Branch (362:10): [True: 130k, False: 25.7k]
  ------------------
  363|   130k|         ec.push_back(g);
  364|   130k|      }
  365|   156k|   }
  366|  38.8k|   return ec;
  367|  38.8k|}
_ZN5Botan3TLS16Supported_GroupsC2ERNS0_15TLS_Data_ReaderEt:
  397|  19.6k|Supported_Groups::Supported_Groups(TLS_Data_Reader& reader, uint16_t extension_size) {
  398|  19.6k|   const uint16_t len = reader.get_uint16_t();
  399|       |
  400|  19.6k|   if(len + 2 != extension_size) {
  ------------------
  |  Branch (400:7): [True: 20, False: 19.6k]
  ------------------
  401|     20|      throw Decoding_Error("Inconsistent length field in supported groups list");
  402|     20|   }
  403|       |
  404|  19.6k|   if(len % 2 == 1) {
  ------------------
  |  Branch (404:7): [True: 1, False: 19.6k]
  ------------------
  405|      1|      throw Decoding_Error("Supported groups list of strange size");
  406|      1|   }
  407|       |
  408|  19.6k|   const size_t elems = len / 2;
  409|       |
  410|  99.6k|   for(size_t i = 0; i != elems; ++i) {
  ------------------
  |  Branch (410:22): [True: 80.0k, False: 19.6k]
  ------------------
  411|  80.0k|      const auto group = static_cast<Group_Params>(reader.get_uint16_t());
  412|       |      // Note: RFC 8446 does not explicitly enforce that groups must be unique.
  413|  80.0k|      if(!value_exists(m_groups, group)) {
  ------------------
  |  Branch (413:10): [True: 79.1k, False: 881]
  ------------------
  414|  79.1k|         m_groups.push_back(group);
  415|  79.1k|      }
  416|  80.0k|   }
  417|  19.6k|}
_ZNK5Botan3TLS23Supported_Point_Formats9serializeENS0_15Connection_SideE:
  419|    584|std::vector<uint8_t> Supported_Point_Formats::serialize(Connection_Side /*whoami*/) const {
  420|       |   // if this extension is sent, it MUST include uncompressed (RFC 4492, section 5.1)
  421|    584|   if(m_prefers_compressed) {
  ------------------
  |  Branch (421:7): [True: 0, False: 584]
  ------------------
  422|      0|      return std::vector<uint8_t>{2, ANSIX962_COMPRESSED_PRIME, UNCOMPRESSED};
  423|    584|   } else {
  424|    584|      return std::vector<uint8_t>{1, UNCOMPRESSED};
  425|    584|   }
  426|    584|}
_ZN5Botan3TLS23Supported_Point_FormatsC2ERNS0_15TLS_Data_ReaderEt:
  428|    652|Supported_Point_Formats::Supported_Point_Formats(TLS_Data_Reader& reader, uint16_t extension_size) {
  429|    652|   uint8_t len = reader.get_byte();
  430|       |
  431|    652|   if(len + 1 != extension_size) {
  ------------------
  |  Branch (431:7): [True: 13, False: 639]
  ------------------
  432|     13|      throw Decoding_Error("Inconsistent length field in supported point formats list");
  433|     13|   }
  434|       |
  435|    639|   bool includes_uncompressed = false;
  436|  1.03k|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (436:22): [True: 1.03k, False: 3]
  ------------------
  437|  1.03k|      uint8_t format = reader.get_byte();
  438|       |
  439|  1.03k|      if(static_cast<ECPointFormat>(format) == UNCOMPRESSED) {
  ------------------
  |  Branch (439:10): [True: 614, False: 416]
  ------------------
  440|    614|         m_prefers_compressed = false;
  441|    614|         reader.discard_next(len - i - 1);
  442|    614|         return;
  443|    614|      } else if(static_cast<ECPointFormat>(format) == ANSIX962_COMPRESSED_PRIME) {
  ------------------
  |  Branch (443:17): [True: 22, False: 394]
  ------------------
  444|     22|         m_prefers_compressed = true;
  445|     22|         std::vector<uint8_t> remaining_formats = reader.get_fixed<uint8_t>(len - i - 1);
  446|     22|         includes_uncompressed =
  447|     22|            std::any_of(std::begin(remaining_formats), std::end(remaining_formats), [](uint8_t remaining_format) {
  448|     22|               return static_cast<ECPointFormat>(remaining_format) == UNCOMPRESSED;
  449|     22|            });
  450|     22|         break;
  451|     22|      }
  452|       |
  453|       |      // ignore ANSIX962_COMPRESSED_CHAR2, we don't support these curves
  454|  1.03k|   }
  455|       |
  456|       |   // RFC 4492 5.1.:
  457|       |   //   If the Supported Point Formats Extension is indeed sent, it MUST contain the value 0 (uncompressed)
  458|       |   //   as one of the items in the list of point formats.
  459|       |   // Note:
  460|       |   //   RFC 8422 5.1.2. explicitly requires this check,
  461|       |   //   but only if the Supported Groups extension was sent.
  462|     25|   if(!includes_uncompressed) {
  ------------------
  |  Branch (462:7): [True: 13, False: 12]
  ------------------
  463|     13|      throw TLS_Exception(Alert::IllegalParameter,
  464|     13|                          "Supported Point Formats Extension must contain the uncompressed point format");
  465|     13|   }
  466|     25|}
_ZN5Botan3TLS20Signature_AlgorithmsC2ERNS0_15TLS_Data_ReaderEt:
  512|    177|      m_schemes(parse_signature_algorithms(reader, extension_size)) {}
_ZN5Botan3TLS25Signature_Algorithms_CertC2ERNS0_15TLS_Data_ReaderEt:
  519|    523|      m_schemes(parse_signature_algorithms(reader, extension_size)) {}
_ZN5Botan3TLS24Session_Ticket_ExtensionC2ERNS0_15TLS_Data_ReaderEt:
  522|  2.95k|      m_ticket(Session_Ticket(reader.get_elem<uint8_t, std::vector<uint8_t>>(extension_size))) {}
_ZN5Botan3TLS24SRTP_Protection_ProfilesC2ERNS0_15TLS_Data_ReaderEt:
  525|     63|      m_pp(reader.get_range<uint16_t>(2, 0, 65535)) {
  526|     63|   const std::vector<uint8_t> mki = reader.get_range<uint8_t>(1, 0, 255);
  527|       |
  528|     63|   if(m_pp.size() * 2 + mki.size() + 3 != extension_size) {
  ------------------
  |  Branch (528:7): [True: 1, False: 62]
  ------------------
  529|      1|      throw Decoding_Error("Bad encoding for SRTP protection extension");
  530|      1|   }
  531|       |
  532|     62|   if(!mki.empty()) {
  ------------------
  |  Branch (532:7): [True: 1, False: 61]
  ------------------
  533|      1|      throw Decoding_Error("Unhandled non-empty MKI for SRTP protection extension");
  534|      1|   }
  535|     62|}
_ZN5Botan3TLS22Extended_Master_SecretC2ERNS0_15TLS_Data_ReaderEt:
  554|  1.34k|Extended_Master_Secret::Extended_Master_Secret(TLS_Data_Reader& /*unused*/, uint16_t extension_size) {
  555|  1.34k|   if(extension_size != 0) {
  ------------------
  |  Branch (555:7): [True: 2, False: 1.34k]
  ------------------
  556|      2|      throw Decoding_Error("Invalid extended_master_secret extension");
  557|      2|   }
  558|  1.34k|}
_ZNK5Botan3TLS22Extended_Master_Secret9serializeENS0_15Connection_SideE:
  560|  1.33k|std::vector<uint8_t> Extended_Master_Secret::serialize(Connection_Side /*whoami*/) const {
  561|  1.33k|   return std::vector<uint8_t>();
  562|  1.33k|}
_ZN5Botan3TLS16Encrypt_then_MACC2ERNS0_15TLS_Data_ReaderEt:
  564|    851|Encrypt_then_MAC::Encrypt_then_MAC(TLS_Data_Reader& /*unused*/, uint16_t extension_size) {
  565|    851|   if(extension_size != 0) {
  ------------------
  |  Branch (565:7): [True: 3, False: 848]
  ------------------
  566|      3|      throw Decoding_Error("Invalid encrypt_then_mac extension");
  567|      3|   }
  568|    851|}
_ZNK5Botan3TLS16Encrypt_then_MAC9serializeENS0_15Connection_SideE:
  570|    816|std::vector<uint8_t> Encrypt_then_MAC::serialize(Connection_Side /*whoami*/) const { return std::vector<uint8_t>(); }
_ZN5Botan3TLS18Supported_VersionsC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE:
  615|    373|Supported_Versions::Supported_Versions(TLS_Data_Reader& reader, uint16_t extension_size, Connection_Side from) {
  616|    373|   if(from == Connection_Side::Server) {
  ------------------
  |  Branch (616:7): [True: 0, False: 373]
  ------------------
  617|      0|      if(extension_size != 2) {
  ------------------
  |  Branch (617:10): [True: 0, False: 0]
  ------------------
  618|      0|         throw Decoding_Error("Server sent invalid supported_versions extension");
  619|      0|      }
  620|      0|      m_versions.push_back(Protocol_Version(reader.get_uint16_t()));
  621|    373|   } else {
  622|    373|      auto versions = reader.get_range<uint16_t>(1, 1, 127);
  623|       |
  624|  1.69k|      for(auto v : versions) {
  ------------------
  |  Branch (624:18): [True: 1.69k, False: 373]
  ------------------
  625|  1.69k|         m_versions.push_back(Protocol_Version(v));
  626|  1.69k|      }
  627|       |
  628|    373|      if(extension_size != 1 + 2 * versions.size()) {
  ------------------
  |  Branch (628:10): [True: 10, False: 363]
  ------------------
  629|     10|         throw Decoding_Error("Client sent invalid supported_versions extension");
  630|     10|      }
  631|    373|   }
  632|    373|}
_ZN5Botan3TLS17Record_Size_LimitC2ERNS0_15TLS_Data_ReaderEtNS0_15Connection_SideE:
  649|    777|Record_Size_Limit::Record_Size_Limit(TLS_Data_Reader& reader, uint16_t extension_size, Connection_Side from) {
  650|    777|   if(extension_size != 2) {
  ------------------
  |  Branch (650:7): [True: 1, False: 776]
  ------------------
  651|      1|      throw TLS_Exception(Alert::DecodeError, "invalid record_size_limit extension");
  652|      1|   }
  653|       |
  654|    776|   m_limit = reader.get_uint16_t();
  655|       |
  656|       |   // RFC 8449 4.
  657|       |   //    This value is the length of the plaintext of a protected record.
  658|       |   //    The value includes the content type and padding added in TLS 1.3 (that
  659|       |   //    is, the complete length of TLSInnerPlaintext).
  660|       |   //
  661|       |   //    A server MUST NOT enforce this restriction; a client might advertise
  662|       |   //    a higher limit that is enabled by an extension or version the server
  663|       |   //    does not understand. A client MAY abort the handshake with an
  664|       |   //    "illegal_parameter" alert.
  665|       |   //
  666|       |   // Note: We are currently supporting this extension in TLS 1.3 only, hence
  667|       |   //       we check for the TLS 1.3 limit. The TLS 1.2 limit would not include
  668|       |   //       the "content type byte" and hence be one byte less!
  669|    776|   if(m_limit > MAX_PLAINTEXT_SIZE + 1 /* encrypted content type byte */ && from == Connection_Side::Server) {
  ------------------
  |  Branch (669:7): [True: 74, False: 702]
  |  Branch (669:77): [True: 0, False: 74]
  ------------------
  670|      0|      throw TLS_Exception(Alert::IllegalParameter,
  671|      0|                          "Server requested a record size limit larger than the protocol's maximum");
  672|      0|   }
  673|       |
  674|       |   // RFC 8449 4.
  675|       |   //    Endpoints MUST NOT send a "record_size_limit" extension with a value
  676|       |   //    smaller than 64.  An endpoint MUST treat receipt of a smaller value
  677|       |   //    as a fatal error and generate an "illegal_parameter" alert.
  678|    776|   if(m_limit < 64) {
  ------------------
  |  Branch (678:7): [True: 1, False: 775]
  ------------------
  679|      1|      throw TLS_Exception(Alert::IllegalParameter, "Received a record size limit smaller than 64 bytes");
  680|      1|   }
  681|    776|}
_ZN5Botan3TLS6CookieC2ERNS0_15TLS_Data_ReaderEt:
  695|    160|Cookie::Cookie(TLS_Data_Reader& reader, uint16_t extension_size) {
  696|    160|   if(extension_size == 0) {
  ------------------
  |  Branch (696:7): [True: 129, False: 31]
  ------------------
  697|    129|      return;
  698|    129|   }
  699|       |
  700|     31|   const uint16_t len = reader.get_uint16_t();
  701|       |
  702|     31|   if(len == 0) {
  ------------------
  |  Branch (702:7): [True: 1, False: 30]
  ------------------
  703|       |      // Based on RFC 8446 4.2.2, len of the Cookie buffer must be at least 1
  704|      1|      throw Decoding_Error("Cookie length must be at least 1 byte");
  705|      1|   }
  706|       |
  707|     30|   if(len > reader.remaining_bytes()) {
  ------------------
  |  Branch (707:7): [True: 14, False: 16]
  ------------------
  708|     14|      throw Decoding_Error("Not enough bytes in the buffer to decode Cookie");
  709|     14|   }
  710|       |
  711|    429|   for(size_t i = 0; i < len; ++i) {
  ------------------
  |  Branch (711:22): [True: 413, False: 16]
  ------------------
  712|    413|      m_cookie.push_back(reader.get_byte());
  713|    413|   }
  714|     16|}
_ZN5Botan3TLS22PSK_Key_Exchange_ModesC2ERNS0_15TLS_Data_ReaderEt:
  743|    267|PSK_Key_Exchange_Modes::PSK_Key_Exchange_Modes(TLS_Data_Reader& reader, uint16_t extension_size) {
  744|    267|   if(extension_size < 2) {
  ------------------
  |  Branch (744:7): [True: 2, False: 265]
  ------------------
  745|      2|      throw Decoding_Error("Empty psk_key_exchange_modes extension is illegal");
  746|      2|   }
  747|       |
  748|    265|   const auto mode_count = reader.get_byte();
  749|  1.78k|   for(uint16_t i = 0; i < mode_count; ++i) {
  ------------------
  |  Branch (749:24): [True: 1.51k, False: 265]
  ------------------
  750|  1.51k|      const auto mode = static_cast<PSK_Key_Exchange_Mode>(reader.get_byte());
  751|  1.51k|      if(mode == PSK_Key_Exchange_Mode::PSK_KE || mode == PSK_Key_Exchange_Mode::PSK_DHE_KE) {
  ------------------
  |  Branch (751:10): [True: 432, False: 1.08k]
  |  Branch (751:51): [True: 450, False: 635]
  ------------------
  752|    863|         m_modes.push_back(mode);
  753|    863|      }
  754|  1.51k|   }
  755|    265|}
_ZN5Botan3TLS23Certificate_AuthoritiesC2ERNS0_15TLS_Data_ReaderEt:
  761|    452|Certificate_Authorities::Certificate_Authorities(TLS_Data_Reader& reader, uint16_t extension_size) {
  762|    452|   if(extension_size < 2) {
  ------------------
  |  Branch (762:7): [True: 1, False: 451]
  ------------------
  763|      1|      throw Decoding_Error("Empty certificate_authorities extension is illegal");
  764|      1|   }
  765|       |
  766|    451|   const uint16_t purported_size = reader.get_uint16_t();
  767|       |
  768|    451|   if(reader.remaining_bytes() != purported_size) {
  ------------------
  |  Branch (768:7): [True: 21, False: 430]
  ------------------
  769|     21|      throw Decoding_Error("Inconsistent length in certificate_authorities extension");
  770|     21|   }
  771|       |
  772|    869|   while(reader.has_remaining()) {
  ------------------
  |  Branch (772:10): [True: 439, False: 430]
  ------------------
  773|    439|      std::vector<uint8_t> name_bits = reader.get_tls_length_value(2);
  774|       |
  775|    439|      BER_Decoder decoder(name_bits.data(), name_bits.size());
  776|    439|      m_distinguished_names.emplace_back();
  777|    439|      decoder.decode(m_distinguished_names.back());
  778|    439|   }
  779|    430|}
_ZN5Botan3TLS19EarlyDataIndicationC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeE:
  798|    348|                                         Handshake_Type message_type) {
  799|    348|   if(message_type == Handshake_Type::NewSessionTicket) {
  ------------------
  |  Branch (799:7): [True: 0, False: 348]
  ------------------
  800|      0|      if(extension_size != 4) {
  ------------------
  |  Branch (800:10): [True: 0, False: 0]
  ------------------
  801|      0|         throw TLS_Exception(Alert::DecodeError,
  802|      0|                             "Received an early_data extension in a NewSessionTicket message "
  803|      0|                             "without maximum early data size indication");
  804|      0|      }
  805|       |
  806|      0|      m_max_early_data_size = reader.get_uint32_t();
  807|    348|   } else if(extension_size != 0) {
  ------------------
  |  Branch (807:14): [True: 3, False: 345]
  ------------------
  808|      3|      throw TLS_Exception(Alert::DecodeError,
  809|      3|                          "Received an early_data extension containing an unexpected data "
  810|      3|                          "size indication");
  811|      3|   }
  812|    348|}
tls_extensions.cpp:_ZN5Botan3TLS12_GLOBAL__N_114make_extensionERNS0_15TLS_Data_ReaderENS0_14Extension_CodeENS0_15Connection_SideENS0_14Handshake_TypeE:
   28|   162k|                                          const Handshake_Type message_type) {
   29|       |   // This cast is safe because we read exactly a 16 bit length field for
   30|       |   // the extension in Extensions::deserialize
   31|   162k|   const uint16_t size = static_cast<uint16_t>(reader.remaining_bytes());
   32|   162k|   switch(code) {
  ------------------
  |  Branch (32:11): [True: 129k, False: 33.3k]
  ------------------
   33|  1.74k|      case Extension_Code::ServerNameIndication:
  ------------------
  |  Branch (33:7): [True: 1.74k, False: 160k]
  ------------------
   34|  1.74k|         return std::make_unique<Server_Name_Indicator>(reader, size);
   35|       |
   36|  19.6k|      case Extension_Code::SupportedGroups:
  ------------------
  |  Branch (36:7): [True: 19.6k, False: 142k]
  ------------------
   37|  19.6k|         return std::make_unique<Supported_Groups>(reader, size);
   38|       |
   39|    623|      case Extension_Code::CertificateStatusRequest:
  ------------------
  |  Branch (39:7): [True: 623, False: 161k]
  ------------------
   40|    623|         return std::make_unique<Certificate_Status_Request>(reader, size, message_type, from);
   41|       |
   42|    652|      case Extension_Code::EcPointFormats:
  ------------------
  |  Branch (42:7): [True: 652, False: 161k]
  ------------------
   43|    652|         return std::make_unique<Supported_Point_Formats>(reader, size);
   44|       |
   45|    295|      case Extension_Code::SafeRenegotiation:
  ------------------
  |  Branch (45:7): [True: 295, False: 162k]
  ------------------
   46|    295|         return std::make_unique<Renegotiation_Extension>(reader, size);
   47|       |
   48|    177|      case Extension_Code::SignatureAlgorithms:
  ------------------
  |  Branch (48:7): [True: 177, False: 162k]
  ------------------
   49|    177|         return std::make_unique<Signature_Algorithms>(reader, size);
   50|       |
   51|    523|      case Extension_Code::CertSignatureAlgorithms:
  ------------------
  |  Branch (51:7): [True: 523, False: 162k]
  ------------------
   52|    523|         return std::make_unique<Signature_Algorithms_Cert>(reader, size);
   53|       |
   54|     63|      case Extension_Code::UseSrtp:
  ------------------
  |  Branch (54:7): [True: 63, False: 162k]
  ------------------
   55|     63|         return std::make_unique<SRTP_Protection_Profiles>(reader, size);
   56|       |
   57|  1.81k|      case Extension_Code::ApplicationLayerProtocolNegotiation:
  ------------------
  |  Branch (57:7): [True: 1.81k, False: 160k]
  ------------------
   58|  1.81k|         return std::make_unique<Application_Layer_Protocol_Notification>(reader, size, from);
   59|       |
   60|  1.34k|      case Extension_Code::ExtendedMasterSecret:
  ------------------
  |  Branch (60:7): [True: 1.34k, False: 161k]
  ------------------
   61|  1.34k|         return std::make_unique<Extended_Master_Secret>(reader, size);
   62|       |
   63|    777|      case Extension_Code::RecordSizeLimit:
  ------------------
  |  Branch (63:7): [True: 777, False: 161k]
  ------------------
   64|    777|         return std::make_unique<Record_Size_Limit>(reader, size, from);
   65|       |
   66|    851|      case Extension_Code::EncryptThenMac:
  ------------------
  |  Branch (66:7): [True: 851, False: 161k]
  ------------------
   67|    851|         return std::make_unique<Encrypt_then_MAC>(reader, size);
   68|       |
   69|  2.95k|      case Extension_Code::SessionTicket:
  ------------------
  |  Branch (69:7): [True: 2.95k, False: 159k]
  ------------------
   70|  2.95k|         return std::make_unique<Session_Ticket_Extension>(reader, size);
   71|       |
   72|    373|      case Extension_Code::SupportedVersions:
  ------------------
  |  Branch (72:7): [True: 373, False: 162k]
  ------------------
   73|    373|         return std::make_unique<Supported_Versions>(reader, size, from);
   74|       |
   75|      0|#if defined(BOTAN_HAS_TLS_13)
   76|     68|      case Extension_Code::PresharedKey:
  ------------------
  |  Branch (76:7): [True: 68, False: 162k]
  ------------------
   77|     68|         return std::make_unique<PSK>(reader, size, message_type);
   78|       |
   79|    348|      case Extension_Code::EarlyData:
  ------------------
  |  Branch (79:7): [True: 348, False: 162k]
  ------------------
   80|    348|         return std::make_unique<EarlyDataIndication>(reader, size, message_type);
   81|       |
   82|    160|      case Extension_Code::Cookie:
  ------------------
  |  Branch (82:7): [True: 160, False: 162k]
  ------------------
   83|    160|         return std::make_unique<Cookie>(reader, size);
   84|       |
   85|    267|      case Extension_Code::PskKeyExchangeModes:
  ------------------
  |  Branch (85:7): [True: 267, False: 162k]
  ------------------
   86|    267|         return std::make_unique<PSK_Key_Exchange_Modes>(reader, size);
   87|       |
   88|    452|      case Extension_Code::CertificateAuthorities:
  ------------------
  |  Branch (88:7): [True: 452, False: 162k]
  ------------------
   89|    452|         return std::make_unique<Certificate_Authorities>(reader, size);
   90|       |
   91|    243|      case Extension_Code::KeyShare:
  ------------------
  |  Branch (91:7): [True: 243, False: 162k]
  ------------------
   92|    243|         return std::make_unique<Key_Share>(reader, size, message_type);
   93|   162k|#endif
   94|   162k|   }
   95|       |
   96|   129k|   return std::make_unique<Unknown_Extension>(static_cast<Extension_Code>(code), reader, size);
   97|   162k|}
tls_extensions.cpp:_ZZNK5Botan3TLS10Extensions15extension_typesEvENK3$_2clINSt3__110unique_ptrINS0_9ExtensionENS4_14default_deleteIS6_EEEEEEDaRKT_:
  211|   159k|      m_extensions.cbegin(), m_extensions.cend(), std::inserter(offers, offers.begin()), [](const auto& ext) {
  212|   159k|         return ext->type();
  213|   159k|      });
tls_extensions.cpp:_ZZN5Botan3TLS23Supported_Point_FormatsC1ERNS0_15TLS_Data_ReaderEtENK3$_3clEh:
  447|    351|            std::any_of(std::begin(remaining_formats), std::end(remaining_formats), [](uint8_t remaining_format) {
  448|    351|               return static_cast<ECPointFormat>(remaining_format) == UNCOMPRESSED;
  449|    351|            });
tls_extensions.cpp:_ZN5Botan3TLS12_GLOBAL__N_126parse_signature_algorithmsERNS0_15TLS_Data_ReaderEt:
  488|    700|std::vector<Signature_Scheme> parse_signature_algorithms(TLS_Data_Reader& reader, uint16_t extension_size) {
  489|    700|   uint16_t len = reader.get_uint16_t();
  490|       |
  491|    700|   if(len + 2 != extension_size || len % 2 == 1 || len == 0) {
  ------------------
  |  Branch (491:7): [True: 18, False: 682]
  |  Branch (491:36): [True: 1, False: 681]
  |  Branch (491:52): [True: 1, False: 680]
  ------------------
  492|     18|      throw Decoding_Error("Bad encoding on signature algorithms extension");
  493|     18|   }
  494|       |
  495|    682|   std::vector<Signature_Scheme> schemes;
  496|    682|   schemes.reserve(len / 2);
  497|  16.6k|   while(len) {
  ------------------
  |  Branch (497:10): [True: 15.9k, False: 682]
  ------------------
  498|  15.9k|      schemes.emplace_back(reader.get_uint16_t());
  499|  15.9k|      len -= 2;
  500|  15.9k|   }
  501|       |
  502|    682|   return schemes;
  503|    700|}

_ZN5Botan3TLS26Certificate_Status_RequestC2ERNS0_15TLS_Data_ReaderEtNS0_14Handshake_TypeENS0_15Connection_SideE:
   89|    623|                                                       Connection_Side from) {
   90|       |   // This parser needs to take TLS 1.2 and TLS 1.3 into account. The
   91|       |   // extension's content and structure is dependent on the context it
   92|       |   // was sent in (i.e. the enclosing handshake message). Below is a list
   93|       |   // of handshake messages this can appear in.
   94|       |   //
   95|       |   // TLS 1.2
   96|       |   //  * Client Hello
   97|       |   //  * Server Hello
   98|       |   //
   99|       |   // TLS 1.3
  100|       |   //  * Client Hello
  101|       |   //  * Certificate Request
  102|       |   //  * Certificate (Entry)
  103|       |
  104|       |   // RFC 6066 8.
  105|       |   //    In order to indicate their desire to receive certificate status
  106|       |   //    information, clients MAY include an extension of type "status_request"
  107|       |   //    in the (extended) client hello.
  108|    623|   if(message_type == Handshake_Type::ClientHello) {
  ------------------
  |  Branch (108:7): [True: 623, False: 0]
  ------------------
  109|    623|      m_impl = std::make_unique<Certificate_Status_Request_Internal>(
  110|    623|         RFC6066_Certificate_Status_Request(reader, extension_size));
  111|    623|   }
  112|       |
  113|       |   // RFC 6066 8.
  114|       |   //    If a server returns a "CertificateStatus" message, then the server MUST
  115|       |   //    have included an extension of type "status_request" with empty
  116|       |   //    "extension_data" in the extended server hello.
  117|       |   //
  118|       |   // RFC 8446 4.4.2.1
  119|       |   //    A server MAY request that a client present an OCSP response with its
  120|       |   //    certificate by sending an empty "status_request" extension in its
  121|       |   //    CertificateRequest message.
  122|      0|   else if(message_type == Handshake_Type::ServerHello || message_type == Handshake_Type::CertificateRequest) {
  ------------------
  |  Branch (122:12): [True: 0, False: 0]
  |  Branch (122:59): [True: 0, False: 0]
  ------------------
  123|      0|      m_impl = std::make_unique<Certificate_Status_Request_Internal>(
  124|      0|         RFC6066_Empty_Certificate_Status_Request(extension_size));
  125|      0|   }
  126|       |
  127|       |   // RFC 8446 4.4.2.1
  128|       |   //    In TLS 1.3, the server's OCSP information is carried in an extension
  129|       |   //    in the CertificateEntry [in a Certificate handshake message] [...].
  130|       |   //    Specifically, the body of the "status_request" extension from the
  131|       |   //    server MUST be a CertificateStatus structure as defined in [RFC6066]
  132|       |   //    [...].
  133|       |   //
  134|       |   // RFC 8446 4.4.2.1
  135|       |   //    If the client opts to send an OCSP response, the body of its
  136|       |   //    "status_request" extension MUST be a CertificateStatus structure as
  137|       |   //    defined in [RFC6066].
  138|      0|   else if(message_type == Handshake_Type::Certificate) {
  ------------------
  |  Branch (138:12): [True: 0, False: 0]
  ------------------
  139|      0|      m_impl = std::make_unique<Certificate_Status_Request_Internal>(
  140|      0|         Certificate_Status(reader.get_fixed<uint8_t>(extension_size), from));
  141|      0|   }
  142|       |
  143|       |   // all other contexts are not allowed for this extension
  144|      0|   else {
  145|      0|      throw TLS_Exception(Alert::UnsupportedExtension,
  146|      0|                          "Server sent a Certificate_Status_Request extension in an unsupported context");
  147|      0|   }
  148|    623|}
_ZN5Botan3TLS26Certificate_Status_RequestC2Ev:
  151|    581|      m_impl(std::make_unique<Certificate_Status_Request_Internal>(RFC6066_Empty_Certificate_Status_Request())) {}
_ZN5Botan3TLS26Certificate_Status_RequestD2Ev:
  161|  1.19k|Certificate_Status_Request::~Certificate_Status_Request() = default;
_ZNK5Botan3TLS26Certificate_Status_Request9serializeENS0_15Connection_SideE:
  169|    581|std::vector<uint8_t> Certificate_Status_Request::serialize(Connection_Side) const {
  170|    581|   BOTAN_ASSERT_NONNULL(m_impl);
  ------------------
  |  |   87|    581|   do {                                                                                   \
  |  |   88|    581|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 581]
  |  |  ------------------
  |  |   89|    581|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|    581|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  171|    581|   return std::visit([](const auto& c) { return c.serialize(); }, m_impl->content);
  172|    581|}
tls_extensions_cert_status_req.cpp:_ZN5Botan3TLS12_GLOBAL__N_134RFC6066_Certificate_Status_RequestC2ERNS0_15TLS_Data_ReaderEt:
   38|    623|      RFC6066_Certificate_Status_Request(TLS_Data_Reader& reader, uint16_t extension_size) {
   39|    623|         if(extension_size == 0) {
  ------------------
  |  Branch (39:13): [True: 1, False: 622]
  ------------------
   40|      1|            throw Decoding_Error("Received an unexpectedly empty Certificate_Status_Request");
   41|      1|         }
   42|       |
   43|    622|         const uint8_t type = reader.get_byte();
   44|    622|         if(type == 1 /* ocsp */) {
  ------------------
  |  Branch (44:13): [True: 7, False: 615]
  ------------------
   45|      7|            const size_t len_resp_id_list = reader.get_uint16_t();
   46|      7|            ocsp_names = reader.get_fixed<uint8_t>(len_resp_id_list);
   47|      7|            const size_t len_requ_ext = reader.get_uint16_t();
   48|      7|            extension_bytes = reader.get_fixed<uint8_t>(len_requ_ext);
   49|    615|         } else {
   50|       |            // RFC 6066 does not specify anything but 'ocsp' and we
   51|       |            // don't support anything else either.
   52|    615|            reader.discard_next(extension_size - 1);
   53|    615|         }
   54|    622|      }
tls_extensions_cert_status_req.cpp:_ZZNK5Botan3TLS26Certificate_Status_Request9serializeENS0_15Connection_SideEENK3$_0clINS0_12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_RequestEEEDaRKT_:
  171|    581|   return std::visit([](const auto& c) { return c.serialize(); }, m_impl->content);
tls_extensions_cert_status_req.cpp:_ZNK5Botan3TLS12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_Request9serializeEv:
   30|    581|      std::vector<uint8_t> serialize() const { return {}; }
tls_extensions_cert_status_req.cpp:_ZN5Botan3TLS35Certificate_Status_Request_InternalC2ENSt3__17variantIJNS0_12_GLOBAL__N_140RFC6066_Empty_Certificate_Status_RequestENS4_34RFC6066_Certificate_Status_RequestENS0_18Certificate_StatusEEEE:
   81|  1.19k|      Certificate_Status_Request_Internal(Contents c) : content(std::move(c)) {}

_ZNK5Botan3TLS21Handshake_Transitions22received_handshake_msgENS0_14Handshake_TypeE:
  125|  15.4k|bool Handshake_Transitions::received_handshake_msg(Handshake_Type msg_type) const {
  126|  15.4k|   const uint32_t mask = bitmask_for_handshake_type(msg_type);
  127|       |
  128|  15.4k|   return (m_hand_received_mask & mask) != 0;
  129|  15.4k|}
_ZN5Botan3TLS21Handshake_Transitions21confirm_transition_toENS0_14Handshake_TypeE:
  131|  42.4k|void Handshake_Transitions::confirm_transition_to(Handshake_Type msg_type) {
  132|  42.4k|   const uint32_t mask = bitmask_for_handshake_type(msg_type);
  133|       |
  134|  42.4k|   m_hand_received_mask |= mask;
  135|       |
  136|  42.4k|   const bool ok = (m_hand_expecting_mask & mask) != 0;  // overlap?
  137|       |
  138|  42.4k|   if(!ok) {
  ------------------
  |  Branch (138:7): [True: 110, False: 42.3k]
  ------------------
  139|    110|      const uint32_t seen_so_far = m_hand_received_mask & ~mask;
  140|       |
  141|    110|      std::ostringstream msg;
  142|       |
  143|    110|      msg << "Unexpected state transition in handshake got a " << handshake_type_to_string(msg_type);
  144|       |
  145|    110|      if(m_hand_expecting_mask == 0) {
  ------------------
  |  Branch (145:10): [True: 0, False: 110]
  ------------------
  146|      0|         msg << " not expecting messages";
  147|    110|      } else {
  148|    110|         msg << " expected " << handshake_mask_to_string(m_hand_expecting_mask, '|');
  149|    110|      }
  150|       |
  151|    110|      if(seen_so_far != 0) {
  ------------------
  |  Branch (151:10): [True: 54, False: 56]
  ------------------
  152|     54|         msg << " seen " << handshake_mask_to_string(seen_so_far, '+');
  153|     54|      }
  154|       |
  155|    110|      throw Unexpected_Message(msg.str());
  156|    110|   }
  157|       |
  158|       |   /* We don't know what to expect next, so force a call to
  159|       |      set_expected_next; if it doesn't happen, the next transition
  160|       |      check will always fail which is what we want.
  161|       |   */
  162|  42.3k|   m_hand_expecting_mask = 0;
  163|  42.3k|}
_ZN5Botan3TLS21Handshake_Transitions17set_expected_nextENS0_14Handshake_TypeE:
  165|  64.8k|void Handshake_Transitions::set_expected_next(Handshake_Type msg_type) {
  166|  64.8k|   m_hand_expecting_mask |= bitmask_for_handshake_type(msg_type);
  167|  64.8k|}
_ZNK5Botan3TLS21Handshake_Transitions27change_cipher_spec_expectedEv:
  175|  84.7k|bool Handshake_Transitions::change_cipher_spec_expected() const {
  176|  84.7k|   return (bitmask_for_handshake_type(Handshake_Type::HandshakeCCS) & m_hand_expecting_mask) != 0;
  177|  84.7k|}
tls_handshake_transitions.cpp:_ZN5Botan3TLS12_GLOBAL__N_126bitmask_for_handshake_typeENS0_14Handshake_TypeE:
   19|   210k|uint32_t bitmask_for_handshake_type(Handshake_Type type) {
   20|   210k|   switch(type) {
  ------------------
  |  Branch (20:11): [True: 46, False: 210k]
  ------------------
   21|    167|      case Handshake_Type::HelloVerifyRequest:
  ------------------
  |  Branch (21:7): [True: 167, False: 210k]
  ------------------
   22|    167|         return (1 << 0);
   23|       |
   24|    207|      case Handshake_Type::HelloRequest:
  ------------------
  |  Branch (24:7): [True: 207, False: 210k]
  ------------------
   25|    207|         return (1 << 1);
   26|       |
   27|  54.1k|      case Handshake_Type::ClientHello:
  ------------------
  |  Branch (27:7): [True: 54.1k, False: 156k]
  ------------------
   28|  54.1k|         return (1 << 2);
   29|       |
   30|    168|      case Handshake_Type::ServerHello:
  ------------------
  |  Branch (30:7): [True: 168, False: 210k]
  ------------------
   31|    168|         return (1 << 3);
   32|       |
   33|  15.5k|      case Handshake_Type::Certificate:
  ------------------
  |  Branch (33:7): [True: 15.5k, False: 194k]
  ------------------
   34|  15.5k|         return (1 << 4);
   35|       |
   36|    169|      case Handshake_Type::CertificateUrl:
  ------------------
  |  Branch (36:7): [True: 169, False: 210k]
  ------------------
   37|    169|         return (1 << 5);
   38|       |
   39|    169|      case Handshake_Type::CertificateStatus:
  ------------------
  |  Branch (39:7): [True: 169, False: 210k]
  ------------------
   40|    169|         return (1 << 6);
   41|       |
   42|    168|      case Handshake_Type::ServerKeyExchange:
  ------------------
  |  Branch (42:7): [True: 168, False: 210k]
  ------------------
   43|    168|         return (1 << 7);
   44|       |
   45|    166|      case Handshake_Type::CertificateRequest:
  ------------------
  |  Branch (45:7): [True: 166, False: 210k]
  ------------------
   46|    166|         return (1 << 8);
   47|       |
   48|    167|      case Handshake_Type::ServerHelloDone:
  ------------------
  |  Branch (48:7): [True: 167, False: 210k]
  ------------------
   49|    167|         return (1 << 9);
   50|       |
   51|    166|      case Handshake_Type::CertificateVerify:
  ------------------
  |  Branch (51:7): [True: 166, False: 210k]
  ------------------
   52|    166|         return (1 << 10);
   53|       |
   54|  36.3k|      case Handshake_Type::ClientKeyExchange:
  ------------------
  |  Branch (54:7): [True: 36.3k, False: 173k]
  ------------------
   55|  36.3k|         return (1 << 11);
   56|       |
   57|    168|      case Handshake_Type::NewSessionTicket:
  ------------------
  |  Branch (57:7): [True: 168, False: 210k]
  ------------------
   58|    168|         return (1 << 12);
   59|       |
   60|   100k|      case Handshake_Type::HandshakeCCS:
  ------------------
  |  Branch (60:7): [True: 100k, False: 109k]
  ------------------
   61|   100k|         return (1 << 13);
   62|       |
   63|    927|      case Handshake_Type::Finished:
  ------------------
  |  Branch (63:7): [True: 927, False: 209k]
  ------------------
   64|    927|         return (1 << 14);
   65|       |
   66|    166|      case Handshake_Type::EndOfEarlyData:  // RFC 8446
  ------------------
  |  Branch (66:7): [True: 166, False: 210k]
  ------------------
   67|    166|         return (1 << 15);
   68|       |
   69|    169|      case Handshake_Type::EncryptedExtensions:  // RFC 8446
  ------------------
  |  Branch (69:7): [True: 169, False: 210k]
  ------------------
   70|    169|         return (1 << 16);
   71|       |
   72|    167|      case Handshake_Type::KeyUpdate:  // RFC 8446
  ------------------
  |  Branch (72:7): [True: 167, False: 210k]
  ------------------
   73|    167|         return (1 << 17);
   74|       |
   75|      4|      case Handshake_Type::HelloRetryRequest:  // RFC 8446
  ------------------
  |  Branch (75:7): [True: 4, False: 210k]
  ------------------
   76|      4|         return (1 << 18);
   77|       |
   78|       |      // allow explicitly disabling new handshakes
   79|    246|      case Handshake_Type::None:
  ------------------
  |  Branch (79:7): [True: 246, False: 210k]
  ------------------
   80|    246|         return 0;
   81|   210k|   }
   82|       |
   83|     46|   throw TLS_Exception(Alert::UnexpectedMessage,
   84|     46|                       "Unknown TLS handshake message type " + std::to_string(static_cast<size_t>(type)));
   85|   210k|}
tls_handshake_transitions.cpp:_ZN5Botan3TLS12_GLOBAL__N_124handshake_mask_to_stringEjc:
   87|    164|std::string handshake_mask_to_string(uint32_t mask, char combiner) {
   88|    164|   const Handshake_Type types[] = {Handshake_Type::HelloVerifyRequest,
   89|    164|                                   Handshake_Type::HelloRequest,
   90|    164|                                   Handshake_Type::ClientHello,
   91|    164|                                   Handshake_Type::ServerHello,
   92|    164|                                   Handshake_Type::Certificate,
   93|    164|                                   Handshake_Type::CertificateUrl,
   94|    164|                                   Handshake_Type::CertificateStatus,
   95|    164|                                   Handshake_Type::ServerKeyExchange,
   96|    164|                                   Handshake_Type::CertificateRequest,
   97|    164|                                   Handshake_Type::ServerHelloDone,
   98|    164|                                   Handshake_Type::CertificateVerify,
   99|    164|                                   Handshake_Type::ClientKeyExchange,
  100|    164|                                   Handshake_Type::NewSessionTicket,
  101|    164|                                   Handshake_Type::HandshakeCCS,
  102|    164|                                   Handshake_Type::Finished,
  103|    164|                                   Handshake_Type::EndOfEarlyData,
  104|    164|                                   Handshake_Type::EncryptedExtensions,
  105|    164|                                   Handshake_Type::KeyUpdate};
  106|       |
  107|    164|   std::ostringstream o;
  108|    164|   bool empty = true;
  109|       |
  110|  2.95k|   for(auto&& t : types) {
  ------------------
  |  Branch (110:17): [True: 2.95k, False: 164]
  ------------------
  111|  2.95k|      if(mask & bitmask_for_handshake_type(t)) {
  ------------------
  |  Branch (111:10): [True: 200, False: 2.75k]
  ------------------
  112|    200|         if(!empty) {
  ------------------
  |  Branch (112:13): [True: 36, False: 164]
  ------------------
  113|     36|            o << combiner;
  114|     36|         }
  115|    200|         o << handshake_type_to_string(t);
  116|    200|         empty = false;
  117|    200|      }
  118|  2.95k|   }
  119|       |
  120|    164|   return o.str();
  121|    164|}

_ZNK5Botan3TLS6Policy25allowed_signature_schemesEv:
   23|    150|std::vector<Signature_Scheme> Policy::allowed_signature_schemes() const {
   24|    150|   std::vector<Signature_Scheme> schemes;
   25|       |
   26|  1.35k|   for(Signature_Scheme scheme : Signature_Scheme::all_available_schemes()) {
  ------------------
  |  Branch (26:32): [True: 1.35k, False: 150]
  ------------------
   27|  1.35k|      const bool sig_allowed = allowed_signature_method(scheme.algorithm_name());
   28|  1.35k|      const bool hash_allowed = allowed_signature_hash(scheme.hash_function_name());
   29|       |
   30|  1.35k|      if(sig_allowed && hash_allowed) {
  ------------------
  |  Branch (30:10): [True: 1.35k, False: 0]
  |  Branch (30:25): [True: 1.35k, False: 0]
  ------------------
   31|  1.35k|         schemes.push_back(scheme);
   32|  1.35k|      }
   33|  1.35k|   }
   34|       |
   35|    150|   return schemes;
   36|    150|}
_ZNK5Botan3TLS6Policy24allowed_signature_hashesEv:
   65|  3.56k|std::vector<std::string> Policy::allowed_signature_hashes() const {
   66|  3.56k|   return {
   67|  3.56k|      "SHA-512",
   68|  3.56k|      "SHA-384",
   69|  3.56k|      "SHA-256",
   70|  3.56k|   };
   71|  3.56k|}
_ZNK5Botan3TLS6Policy25allowed_signature_methodsEv:
   97|  1.35k|std::vector<std::string> Policy::allowed_signature_methods() const {
   98|  1.35k|   return {
   99|  1.35k|      "ECDSA", "RSA",
  100|       |      //"IMPLICIT",
  101|  1.35k|   };
  102|  1.35k|}
_ZNK5Botan3TLS6Policy24allowed_signature_methodENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  104|  1.35k|bool Policy::allowed_signature_method(std::string_view sig_method) const {
  105|  1.35k|   return value_exists(allowed_signature_methods(), sig_method);
  106|  1.35k|}
_ZNK5Botan3TLS6Policy22allowed_signature_hashENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
  108|  3.56k|bool Policy::allowed_signature_hash(std::string_view sig_hash) const {
  109|  3.56k|   return value_exists(allowed_signature_hashes(), sig_hash);
  110|  3.56k|}
_ZNK5Botan3TLS6Policy25use_ecc_point_compressionEv:
  112|    584|bool Policy::use_ecc_point_compression() const { return false; }
_ZNK5Botan3TLS6Policy25choose_key_exchange_groupERKNSt3__16vectorINS0_12Group_ParamsENS2_9allocatorIS4_EEEES9_:
  115|  40.4k|                                               const std::vector<Group_Params>& offered_by_peer) const {
  116|  40.4k|   if(supported_by_peer.empty()) {
  ------------------
  |  Branch (116:7): [True: 1.64k, False: 38.8k]
  ------------------
  117|  1.64k|      return Group_Params::NONE;
  118|  1.64k|   }
  119|       |
  120|  38.8k|   const std::vector<Group_Params> our_groups = key_exchange_groups();
  121|       |
  122|       |   // Prefer groups that were offered by the peer for the sake of saving
  123|       |   // an additional round trip. For TLS 1.2, this won't be used.
  124|  38.8k|   for(auto g : offered_by_peer) {
  ------------------
  |  Branch (124:15): [True: 0, False: 38.8k]
  ------------------
  125|      0|      if(value_exists(our_groups, g)) {
  ------------------
  |  Branch (125:10): [True: 0, False: 0]
  ------------------
  126|      0|         return g;
  127|      0|      }
  128|      0|   }
  129|       |
  130|       |   // If no pre-offered groups fit our supported set, we prioritize our
  131|       |   // own preference.
  132|   196k|   for(auto g : our_groups) {
  ------------------
  |  Branch (132:15): [True: 196k, False: 172]
  ------------------
  133|   196k|      if(value_exists(supported_by_peer, g)) {
  ------------------
  |  Branch (133:10): [True: 38.6k, False: 157k]
  ------------------
  134|  38.6k|         return g;
  135|  38.6k|      }
  136|   196k|   }
  137|       |
  138|    172|   return Group_Params::NONE;
  139|  38.8k|}
_ZNK5Botan3TLS6Policy19key_exchange_groupsEv:
  154|  38.8k|std::vector<Group_Params> Policy::key_exchange_groups() const {
  155|       |   // Default list is ordered by performance
  156|  38.8k|   return {
  157|  38.8k|#if defined(BOTAN_HAS_CURVE_25519)
  158|  38.8k|      Group_Params::X25519,
  159|  38.8k|#endif
  160|       |
  161|  38.8k|         Group_Params::SECP256R1, Group_Params::BRAINPOOL256R1, Group_Params::SECP384R1, Group_Params::BRAINPOOL384R1,
  162|  38.8k|         Group_Params::SECP521R1, Group_Params::BRAINPOOL512R1,
  163|       |
  164|  38.8k|         Group_Params::FFDHE_2048, Group_Params::FFDHE_3072, Group_Params::FFDHE_4096, Group_Params::FFDHE_6144,
  165|  38.8k|         Group_Params::FFDHE_8192,
  166|  38.8k|   };
  167|  38.8k|}
_ZNK5Botan3TLS6Policy23minimum_ecdh_group_sizeEv:
  186|  9.82k|size_t Policy::minimum_ecdh_group_size() const {
  187|       |   // x25519 is smallest curve currently supported for TLS key exchange
  188|  9.82k|   return 255;
  189|  9.82k|}
_ZNK5Botan3TLS6Policy25check_peer_key_acceptableERKNS_10Public_KeyE:
  206|  9.82k|void Policy::check_peer_key_acceptable(const Public_Key& public_key) const {
  207|  9.82k|   const std::string algo_name = public_key.algo_name();
  208|       |
  209|  9.82k|   const size_t keylength = public_key.key_length();
  210|  9.82k|   size_t expected_keylength = 0;
  211|       |
  212|  9.82k|   if(algo_name == "RSA") {
  ------------------
  |  Branch (212:7): [True: 0, False: 9.82k]
  ------------------
  213|      0|      expected_keylength = minimum_rsa_bits();
  214|  9.82k|   } else if(algo_name == "DH") {
  ------------------
  |  Branch (214:14): [True: 0, False: 9.82k]
  ------------------
  215|      0|      expected_keylength = minimum_dh_group_size();
  216|  9.82k|   } else if(algo_name == "ECDH" || algo_name == "Curve25519") {
  ------------------
  |  Branch (216:14): [True: 9.82k, False: 0]
  |  Branch (216:37): [True: 0, False: 0]
  ------------------
  217|  9.82k|      expected_keylength = minimum_ecdh_group_size();
  218|  9.82k|   } else if(algo_name == "ECDSA") {
  ------------------
  |  Branch (218:14): [True: 0, False: 0]
  ------------------
  219|      0|      expected_keylength = minimum_ecdsa_group_size();
  220|      0|   }
  221|       |   // else some other algo, so leave expected_keylength as zero and the check is a no-op
  222|       |
  223|  9.82k|   if(keylength < expected_keylength) {
  ------------------
  |  Branch (223:7): [True: 0, False: 9.82k]
  ------------------
  224|      0|      throw TLS_Exception(Alert::InsufficientSecurity,
  225|      0|                          "Peer sent " + std::to_string(keylength) + " bit " + algo_name +
  226|      0|                             " key"
  227|      0|                             ", policy requires at least " +
  228|      0|                             std::to_string(expected_keylength));
  229|      0|   }
  230|  9.82k|}
_ZNK5Botan3TLS6Policy27acceptable_protocol_versionENS0_16Protocol_VersionE:
  240|  10.6k|bool Policy::acceptable_protocol_version(Protocol_Version version) const {
  241|  10.6k|#if defined(BOTAN_HAS_TLS_13)
  242|  10.6k|   if(version == Protocol_Version::TLS_V13 && allow_tls13()) {
  ------------------
  |  Branch (242:7): [True: 4.91k, False: 5.77k]
  |  Branch (242:7): [True: 0, False: 10.6k]
  |  Branch (242:47): [True: 0, False: 4.91k]
  ------------------
  243|      0|      return true;
  244|      0|   }
  245|  10.6k|#endif
  246|       |
  247|  10.6k|#if defined(BOTAN_HAS_TLS_12)
  248|  10.6k|   if(version == Protocol_Version::TLS_V12 && allow_tls12()) {
  ------------------
  |  Branch (248:7): [True: 4.91k, False: 5.77k]
  |  Branch (248:7): [True: 4.91k, False: 5.77k]
  |  Branch (248:47): [True: 4.91k, False: 0]
  ------------------
  249|  4.91k|      return true;
  250|  4.91k|   }
  251|       |
  252|  5.77k|   if(version == Protocol_Version::DTLS_V12 && allow_dtls12()) {
  ------------------
  |  Branch (252:7): [True: 862, False: 4.91k]
  |  Branch (252:7): [True: 862, False: 4.91k]
  |  Branch (252:48): [True: 862, False: 0]
  ------------------
  253|    862|      return true;
  254|    862|   }
  255|  4.91k|#endif
  256|       |
  257|  4.91k|   return false;
  258|  5.77k|}
_ZNK5Botan3TLS6Policy24latest_supported_versionEb:
  260|  5.77k|Protocol_Version Policy::latest_supported_version(bool datagram) const {
  261|  5.77k|   if(datagram) {
  ------------------
  |  Branch (261:7): [True: 862, False: 4.91k]
  ------------------
  262|    862|      if(acceptable_protocol_version(Protocol_Version::DTLS_V12)) {
  ------------------
  |  Branch (262:10): [True: 862, False: 0]
  ------------------
  263|    862|         return Protocol_Version::DTLS_V12;
  264|    862|      }
  265|      0|      throw Invalid_State("Policy forbids all available DTLS version");
  266|  4.91k|   } else {
  267|  4.91k|#if defined(BOTAN_HAS_TLS_13)
  268|  4.91k|      if(acceptable_protocol_version(Protocol_Version::TLS_V13)) {
  ------------------
  |  Branch (268:10): [True: 0, False: 4.91k]
  ------------------
  269|      0|         return Protocol_Version::TLS_V13;
  270|      0|      }
  271|  4.91k|#endif
  272|  4.91k|      if(acceptable_protocol_version(Protocol_Version::TLS_V12)) {
  ------------------
  |  Branch (272:10): [True: 4.91k, False: 0]
  ------------------
  273|  4.91k|         return Protocol_Version::TLS_V12;
  274|  4.91k|      }
  275|      0|      throw Invalid_State("Policy forbids all available TLS version");
  276|  4.91k|   }
  277|  5.77k|}
_ZNK5Botan3TLS6Policy28allow_insecure_renegotiationEv:
  288|  26.1k|bool Policy::allow_insecure_renegotiation() const { return false; }
_ZNK5Botan3TLS6Policy11allow_tls12Ev:
  290|  68.1k|bool Policy::allow_tls12() const {
  291|  68.1k|#if defined(BOTAN_HAS_TLS_12)
  292|  68.1k|   return true;
  293|       |#else
  294|       |   return false;
  295|       |#endif
  296|  68.1k|}
_ZNK5Botan3TLS6Policy12allow_dtls12Ev:
  306|  4.70k|bool Policy::allow_dtls12() const {
  307|  4.70k|#if defined(BOTAN_HAS_TLS_12)
  308|  4.70k|   return true;
  309|       |#else
  310|       |   return false;
  311|       |#endif
  312|  4.70k|}
_ZNK5Botan3TLS6Policy28include_time_in_hello_randomEv:
  314|  41.9k|bool Policy::include_time_in_hello_random() const { return true; }
_ZNK5Botan3TLS6Policy39server_uses_own_ciphersuite_preferencesEv:
  318|  21.1k|bool Policy::server_uses_own_ciphersuite_preferences() const { return true; }
_ZNK5Botan3TLS6Policy26negotiate_encrypt_then_macEv:
  320|    816|bool Policy::negotiate_encrypt_then_mac() const { return true; }
_ZNK5Botan3TLS6Policy27support_cert_status_messageEv:
  324|    581|bool Policy::support_cert_status_message() const { return true; }
_ZNK5Botan3TLS6Policy17hash_hello_randomEv:
  330|  41.9k|bool Policy::hash_hello_random() const { return true; }
_ZNK5Botan3TLS6Policy41require_client_certificate_authenticationEv:
  334|  20.8k|bool Policy::require_client_certificate_authentication() const { return false; }
_ZNK5Botan3TLS6Policy41request_client_certificate_authenticationEv:
  336|  20.8k|bool Policy::request_client_certificate_authentication() const { return require_client_certificate_authentication(); }
_ZNK5Botan3TLS6Policy25allow_dtls_epoch0_restartEv:
  340|    862|bool Policy::allow_dtls_epoch0_restart() const { return false; }
_ZNK5Botan3TLS6Policy20dtls_initial_timeoutEv:
  345|    708|size_t Policy::dtls_initial_timeout() const { return 1 * 1000; }
_ZNK5Botan3TLS6Policy20dtls_maximum_timeoutEv:
  347|    708|size_t Policy::dtls_maximum_timeout() const { return 60 * 1000; }
_ZNK5Botan3TLS6Policy16dtls_default_mtuEv:
  349|    708|size_t Policy::dtls_default_mtu() const {
  350|       |   // default MTU is IPv6 min MTU minus UDP/IP headers
  351|    708|   return 1280 - 40 - 8;
  352|    708|}

_ZN5Botan3TLS6ServerC2ERKNSt3__110shared_ptrINS0_9CallbacksEEERKNS3_INS0_15Session_ManagerEEERKNS3_INS_19Credentials_ManagerEEERKNS3_IKNS0_6PolicyEEERKNS3_INS_21RandomNumberGeneratorEEEbm:
   34|  5.77k|               size_t io_buf_sz) {
   35|  5.77k|   const auto max_version = policy->latest_supported_version(is_datagram);
   36|       |
   37|  5.77k|   if(!max_version.is_pre_tls_13()) {
  ------------------
  |  Branch (37:7): [True: 0, False: 5.77k]
  ------------------
   38|      0|#if defined(BOTAN_HAS_TLS_13)
   39|      0|      m_impl = std::make_unique<Server_Impl_13>(callbacks, session_manager, creds, policy, rng);
   40|       |
   41|      0|      if(m_impl->expects_downgrade()) {
  ------------------
  |  Branch (41:10): [True: 0, False: 0]
  ------------------
   42|      0|         m_impl->set_io_buffer_size(io_buf_sz);
   43|      0|      }
   44|       |#else
   45|       |      throw Not_Implemented("TLS 1.3 server is not available in this build");
   46|       |#endif
   47|  5.77k|   } else {
   48|  5.77k|      m_impl = std::make_unique<Server_Impl_12>(callbacks, session_manager, creds, policy, rng, is_datagram, io_buf_sz);
   49|  5.77k|   }
   50|  5.77k|}
_ZN5Botan3TLS6ServerD2Ev:
   52|  5.77k|Server::~Server() = default;
_ZN5Botan3TLS6Server9from_peerENSt3__14spanIKhLm18446744073709551615EEE:
   54|  5.77k|size_t Server::from_peer(std::span<const uint8_t> data) {
   55|  5.77k|   auto read = m_impl->from_peer(data);
   56|       |
   57|  5.77k|   if(m_impl->is_downgrading()) {
  ------------------
  |  Branch (57:7): [True: 0, False: 5.77k]
  ------------------
   58|      0|      auto info = m_impl->extract_downgrade_info();
   59|      0|      m_impl = std::make_unique<Server_Impl_12>(*info);
   60|       |
   61|       |      // replay peer data received so far
   62|      0|      read = m_impl->from_peer(info->peer_transcript);
   63|      0|   }
   64|       |
   65|  5.77k|   return read;
   66|  5.77k|}

_ZNK5Botan3TLS14Session_Handle20validate_constraintsEv:
   28|  2.57k|void Session_Handle::validate_constraints() const {
   29|  2.57k|   std::visit(overloaded{
   30|  2.57k|                 [](const Session_ID& id) {
   31|       |                    // RFC 5246 7.4.1.2
   32|       |                    //    opaque SessionID<0..32>;
   33|  2.57k|                    BOTAN_ARG_CHECK(!id.empty(), "Session ID must not be empty");
   34|  2.57k|                    BOTAN_ARG_CHECK(id.size() <= 32, "Session ID cannot be longer than 32 bytes");
   35|  2.57k|                 },
   36|  2.57k|                 [](const Session_Ticket& ticket) {
   37|  2.57k|                    BOTAN_ARG_CHECK(!ticket.empty(), "Ticket most not be empty");
   38|  2.57k|                    BOTAN_ARG_CHECK(ticket.size() <= std::numeric_limits<uint16_t>::max(),
   39|  2.57k|                                    "Ticket cannot be longer than 64kB");
   40|  2.57k|                 },
   41|  2.57k|                 [](const Opaque_Session_Handle& handle) {
   42|       |                    // RFC 8446 4.6.1
   43|       |                    //    opaque ticket<1..2^16-1>;
   44|  2.57k|                    BOTAN_ARG_CHECK(!handle.empty(), "Opaque session handle must not be empty");
   45|  2.57k|                    BOTAN_ARG_CHECK(handle.size() <= std::numeric_limits<uint16_t>::max(),
   46|  2.57k|                                    "Opaque session handle cannot be longer than 64kB");
   47|  2.57k|                 },
   48|  2.57k|              },
   49|  2.57k|              m_handle);
   50|  2.57k|}
_ZNK5Botan3TLS12Session_Base11ciphersuiteEv:
   86|    245|Ciphersuite Session_Base::ciphersuite() const {
   87|    245|   auto suite = Ciphersuite::by_id(m_ciphersuite);
   88|    245|   if(!suite.has_value()) {
  ------------------
  |  Branch (88:7): [True: 0, False: 245]
  ------------------
   89|      0|      throw Decoding_Error("Failed to find cipher suite for ID " + std::to_string(m_ciphersuite));
   90|      0|   }
   91|    245|   return suite.value();
   92|    245|}
_ZN5Botan3TLS15Session_SummaryC2ERKNS0_12Session_BaseEb:
   94|    245|Session_Summary::Session_Summary(const Session_Base& base, bool was_resumption) : Session_Base(base) {
   95|    245|   BOTAN_ARG_CHECK(version().is_pre_tls_13(), "Instantiated a TLS 1.2 session summary with an newer TLS version");
  ------------------
  |  |   30|    245|   do {                                                          \
  |  |   31|    245|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 245]
  |  |  ------------------
  |  |   32|    245|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    245|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   96|       |
   97|    245|   const auto cs = ciphersuite();
   98|    245|   m_psk_used = cs.psk_ciphersuite();
   99|    245|   m_kex_algo = cs.kex_algo();
  100|    245|   m_was_resumption = was_resumption;
  101|    245|}
_ZN5Botan3TLS7SessionC2ERKNSt3__16vectorIhNS_16secure_allocatorIhEEEENS0_16Protocol_VersionEtNS0_15Connection_SideEbbRKNS3_INS_16X509_CertificateENS2_9allocatorISB_EEEERKNS0_18Server_InformationEtNS2_6chrono10time_pointINSK_12system_clockENSK_8durationIxNS2_5ratioILl1ELl1000000EEEEEEENSN_IxNSO_ILl1ELl1EEEEE:
  195|    245|      m_lifetime_hint(lifetime_hint) {
  196|    245|   BOTAN_ARG_CHECK(version.is_pre_tls_13(), "Instantiated a TLS 1.2 session object with a TLS version newer than 1.2");
  ------------------
  |  |   30|    245|   do {                                                          \
  |  |   31|    245|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 245]
  |  |  ------------------
  |  |   32|    245|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    245|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  197|    245|}
tls_session.cpp:_ZZNK5Botan3TLS14Session_Handle20validate_constraintsEvENK3$_0clERKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_11Session_ID_EJEEE:
   30|    167|                 [](const Session_ID& id) {
   31|       |                    // RFC 5246 7.4.1.2
   32|       |                    //    opaque SessionID<0..32>;
   33|    167|                    BOTAN_ARG_CHECK(!id.empty(), "Session ID must not be empty");
  ------------------
  |  |   30|    167|   do {                                                          \
  |  |   31|    167|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 167]
  |  |  ------------------
  |  |   32|    167|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    167|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   34|    167|                    BOTAN_ARG_CHECK(id.size() <= 32, "Session ID cannot be longer than 32 bytes");
  ------------------
  |  |   30|    167|   do {                                                          \
  |  |   31|    167|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 167]
  |  |  ------------------
  |  |   32|    167|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    167|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   35|    167|                 },
tls_session.cpp:_ZZNK5Botan3TLS14Session_Handle20validate_constraintsEvENK3$_1clERKNS_6StrongINSt3__16vectorIhNS4_9allocatorIhEEEENS0_15Session_Ticket_EJEEE:
   36|  2.40k|                 [](const Session_Ticket& ticket) {
   37|  2.40k|                    BOTAN_ARG_CHECK(!ticket.empty(), "Ticket most not be empty");
  ------------------
  |  |   30|  2.40k|   do {                                                          \
  |  |   31|  2.40k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 2.40k]
  |  |  ------------------
  |  |   32|  2.40k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  2.40k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   38|  2.40k|                    BOTAN_ARG_CHECK(ticket.size() <= std::numeric_limits<uint16_t>::max(),
  ------------------
  |  |   30|  2.40k|   do {                                                          \
  |  |   31|  2.40k|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 2.40k]
  |  |  ------------------
  |  |   32|  2.40k|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|  2.40k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   39|  2.40k|                                    "Ticket cannot be longer than 64kB");
   40|  2.40k|                 },

_ZN5Botan3TLS15Session_ManagerC2ERKNSt3__110shared_ptrINS_21RandomNumberGeneratorEEE:
   17|  5.77k|Session_Manager::Session_Manager(const std::shared_ptr<RandomNumberGenerator>& rng) : m_rng(rng) {
   18|  5.77k|   BOTAN_ASSERT_NONNULL(m_rng);
  ------------------
  |  |   87|  5.77k|   do {                                                                                   \
  |  |   88|  5.77k|      if((ptr) == nullptr)                                                                \
  |  |  ------------------
  |  |  |  Branch (88:10): [True: 0, False: 5.77k]
  |  |  ------------------
  |  |   89|  5.77k|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |   90|  5.77k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
   19|  5.77k|}
_ZN5Botan3TLS15Session_Manager8retrieveERKNS0_14Session_HandleERNS0_9CallbacksERKNS0_6PolicyE:
   38|  2.45k|                                                 const Policy& policy) {
   39|       |   // Retrieving a session for a given handle does not require locking on this
   40|       |   // level. Concurrent threads might handle the removal of an expired ticket
   41|       |   // more than once, but removing an already removed ticket is a harmless NOOP.
   42|       |
   43|  2.45k|   auto session = retrieve_one(handle);
   44|  2.45k|   if(!session.has_value()) {
  ------------------
  |  Branch (44:7): [True: 2.45k, False: 0]
  ------------------
   45|  2.45k|      return std::nullopt;
   46|  2.45k|   }
   47|       |
   48|       |   // A value of '0' means: No policy restrictions.
   49|      0|   const std::chrono::seconds policy_lifetime =
   50|      0|      (policy.session_ticket_lifetime().count() > 0) ? policy.session_ticket_lifetime() : std::chrono::seconds::max();
  ------------------
  |  Branch (50:7): [True: 0, False: 0]
  ------------------
   51|       |
   52|       |   // RFC 5077 3.3 -- "Old Session Tickets"
   53|       |   //    A server MAY treat a ticket as valid for a shorter or longer period of
   54|       |   //    time than what is stated in the ticket_lifetime_hint.
   55|       |   //
   56|       |   // RFC 5246 F.1.4 -- TLS 1.2
   57|       |   //    If either party suspects that the session may have been compromised, or
   58|       |   //    that certificates may have expired or been revoked, it should force a
   59|       |   //    full handshake.  An upper limit of 24 hours is suggested for session ID
   60|       |   //    lifetimes.
   61|       |   //
   62|       |   // RFC 8446 4.6.1 -- TLS 1.3
   63|       |   //    A server MAY treat a ticket as valid for a shorter period of time than
   64|       |   //    what is stated in the ticket_lifetime.
   65|       |   //
   66|       |   // Note: This disregards what is stored in the session (e.g. "lifetime_hint")
   67|       |   //       and only takes the local policy into account. The lifetime stored in
   68|       |   //       the sessions was taken from the same policy anyways and changes by
   69|       |   //       the application should have an immediate effect.
   70|      0|   const auto ticket_age =
   71|      0|      std::chrono::duration_cast<std::chrono::seconds>(callbacks.tls_current_timestamp() - session->start_time());
   72|      0|   const bool expired = ticket_age > policy_lifetime;
   73|       |
   74|      0|   if(expired) {
  ------------------
  |  Branch (74:7): [True: 0, False: 0]
  ------------------
   75|      0|      remove(handle);
   76|      0|      return std::nullopt;
   77|      0|   } else {
   78|      0|      return session;
   79|      0|   }
   80|      0|}

_ZN5Botan3TLS20Session_Manager_NoopC2Ev:
   15|  5.77k|Session_Manager_Noop::Session_Manager_Noop() : Session_Manager(std::make_shared<Null_RNG>()) {}

_ZN5Botan3TLS16Signature_Scheme21all_available_schemesEv:
   21|  9.97k|const std::vector<Signature_Scheme>& Signature_Scheme::all_available_schemes() {
   22|       |   /*
   23|       |   * This is ordered in some approximate order of preference
   24|       |   */
   25|  9.97k|   static const std::vector<Signature_Scheme> all_schemes = {
   26|       |
   27|       |      // EdDSA 25519 is currently not supported as a signature scheme for certificates
   28|       |      // certificate authentication.
   29|       |      // See: https://github.com/randombit/botan/pull/2958#discussion_r851294715
   30|       |      //
   31|       |      // #if defined(BOTAN_HAS_ED25519)
   32|       |      //       EDDSA_25519,
   33|       |      // #endif
   34|       |
   35|  9.97k|      RSA_PSS_SHA384,
   36|  9.97k|      RSA_PSS_SHA256,
   37|  9.97k|      RSA_PSS_SHA512,
   38|       |
   39|  9.97k|      RSA_PKCS1_SHA384,
   40|  9.97k|      RSA_PKCS1_SHA512,
   41|  9.97k|      RSA_PKCS1_SHA256,
   42|       |
   43|  9.97k|      ECDSA_SHA384,
   44|  9.97k|      ECDSA_SHA512,
   45|  9.97k|      ECDSA_SHA256,
   46|  9.97k|   };
   47|       |
   48|  9.97k|   return all_schemes;
   49|  9.97k|}
_ZN5Botan3TLS16Signature_SchemeC2Ev:
   51|  20.8k|Signature_Scheme::Signature_Scheme() : m_code(NONE) {}
_ZN5Botan3TLS16Signature_SchemeC2Et:
   53|  15.9k|Signature_Scheme::Signature_Scheme(uint16_t wire_code) : Signature_Scheme(Signature_Scheme::Code(wire_code)) {}
_ZN5Botan3TLS16Signature_SchemeC2ENS1_4CodeE:
   55|  15.9k|Signature_Scheme::Signature_Scheme(Signature_Scheme::Code wire_code) : m_code(wire_code) {}
_ZNK5Botan3TLS16Signature_Scheme12is_availableEv:
   57|  9.82k|bool Signature_Scheme::is_available() const noexcept {
   58|  9.82k|   return value_exists(Signature_Scheme::all_available_schemes(), *this);
   59|  9.82k|}
_ZNK5Botan3TLS16Signature_Scheme18hash_function_nameEv:
  100|  3.56k|std::string Signature_Scheme::hash_function_name() const noexcept {
  101|  3.56k|   switch(m_code) {
  102|      0|      case RSA_PKCS1_SHA1:
  ------------------
  |  Branch (102:7): [True: 0, False: 3.56k]
  ------------------
  103|      0|      case ECDSA_SHA1:
  ------------------
  |  Branch (103:7): [True: 0, False: 3.56k]
  ------------------
  104|      0|         return "SHA-1";
  105|       |
  106|    150|      case ECDSA_SHA256:
  ------------------
  |  Branch (106:7): [True: 150, False: 3.41k]
  ------------------
  107|  1.26k|      case RSA_PKCS1_SHA256:
  ------------------
  |  Branch (107:7): [True: 1.11k, False: 2.44k]
  ------------------
  108|  2.36k|      case RSA_PSS_SHA256:
  ------------------
  |  Branch (108:7): [True: 1.09k, False: 2.46k]
  ------------------
  109|  2.36k|         return "SHA-256";
  110|       |
  111|    150|      case ECDSA_SHA384:
  ------------------
  |  Branch (111:7): [True: 150, False: 3.41k]
  ------------------
  112|    360|      case RSA_PKCS1_SHA384:
  ------------------
  |  Branch (112:7): [True: 210, False: 3.35k]
  ------------------
  113|    621|      case RSA_PSS_SHA384:
  ------------------
  |  Branch (113:7): [True: 261, False: 3.30k]
  ------------------
  114|    621|         return "SHA-384";
  115|       |
  116|    150|      case ECDSA_SHA512:
  ------------------
  |  Branch (116:7): [True: 150, False: 3.41k]
  ------------------
  117|    355|      case RSA_PKCS1_SHA512:
  ------------------
  |  Branch (117:7): [True: 205, False: 3.35k]
  ------------------
  118|    574|      case RSA_PSS_SHA512:
  ------------------
  |  Branch (118:7): [True: 219, False: 3.34k]
  ------------------
  119|    574|         return "SHA-512";
  120|       |
  121|      0|      case EDDSA_25519:
  ------------------
  |  Branch (121:7): [True: 0, False: 3.56k]
  ------------------
  122|      0|      case EDDSA_448:
  ------------------
  |  Branch (122:7): [True: 0, False: 3.56k]
  ------------------
  123|      0|         return "Pure";
  124|       |
  125|      0|      default:
  ------------------
  |  Branch (125:7): [True: 0, False: 3.56k]
  ------------------
  126|      0|         return "Unknown hash function";
  127|  3.56k|   }
  128|  3.56k|}
_ZNK5Botan3TLS16Signature_Scheme14algorithm_nameEv:
  167|  3.78k|std::string Signature_Scheme::algorithm_name() const noexcept {
  168|  3.78k|   switch(m_code) {
  169|      0|      case RSA_PKCS1_SHA1:
  ------------------
  |  Branch (169:7): [True: 0, False: 3.78k]
  ------------------
  170|  1.11k|      case RSA_PKCS1_SHA256:
  ------------------
  |  Branch (170:7): [True: 1.11k, False: 2.66k]
  ------------------
  171|  1.32k|      case RSA_PKCS1_SHA384:
  ------------------
  |  Branch (171:7): [True: 210, False: 3.57k]
  ------------------
  172|  1.53k|      case RSA_PKCS1_SHA512:
  ------------------
  |  Branch (172:7): [True: 205, False: 3.57k]
  ------------------
  173|  2.63k|      case RSA_PSS_SHA256:
  ------------------
  |  Branch (173:7): [True: 1.09k, False: 2.68k]
  ------------------
  174|  2.89k|      case RSA_PSS_SHA384:
  ------------------
  |  Branch (174:7): [True: 261, False: 3.52k]
  ------------------
  175|  3.11k|      case RSA_PSS_SHA512:
  ------------------
  |  Branch (175:7): [True: 219, False: 3.56k]
  ------------------
  176|  3.11k|         return "RSA";
  177|       |
  178|      0|      case ECDSA_SHA1:
  ------------------
  |  Branch (178:7): [True: 0, False: 3.78k]
  ------------------
  179|    270|      case ECDSA_SHA256:
  ------------------
  |  Branch (179:7): [True: 270, False: 3.51k]
  ------------------
  180|    461|      case ECDSA_SHA384:
  ------------------
  |  Branch (180:7): [True: 191, False: 3.59k]
  ------------------
  181|    671|      case ECDSA_SHA512:
  ------------------
  |  Branch (181:7): [True: 210, False: 3.57k]
  ------------------
  182|    671|         return "ECDSA";
  183|       |
  184|      0|      case EDDSA_25519:
  ------------------
  |  Branch (184:7): [True: 0, False: 3.78k]
  ------------------
  185|      0|         return "Ed25519";
  186|       |
  187|      0|      case EDDSA_448:
  ------------------
  |  Branch (187:7): [True: 0, False: 3.78k]
  ------------------
  188|      0|         return "Ed448";
  189|       |
  190|      0|      default:
  ------------------
  |  Branch (190:7): [True: 0, False: 3.78k]
  ------------------
  191|      0|         return "Unknown algorithm";
  192|  3.78k|   }
  193|  3.78k|}
_ZNK5Botan3TLS16Signature_Scheme20algorithm_identifierEv:
  222|  47.1k|AlgorithmIdentifier Signature_Scheme::algorithm_identifier() const noexcept {
  223|  47.1k|   switch(m_code) {
  224|    270|      case RSA_PKCS1_SHA1:
  ------------------
  |  Branch (224:7): [True: 270, False: 46.9k]
  ------------------
  225|    270|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA3(SHA-1)"), AlgorithmIdentifier::USE_NULL_PARAM);
  226|  4.83k|      case RSA_PKCS1_SHA256:
  ------------------
  |  Branch (226:7): [True: 4.83k, False: 42.3k]
  ------------------
  227|  4.83k|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA3(SHA-256)"), AlgorithmIdentifier::USE_NULL_PARAM);
  228|    222|      case RSA_PKCS1_SHA384:
  ------------------
  |  Branch (228:7): [True: 222, False: 46.9k]
  ------------------
  229|    222|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA3(SHA-384)"), AlgorithmIdentifier::USE_NULL_PARAM);
  230|    186|      case RSA_PKCS1_SHA512:
  ------------------
  |  Branch (230:7): [True: 186, False: 46.9k]
  ------------------
  231|    186|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA3(SHA-512)"), AlgorithmIdentifier::USE_NULL_PARAM);
  232|       |
  233|    105|      case ECDSA_SHA1:
  ------------------
  |  Branch (233:7): [True: 105, False: 47.0k]
  ------------------
  234|    105|         return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-1"), AlgorithmIdentifier::USE_EMPTY_PARAM);
  235|    393|      case ECDSA_SHA256:
  ------------------
  |  Branch (235:7): [True: 393, False: 46.7k]
  ------------------
  236|    393|         return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-256"), AlgorithmIdentifier::USE_EMPTY_PARAM);
  237|    129|      case ECDSA_SHA384:
  ------------------
  |  Branch (237:7): [True: 129, False: 47.0k]
  ------------------
  238|    129|         return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-384"), AlgorithmIdentifier::USE_EMPTY_PARAM);
  239|    180|      case ECDSA_SHA512:
  ------------------
  |  Branch (239:7): [True: 180, False: 46.9k]
  ------------------
  240|    180|         return AlgorithmIdentifier(OID::from_string("ECDSA/SHA-512"), AlgorithmIdentifier::USE_EMPTY_PARAM);
  241|       |
  242|  5.22k|      case RSA_PSS_SHA256:
  ------------------
  |  Branch (242:7): [True: 5.22k, False: 41.9k]
  ------------------
  243|  5.22k|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA4"), PSS_Params("SHA-256", 32).serialize());
  244|    399|      case RSA_PSS_SHA384:
  ------------------
  |  Branch (244:7): [True: 399, False: 46.7k]
  ------------------
  245|    399|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA4"), PSS_Params("SHA-384", 48).serialize());
  246|    222|      case RSA_PSS_SHA512:
  ------------------
  |  Branch (246:7): [True: 222, False: 46.9k]
  ------------------
  247|    222|         return AlgorithmIdentifier(OID::from_string("RSA/EMSA4"), PSS_Params("SHA-512", 64).serialize());
  248|       |
  249|  35.0k|      default:
  ------------------
  |  Branch (249:7): [True: 35.0k, False: 12.1k]
  ------------------
  250|       |         // Note that Ed25519 and Ed448 end up here
  251|  35.0k|         return AlgorithmIdentifier();
  252|  47.1k|   }
  253|  47.1k|}
_ZN5Botan3TLS24to_algorithm_identifiersERKNSt3__16vectorINS0_16Signature_SchemeENS1_9allocatorIS3_EEEE:
  328|  63.5k|std::vector<AlgorithmIdentifier> to_algorithm_identifiers(const std::vector<Signature_Scheme>& schemes) {
  329|  63.5k|   std::vector<AlgorithmIdentifier> result;
  330|  63.5k|   std::transform(schemes.begin(), schemes.end(), std::back_inserter(result), [](const auto& scheme) {
  331|  63.5k|      return scheme.algorithm_identifier();
  332|  63.5k|   });
  333|  63.5k|   return result;
  334|  63.5k|}
tls_signature_scheme.cpp:_ZZN5Botan3TLS24to_algorithm_identifiersERKNSt3__16vectorINS0_16Signature_SchemeENS1_9allocatorIS3_EEEEENK3$_0clIS3_EEDaRKT_:
  330|  47.1k|   std::transform(schemes.begin(), schemes.end(), std::back_inserter(result), [](const auto& scheme) {
  331|  47.1k|      return scheme.algorithm_identifier();
  332|  47.1k|   });

_ZN5Botan3TLS11Ciphersuite22all_known_ciphersuitesEv:
   15|  85.2k|const std::vector<Ciphersuite>& Ciphersuite::all_known_ciphersuites() {
   16|       |   // clang-format off
   17|       |
   18|       |   // Note that this list of ciphersuites is ordered by id!
   19|  85.2k|   static const std::vector<Ciphersuite> g_ciphersuite_list = {
   20|  85.2k|      Ciphersuite(0x000A, "RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   21|  85.2k|      Ciphersuite(0x0016, "DHE_RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   22|  85.2k|      Ciphersuite(0x002F, "RSA_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   23|  85.2k|      Ciphersuite(0x0033, "DHE_RSA_WITH_AES_128_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   24|  85.2k|      Ciphersuite(0x0035, "RSA_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   25|  85.2k|      Ciphersuite(0x0039, "DHE_RSA_WITH_AES_256_CBC_SHA", Auth_Method::RSA, Kex_Algo::DH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   26|  85.2k|      Ciphersuite(0x003C, "RSA_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   27|  85.2k|      Ciphersuite(0x003D, "RSA_WITH_AES_256_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256", 32, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   28|  85.2k|      Ciphersuite(0x0067, "DHE_RSA_WITH_AES_128_CBC_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   29|  85.2k|      Ciphersuite(0x006B, "DHE_RSA_WITH_AES_256_CBC_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-256", 32, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   30|  85.2k|      Ciphersuite(0x008B, "PSK_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   31|  85.2k|      Ciphersuite(0x008C, "PSK_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   32|  85.2k|      Ciphersuite(0x008D, "PSK_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   33|  85.2k|      Ciphersuite(0x009C, "RSA_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   34|  85.2k|      Ciphersuite(0x009D, "RSA_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   35|  85.2k|      Ciphersuite(0x009E, "DHE_RSA_WITH_AES_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   36|  85.2k|      Ciphersuite(0x009F, "DHE_RSA_WITH_AES_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   37|  85.2k|      Ciphersuite(0x00A8, "PSK_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   38|  85.2k|      Ciphersuite(0x00A9, "PSK_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   39|  85.2k|      Ciphersuite(0x00AE, "PSK_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   40|  85.2k|      Ciphersuite(0x00AF, "PSK_WITH_AES_256_CBC_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE),
   41|  85.2k|      Ciphersuite(0x1301, "AES_128_GCM_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   42|  85.2k|      Ciphersuite(0x1302, "AES_256_GCM_SHA384", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   43|  85.2k|      Ciphersuite(0x1303, "CHACHA20_POLY1305_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
   44|  85.2k|      Ciphersuite(0x1304, "AES_128_CCM_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   45|  85.2k|      Ciphersuite(0x1305, "AES_128_CCM_8_SHA256", Auth_Method::UNDEFINED, Kex_Algo::UNDEFINED, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   46|  85.2k|      Ciphersuite(0xC008, "ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   47|  85.2k|      Ciphersuite(0xC009, "ECDHE_ECDSA_WITH_AES_128_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   48|  85.2k|      Ciphersuite(0xC00A, "ECDHE_ECDSA_WITH_AES_256_CBC_SHA", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   49|  85.2k|      Ciphersuite(0xC012, "ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   50|  85.2k|      Ciphersuite(0xC013, "ECDHE_RSA_WITH_AES_128_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   51|  85.2k|      Ciphersuite(0xC014, "ECDHE_RSA_WITH_AES_256_CBC_SHA", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   52|  85.2k|      Ciphersuite(0xC023, "ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   53|  85.2k|      Ciphersuite(0xC024, "ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE),
   54|  85.2k|      Ciphersuite(0xC027, "ECDHE_RSA_WITH_AES_128_CBC_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   55|  85.2k|      Ciphersuite(0xC028, "ECDHE_RSA_WITH_AES_256_CBC_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE),
   56|  85.2k|      Ciphersuite(0xC02B, "ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   57|  85.2k|      Ciphersuite(0xC02C, "ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   58|  85.2k|      Ciphersuite(0xC02F, "ECDHE_RSA_WITH_AES_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   59|  85.2k|      Ciphersuite(0xC030, "ECDHE_RSA_WITH_AES_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   60|  85.2k|      Ciphersuite(0xC034, "ECDHE_PSK_WITH_3DES_EDE_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "3DES", 24, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   61|  85.2k|      Ciphersuite(0xC035, "ECDHE_PSK_WITH_AES_128_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128", 16, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   62|  85.2k|      Ciphersuite(0xC036, "ECDHE_PSK_WITH_AES_256_CBC_SHA", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256", 32, "SHA-1", 20, KDF_Algo::SHA_1, Nonce_Format::CBC_MODE),
   63|  85.2k|      Ciphersuite(0xC037, "ECDHE_PSK_WITH_AES_128_CBC_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128", 16, "SHA-256", 32, KDF_Algo::SHA_256, Nonce_Format::CBC_MODE),
   64|  85.2k|      Ciphersuite(0xC038, "ECDHE_PSK_WITH_AES_256_CBC_SHA384", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256", 32, "SHA-384", 48, KDF_Algo::SHA_384, Nonce_Format::CBC_MODE),
   65|  85.2k|      Ciphersuite(0xC050, "RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   66|  85.2k|      Ciphersuite(0xC051, "RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   67|  85.2k|      Ciphersuite(0xC052, "DHE_RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   68|  85.2k|      Ciphersuite(0xC053, "DHE_RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   69|  85.2k|      Ciphersuite(0xC05C, "ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   70|  85.2k|      Ciphersuite(0xC05D, "ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   71|  85.2k|      Ciphersuite(0xC060, "ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   72|  85.2k|      Ciphersuite(0xC061, "ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   73|  85.2k|      Ciphersuite(0xC06A, "PSK_WITH_ARIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ARIA-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   74|  85.2k|      Ciphersuite(0xC06B, "PSK_WITH_ARIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ARIA-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   75|  85.2k|      Ciphersuite(0xC07A, "RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   76|  85.2k|      Ciphersuite(0xC07B, "RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   77|  85.2k|      Ciphersuite(0xC07C, "DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::DH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   78|  85.2k|      Ciphersuite(0xC07D, "DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::DH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   79|  85.2k|      Ciphersuite(0xC086, "ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   80|  85.2k|      Ciphersuite(0xC087, "ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::ECDSA, Kex_Algo::ECDH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   81|  85.2k|      Ciphersuite(0xC08A, "ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   82|  85.2k|      Ciphersuite(0xC08B, "ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::RSA, Kex_Algo::ECDH, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   83|  85.2k|      Ciphersuite(0xC08E, "PSK_WITH_CAMELLIA_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "Camellia-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   84|  85.2k|      Ciphersuite(0xC08F, "PSK_WITH_CAMELLIA_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::PSK, "Camellia-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
   85|  85.2k|      Ciphersuite(0xC09C, "RSA_WITH_AES_128_CCM", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   86|  85.2k|      Ciphersuite(0xC09D, "RSA_WITH_AES_256_CCM", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   87|  85.2k|      Ciphersuite(0xC09E, "DHE_RSA_WITH_AES_128_CCM", Auth_Method::RSA, Kex_Algo::DH, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   88|  85.2k|      Ciphersuite(0xC09F, "DHE_RSA_WITH_AES_256_CCM", Auth_Method::RSA, Kex_Algo::DH, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   89|  85.2k|      Ciphersuite(0xC0A0, "RSA_WITH_AES_128_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   90|  85.2k|      Ciphersuite(0xC0A1, "RSA_WITH_AES_256_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::STATIC_RSA, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   91|  85.2k|      Ciphersuite(0xC0A2, "DHE_RSA_WITH_AES_128_CCM_8", Auth_Method::RSA, Kex_Algo::DH, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   92|  85.2k|      Ciphersuite(0xC0A3, "DHE_RSA_WITH_AES_256_CCM_8", Auth_Method::RSA, Kex_Algo::DH, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   93|  85.2k|      Ciphersuite(0xC0A4, "PSK_WITH_AES_128_CCM", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   94|  85.2k|      Ciphersuite(0xC0A5, "PSK_WITH_AES_256_CCM", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   95|  85.2k|      Ciphersuite(0xC0A8, "PSK_WITH_AES_128_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   96|  85.2k|      Ciphersuite(0xC0A9, "PSK_WITH_AES_256_CCM_8", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   97|  85.2k|      Ciphersuite(0xC0AC, "ECDHE_ECDSA_WITH_AES_128_CCM", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   98|  85.2k|      Ciphersuite(0xC0AD, "ECDHE_ECDSA_WITH_AES_256_CCM", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/CCM", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
   99|  85.2k|      Ciphersuite(0xC0AE, "ECDHE_ECDSA_WITH_AES_128_CCM_8", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
  100|  85.2k|      Ciphersuite(0xC0AF, "ECDHE_ECDSA_WITH_AES_256_CCM_8", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/CCM(8)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
  101|  85.2k|      Ciphersuite(0xCCA8, "ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  102|  85.2k|      Ciphersuite(0xCCA9, "ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  103|  85.2k|      Ciphersuite(0xCCAA, "DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::RSA, Kex_Algo::DH, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  104|  85.2k|      Ciphersuite(0xCCAB, "PSK_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  105|  85.2k|      Ciphersuite(0xCCAC, "ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "ChaCha20Poly1305", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  106|  85.2k|      Ciphersuite(0xD001, "ECDHE_PSK_WITH_AES_128_GCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/GCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
  107|  85.2k|      Ciphersuite(0xD002, "ECDHE_PSK_WITH_AES_256_GCM_SHA384", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256/GCM", 32, "AEAD", 0, KDF_Algo::SHA_384, Nonce_Format::AEAD_IMPLICIT_4),
  108|  85.2k|      Ciphersuite(0xD003, "ECDHE_PSK_WITH_AES_128_CCM_8_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/CCM(8)", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
  109|  85.2k|      Ciphersuite(0xD005, "ECDHE_PSK_WITH_AES_128_CCM_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-128/CCM", 16, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_IMPLICIT_4),
  110|  85.2k|      Ciphersuite(0xFFC3, "ECDHE_RSA_WITH_AES_256_OCB_SHA256", Auth_Method::RSA, Kex_Algo::ECDH, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  111|  85.2k|      Ciphersuite(0xFFC5, "ECDHE_ECDSA_WITH_AES_256_OCB_SHA256", Auth_Method::ECDSA, Kex_Algo::ECDH, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  112|  85.2k|      Ciphersuite(0xFFC7, "PSK_WITH_AES_256_OCB_SHA256", Auth_Method::IMPLICIT, Kex_Algo::PSK, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  113|  85.2k|      Ciphersuite(0xFFCB, "ECDHE_PSK_WITH_AES_256_OCB_SHA256", Auth_Method::IMPLICIT, Kex_Algo::ECDHE_PSK, "AES-256/OCB(12)", 32, "AEAD", 0, KDF_Algo::SHA_256, Nonce_Format::AEAD_XOR_12),
  114|  85.2k|      };
  115|       |
  116|       |   // clang-format on
  117|       |
  118|  85.2k|   return g_ciphersuite_list;
  119|  85.2k|}

_ZNK5Botan3TLS16Protocol_Version9to_stringEv:
   16|      3|std::string Protocol_Version::to_string() const {
   17|      3|   const uint8_t maj = major_version();
   18|      3|   const uint8_t min = minor_version();
   19|       |
   20|      3|   if(maj == 3 && min == 0) {
  ------------------
  |  Branch (20:7): [True: 1, False: 2]
  |  Branch (20:19): [True: 0, False: 1]
  ------------------
   21|      0|      return "SSL v3";
   22|      0|   }
   23|       |
   24|      3|   if(maj == 3 && min >= 1) {  // TLS v1.x
  ------------------
  |  Branch (24:7): [True: 1, False: 2]
  |  Branch (24:19): [True: 1, False: 0]
  ------------------
   25|      1|      return "TLS v1." + std::to_string(min - 1);
   26|      1|   }
   27|       |
   28|      2|   if(maj == 254) {  // DTLS 1.x
  ------------------
  |  Branch (28:7): [True: 2, False: 0]
  ------------------
   29|      2|      return "DTLS v1." + std::to_string(255 - min);
   30|      2|   }
   31|       |
   32|       |   // Some very new or very old protocol (or bogus data)
   33|      0|   return "Unknown " + std::to_string(maj) + "." + std::to_string(min);
   34|      2|}
_ZNK5Botan3TLS16Protocol_Version20is_datagram_protocolEv:
   36|   388k|bool Protocol_Version::is_datagram_protocol() const { return major_version() > 250; }
_ZNK5Botan3TLS16Protocol_Version13is_pre_tls_13Ev:
   38|  27.2k|bool Protocol_Version::is_pre_tls_13() const {
   39|  27.2k|   return (!is_datagram_protocol() && *this <= Protocol_Version::TLS_V12) ||
  ------------------
  |  Branch (39:12): [True: 26.3k, False: 862]
  |  Branch (39:39): [True: 26.3k, False: 0]
  ------------------
   40|  27.2k|          (is_datagram_protocol() && *this <= Protocol_Version::DTLS_V12);
  ------------------
  |  Branch (40:12): [True: 862, False: 0]
  |  Branch (40:38): [True: 862, False: 0]
  ------------------
   41|  27.2k|}
_ZNK5Botan3TLS16Protocol_VersiongtERKS1_:
   48|  24.5k|bool Protocol_Version::operator>(const Protocol_Version& other) const {
   49|  24.5k|   if(this->is_datagram_protocol() != other.is_datagram_protocol()) {
  ------------------
  |  Branch (49:7): [True: 0, False: 24.5k]
  ------------------
   50|      0|      throw TLS_Exception(Alert::ProtocolVersion, "Version comparing " + to_string() + " with " + other.to_string());
   51|      0|   }
   52|       |
   53|  24.5k|   if(this->is_datagram_protocol()) {
  ------------------
  |  Branch (53:7): [True: 3.41k, False: 21.1k]
  ------------------
   54|  3.41k|      return m_version < other.m_version;  // goes backwards
   55|  3.41k|   }
   56|       |
   57|  21.1k|   return m_version > other.m_version;
   58|  24.5k|}
_ZNK5Botan3TLS16Protocol_Version5validEv:
   60|  25.0k|bool Protocol_Version::valid() const {
   61|  25.0k|   const uint8_t maj = major_version();
   62|  25.0k|   const uint8_t min = minor_version();
   63|       |
   64|  25.0k|   if(maj == 3 && min <= 4) {
  ------------------
  |  Branch (64:7): [True: 0, False: 25.0k]
  |  Branch (64:19): [True: 0, False: 0]
  ------------------
   65|       |      // 3.0: SSLv3
   66|       |      // 3.1: TLS 1.0
   67|       |      // 3.2: TLS 1.1
   68|       |      // 3.3: TLS 1.2
   69|       |      // 3.4: TLS 1.3
   70|      0|      return true;
   71|      0|   }
   72|       |
   73|  25.0k|   if(maj == 254 && (min == 253 || min == 255)) {
  ------------------
  |  Branch (73:7): [True: 0, False: 25.0k]
  |  Branch (73:22): [True: 0, False: 0]
  |  Branch (73:36): [True: 0, False: 0]
  ------------------
   74|       |      // 254.253: DTLS 1.2
   75|       |      // 254.255: DTLS 1.0
   76|      0|      return true;
   77|      0|   }
   78|       |
   79|  25.0k|   return false;
   80|  25.0k|}

_ZN5Botan19throw_invalid_stateEPKcS1_S1_:
   25|      5|void throw_invalid_state(const char* expr, const char* func, const char* file) {
   26|      5|   throw Invalid_State(fmt("Invalid state: expr {} was false in {}:{}", expr, func, file));
   27|      5|}
_ZN5Botan17assertion_failureEPKcS1_S1_S1_i:
   29|     22|void assertion_failure(const char* expr_str, const char* assertion_made, const char* func, const char* file, int line) {
   30|     22|   std::ostringstream format;
   31|       |
   32|     22|   format << "False assertion ";
   33|       |
   34|     22|   if(assertion_made && assertion_made[0] != 0) {
  ------------------
  |  Branch (34:7): [True: 22, False: 0]
  |  Branch (34:25): [True: 22, False: 0]
  ------------------
   35|     22|      format << "'" << assertion_made << "' (expression " << expr_str << ") ";
   36|     22|   } else {
   37|      0|      format << expr_str << " ";
   38|      0|   }
   39|       |
   40|     22|   if(func) {
  ------------------
  |  Branch (40:7): [True: 22, False: 0]
  ------------------
   41|     22|      format << "in " << func << " ";
   42|     22|   }
   43|       |
   44|     22|   format << "@" << file << ":" << line;
   45|       |
   46|       |#if defined(BOTAN_TERMINATE_ON_ASSERTS)
   47|       |   std::cerr << format.str() << '\n';
   48|       |   std::abort();
   49|       |#else
   50|     22|   throw Internal_Error(format.str());
   51|     22|#endif
   52|     22|}

_ZN5Botan12ucs2_to_utf8EPKhm:
   54|     42|std::string ucs2_to_utf8(const uint8_t ucs2[], size_t len) {
   55|     42|   if(len % 2 != 0) {
  ------------------
  |  Branch (55:7): [True: 1, False: 41]
  ------------------
   56|      1|      throw Decoding_Error("Invalid length for UCS-2 string");
   57|      1|   }
   58|       |
   59|     41|   const size_t chars = len / 2;
   60|       |
   61|     41|   std::string s;
   62|    234|   for(size_t i = 0; i != chars; ++i) {
  ------------------
  |  Branch (62:22): [True: 193, False: 41]
  ------------------
   63|    193|      const uint32_t c = load_be<uint16_t>(ucs2, i);
   64|    193|      append_utf8_for(s, c);
   65|    193|   }
   66|       |
   67|     41|   return s;
   68|     42|}
_ZN5Botan12ucs4_to_utf8EPKhm:
   70|     67|std::string ucs4_to_utf8(const uint8_t ucs4[], size_t len) {
   71|     67|   if(len % 4 != 0) {
  ------------------
  |  Branch (71:7): [True: 1, False: 66]
  ------------------
   72|      1|      throw Decoding_Error("Invalid length for UCS-4 string");
   73|      1|   }
   74|       |
   75|     66|   const size_t chars = len / 4;
   76|       |
   77|     66|   std::string s;
   78|    250|   for(size_t i = 0; i != chars; ++i) {
  ------------------
  |  Branch (78:22): [True: 184, False: 66]
  ------------------
   79|    184|      const uint32_t c = load_be<uint32_t>(ucs4, i);
   80|    184|      append_utf8_for(s, c);
   81|    184|   }
   82|       |
   83|     66|   return s;
   84|     67|}
_ZN5Botan14latin1_to_utf8EPKhm:
   89|     24|std::string latin1_to_utf8(const uint8_t chars[], size_t len) {
   90|     24|   std::string s;
   91|    279|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (91:22): [True: 255, False: 24]
  ------------------
   92|    255|      const uint32_t c = static_cast<uint8_t>(chars[i]);
   93|    255|      append_utf8_for(s, c);
   94|    255|   }
   95|     24|   return s;
   96|     24|}
charset.cpp:_ZN5Botan12_GLOBAL__N_115append_utf8_forERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEj:
   18|    632|void append_utf8_for(std::string& s, uint32_t c) {
   19|    632|   if(c >= 0xD800 && c < 0xE000) {
  ------------------
  |  Branch (19:7): [True: 194, False: 438]
  |  Branch (19:22): [True: 9, False: 185]
  ------------------
   20|      9|      throw Decoding_Error("Invalid Unicode character");
   21|      9|   }
   22|       |
   23|    623|   if(c <= 0x7F) {
  ------------------
  |  Branch (23:7): [True: 199, False: 424]
  ------------------
   24|    199|      const uint8_t b0 = static_cast<uint8_t>(c);
   25|    199|      s.push_back(static_cast<char>(b0));
   26|    424|   } else if(c <= 0x7FF) {
  ------------------
  |  Branch (26:14): [True: 170, False: 254]
  ------------------
   27|    170|      const uint8_t b0 = 0xC0 | static_cast<uint8_t>(c >> 6);
   28|    170|      const uint8_t b1 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   29|    170|      s.push_back(static_cast<char>(b0));
   30|    170|      s.push_back(static_cast<char>(b1));
   31|    254|   } else if(c <= 0xFFFF) {
  ------------------
  |  Branch (31:14): [True: 149, False: 105]
  ------------------
   32|    149|      const uint8_t b0 = 0xE0 | static_cast<uint8_t>(c >> 12);
   33|    149|      const uint8_t b1 = 0x80 | static_cast<uint8_t>((c >> 6) & 0x3F);
   34|    149|      const uint8_t b2 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   35|    149|      s.push_back(static_cast<char>(b0));
   36|    149|      s.push_back(static_cast<char>(b1));
   37|    149|      s.push_back(static_cast<char>(b2));
   38|    149|   } else if(c <= 0x10FFFF) {
  ------------------
  |  Branch (38:14): [True: 57, False: 48]
  ------------------
   39|     57|      const uint8_t b0 = 0xF0 | static_cast<uint8_t>(c >> 18);
   40|     57|      const uint8_t b1 = 0x80 | static_cast<uint8_t>((c >> 12) & 0x3F);
   41|     57|      const uint8_t b2 = 0x80 | static_cast<uint8_t>((c >> 6) & 0x3F);
   42|     57|      const uint8_t b3 = 0x80 | static_cast<uint8_t>(c & 0x3F);
   43|     57|      s.push_back(static_cast<char>(b0));
   44|     57|      s.push_back(static_cast<char>(b1));
   45|     57|      s.push_back(static_cast<char>(b2));
   46|     57|      s.push_back(static_cast<char>(b3));
   47|     57|   } else {
   48|     48|      throw Decoding_Error("Invalid Unicode character");
   49|     48|   }
   50|    623|}

_ZN5Botan5CPUID11has_simd_32Ev:
   18|  29.4k|bool CPUID::has_simd_32() {
   19|  29.4k|#if defined(BOTAN_TARGET_SUPPORTS_SSE2)
   20|  29.4k|   return CPUID::has_sse2();
   21|       |#elif defined(BOTAN_TARGET_SUPPORTS_ALTIVEC)
   22|       |   return CPUID::has_altivec();
   23|       |#elif defined(BOTAN_TARGET_SUPPORTS_NEON)
   24|       |   return CPUID::has_neon();
   25|       |#else
   26|       |   return true;
   27|       |#endif
   28|  29.4k|}
_ZN5Botan5CPUID10CPUID_DataC2Ev:
  120|      1|CPUID::CPUID_Data::CPUID_Data() {
  121|      1|   m_processor_features = 0;
  122|       |
  123|      1|#if defined(BOTAN_TARGET_CPU_IS_PPC_FAMILY) || defined(BOTAN_TARGET_CPU_IS_ARM_FAMILY) || \
  124|      1|   defined(BOTAN_TARGET_CPU_IS_X86_FAMILY)
  125|       |
  126|      1|   m_processor_features = detect_cpu_features();
  127|       |
  128|      1|#endif
  129|       |
  130|      1|   m_processor_features |= CPUID::CPUID_INITIALIZED_BIT;
  131|       |
  132|      1|   if(runtime_check_if_big_endian()) {
  ------------------
  |  Branch (132:7): [True: 0, False: 1]
  ------------------
  133|      0|      m_processor_features |= CPUID::CPUID_IS_BIG_ENDIAN_BIT;
  134|      0|   }
  135|       |
  136|      1|   std::string clear_cpuid_env;
  137|      1|   if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) {
  ------------------
  |  Branch (137:7): [True: 0, False: 1]
  ------------------
  138|      0|      for(const auto& cpuid : split_on(clear_cpuid_env, ',')) {
  ------------------
  |  Branch (138:29): [True: 0, False: 0]
  ------------------
  139|      0|         for(auto& bit : CPUID::bit_from_string(cpuid)) {
  ------------------
  |  Branch (139:24): [True: 0, False: 0]
  ------------------
  140|      0|            const uint32_t cleared = ~static_cast<uint32_t>(bit);
  141|      0|            m_processor_features &= cleared;
  142|      0|         }
  143|      0|      }
  144|      0|   }
  145|      1|}
cpuid.cpp:_ZN5Botan12_GLOBAL__N_127runtime_check_if_big_endianEv:
   93|      1|bool runtime_check_if_big_endian() {
   94|       |   // Check runtime endian
   95|      1|   const uint32_t endian32 = 0x01234567;
   96|      1|   const uint8_t* e8 = reinterpret_cast<const uint8_t*>(&endian32);
   97|       |
   98|      1|   bool is_big_endian = false;
   99|       |
  100|      1|   if(e8[0] == 0x01 && e8[1] == 0x23 && e8[2] == 0x45 && e8[3] == 0x67) {
  ------------------
  |  Branch (100:7): [True: 0, False: 1]
  |  Branch (100:24): [True: 0, False: 0]
  |  Branch (100:41): [True: 0, False: 0]
  |  Branch (100:58): [True: 0, False: 0]
  ------------------
  101|      0|      is_big_endian = true;
  102|      1|   } else if(e8[0] == 0x67 && e8[1] == 0x45 && e8[2] == 0x23 && e8[3] == 0x01) {
  ------------------
  |  Branch (102:14): [True: 1, False: 0]
  |  Branch (102:31): [True: 1, False: 0]
  |  Branch (102:48): [True: 1, False: 0]
  |  Branch (102:65): [True: 1, False: 0]
  ------------------
  103|      1|      is_big_endian = false;
  104|      1|   } else {
  105|      0|      throw Internal_Error("Unexpected endian at runtime, neither big nor little");
  106|      0|   }
  107|       |
  108|       |   // If we were compiled with a known endian, verify it matches at runtime
  109|      1|#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
  110|      1|   BOTAN_ASSERT(!is_big_endian, "Build and runtime endian match");
  ------------------
  |  |   51|      1|   do {                                                                                 \
  |  |   52|      1|      if(!(expr))                                                                       \
  |  |  ------------------
  |  |  |  Branch (52:10): [True: 0, False: 1]
  |  |  ------------------
  |  |   53|      1|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   54|      1|   } while(0)
  |  |  ------------------
  |  |  |  Branch (54:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  111|       |#elif defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
  112|       |   BOTAN_ASSERT(is_big_endian, "Build and runtime endian match");
  113|       |#endif
  114|       |
  115|      1|   return is_big_endian;
  116|      1|}

_ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEv:
   69|      1|uint32_t CPUID::CPUID_Data::detect_cpu_features() {
   70|      1|   uint32_t features_detected = 0;
   71|      1|   uint32_t cpuid[4] = {0};
   72|      1|   bool has_os_ymm_support = false;
   73|      1|   bool has_os_zmm_support = false;
   74|       |
   75|       |   // CPUID 0: vendor identification, max sublevel
   76|      1|   invoke_cpuid(0, cpuid);
   77|       |
   78|      1|   const uint32_t max_supported_sublevel = cpuid[0];
   79|       |
   80|      1|   if(max_supported_sublevel >= 1) {
  ------------------
  |  Branch (80:7): [True: 1, False: 0]
  ------------------
   81|       |      // CPUID 1: feature bits
   82|      1|      invoke_cpuid(1, cpuid);
   83|      1|      const uint64_t flags0 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[3];
   84|       |
   85|      1|      enum x86_CPUID_1_bits : uint64_t {
   86|      1|         RDTSC = (1ULL << 4),
   87|      1|         SSE2 = (1ULL << 26),
   88|      1|         CLMUL = (1ULL << 33),
   89|      1|         SSSE3 = (1ULL << 41),
   90|      1|         AESNI = (1ULL << 57),
   91|      1|         OSXSAVE = (1ULL << 59),
   92|      1|         AVX = (1ULL << 60),
   93|      1|         RDRAND = (1ULL << 62)
   94|      1|      };
   95|       |
   96|      1|      if(flags0 & x86_CPUID_1_bits::RDTSC) {
  ------------------
  |  Branch (96:10): [True: 1, False: 0]
  ------------------
   97|      1|         features_detected |= CPUID::CPUID_RDTSC_BIT;
   98|      1|      }
   99|      1|      if(flags0 & x86_CPUID_1_bits::SSE2) {
  ------------------
  |  Branch (99:10): [True: 1, False: 0]
  ------------------
  100|      1|         features_detected |= CPUID::CPUID_SSE2_BIT;
  101|      1|      }
  102|      1|      if(flags0 & x86_CPUID_1_bits::CLMUL) {
  ------------------
  |  Branch (102:10): [True: 1, False: 0]
  ------------------
  103|      1|         features_detected |= CPUID::CPUID_CLMUL_BIT;
  104|      1|      }
  105|      1|      if(flags0 & x86_CPUID_1_bits::SSSE3) {
  ------------------
  |  Branch (105:10): [True: 1, False: 0]
  ------------------
  106|      1|         features_detected |= CPUID::CPUID_SSSE3_BIT;
  107|      1|      }
  108|      1|      if(flags0 & x86_CPUID_1_bits::AESNI) {
  ------------------
  |  Branch (108:10): [True: 1, False: 0]
  ------------------
  109|      1|         features_detected |= CPUID::CPUID_AESNI_BIT;
  110|      1|      }
  111|      1|      if(flags0 & x86_CPUID_1_bits::RDRAND) {
  ------------------
  |  Branch (111:10): [True: 1, False: 0]
  ------------------
  112|      1|         features_detected |= CPUID::CPUID_RDRAND_BIT;
  113|      1|      }
  114|       |
  115|      1|      if((flags0 & x86_CPUID_1_bits::AVX) && (flags0 & x86_CPUID_1_bits::OSXSAVE)) {
  ------------------
  |  Branch (115:10): [True: 1, False: 0]
  |  Branch (115:46): [True: 1, False: 0]
  ------------------
  116|      1|         const uint64_t xcr_flags = xgetbv();
  117|      1|         if((xcr_flags & 0x6) == 0x6) {
  ------------------
  |  Branch (117:13): [True: 1, False: 0]
  ------------------
  118|      1|            has_os_ymm_support = true;
  119|      1|            has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0;
  120|      1|         }
  121|      1|      }
  122|      1|   }
  123|       |
  124|      1|   if(max_supported_sublevel >= 7) {
  ------------------
  |  Branch (124:7): [True: 1, False: 0]
  ------------------
  125|      1|      clear_mem(cpuid, 4);
  126|      1|      invoke_cpuid_sublevel(7, 0, cpuid);
  127|       |
  128|      1|      enum x86_CPUID_7_bits : uint64_t {
  129|      1|         BMI1 = (1ULL << 3),
  130|      1|         AVX2 = (1ULL << 5),
  131|      1|         BMI2 = (1ULL << 8),
  132|      1|         AVX512_F = (1ULL << 16),
  133|      1|         AVX512_DQ = (1ULL << 17),
  134|      1|         RDSEED = (1ULL << 18),
  135|      1|         ADX = (1ULL << 19),
  136|      1|         AVX512_IFMA = (1ULL << 21),
  137|      1|         SHA = (1ULL << 29),
  138|      1|         AVX512_BW = (1ULL << 30),
  139|      1|         AVX512_VL = (1ULL << 31),
  140|      1|         AVX512_VBMI = (1ULL << 33),
  141|      1|         AVX512_VBMI2 = (1ULL << 38),
  142|      1|         AVX512_VAES = (1ULL << 41),
  143|      1|         AVX512_VCLMUL = (1ULL << 42),
  144|      1|         AVX512_VBITALG = (1ULL << 44),
  145|      1|      };
  146|       |
  147|      1|      const uint64_t flags7 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[1];
  148|       |
  149|      1|      if((flags7 & x86_CPUID_7_bits::AVX2) && has_os_ymm_support) {
  ------------------
  |  Branch (149:10): [True: 1, False: 0]
  |  Branch (149:47): [True: 1, False: 0]
  ------------------
  150|      1|         features_detected |= CPUID::CPUID_AVX2_BIT;
  151|      1|      }
  152|      1|      if(flags7 & x86_CPUID_7_bits::RDSEED) {
  ------------------
  |  Branch (152:10): [True: 1, False: 0]
  ------------------
  153|      1|         features_detected |= CPUID::CPUID_RDSEED_BIT;
  154|      1|      }
  155|      1|      if(flags7 & x86_CPUID_7_bits::ADX) {
  ------------------
  |  Branch (155:10): [True: 1, False: 0]
  ------------------
  156|      1|         features_detected |= CPUID::CPUID_ADX_BIT;
  157|      1|      }
  158|      1|      if(flags7 & x86_CPUID_7_bits::SHA) {
  ------------------
  |  Branch (158:10): [True: 0, False: 1]
  ------------------
  159|      0|         features_detected |= CPUID::CPUID_SHA_BIT;
  160|      0|      }
  161|       |
  162|       |      /*
  163|       |      We only set the BMI bit if both BMI1 and BMI2 are supported, since
  164|       |      typically we want to use both extensions in the same code.
  165|       |      */
  166|      1|      if((flags7 & x86_CPUID_7_bits::BMI1) && (flags7 & x86_CPUID_7_bits::BMI2)) {
  ------------------
  |  Branch (166:10): [True: 1, False: 0]
  |  Branch (166:47): [True: 1, False: 0]
  ------------------
  167|      1|         features_detected |= CPUID::CPUID_BMI_BIT;
  168|      1|      }
  169|       |
  170|      1|      if((flags7 & x86_CPUID_7_bits::AVX512_F) && has_os_zmm_support) {
  ------------------
  |  Branch (170:10): [True: 0, False: 1]
  |  Branch (170:51): [True: 0, False: 0]
  ------------------
  171|      0|         const uint64_t AVX512_PROFILE_FLAGS = x86_CPUID_7_bits::AVX512_F | x86_CPUID_7_bits::AVX512_DQ |
  172|      0|                                               x86_CPUID_7_bits::AVX512_IFMA | x86_CPUID_7_bits::AVX512_BW |
  173|      0|                                               x86_CPUID_7_bits::AVX512_VL | x86_CPUID_7_bits::AVX512_VBMI |
  174|      0|                                               x86_CPUID_7_bits::AVX512_VBMI2 | x86_CPUID_7_bits::AVX512_VBITALG;
  175|       |
  176|       |         /*
  177|       |         We only enable AVX512 support if all of the above flags are available
  178|       |
  179|       |         This is more than we strictly need for most uses, however it also has
  180|       |         the effect of preventing execution of AVX512 codepaths on cores that
  181|       |         have serious downclocking problems when AVX512 code executes,
  182|       |         especially Intel Skylake.
  183|       |
  184|       |         VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice
  185|       |         Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for
  186|       |         executing AVX512.
  187|       |
  188|       |         There is nothing stopping some future processor from supporting the
  189|       |         above flags and having AVX512 penalties, but maybe you should not have
  190|       |         bought such a processor.
  191|       |         */
  192|      0|         if((flags7 & AVX512_PROFILE_FLAGS) == AVX512_PROFILE_FLAGS) {
  ------------------
  |  Branch (192:13): [True: 0, False: 0]
  ------------------
  193|      0|            features_detected |= CPUID::CPUID_AVX512_BIT;
  194|       |
  195|      0|            if(flags7 & x86_CPUID_7_bits::AVX512_VAES) {
  ------------------
  |  Branch (195:16): [True: 0, False: 0]
  ------------------
  196|      0|               features_detected |= CPUID::CPUID_AVX512_AES_BIT;
  197|      0|            }
  198|      0|            if(flags7 & x86_CPUID_7_bits::AVX512_VCLMUL) {
  ------------------
  |  Branch (198:16): [True: 0, False: 0]
  ------------------
  199|      0|               features_detected |= CPUID::CPUID_AVX512_CLMUL_BIT;
  200|      0|            }
  201|      0|         }
  202|      0|      }
  203|      1|   }
  204|       |
  205|       |   /*
  206|       |   * If we don't have access to CPUID, we can still safely assume that
  207|       |   * any x86-64 processor has SSE2 and RDTSC
  208|       |   */
  209|      1|   #if defined(BOTAN_TARGET_ARCH_IS_X86_64)
  210|      1|   if(features_detected == 0) {
  ------------------
  |  Branch (210:7): [True: 0, False: 1]
  ------------------
  211|      0|      features_detected |= CPUID::CPUID_SSE2_BIT;
  212|      0|      features_detected |= CPUID::CPUID_RDTSC_BIT;
  213|      0|   }
  214|      1|   #endif
  215|       |
  216|      1|   return features_detected;
  217|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj:
   33|      2|void invoke_cpuid(uint32_t type, uint32_t out[4]) {
   34|       |   #if defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_INTEL)
   35|       |   __cpuid((int*)out, type);
   36|       |
   37|       |   #elif defined(BOTAN_BUILD_COMPILER_IS_GCC) || defined(BOTAN_BUILD_COMPILER_IS_CLANG)
   38|      2|   __get_cpuid(type, out, out + 1, out + 2, out + 3);
   39|       |
   40|       |   #elif defined(BOTAN_USE_GCC_INLINE_ASM)
   41|       |   asm("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type));
   42|       |
   43|       |   #else
   44|       |      #warning "No way of calling x86 cpuid instruction for this compiler"
   45|       |   clear_mem(out, 4);
   46|       |   #endif
   47|      2|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv:
   49|      1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() { return _xgetbv(0); }
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj:
   51|      1|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) {
   52|       |   #if defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   53|       |   __cpuidex((int*)out, type, level);
   54|       |
   55|       |   #elif defined(BOTAN_BUILD_COMPILER_IS_GCC) || defined(BOTAN_BUILD_COMPILER_IS_CLANG)
   56|      1|   __cpuid_count(type, level, out[0], out[1], out[2], out[3]);
   57|       |
   58|       |   #elif defined(BOTAN_USE_GCC_INLINE_ASM)
   59|       |   asm("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level));
   60|       |
   61|       |   #else
   62|       |      #warning "No way of calling x86 cpuid instruction for this compiler"
   63|       |   clear_mem(out, 4);
   64|       |   #endif
   65|      1|}

_ZN5Botan10DataSource9read_byteERh:
   25|  22.5M|size_t DataSource::read_byte(uint8_t& out) { return read(&out, 1); }
_ZNK5Botan10DataSource9peek_byteERh:
   30|  17.3k|size_t DataSource::peek_byte(uint8_t& out) const { return peek(&out, 1, 0); }
_ZN5Botan10DataSource12discard_nextEm:
   35|  1.54k|size_t DataSource::discard_next(size_t n) {
   36|  1.54k|   uint8_t buf[64] = {0};
   37|  1.54k|   size_t discarded = 0;
   38|       |
   39|  2.48k|   while(n) {
  ------------------
  |  Branch (39:10): [True: 1.07k, False: 1.41k]
  ------------------
   40|  1.07k|      const size_t got = this->read(buf, std::min(n, sizeof(buf)));
   41|  1.07k|      discarded += got;
   42|  1.07k|      n -= got;
   43|       |
   44|  1.07k|      if(got == 0) {
  ------------------
  |  Branch (44:10): [True: 133, False: 941]
  ------------------
   45|    133|         break;
   46|    133|      }
   47|  1.07k|   }
   48|       |
   49|  1.54k|   return discarded;
   50|  1.54k|}
_ZN5Botan17DataSource_Memory4readEPhm:
   55|  17.3M|size_t DataSource_Memory::read(uint8_t out[], size_t length) {
   56|  17.3M|   const size_t got = std::min<size_t>(m_source.size() - m_offset, length);
   57|  17.3M|   copy_mem(out, m_source.data() + m_offset, got);
   58|  17.3M|   m_offset += got;
   59|  17.3M|   return got;
   60|  17.3M|}
_ZN5Botan17DataSource_Memory15check_availableEm:
   62|   133k|bool DataSource_Memory::check_available(size_t n) { return (n <= (m_source.size() - m_offset)); }
_ZNK5Botan17DataSource_Memory4peekEPhmm:
   67|  24.9k|size_t DataSource_Memory::peek(uint8_t out[], size_t length, size_t peek_offset) const {
   68|  24.9k|   const size_t bytes_left = m_source.size() - m_offset;
   69|  24.9k|   if(peek_offset >= bytes_left) {
  ------------------
  |  Branch (69:7): [True: 932, False: 23.9k]
  ------------------
   70|    932|      return 0;
   71|    932|   }
   72|       |
   73|  23.9k|   const size_t got = std::min(bytes_left - peek_offset, length);
   74|  23.9k|   copy_mem(out, &m_source[m_offset + peek_offset], got);
   75|  23.9k|   return got;
   76|  24.9k|}
_ZNK5Botan17DataSource_Memory11end_of_dataEv:
   81|  75.4k|bool DataSource_Memory::end_of_data() const { return (m_offset == m_source.size()); }
_ZN5Botan17DataSource_MemoryC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   87|  11.5k|      m_source(cast_char_ptr_to_uint8(in.data()), cast_char_ptr_to_uint8(in.data()) + in.length()), m_offset(0) {}

_ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   71|  8.83k|Exception::Exception(std::string_view msg) : m_msg(msg) {}
_ZN5Botan9ExceptionC2EPKcNSt3__117basic_string_viewIcNS3_11char_traitsIcEEEE:
   75|    522|Exception::Exception(const char* prefix, std::string_view msg) : m_msg(fmt("{} {}", prefix, msg)) {}
_ZN5Botan16Invalid_ArgumentC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   77|    148|Invalid_Argument::Invalid_Argument(std::string_view msg) : Exception(msg) {}
_ZN5Botan14Internal_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   99|    291|Internal_Error::Internal_Error(std::string_view err) : Exception("Internal error:", err) {}
_ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  125|  6.67k|Decoding_Error::Decoding_Error(std::string_view name) : Exception(name) {}
_ZN5Botan26Invalid_Authentication_TagC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  133|    231|      Exception("Invalid authentication tag:", msg) {}

_ZN5Botan5GHASH14ghash_multiplyERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhm:
   34|    629|void GHASH::ghash_multiply(secure_vector<uint8_t>& x, const uint8_t input[], size_t blocks) {
   35|    629|#if defined(BOTAN_HAS_GHASH_CLMUL_CPU)
   36|    629|   if(CPUID::has_carryless_multiply()) {
  ------------------
  |  Branch (36:7): [True: 629, False: 0]
  ------------------
   37|    629|      return ghash_multiply_cpu(x.data(), m_H_pow.data(), input, blocks);
   38|    629|   }
   39|      0|#endif
   40|       |
   41|      0|#if defined(BOTAN_HAS_GHASH_CLMUL_VPERM)
   42|      0|   if(CPUID::has_vperm()) {
  ------------------
  |  Branch (42:7): [True: 0, False: 0]
  ------------------
   43|      0|      return ghash_multiply_vperm(x.data(), m_HM.data(), input, blocks);
   44|      0|   }
   45|      0|#endif
   46|       |
   47|      0|   CT::poison(x.data(), x.size());
   48|       |
   49|      0|   const uint64_t ALL_BITS = 0xFFFFFFFFFFFFFFFF;
   50|       |
   51|      0|   uint64_t X[2] = {load_be<uint64_t>(x.data(), 0), load_be<uint64_t>(x.data(), 1)};
   52|       |
   53|      0|   for(size_t b = 0; b != blocks; ++b) {
  ------------------
  |  Branch (53:22): [True: 0, False: 0]
  ------------------
   54|      0|      X[0] ^= load_be<uint64_t>(input, 2 * b);
   55|      0|      X[1] ^= load_be<uint64_t>(input, 2 * b + 1);
   56|       |
   57|      0|      uint64_t Z[2] = {0, 0};
   58|       |
   59|      0|      for(size_t i = 0; i != 64; ++i) {
  ------------------
  |  Branch (59:25): [True: 0, False: 0]
  ------------------
   60|      0|         const uint64_t X0MASK = (ALL_BITS + (X[0] >> 63)) ^ ALL_BITS;
   61|      0|         const uint64_t X1MASK = (ALL_BITS + (X[1] >> 63)) ^ ALL_BITS;
   62|       |
   63|      0|         X[0] <<= 1;
   64|      0|         X[1] <<= 1;
   65|       |
   66|      0|         Z[0] ^= m_HM[4 * i] & X0MASK;
   67|      0|         Z[1] ^= m_HM[4 * i + 1] & X0MASK;
   68|      0|         Z[0] ^= m_HM[4 * i + 2] & X1MASK;
   69|      0|         Z[1] ^= m_HM[4 * i + 3] & X1MASK;
   70|      0|      }
   71|       |
   72|      0|      X[0] = Z[0];
   73|      0|      X[1] = Z[1];
   74|      0|   }
   75|       |
   76|      0|   store_be<uint64_t>(x.data(), X[0], X[1]);
   77|      0|   CT::unpoison(x.data(), x.size());
   78|      0|}
_ZN5Botan5GHASH12ghash_updateERNSt3__16vectorIhNS_16secure_allocatorIhEEEEPKhm:
   80|    556|void GHASH::ghash_update(secure_vector<uint8_t>& ghash, const uint8_t input[], size_t length) {
   81|    556|   assert_key_material_set(!m_H.empty());
   82|       |
   83|       |   /*
   84|       |   This assumes if less than block size input then we're just on the
   85|       |   final block and should pad with zeros
   86|       |   */
   87|       |
   88|    556|   const size_t full_blocks = length / GCM_BS;
   89|    556|   const size_t final_bytes = length - (full_blocks * GCM_BS);
   90|       |
   91|    556|   if(full_blocks > 0) {
  ------------------
  |  Branch (91:7): [True: 325, False: 231]
  ------------------
   92|    325|      ghash_multiply(ghash, input, full_blocks);
   93|    325|   }
   94|       |
   95|    556|   if(final_bytes) {
  ------------------
  |  Branch (95:7): [True: 304, False: 252]
  ------------------
   96|    304|      uint8_t last_block[GCM_BS] = {0};
   97|    304|      copy_mem(last_block, input + full_blocks * GCM_BS, final_bytes);
   98|    304|      ghash_multiply(ghash, last_block, 1);
   99|    304|      secure_scrub_memory(last_block, final_bytes);
  100|    304|   }
  101|    556|}
_ZNK5Botan5GHASH19has_keying_materialEv:
  103|    369|bool GHASH::has_keying_material() const { return !m_ghash.empty(); }
_ZN5Botan5GHASH12key_scheduleEPKhm:
  105|    182|void GHASH::key_schedule(const uint8_t key[], size_t length) {
  106|    182|   m_H.assign(key, key + length);
  107|    182|   m_H_ad.resize(GCM_BS);
  108|    182|   m_ad_len = 0;
  109|    182|   m_text_len = 0;
  110|       |
  111|    182|   uint64_t H0 = load_be<uint64_t>(m_H.data(), 0);
  112|    182|   uint64_t H1 = load_be<uint64_t>(m_H.data(), 1);
  113|       |
  114|    182|   const uint64_t R = 0xE100000000000000;
  115|       |
  116|    182|   m_HM.resize(256);
  117|       |
  118|       |   // precompute the multiples of H
  119|    546|   for(size_t i = 0; i != 2; ++i) {
  ------------------
  |  Branch (119:22): [True: 364, False: 182]
  ------------------
  120|  23.6k|      for(size_t j = 0; j != 64; ++j) {
  ------------------
  |  Branch (120:25): [True: 23.2k, False: 364]
  ------------------
  121|       |         /*
  122|       |         we interleave H^1, H^65, H^2, H^66, H3, H67, H4, H68
  123|       |         to make indexing nicer in the multiplication code
  124|       |         */
  125|  23.2k|         m_HM[4 * j + 2 * i] = H0;
  126|  23.2k|         m_HM[4 * j + 2 * i + 1] = H1;
  127|       |
  128|       |         // GCM's bit ops are reversed so we carry out of the bottom
  129|  23.2k|         const uint64_t carry = R * (H1 & 1);
  130|  23.2k|         H1 = (H1 >> 1) | (H0 << 63);
  131|  23.2k|         H0 = (H0 >> 1) ^ carry;
  132|  23.2k|      }
  133|    364|   }
  134|       |
  135|    182|#if defined(BOTAN_HAS_GHASH_CLMUL_CPU)
  136|    182|   if(CPUID::has_carryless_multiply()) {
  ------------------
  |  Branch (136:7): [True: 182, False: 0]
  ------------------
  137|    182|      m_H_pow.resize(8);
  138|    182|      ghash_precompute_cpu(m_H.data(), m_H_pow.data());
  139|    182|   }
  140|    182|#endif
  141|    182|}
_ZN5Botan5GHASH5startEPKhm:
  143|    187|void GHASH::start(const uint8_t nonce[], size_t len) {
  144|    187|   BOTAN_ARG_CHECK(len == 16, "GHASH requires a 128-bit nonce");
  ------------------
  |  |   30|    187|   do {                                                          \
  |  |   31|    187|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:10): [True: 0, False: 187]
  |  |  ------------------
  |  |   32|    187|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    187|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  145|    187|   m_nonce.assign(nonce, nonce + len);
  146|    187|   m_ghash = m_H_ad;
  147|    187|}
_ZN5Botan5GHASH19set_associated_dataEPKhm:
  149|    187|void GHASH::set_associated_data(const uint8_t input[], size_t length) {
  150|    187|   if(m_ghash.empty() == false) {
  ------------------
  |  Branch (150:7): [True: 0, False: 187]
  ------------------
  151|      0|      throw Invalid_State("Too late to set AD in GHASH");
  152|      0|   }
  153|       |
  154|    187|   zeroise(m_H_ad);
  155|       |
  156|    187|   ghash_update(m_H_ad, input, length);
  157|    187|   m_ad_len = length;
  158|    187|}
_ZN5Botan5GHASH6updateEPKhm:
  166|    182|void GHASH::update(const uint8_t input[], size_t length) {
  167|    182|   assert_key_material_set();
  168|    182|   m_text_len += length;
  169|    182|   ghash_update(m_ghash, input, length);
  170|    182|}
_ZN5Botan5GHASH15add_final_blockERNSt3__16vectorIhNS_16secure_allocatorIhEEEEmm:
  172|    187|void GHASH::add_final_block(secure_vector<uint8_t>& hash, size_t ad_len, size_t text_len) {
  173|       |   /*
  174|       |   * stack buffer is fine here since the text len is public
  175|       |   * and the length of the AD is probably not sensitive either.
  176|       |   */
  177|    187|   uint8_t final_block[GCM_BS];
  178|    187|   store_be<uint64_t>(final_block, 8 * ad_len, 8 * text_len);
  179|    187|   ghash_update(hash, final_block, GCM_BS);
  180|    187|}
_ZN5Botan5GHASH5finalEPhm:
  182|    187|void GHASH::final(uint8_t mac[], size_t mac_len) {
  183|    187|   BOTAN_ARG_CHECK(mac_len > 0 && mac_len <= 16, "GHASH output length");
  ------------------
  |  |   30|    187|   do {                                                          \
  |  |   31|    374|      if(!(expr))                                                \
  |  |  ------------------
  |  |  |  Branch (31:12): [True: 187, False: 0]
  |  |  |  Branch (31:12): [True: 187, False: 0]
  |  |  ------------------
  |  |   32|    187|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   33|    187|   } while(0)
  |  |  ------------------
  |  |  |  Branch (33:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  184|       |
  185|    187|   assert_key_material_set();
  186|    187|   add_final_block(m_ghash, m_ad_len, m_text_len);
  187|       |
  188|  3.17k|   for(size_t i = 0; i != mac_len; ++i) {
  ------------------
  |  Branch (188:22): [True: 2.99k, False: 187]
  ------------------
  189|  2.99k|      mac[i] = m_ghash[i] ^ m_nonce[i];
  190|  2.99k|   }
  191|       |
  192|    187|   m_ghash.clear();
  193|    187|   m_text_len = 0;
  194|    187|}

_ZN5Botan5GHASH20ghash_precompute_cpuEPKhPm:
  139|    182|BOTAN_FUNC_ISA(BOTAN_VPERM_ISA) void GHASH::ghash_precompute_cpu(const uint8_t H_bytes[16], uint64_t H_pow[4 * 2]) {
  140|    182|   const SIMD_4x32 H1 = reverse_vector(SIMD_4x32::load_le(H_bytes));
  141|    182|   const SIMD_4x32 H2 = gcm_multiply(H1, H1);
  142|    182|   const SIMD_4x32 H3 = gcm_multiply(H1, H2);
  143|    182|   const SIMD_4x32 H4 = gcm_multiply(H2, H2);
  144|       |
  145|    182|   H1.store_le(H_pow);
  146|    182|   H2.store_le(H_pow + 2);
  147|    182|   H3.store_le(H_pow + 4);
  148|    182|   H4.store_le(H_pow + 6);
  149|    182|}
_ZN5Botan5GHASH18ghash_multiply_cpuEPhPKmPKhm:
  152|    629|void GHASH::ghash_multiply_cpu(uint8_t x[16], const uint64_t H_pow[8], const uint8_t input[], size_t blocks) {
  153|       |   /*
  154|       |   * Algorithms 1 and 5 from Intel's CLMUL guide
  155|       |   */
  156|    629|   const SIMD_4x32 H1 = SIMD_4x32::load_le(H_pow);
  157|       |
  158|    629|   SIMD_4x32 a = reverse_vector(SIMD_4x32::load_le(x));
  159|       |
  160|    629|   if(blocks >= 4) {
  ------------------
  |  Branch (160:7): [True: 74, False: 555]
  ------------------
  161|     74|      const SIMD_4x32 H2 = SIMD_4x32::load_le(H_pow + 2);
  162|     74|      const SIMD_4x32 H3 = SIMD_4x32::load_le(H_pow + 4);
  163|     74|      const SIMD_4x32 H4 = SIMD_4x32::load_le(H_pow + 6);
  164|       |
  165|  1.65k|      while(blocks >= 4) {
  ------------------
  |  Branch (165:13): [True: 1.58k, False: 74]
  ------------------
  166|  1.58k|         const SIMD_4x32 m0 = reverse_vector(SIMD_4x32::load_le(input));
  167|  1.58k|         const SIMD_4x32 m1 = reverse_vector(SIMD_4x32::load_le(input + 16 * 1));
  168|  1.58k|         const SIMD_4x32 m2 = reverse_vector(SIMD_4x32::load_le(input + 16 * 2));
  169|  1.58k|         const SIMD_4x32 m3 = reverse_vector(SIMD_4x32::load_le(input + 16 * 3));
  170|       |
  171|  1.58k|         a ^= m0;
  172|  1.58k|         a = gcm_multiply_x4(H1, H2, H3, H4, m3, m2, m1, a);
  173|       |
  174|  1.58k|         input += 4 * 16;
  175|  1.58k|         blocks -= 4;
  176|  1.58k|      }
  177|     74|   }
  178|       |
  179|  1.32k|   for(size_t i = 0; i != blocks; ++i) {
  ------------------
  |  Branch (179:22): [True: 698, False: 629]
  ------------------
  180|    698|      const SIMD_4x32 m = reverse_vector(SIMD_4x32::load_le(input + 16 * i));
  181|       |
  182|    698|      a ^= m;
  183|    698|      a = gcm_multiply(H1, a);
  184|    698|   }
  185|       |
  186|    629|   a = reverse_vector(a);
  187|    629|   a.store_le(x);
  188|    629|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_114reverse_vectorERKNS_9SIMD_4x32E:
   21|  8.45k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_VPERM_ISA) reverse_vector(const SIMD_4x32& in) {
   22|  8.45k|#if defined(BOTAN_SIMD_USE_SSE2)
   23|  8.45k|   const __m128i BSWAP_MASK = _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15);
   24|  8.45k|   return SIMD_4x32(_mm_shuffle_epi8(in.raw(), BSWAP_MASK));
   25|       |#elif defined(BOTAN_SIMD_USE_NEON)
   26|       |   const uint8_t maskb[16] = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0};
   27|       |   const uint8x16_t mask = vld1q_u8(maskb);
   28|       |   return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(in.raw()), mask)));
   29|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   30|       |   const __vector unsigned char mask = {15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0};
   31|       |   return SIMD_4x32(vec_perm(in.raw(), in.raw(), mask));
   32|       |#endif
   33|  8.45k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_112gcm_multiplyERKNS_9SIMD_4x32ES3_:
   95|  1.24k|inline SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_CLMUL_ISA) gcm_multiply(const SIMD_4x32& H, const SIMD_4x32& x) {
   96|  1.24k|   SIMD_4x32 T0 = clmul<0x11>(H, x);
   97|  1.24k|   SIMD_4x32 T1 = clmul<0x10>(H, x);
   98|  1.24k|   SIMD_4x32 T2 = clmul<0x01>(H, x);
   99|  1.24k|   SIMD_4x32 T3 = clmul<0x00>(H, x);
  100|       |
  101|  1.24k|   T1 ^= T2;
  102|  1.24k|   T0 ^= T1.shift_elems_right<2>();
  103|  1.24k|   T3 ^= T1.shift_elems_left<2>();
  104|       |
  105|  1.24k|   return gcm_reduce(T0, T3);
  106|  1.24k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_15clmulILi17EEENS_9SIMD_4x32ERKS2_S4_:
   36|  7.56k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_CLMUL_ISA) clmul(const SIMD_4x32& H, const SIMD_4x32& x) {
   37|  7.56k|   static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode");
   38|       |
   39|  7.56k|#if defined(BOTAN_SIMD_USE_SSE2)
   40|  7.56k|   return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M));
   41|       |#elif defined(BOTAN_SIMD_USE_NEON)
   42|       |   const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01);
   43|       |   const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4);
   44|       |   return SIMD_4x32(reinterpret_cast<uint32x4_t>(vmull_p64(a, b)));
   45|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   46|       |   const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF);
   47|       |
   48|       |   SIMD_4x32 i1 = x;
   49|       |   SIMD_4x32 i2 = H;
   50|       |
   51|       |   if(M == 0x11) {
   52|       |      i1 &= mask_lo;
   53|       |      i2 &= mask_lo;
   54|       |   } else if(M == 0x10) {
   55|       |      i1 = i1.shift_elems_left<2>();
   56|       |   } else if(M == 0x01) {
   57|       |      i2 = i2.shift_elems_left<2>();
   58|       |   } else if(M == 0x00) {
   59|       |      i1 = mask_lo.andc(i1);
   60|       |      i2 = mask_lo.andc(i2);
   61|       |   }
   62|       |
   63|       |   auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw());
   64|       |   auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw());
   65|       |
   66|       |   #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd)
   67|       |   auto rv = __builtin_crypto_vpmsumd(i1v, i2v);
   68|       |   #else
   69|       |   auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v);
   70|       |   #endif
   71|       |
   72|       |   return SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv));
   73|       |#endif
   74|  7.56k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_15clmulILi16EEENS_9SIMD_4x32ERKS2_S4_:
   36|  1.24k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_CLMUL_ISA) clmul(const SIMD_4x32& H, const SIMD_4x32& x) {
   37|  1.24k|   static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode");
   38|       |
   39|  1.24k|#if defined(BOTAN_SIMD_USE_SSE2)
   40|  1.24k|   return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M));
   41|       |#elif defined(BOTAN_SIMD_USE_NEON)
   42|       |   const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01);
   43|       |   const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4);
   44|       |   return SIMD_4x32(reinterpret_cast<uint32x4_t>(vmull_p64(a, b)));
   45|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   46|       |   const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF);
   47|       |
   48|       |   SIMD_4x32 i1 = x;
   49|       |   SIMD_4x32 i2 = H;
   50|       |
   51|       |   if(M == 0x11) {
   52|       |      i1 &= mask_lo;
   53|       |      i2 &= mask_lo;
   54|       |   } else if(M == 0x10) {
   55|       |      i1 = i1.shift_elems_left<2>();
   56|       |   } else if(M == 0x01) {
   57|       |      i2 = i2.shift_elems_left<2>();
   58|       |   } else if(M == 0x00) {
   59|       |      i1 = mask_lo.andc(i1);
   60|       |      i2 = mask_lo.andc(i2);
   61|       |   }
   62|       |
   63|       |   auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw());
   64|       |   auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw());
   65|       |
   66|       |   #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd)
   67|       |   auto rv = __builtin_crypto_vpmsumd(i1v, i2v);
   68|       |   #else
   69|       |   auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v);
   70|       |   #endif
   71|       |
   72|       |   return SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv));
   73|       |#endif
   74|  1.24k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_15clmulILi1EEENS_9SIMD_4x32ERKS2_S4_:
   36|  1.24k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_CLMUL_ISA) clmul(const SIMD_4x32& H, const SIMD_4x32& x) {
   37|  1.24k|   static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode");
   38|       |
   39|  1.24k|#if defined(BOTAN_SIMD_USE_SSE2)
   40|  1.24k|   return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M));
   41|       |#elif defined(BOTAN_SIMD_USE_NEON)
   42|       |   const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01);
   43|       |   const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4);
   44|       |   return SIMD_4x32(reinterpret_cast<uint32x4_t>(vmull_p64(a, b)));
   45|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   46|       |   const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF);
   47|       |
   48|       |   SIMD_4x32 i1 = x;
   49|       |   SIMD_4x32 i2 = H;
   50|       |
   51|       |   if(M == 0x11) {
   52|       |      i1 &= mask_lo;
   53|       |      i2 &= mask_lo;
   54|       |   } else if(M == 0x10) {
   55|       |      i1 = i1.shift_elems_left<2>();
   56|       |   } else if(M == 0x01) {
   57|       |      i2 = i2.shift_elems_left<2>();
   58|       |   } else if(M == 0x00) {
   59|       |      i1 = mask_lo.andc(i1);
   60|       |      i2 = mask_lo.andc(i2);
   61|       |   }
   62|       |
   63|       |   auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw());
   64|       |   auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw());
   65|       |
   66|       |   #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd)
   67|       |   auto rv = __builtin_crypto_vpmsumd(i1v, i2v);
   68|       |   #else
   69|       |   auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v);
   70|       |   #endif
   71|       |
   72|       |   return SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv));
   73|       |#endif
   74|  1.24k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_15clmulILi0EEENS_9SIMD_4x32ERKS2_S4_:
   36|  13.8k|BOTAN_FORCE_INLINE SIMD_4x32 BOTAN_FUNC_ISA(BOTAN_CLMUL_ISA) clmul(const SIMD_4x32& H, const SIMD_4x32& x) {
   37|  13.8k|   static_assert(M == 0x00 || M == 0x01 || M == 0x10 || M == 0x11, "Valid clmul mode");
   38|       |
   39|  13.8k|#if defined(BOTAN_SIMD_USE_SSE2)
   40|  13.8k|   return SIMD_4x32(_mm_clmulepi64_si128(x.raw(), H.raw(), M));
   41|       |#elif defined(BOTAN_SIMD_USE_NEON)
   42|       |   const uint64_t a = vgetq_lane_u64(vreinterpretq_u64_u32(x.raw()), M & 0x01);
   43|       |   const uint64_t b = vgetq_lane_u64(vreinterpretq_u64_u32(H.raw()), (M & 0x10) >> 4);
   44|       |   return SIMD_4x32(reinterpret_cast<uint32x4_t>(vmull_p64(a, b)));
   45|       |#elif defined(BOTAN_SIMD_USE_ALTIVEC)
   46|       |   const SIMD_4x32 mask_lo = SIMD_4x32(0, 0, 0xFFFFFFFF, 0xFFFFFFFF);
   47|       |
   48|       |   SIMD_4x32 i1 = x;
   49|       |   SIMD_4x32 i2 = H;
   50|       |
   51|       |   if(M == 0x11) {
   52|       |      i1 &= mask_lo;
   53|       |      i2 &= mask_lo;
   54|       |   } else if(M == 0x10) {
   55|       |      i1 = i1.shift_elems_left<2>();
   56|       |   } else if(M == 0x01) {
   57|       |      i2 = i2.shift_elems_left<2>();
   58|       |   } else if(M == 0x00) {
   59|       |      i1 = mask_lo.andc(i1);
   60|       |      i2 = mask_lo.andc(i2);
   61|       |   }
   62|       |
   63|       |   auto i1v = reinterpret_cast<__vector unsigned long long>(i1.raw());
   64|       |   auto i2v = reinterpret_cast<__vector unsigned long long>(i2.raw());
   65|       |
   66|       |   #if BOTAN_COMPILER_HAS_BUILTIN(__builtin_crypto_vpmsumd)
   67|       |   auto rv = __builtin_crypto_vpmsumd(i1v, i2v);
   68|       |   #else
   69|       |   auto rv = __builtin_altivec_crypto_vpmsumd(i1v, i2v);
   70|       |   #endif
   71|       |
   72|       |   return SIMD_4x32(reinterpret_cast<__vector unsigned int>(rv));
   73|       |#endif
   74|  13.8k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_110gcm_reduceERKNS_9SIMD_4x32ES3_:
   76|  2.82k|inline SIMD_4x32 gcm_reduce(const SIMD_4x32& B0, const SIMD_4x32& B1) {
   77|  2.82k|   SIMD_4x32 X0 = B1.shr<31>();
   78|  2.82k|   SIMD_4x32 X1 = B1.shl<1>();
   79|  2.82k|   SIMD_4x32 X2 = B0.shr<31>();
   80|  2.82k|   SIMD_4x32 X3 = B0.shl<1>();
   81|       |
   82|  2.82k|   X3 |= X0.shift_elems_right<3>();
   83|  2.82k|   X3 |= X2.shift_elems_left<1>();
   84|  2.82k|   X1 |= X0.shift_elems_left<1>();
   85|       |
   86|  2.82k|   X0 = X1.shl<31>() ^ X1.shl<30>() ^ X1.shl<25>();
   87|       |
   88|  2.82k|   X1 ^= X0.shift_elems_left<3>();
   89|       |
   90|  2.82k|   X0 = X1 ^ X3 ^ X0.shift_elems_right<1>();
   91|  2.82k|   X0 ^= X1.shr<7>() ^ X1.shr<2>() ^ X1.shr<1>();
   92|  2.82k|   return X0;
   93|  2.82k|}
ghash_cpu.cpp:_ZN5Botan12_GLOBAL__N_115gcm_multiply_x4ERKNS_9SIMD_4x32ES3_S3_S3_S3_S3_S3_S3_:
  115|  1.58k|                                                                 const SIMD_4x32& X4) {
  116|       |   /*
  117|       |   * Mutiply with delayed reduction, algorithm by Krzysztof Jankowski
  118|       |   * and Pierre Laurent of Intel
  119|       |   */
  120|       |
  121|  1.58k|   const SIMD_4x32 lo = (clmul<0x00>(H1, X1) ^ clmul<0x00>(H2, X2)) ^ (clmul<0x00>(H3, X3) ^ clmul<0x00>(H4, X4));
  122|       |
  123|  1.58k|   const SIMD_4x32 hi = (clmul<0x11>(H1, X1) ^ clmul<0x11>(H2, X2)) ^ (clmul<0x11>(H3, X3) ^ clmul<0x11>(H4, X4));
  124|       |
  125|  1.58k|   SIMD_4x32 T;
  126|       |
  127|  1.58k|   T ^= clmul<0x00>(H1 ^ H1.shift_elems_right<2>(), X1 ^ X1.shift_elems_right<2>());
  128|  1.58k|   T ^= clmul<0x00>(H2 ^ H2.shift_elems_right<2>(), X2 ^ X2.shift_elems_right<2>());
  129|  1.58k|   T ^= clmul<0x00>(H3 ^ H3.shift_elems_right<2>(), X3 ^ X3.shift_elems_right<2>());
  130|  1.58k|   T ^= clmul<0x00>(H4 ^ H4.shift_elems_right<2>(), X4 ^ X4.shift_elems_right<2>());
  131|  1.58k|   T ^= lo;
  132|  1.58k|   T ^= hi;
  133|       |
  134|  1.58k|   return gcm_reduce(hi ^ T.shift_elems_right<2>(), lo ^ T.shift_elems_left<2>());
  135|  1.58k|}

_ZN5Botan15allocate_memoryEmm:
   20|  24.4M|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   21|  24.4M|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (21:7): [True: 0, False: 24.4M]
  |  Branch (21:21): [True: 0, False: 24.4M]
  ------------------
   22|      0|      return nullptr;
   23|      0|   }
   24|       |
   25|       |   // Some calloc implementations do not check for overflow (?!?)
   26|       |
   27|  24.4M|   if(!BOTAN_CHECKED_MUL(elems, elem_size).has_value()) {
  ------------------
  |  |   73|  24.4M|#define BOTAN_CHECKED_MUL(x, y) checked_mul(x, y)
  ------------------
  |  Branch (27:7): [True: 0, False: 24.4M]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   33|       |      return p;
   34|       |   }
   35|       |#endif
   36|       |
   37|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   38|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   39|       |#else
   40|  24.4M|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc)
   41|  24.4M|#endif
   42|  24.4M|   if(!ptr) {
  ------------------
  |  Branch (42:7): [True: 0, False: 24.4M]
  ------------------
   43|      0|      [[unlikely]] throw std::bad_alloc();
   44|      0|   }
   45|  24.4M|   return ptr;
   46|  24.4M|}
_ZN5Botan17deallocate_memoryEPvmm:
   48|  24.4M|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   49|  24.4M|   if(p == nullptr) {
  ------------------
  |  Branch (49:7): [True: 0, False: 24.4M]
  ------------------
   50|      0|      [[unlikely]] return;
   51|      0|   }
   52|       |
   53|  24.4M|   secure_scrub_memory(p, elems * elem_size);
   54|       |
   55|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   56|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   57|       |      return;
   58|       |   }
   59|       |#endif
   60|       |
   61|  24.4M|   std::free(p);  // NOLINT(*-no-malloc)
   62|  24.4M|}
_ZN5Botan20initialize_allocatorEv:
   64|      1|void initialize_allocator() {
   65|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   66|       |   mlock_allocator::instance();
   67|       |#endif
   68|      1|}
_ZN5Botan13ct_compare_u8EPKhS1_m:
   70|    304|uint8_t ct_compare_u8(const uint8_t x[], const uint8_t y[], size_t len) {
   71|    304|   volatile uint8_t difference = 0;
   72|       |
   73|  5.25k|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (73:22): [True: 4.94k, False: 304]
  ------------------
   74|  4.94k|      difference = difference | (x[i] ^ y[i]);
   75|  4.94k|   }
   76|       |
   77|    304|   return CT::Mask<uint8_t>::is_zero(difference).value();
   78|    304|}

_ZN5Botan19secure_scrub_memoryEPvm:
   78|  24.4M|void secure_scrub_memory(void* ptr, size_t n) {
   79|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   80|       |   ::RtlSecureZeroMemory(ptr, n);
   81|       |
   82|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   83|  24.4M|   ::explicit_bzero(ptr, n);
   84|       |
   85|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   86|       |   (void)::explicit_memset(ptr, 0, n);
   87|       |
   88|       |#elif defined(BOTAN_USE_VOLATILE_MEMSET_FOR_ZERO) && (BOTAN_USE_VOLATILE_MEMSET_FOR_ZERO == 1)
   89|       |   /*
   90|       |   Call memset through a static volatile pointer, which the compiler
   91|       |   should not elide. This construct should be safe in conforming
   92|       |   compilers, but who knows. I did confirm that on x86-64 GCC 6.1 and
   93|       |   Clang 3.8 both create code that saves the memset address in the
   94|       |   data segment and unconditionally loads and jumps to that address.
   95|       |   */
   96|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   97|       |   (memset_ptr)(ptr, 0, n);
   98|       |#else
   99|       |
  100|       |   volatile uint8_t* p = reinterpret_cast<volatile uint8_t*>(ptr);
  101|       |
  102|       |   for(size_t i = 0; i != n; ++i)
  103|       |      p[i] = 0;
  104|       |#endif
  105|  24.4M|}
_ZN5Botan2OS14get_process_idEv:
  107|   296k|uint32_t OS::get_process_id() {
  108|   296k|#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
  109|   296k|   return ::getpid();
  110|       |#elif defined(BOTAN_TARGET_OS_HAS_WIN32)
  111|       |   return ::GetCurrentProcessId();
  112|       |#elif defined(BOTAN_TARGET_OS_IS_LLVM) || defined(BOTAN_TARGET_OS_IS_NONE)
  113|       |   return 0;  // truly no meaningful value
  114|       |#else
  115|       |   #error "Missing get_process_id"
  116|       |#endif
  117|   296k|}
_ZN5Botan2OS10get_auxvalEm:
  119|      1|unsigned long OS::get_auxval(unsigned long id) {
  120|      1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL)
  121|      1|   return ::getauxval(id);
  122|       |#elif defined(BOTAN_TARGET_OS_IS_ANDROID) && defined(BOTAN_TARGET_ARCH_IS_ARM32)
  123|       |
  124|       |   if(id == 0)
  125|       |      return 0;
  126|       |
  127|       |   char** p = environ;
  128|       |
  129|       |   while(*p++ != nullptr)
  130|       |      ;
  131|       |
  132|       |   Elf32_auxv_t* e = reinterpret_cast<Elf32_auxv_t*>(p);
  133|       |
  134|       |   while(e != nullptr) {
  135|       |      if(e->a_type == id)
  136|       |         return e->a_un.a_val;
  137|       |      e++;
  138|       |   }
  139|       |
  140|       |   return 0;
  141|       |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO)
  142|       |   unsigned long auxinfo = 0;
  143|       |   ::elf_aux_info(static_cast<int>(id), &auxinfo, sizeof(auxinfo));
  144|       |   return auxinfo;
  145|       |#elif defined(BOTAN_TARGET_OS_HAS_AUXINFO)
  146|       |   for(const AuxInfo* auxinfo = static_cast<AuxInfo*>(::_dlauxinfo()); auxinfo != AT_NULL; ++auxinfo) {
  147|       |      if(id == auxinfo->a_type)
  148|       |         return auxinfo->a_v;
  149|       |   }
  150|       |
  151|       |   return 0;
  152|       |#else
  153|       |   BOTAN_UNUSED(id);
  154|       |   return 0;
  155|       |#endif
  156|      1|}
_ZN5Botan2OS27running_in_privileged_stateEv:
  158|      1|bool OS::running_in_privileged_state() {
  159|      1|#if defined(AT_SECURE)
  160|      1|   return OS::get_auxval(AT_SECURE) != 0;
  161|       |#elif defined(BOTAN_TARGET_OS_HAS_POSIX1)
  162|       |   return (::getuid() != ::geteuid()) || (::getgid() != ::getegid());
  163|       |#else
  164|       |   return false;
  165|       |#endif
  166|      1|}
_ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
  400|      1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) {
  401|      1|   value_out = "";
  402|       |
  403|      1|   if(running_in_privileged_state()) {
  ------------------
  |  Branch (403:7): [True: 0, False: 1]
  ------------------
  404|      0|      return false;
  405|      0|   }
  406|       |
  407|       |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && defined(BOTAN_BUILD_COMPILER_IS_MSVC)
  408|       |   const std::string name(name_view);
  409|       |   char val[128] = {0};
  410|       |   size_t req_size = 0;
  411|       |   if(getenv_s(&req_size, val, sizeof(val), name.c_str()) == 0) {
  412|       |      value_out = std::string(val, req_size);
  413|       |      return true;
  414|       |   }
  415|       |#else
  416|      1|   const std::string name(name_view);
  417|      1|   if(const char* val = std::getenv(name.c_str())) {
  ------------------
  |  Branch (417:19): [True: 0, False: 1]
  ------------------
  418|      0|      value_out = val;
  419|      0|      return true;
  420|      0|   }
  421|      1|#endif
  422|       |
  423|      1|   return false;
  424|      1|}

_ZN5Botan9to_u32bitENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
   32|   352k|uint32_t to_u32bit(std::string_view str_view) {
   33|   352k|   const std::string str(str_view);
   34|       |
   35|       |   // std::stoul is not strict enough. Ensure that str is digit only [0-9]*
   36|   537k|   for(const char chr : str) {
  ------------------
  |  Branch (36:23): [True: 537k, False: 352k]
  ------------------
   37|   537k|      if(chr < '0' || chr > '9') {
  ------------------
  |  Branch (37:10): [True: 0, False: 537k]
  |  Branch (37:23): [True: 0, False: 537k]
  ------------------
   38|      0|         throw Invalid_Argument("to_u32bit invalid decimal string '" + str + "'");
   39|      0|      }
   40|   537k|   }
   41|       |
   42|   352k|   const unsigned long int x = std::stoul(str);
   43|       |
   44|   352k|   if constexpr(sizeof(unsigned long int) > 4) {
  ------------------
  |  Branch (44:17): [Folded - Ignored]
  ------------------
   45|       |      // x might be uint64
   46|   352k|      if(x > std::numeric_limits<uint32_t>::max()) {
  ------------------
  |  Branch (46:10): [True: 0, False: 352k]
  ------------------
   47|      0|         throw Invalid_Argument("Integer value of " + str + " exceeds 32 bit range");
   48|      0|      }
   49|   352k|   }
   50|       |
   51|   352k|   return static_cast<uint32_t>(x);
   52|   352k|}
_ZN5Botan20parse_algorithm_nameENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE:
   57|    373|std::vector<std::string> parse_algorithm_name(std::string_view namex) {
   58|    373|   if(namex.find('(') == std::string::npos && namex.find(')') == std::string::npos) {
  ------------------
  |  Branch (58:7): [True: 187, False: 186]
  |  Branch (58:47): [True: 187, False: 0]
  ------------------
   59|    187|      return {std::string(namex)};
   60|    187|   }
   61|       |
   62|    186|   std::string name(namex);
   63|    186|   std::string substring;
   64|    186|   std::vector<std::string> elems;
   65|    186|   size_t level = 0;
   66|       |
   67|    186|   elems.push_back(name.substr(0, name.find('(')));
   68|    186|   name = name.substr(name.find('('));
   69|       |
   70|    695|   for(auto i = name.begin(); i != name.end(); ++i) {
  ------------------
  |  Branch (70:31): [True: 695, False: 0]
  ------------------
   71|    695|      char c = *i;
   72|       |
   73|    695|      if(c == '(') {
  ------------------
  |  Branch (73:10): [True: 186, False: 509]
  ------------------
   74|    186|         ++level;
   75|    186|      }
   76|    695|      if(c == ')') {
  ------------------
  |  Branch (76:10): [True: 186, False: 509]
  ------------------
   77|    186|         if(level == 1 && i == name.end() - 1) {
  ------------------
  |  Branch (77:13): [True: 186, False: 0]
  |  Branch (77:13): [True: 186, False: 0]
  |  Branch (77:27): [True: 186, False: 0]
  ------------------
   78|    186|            if(elems.size() == 1) {
  ------------------
  |  Branch (78:16): [True: 186, False: 0]
  ------------------
   79|    186|               elems.push_back(substring.substr(1));
   80|    186|            } else {
   81|      0|               elems.push_back(substring);
   82|      0|            }
   83|    186|            return elems;
   84|    186|         }
   85|       |
   86|      0|         if(level == 0 || (level == 1 && i != name.end() - 1)) {
  ------------------
  |  Branch (86:13): [True: 0, False: 0]
  |  Branch (86:13): [True: 0, False: 0]
  |  Branch (86:28): [True: 0, False: 0]
  |  Branch (86:42): [True: 0, False: 0]
  ------------------
   87|      0|            throw Invalid_Algorithm_Name(namex);
   88|      0|         }
   89|      0|         --level;
   90|      0|      }
   91|       |
   92|    509|      if(c == ',' && level == 1) {
  ------------------
  |  Branch (92:10): [True: 0, False: 509]
  |  Branch (92:22): [True: 0, False: 0]
  ------------------
   93|      0|         if(elems.size() == 1) {
  ------------------
  |  Branch (93:13): [True: 0, False: 0]
  ------------------
   94|      0|            elems.push_back(substring.substr(1));
   95|      0|         } else {
   96|      0|            elems.push_back(substring);
   97|      0|         }
   98|      0|         substring.clear();
   99|    509|      } else {
  100|    509|         substring += c;
  101|    509|      }
  102|    509|   }
  103|       |
  104|      0|   if(!substring.empty()) {
  ------------------
  |  Branch (104:7): [True: 0, False: 0]
  ------------------
  105|      0|      throw Invalid_Algorithm_Name(namex);
  106|      0|   }
  107|       |
  108|      0|   return elems;
  109|      0|}
_ZN5Botan8split_onENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEc:
  111|  17.7k|std::vector<std::string> split_on(std::string_view str, char delim) {
  112|  17.7k|   std::vector<std::string> elems;
  113|  17.7k|   if(str.empty()) {
  ------------------
  |  Branch (113:7): [True: 0, False: 17.7k]
  ------------------
  114|      0|      return elems;
  115|      0|   }
  116|       |
  117|  17.7k|   std::string substr;
  118|   162k|   for(auto i = str.begin(); i != str.end(); ++i) {
  ------------------
  |  Branch (118:30): [True: 144k, False: 17.7k]
  ------------------
  119|   144k|      if(*i == delim) {
  ------------------
  |  Branch (119:10): [True: 6.20k, False: 138k]
  ------------------
  120|  6.20k|         if(!substr.empty()) {
  ------------------
  |  Branch (120:13): [True: 6.20k, False: 0]
  ------------------
  121|  6.20k|            elems.push_back(substr);
  122|  6.20k|         }
  123|  6.20k|         substr.clear();
  124|   138k|      } else {
  125|   138k|         substr += *i;
  126|   138k|      }
  127|   144k|   }
  128|       |
  129|  17.7k|   if(substr.empty()) {
  ------------------
  |  Branch (129:7): [True: 0, False: 17.7k]
  ------------------
  130|      0|      throw Invalid_Argument(fmt("Unable to split string '{}", str));
  131|      0|   }
  132|  17.7k|   elems.push_back(substr);
  133|       |
  134|  17.7k|   return elems;
  135|  17.7k|}

_ZN5Botan13poly_double_nEPhPKhm:
   74|  1.24k|void poly_double_n(uint8_t out[], const uint8_t in[], size_t n) {
   75|  1.24k|   switch(n) {
   76|      0|      case 8:
  ------------------
  |  Branch (76:7): [True: 0, False: 1.24k]
  ------------------
   77|      0|         return poly_double<1, MinWeightPolynomial::P64>(out, in);
   78|  1.24k|      case 16:
  ------------------
  |  Branch (78:7): [True: 1.24k, False: 0]
  ------------------
   79|  1.24k|         return poly_double<2, MinWeightPolynomial::P128>(out, in);
   80|      0|      case 24:
  ------------------
  |  Branch (80:7): [True: 0, False: 1.24k]
  ------------------
   81|      0|         return poly_double<3, MinWeightPolynomial::P192>(out, in);
   82|      0|      case 32:
  ------------------
  |  Branch (82:7): [True: 0, False: 1.24k]
  ------------------
   83|      0|         return poly_double<4, MinWeightPolynomial::P256>(out, in);
   84|      0|      case 64:
  ------------------
  |  Branch (84:7): [True: 0, False: 1.24k]
  ------------------
   85|      0|         return poly_double<8, MinWeightPolynomial::P512>(out, in);
   86|      0|      case 128:
  ------------------
  |  Branch (86:7): [True: 0, False: 1.24k]
  ------------------
   87|      0|         return poly_double<16, MinWeightPolynomial::P1024>(out, in);
   88|      0|      default:
  ------------------
  |  Branch (88:7): [True: 0, False: 1.24k]
  ------------------
   89|      0|         throw Invalid_Argument("Unsupported size for poly_double_n");
   90|  1.24k|   }
   91|  1.24k|}
poly_dbl.cpp:_ZN5Botan12_GLOBAL__N_111poly_doubleILm2ELNS0_19MinWeightPolynomialE135EEEvPhPKh:
   33|  1.24k|void poly_double(uint8_t out[], const uint8_t in[]) {
   34|  1.24k|   uint64_t W[LIMBS];
   35|  1.24k|   load_be(W, in, LIMBS);
   36|       |
   37|  1.24k|   const uint64_t POLY = static_cast<uint64_t>(P);
   38|       |
   39|  1.24k|   const uint64_t carry = POLY * (W[0] >> 63);
   40|       |
   41|  1.24k|   if constexpr(LIMBS > 0) {
  ------------------
  |  Branch (41:17): [Folded - Ignored]
  ------------------
   42|  2.48k|      for(size_t i = 0; i != LIMBS - 1; ++i) {
  ------------------
  |  Branch (42:25): [True: 1.24k, False: 1.24k]
  ------------------
   43|  1.24k|         W[i] = (W[i] << 1) ^ (W[i + 1] >> 63);
   44|  1.24k|      }
   45|  1.24k|   }
   46|       |
   47|  1.24k|   W[LIMBS - 1] = (W[LIMBS - 1] << 1) ^ carry;
   48|       |
   49|  1.24k|   copy_out_be(out, LIMBS * 8, W);
   50|  1.24k|}

_ZN5Botan18prefetch_array_rawEmPKv:
   14|  5.28k|uint64_t prefetch_array_raw(size_t bytes, const void* arrayv) noexcept {
   15|       |   // Android NDK is garbage and defines the feature macro, but not the variable
   16|       |#if defined(__cpp_lib_hardware_interference_size) && !defined(BOTAN_TARGET_OS_IS_ANDROID)
   17|       |   const size_t cache_line_size = std::hardware_destructive_interference_size;
   18|       |#else
   19|       |   // We arbitrarily use a 64 byte cache line, which is by far the most
   20|       |   // common size.
   21|       |   //
   22|       |   // Runtime detection adds too much overhead to this function.
   23|  5.28k|   const size_t cache_line_size = 64;
   24|  5.28k|#endif
   25|       |
   26|  5.28k|   const uint8_t* array = static_cast<const uint8_t*>(arrayv);
   27|       |
   28|  5.28k|   volatile uint64_t combiner = 1;
   29|       |
   30|  26.4k|   for(size_t idx = 0; idx < bytes; idx += cache_line_size) {
  ------------------
  |  Branch (30:24): [True: 21.1k, False: 5.28k]
  ------------------
   31|  21.1k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_prefetch)
   32|       |      // we have no way of knowing if the compiler will emit anything here
   33|  21.1k|      __builtin_prefetch(&array[idx]);
   34|  21.1k|#endif
   35|       |
   36|  21.1k|      combiner = combiner | array[idx];
   37|  21.1k|   }
   38|       |
   39|       |   /*
   40|       |   * The combiner variable is initialized with 1, and we accumulate using OR, so
   41|       |   * now combiner must be a value other than zero. This being the case we will
   42|       |   * always return zero here. Hopefully the compiler will not figure this out.
   43|       |   */
   44|  5.28k|   return ct_is_zero(combiner);
   45|  5.28k|}

_ZN5Botan9SCAN_NameC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   58|  40.6k|SCAN_Name::SCAN_Name(std::string_view algo_spec) : m_orig_algo_spec(algo_spec), m_alg_name(), m_args(), m_mode_info() {
   59|  40.6k|   if(algo_spec.empty()) {
  ------------------
  |  Branch (59:7): [True: 0, False: 40.6k]
  ------------------
   60|      0|      throw Invalid_Argument("Expected algorithm name, got empty string");
   61|      0|   }
   62|       |
   63|  40.6k|   std::vector<std::pair<size_t, std::string>> name;
   64|  40.6k|   size_t level = 0;
   65|  40.6k|   std::pair<size_t, std::string> accum = std::make_pair(level, "");
   66|       |
   67|  40.6k|   const std::string decoding_error = "Bad SCAN name '" + m_orig_algo_spec + "': ";
   68|       |
   69|   624k|   for(char c : algo_spec) {
  ------------------
  |  Branch (69:15): [True: 624k, False: 40.6k]
  ------------------
   70|   624k|      if(c == '/' || c == ',' || c == '(' || c == ')') {
  ------------------
  |  Branch (70:10): [True: 0, False: 624k]
  |  Branch (70:22): [True: 186, False: 624k]
  |  Branch (70:34): [True: 40.4k, False: 583k]
  |  Branch (70:46): [True: 40.4k, False: 543k]
  ------------------
   71|  81.1k|         if(c == '(') {
  ------------------
  |  Branch (71:13): [True: 40.4k, False: 40.6k]
  ------------------
   72|  40.4k|            ++level;
   73|  40.6k|         } else if(c == ')') {
  ------------------
  |  Branch (73:20): [True: 40.4k, False: 186]
  ------------------
   74|  40.4k|            if(level == 0) {
  ------------------
  |  Branch (74:16): [True: 0, False: 40.4k]
  ------------------
   75|      0|               throw Decoding_Error(decoding_error + "Mismatched parens");
   76|      0|            }
   77|  40.4k|            --level;
   78|  40.4k|         }
   79|       |
   80|  81.1k|         if(c == '/' && level > 0) {
  ------------------
  |  Branch (80:13): [True: 0, False: 81.1k]
  |  Branch (80:25): [True: 0, False: 0]
  ------------------
   81|      0|            accum.second.push_back(c);
   82|  81.1k|         } else {
   83|  81.1k|            if(!accum.second.empty()) {
  ------------------
  |  Branch (83:16): [True: 81.1k, False: 0]
  ------------------
   84|  81.1k|               name.push_back(accum);
   85|  81.1k|            }
   86|  81.1k|            accum = std::make_pair(level, "");
   87|  81.1k|         }
   88|   543k|      } else {
   89|   543k|         accum.second.push_back(c);
   90|   543k|      }
   91|   624k|   }
   92|       |
   93|  40.6k|   if(!accum.second.empty()) {
  ------------------
  |  Branch (93:7): [True: 200, False: 40.4k]
  ------------------
   94|    200|      name.push_back(accum);
   95|    200|   }
   96|       |
   97|  40.6k|   if(level != 0) {
  ------------------
  |  Branch (97:7): [True: 0, False: 40.6k]
  ------------------
   98|      0|      throw Decoding_Error(decoding_error + "Missing close paren");
   99|      0|   }
  100|       |
  101|  40.6k|   if(name.empty()) {
  ------------------
  |  Branch (101:7): [True: 0, False: 40.6k]
  ------------------
  102|      0|      throw Decoding_Error(decoding_error + "Empty name");
  103|      0|   }
  104|       |
  105|  40.6k|   m_alg_name = name[0].second;
  106|       |
  107|  40.6k|   bool in_modes = false;
  108|       |
  109|  81.3k|   for(size_t i = 1; i != name.size(); ++i) {
  ------------------
  |  Branch (109:22): [True: 40.6k, False: 40.6k]
  ------------------
  110|  40.6k|      if(name[i].first == 0) {
  ------------------
  |  Branch (110:10): [True: 0, False: 40.6k]
  ------------------
  111|      0|         m_mode_info.push_back(make_arg(name, i));
  112|      0|         in_modes = true;
  113|  40.6k|      } else if(name[i].first == 1 && !in_modes) {
  ------------------
  |  Branch (113:17): [True: 40.6k, False: 0]
  |  Branch (113:39): [True: 40.6k, False: 0]
  ------------------
  114|  40.6k|         m_args.push_back(make_arg(name, i));
  115|  40.6k|      }
  116|  40.6k|   }
  117|  40.6k|}
_ZNK5Botan9SCAN_Name3argEm:
  119|  46.2k|std::string SCAN_Name::arg(size_t i) const {
  120|  46.2k|   if(i >= arg_count()) {
  ------------------
  |  Branch (120:7): [True: 0, False: 46.2k]
  ------------------
  121|      0|      throw Invalid_Argument("SCAN_Name::arg " + std::to_string(i) + " out of range for '" + to_string() + "'");
  122|      0|   }
  123|  46.2k|   return m_args[i];
  124|  46.2k|}
_ZNK5Botan9SCAN_Name14arg_as_integerEmm:
  133|    528|size_t SCAN_Name::arg_as_integer(size_t i, size_t def_value) const {
  134|    528|   if(i >= arg_count()) {
  ------------------
  |  Branch (134:7): [True: 341, False: 187]
  ------------------
  135|    341|      return def_value;
  136|    341|   }
  137|    187|   return to_u32bit(m_args[i]);
  138|    528|}
scan_name.cpp:_ZN5Botan12_GLOBAL__N_18make_argERKNSt3__16vectorINS1_4pairImNS1_12basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEENS7_ISA_EEEEm:
   17|  40.6k|std::string make_arg(const std::vector<std::pair<size_t, std::string>>& name, size_t start) {
   18|  40.6k|   std::string output = name[start].second;
   19|  40.6k|   size_t level = name[start].first;
   20|       |
   21|  40.6k|   size_t paren_depth = 0;
   22|       |
   23|  40.6k|   for(size_t i = start + 1; i != name.size(); ++i) {
  ------------------
  |  Branch (23:30): [True: 186, False: 40.4k]
  ------------------
   24|    186|      if(name[i].first <= name[start].first) {
  ------------------
  |  Branch (24:10): [True: 186, False: 0]
  ------------------
   25|    186|         break;
   26|    186|      }
   27|       |
   28|      0|      if(name[i].first > level) {
  ------------------
  |  Branch (28:10): [True: 0, False: 0]
  ------------------
   29|      0|         output += "(" + name[i].second;
   30|      0|         ++paren_depth;
   31|      0|      } else if(name[i].first < level) {
  ------------------
  |  Branch (31:17): [True: 0, False: 0]
  ------------------
   32|      0|         for(size_t j = name[i].first; j < level; j++) {
  ------------------
  |  Branch (32:40): [True: 0, False: 0]
  ------------------
   33|      0|            output += ")";
   34|      0|            --paren_depth;
   35|      0|         }
   36|      0|         output += "," + name[i].second;
   37|      0|      } else {
   38|      0|         if(output[output.size() - 1] != '(') {
  ------------------
  |  Branch (38:13): [True: 0, False: 0]
  ------------------
   39|      0|            output += ",";
   40|      0|         }
   41|      0|         output += name[i].second;
   42|      0|      }
   43|       |
   44|      0|      level = name[i].first;
   45|      0|   }
   46|       |
   47|  40.6k|   for(size_t i = 0; i != paren_depth; ++i) {
  ------------------
  |  Branch (47:22): [True: 0, False: 40.6k]
  ------------------
   48|      0|      output += ")";
   49|      0|   }
   50|       |
   51|  40.6k|   return output;
   52|  40.6k|}

_ZN5Botan15AlternativeNameC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_S5_S5_:
   27|  11.5k|                                 std::string_view ip) {
   28|  11.5k|   add_attribute("RFC822", email_addr);
   29|  11.5k|   add_attribute("DNS", dns);
   30|  11.5k|   add_attribute("URI", uri);
   31|  11.5k|   add_attribute("IP", ip);
   32|  11.5k|}
_ZN5Botan15AlternativeName13add_attributeENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   37|  46.2k|void AlternativeName::add_attribute(std::string_view type, std::string_view value) {
   38|  46.2k|   if(type.empty() || value.empty()) {
  ------------------
  |  Branch (38:7): [True: 0, False: 46.2k]
  |  Branch (38:23): [True: 46.2k, False: 0]
  ------------------
   39|  46.2k|      return;
   40|  46.2k|   }
   41|       |
   42|      0|   auto range = m_alt_info.equal_range(type);
   43|      0|   for(auto j = range.first; j != range.second; ++j) {
  ------------------
  |  Branch (43:30): [True: 0, False: 0]
  ------------------
   44|      0|      if(j->second == value) {
  ------------------
  |  Branch (44:10): [True: 0, False: 0]
  ------------------
   45|      0|         return;
   46|      0|      }
   47|      0|   }
   48|       |
   49|      0|   m_alt_info.emplace(type, value);
   50|      0|}

_ZN5Botan7X509_DN13add_attributeERKNS_3OIDERKNS_11ASN1_StringE:
   96|  57.8k|void X509_DN::add_attribute(const OID& oid, const ASN1_String& str) {
   97|  57.8k|   if(str.empty()) {
  ------------------
  |  Branch (97:7): [True: 43, False: 57.8k]
  ------------------
   98|     43|      return;
   99|     43|   }
  100|       |
  101|  57.8k|   m_rdn.push_back(std::make_pair(oid, str));
  102|  57.8k|   m_dn_bits.clear();
  103|  57.8k|}
_ZNK5Botan7X509_DN14get_attributesEv:
  108|  11.5k|std::multimap<OID, std::string> X509_DN::get_attributes() const {
  109|  11.5k|   std::multimap<OID, std::string> retval;
  110|       |
  111|  57.7k|   for(auto& i : m_rdn) {
  ------------------
  |  Branch (111:16): [True: 57.7k, False: 11.5k]
  ------------------
  112|  57.7k|      multimap_insert(retval, i.first, i.second.value());
  113|  57.7k|   }
  114|  11.5k|   return retval;
  115|  11.5k|}
_ZN5BotaneqERKNS_7X509_DNES2_:
  216|  5.77k|bool operator==(const X509_DN& dn1, const X509_DN& dn2) {
  217|  5.77k|   auto attr1 = dn1.get_attributes();
  218|  5.77k|   auto attr2 = dn2.get_attributes();
  219|       |
  220|  5.77k|   if(attr1.size() != attr2.size()) {
  ------------------
  |  Branch (220:7): [True: 0, False: 5.77k]
  ------------------
  221|      0|      return false;
  222|      0|   }
  223|       |
  224|  5.77k|   auto p1 = attr1.begin();
  225|  5.77k|   auto p2 = attr2.begin();
  226|       |
  227|  34.6k|   while(true) {
  ------------------
  |  Branch (227:10): [Folded - Ignored]
  ------------------
  228|  34.6k|      if(p1 == attr1.end() && p2 == attr2.end()) {
  ------------------
  |  Branch (228:10): [True: 5.77k, False: 28.8k]
  |  Branch (228:10): [True: 5.77k, False: 28.8k]
  |  Branch (228:31): [True: 5.77k, False: 0]
  ------------------
  229|  5.77k|         break;
  230|  5.77k|      }
  231|  28.8k|      if(p1 == attr1.end()) {
  ------------------
  |  Branch (231:10): [True: 0, False: 28.8k]
  ------------------
  232|      0|         return false;
  233|      0|      }
  234|  28.8k|      if(p2 == attr2.end()) {
  ------------------
  |  Branch (234:10): [True: 0, False: 28.8k]
  ------------------
  235|      0|         return false;
  236|      0|      }
  237|  28.8k|      if(p1->first != p2->first) {
  ------------------
  |  Branch (237:10): [True: 0, False: 28.8k]
  ------------------
  238|      0|         return false;
  239|      0|      }
  240|  28.8k|      if(!x500_name_cmp(p1->second, p2->second)) {
  ------------------
  |  Branch (240:10): [True: 0, False: 28.8k]
  ------------------
  241|      0|         return false;
  242|      0|      }
  243|  28.8k|      ++p1;
  244|  28.8k|      ++p2;
  245|  28.8k|   }
  246|  5.77k|   return true;
  247|  5.77k|}
_ZN5Botan7X509_DN11decode_fromERNS_11BER_DecoderE:
  341|  11.9k|void X509_DN::decode_from(BER_Decoder& source) {
  342|  11.9k|   std::vector<uint8_t> bits;
  343|       |
  344|  11.9k|   source.start_sequence().raw_bytes(bits).end_cons();
  345|       |
  346|  11.9k|   BER_Decoder sequence(bits);
  347|       |
  348|  11.9k|   m_rdn.clear();
  349|       |
  350|  70.1k|   while(sequence.more_items()) {
  ------------------
  |  Branch (350:10): [True: 58.1k, False: 11.9k]
  ------------------
  351|  58.1k|      BER_Decoder rdn = sequence.start_set();
  352|       |
  353|   116k|      while(rdn.more_items()) {
  ------------------
  |  Branch (353:13): [True: 58.1k, False: 58.1k]
  ------------------
  354|  58.1k|         OID oid;
  355|  58.1k|         ASN1_String str;
  356|       |
  357|  58.1k|         rdn.start_sequence()
  358|  58.1k|            .decode(oid)
  359|  58.1k|            .decode(str)  // TODO support Any
  360|  58.1k|            .end_cons();
  361|       |
  362|  58.1k|         add_attribute(oid, str);
  363|  58.1k|      }
  364|  58.1k|   }
  365|       |
  366|       |   // Have to assign last as add_attribute zaps m_dn_bits
  367|  11.9k|   m_dn_bits = bits;
  368|  11.9k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_113x500_name_cmpENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_:
   34|  28.8k|bool x500_name_cmp(std::string_view name1, std::string_view name2) {
   35|  28.8k|   auto p1 = name1.begin();
   36|  28.8k|   auto p2 = name2.begin();
   37|       |
   38|  28.8k|   while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (38:10): [True: 28.8k, False: 0]
  |  Branch (38:33): [True: 0, False: 28.8k]
  ------------------
   39|      0|      ++p1;
   40|      0|   }
   41|  28.8k|   while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (41:10): [True: 28.8k, False: 0]
  |  Branch (41:33): [True: 0, False: 28.8k]
  ------------------
   42|      0|      ++p2;
   43|      0|   }
   44|       |
   45|   306k|   while(p1 != name1.end() && p2 != name2.end()) {
  ------------------
  |  Branch (45:10): [True: 277k, False: 28.8k]
  |  Branch (45:31): [True: 277k, False: 0]
  ------------------
   46|   277k|      if(is_space(*p1)) {
  ------------------
  |  Branch (46:10): [True: 17.3k, False: 260k]
  ------------------
   47|  17.3k|         if(!is_space(*p2)) {
  ------------------
  |  Branch (47:13): [True: 0, False: 17.3k]
  ------------------
   48|      0|            return false;
   49|      0|         }
   50|       |
   51|  34.6k|         while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (51:16): [True: 34.6k, False: 0]
  |  Branch (51:39): [True: 17.3k, False: 17.3k]
  ------------------
   52|  17.3k|            ++p1;
   53|  17.3k|         }
   54|  34.6k|         while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (54:16): [True: 34.6k, False: 0]
  |  Branch (54:39): [True: 17.3k, False: 17.3k]
  ------------------
   55|  17.3k|            ++p2;
   56|  17.3k|         }
   57|       |
   58|  17.3k|         if(p1 == name1.end() && p2 == name2.end()) {
  ------------------
  |  Branch (58:13): [True: 0, False: 17.3k]
  |  Branch (58:34): [True: 0, False: 0]
  ------------------
   59|      0|            return true;
   60|      0|         }
   61|  17.3k|         if(p1 == name1.end() || p2 == name2.end()) {
  ------------------
  |  Branch (61:13): [True: 0, False: 17.3k]
  |  Branch (61:34): [True: 0, False: 17.3k]
  ------------------
   62|      0|            return false;
   63|      0|         }
   64|  17.3k|      }
   65|       |
   66|   277k|      if(!caseless_cmp(*p1, *p2)) {
  ------------------
  |  Branch (66:10): [True: 0, False: 277k]
  ------------------
   67|      0|         return false;
   68|      0|      }
   69|   277k|      ++p1;
   70|   277k|      ++p2;
   71|   277k|   }
   72|       |
   73|  28.8k|   while((p1 != name1.end()) && is_space(*p1)) {
  ------------------
  |  Branch (73:10): [True: 0, False: 28.8k]
  |  Branch (73:33): [True: 0, False: 0]
  ------------------
   74|      0|      ++p1;
   75|      0|   }
   76|  28.8k|   while((p2 != name2.end()) && is_space(*p2)) {
  ------------------
  |  Branch (76:10): [True: 0, False: 28.8k]
  |  Branch (76:33): [True: 0, False: 0]
  ------------------
   77|      0|      ++p2;
   78|      0|   }
   79|       |
   80|  28.8k|   if((p1 != name1.end()) || (p2 != name2.end())) {
  ------------------
  |  Branch (80:7): [True: 0, False: 28.8k]
  |  Branch (80:30): [True: 0, False: 28.8k]
  ------------------
   81|      0|      return false;
   82|      0|   }
   83|  28.8k|   return true;
   84|  28.8k|}
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_112_GLOBAL__N_18is_spaceEc:
   27|   421k|bool is_space(char c) { return std::isspace(static_cast<unsigned char>(c)); }
x509_dn.cpp:_ZN5Botan12_GLOBAL__N_112_GLOBAL__N_112caseless_cmpEcc:
   23|   277k|bool caseless_cmp(char a, char b) {
   24|   277k|   return (std::tolower(static_cast<unsigned char>(a)) == std::tolower(static_cast<unsigned char>(b)));
   25|   277k|}

_ZNK5Botan10Extensions20get_extension_objectERKNS_3OIDE:
  188|  63.5k|const Certificate_Extension* Extensions::get_extension_object(const OID& oid) const {
  189|  63.5k|   auto extn = m_extension_info.find(oid);
  190|  63.5k|   if(extn == m_extension_info.end()) {
  ------------------
  |  Branch (190:7): [True: 63.5k, False: 0]
  ------------------
  191|  63.5k|      return nullptr;
  192|  63.5k|   }
  193|       |
  194|      0|   return &extn->second.obj();
  195|  63.5k|}

_ZN5Botan11X509_Object9load_dataERNS_10DataSourceE:
   24|  5.77k|void X509_Object::load_data(DataSource& in) {
   25|  5.77k|   try {
   26|  5.77k|      if(ASN1::maybe_BER(in) && !PEM_Code::matches(in)) {
  ------------------
  |  Branch (26:10): [True: 0, False: 5.77k]
  |  Branch (26:33): [True: 0, False: 0]
  ------------------
   27|      0|         BER_Decoder dec(in);
   28|      0|         decode_from(dec);
   29|  5.77k|      } else {
   30|  5.77k|         std::string got_label;
   31|  5.77k|         DataSource_Memory ber(PEM_Code::decode(in, got_label));
   32|       |
   33|  5.77k|         if(got_label != PEM_label()) {
  ------------------
  |  Branch (33:13): [True: 0, False: 5.77k]
  ------------------
   34|      0|            bool is_alternate = false;
   35|      0|            for(std::string_view alt_label : alternate_PEM_labels()) {
  ------------------
  |  Branch (35:44): [True: 0, False: 0]
  ------------------
   36|      0|               if(got_label == alt_label) {
  ------------------
  |  Branch (36:19): [True: 0, False: 0]
  ------------------
   37|      0|                  is_alternate = true;
   38|      0|                  break;
   39|      0|               }
   40|      0|            }
   41|       |
   42|      0|            if(!is_alternate) {
  ------------------
  |  Branch (42:16): [True: 0, False: 0]
  ------------------
   43|      0|               throw Decoding_Error("Unexpected PEM label for " + PEM_label() + " of " + got_label);
   44|      0|            }
   45|      0|         }
   46|       |
   47|  5.77k|         BER_Decoder dec(ber);
   48|  5.77k|         decode_from(dec);
   49|  5.77k|      }
   50|  5.77k|   } catch(Decoding_Error& e) {
   51|      0|      throw Decoding_Error(PEM_label() + " decoding", e);
   52|      0|   }
   53|  5.77k|}
_ZNK5Botan11X509_Object11encode_intoERNS_11DER_EncoderE:
   55|  5.95k|void X509_Object::encode_into(DER_Encoder& to) const {
   56|  5.95k|   to.start_sequence()
   57|  5.95k|      .start_sequence()
   58|  5.95k|      .raw_bytes(signed_body())
   59|  5.95k|      .end_cons()
   60|  5.95k|      .encode(signature_algorithm())
   61|  5.95k|      .encode(signature(), ASN1_Type::BitString)
   62|  5.95k|      .end_cons();
   63|  5.95k|}
_ZN5Botan11X509_Object11decode_fromERNS_11BER_DecoderE:
   68|  5.77k|void X509_Object::decode_from(BER_Decoder& from) {
   69|  5.77k|   from.start_sequence()
   70|  5.77k|      .start_sequence()
   71|  5.77k|      .raw_bytes(m_tbs_bits)
   72|  5.77k|      .end_cons()
   73|  5.77k|      .decode(m_sig_algo)
   74|  5.77k|      .decode(m_sig, ASN1_Type::BitString)
   75|  5.77k|      .end_cons();
   76|       |
   77|  5.77k|   force_decode();
   78|  5.77k|}
_ZNK5Botan11X509_Object8tbs_dataEv:
   88|  5.77k|std::vector<uint8_t> X509_Object::tbs_data() const { return ASN1::put_in_sequence(m_tbs_bits); }
_ZNK5Botan11X509_Object16verify_signatureERKNS_10Public_KeyE:
   98|  5.77k|std::pair<Certificate_Status_Code, std::string> X509_Object::verify_signature(const Public_Key& pub_key) const {
   99|  5.77k|   try {
  100|  5.77k|      PK_Verifier verifier(pub_key, signature_algorithm());
  101|  5.77k|      const bool valid = verifier.verify_message(tbs_data(), signature());
  102|       |
  103|  5.77k|      if(valid) {
  ------------------
  |  Branch (103:10): [True: 5.77k, False: 0]
  ------------------
  104|  5.77k|         return std::make_pair(Certificate_Status_Code::VERIFIED, verifier.hash_function());
  105|  5.77k|      } else {
  106|      0|         return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
  107|      0|      }
  108|  5.77k|   } catch(Decoding_Error&) {
  109|      0|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_BAD_PARAMS, "");
  110|      0|   } catch(Algorithm_Not_Found&) {
  111|      0|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN, "");
  112|      0|   } catch(...) {
  113|       |      // This shouldn't happen, fallback to generic signature error
  114|      0|      return std::make_pair(Certificate_Status_Code::SIGNATURE_ERROR, "");
  115|      0|   }
  116|  5.77k|}

_ZNK5Botan16X509_Certificate9PEM_labelEv:
   70|  5.77k|std::string X509_Certificate::PEM_label() const { return "CERTIFICATE"; }
_ZN5Botan16X509_CertificateC2ERNS_10DataSourceE:
   74|  5.77k|X509_Certificate::X509_Certificate(DataSource& src) { load_data(src); }
_ZN5Botan16X509_Certificate12force_decodeEv:
  276|  5.77k|void X509_Certificate::force_decode() {
  277|  5.77k|   m_data.reset();
  278|  5.77k|   m_data = parse_x509_cert_body(*this);
  279|  5.77k|}
x509cert.cpp:_ZN5Botan12_GLOBAL__N_120parse_x509_cert_bodyERKNS_11X509_ObjectE:
   95|  5.77k|std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& obj) {
   96|  5.77k|   auto data = std::make_unique<X509_Certificate_Data>();
   97|       |
   98|  5.77k|   BigInt serial_bn;
   99|  5.77k|   BER_Object public_key;
  100|  5.77k|   BER_Object v3_exts_data;
  101|       |
  102|  5.77k|   BER_Decoder(obj.signed_body())
  103|  5.77k|      .decode_optional(data->m_version, ASN1_Type(0), ASN1_Class::Constructed | ASN1_Class::ContextSpecific)
  104|  5.77k|      .decode(serial_bn)
  105|  5.77k|      .decode(data->m_sig_algo_inner)
  106|  5.77k|      .decode(data->m_issuer_dn)
  107|  5.77k|      .start_sequence()
  108|  5.77k|      .decode(data->m_not_before)
  109|  5.77k|      .decode(data->m_not_after)
  110|  5.77k|      .end_cons()
  111|  5.77k|      .decode(data->m_subject_dn)
  112|  5.77k|      .get_next(public_key)
  113|  5.77k|      .decode_optional_string(data->m_v2_issuer_key_id, ASN1_Type::BitString, 1)
  114|  5.77k|      .decode_optional_string(data->m_v2_subject_key_id, ASN1_Type::BitString, 2)
  115|  5.77k|      .get_next(v3_exts_data)
  116|  5.77k|      .verify_end("TBSCertificate has extra data after extensions block");
  117|       |
  118|  5.77k|   if(data->m_version > 2) {
  ------------------
  |  Branch (118:7): [True: 0, False: 5.77k]
  ------------------
  119|      0|      throw Decoding_Error("Unknown X.509 cert version " + std::to_string(data->m_version));
  120|      0|   }
  121|  5.77k|   if(obj.signature_algorithm() != data->m_sig_algo_inner) {
  ------------------
  |  Branch (121:7): [True: 0, False: 5.77k]
  ------------------
  122|      0|      throw Decoding_Error("X.509 Certificate had differing algorithm identifers in inner and outer ID fields");
  123|      0|   }
  124|       |
  125|  5.77k|   public_key.assert_is_a(ASN1_Type::Sequence, ASN1_Class::Constructed, "X.509 certificate public key");
  126|       |
  127|       |   // crude method to save the serial's sign; will get lost during decoding, otherwise
  128|  5.77k|   data->m_serial_negative = serial_bn.is_negative();
  129|       |
  130|       |   // for general sanity convert wire version (0 based) to standards version (v1 .. v3)
  131|  5.77k|   data->m_version += 1;
  132|       |
  133|  5.77k|   data->m_serial = BigInt::encode(serial_bn);
  134|  5.77k|   data->m_subject_dn_bits = ASN1::put_in_sequence(data->m_subject_dn.get_bits());
  135|  5.77k|   data->m_issuer_dn_bits = ASN1::put_in_sequence(data->m_issuer_dn.get_bits());
  136|       |
  137|  5.77k|   data->m_subject_public_key_bits.assign(public_key.bits(), public_key.bits() + public_key.length());
  138|       |
  139|  5.77k|   data->m_subject_public_key_bits_seq = ASN1::put_in_sequence(data->m_subject_public_key_bits);
  140|       |
  141|  5.77k|   BER_Decoder(data->m_subject_public_key_bits)
  142|  5.77k|      .decode(data->m_subject_public_key_algid)
  143|  5.77k|      .decode(data->m_subject_public_key_bitstring, ASN1_Type::BitString);
  144|       |
  145|  5.77k|   if(v3_exts_data.is_a(3, ASN1_Class::Constructed | ASN1_Class::ContextSpecific)) {
  ------------------
  |  Branch (145:7): [True: 0, False: 5.77k]
  ------------------
  146|       |      // Path validation will reject a v1/v2 cert with v3 extensions
  147|      0|      BER_Decoder(v3_exts_data).decode(data->m_v3_extensions).verify_end();
  148|  5.77k|   } else if(v3_exts_data.is_set()) {
  ------------------
  |  Branch (148:14): [True: 0, False: 5.77k]
  ------------------
  149|      0|      throw BER_Bad_Tag("Unknown tag in X.509 cert", v3_exts_data.tagging());
  150|      0|   }
  151|       |
  152|       |   // Now cache some fields from the extensions
  153|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Key_Usage>()) {
  ------------------
  |  Branch (153:12): [True: 0, False: 5.77k]
  ------------------
  154|      0|      data->m_key_constraints = ext->get_constraints();
  155|       |      /*
  156|       |      RFC 5280: When the keyUsage extension appears in a certificate,
  157|       |      at least one of the bits MUST be set to 1.
  158|       |      */
  159|      0|      if(data->m_key_constraints.empty()) {
  ------------------
  |  Branch (159:10): [True: 0, False: 0]
  ------------------
  160|      0|         throw Decoding_Error("Certificate has invalid encoding for KeyUsage");
  161|      0|      }
  162|      0|   }
  163|       |
  164|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Key_ID>()) {
  ------------------
  |  Branch (164:12): [True: 0, False: 5.77k]
  ------------------
  165|      0|      data->m_subject_key_id = ext->get_key_id();
  166|      0|   }
  167|       |
  168|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
  ------------------
  |  Branch (168:12): [True: 0, False: 5.77k]
  ------------------
  169|      0|      data->m_authority_key_id = ext->get_key_id();
  170|      0|   }
  171|       |
  172|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Name_Constraints>()) {
  ------------------
  |  Branch (172:12): [True: 0, False: 5.77k]
  ------------------
  173|      0|      data->m_name_constraints = ext->get_name_constraints();
  174|      0|   }
  175|       |
  176|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Basic_Constraints>()) {
  ------------------
  |  Branch (176:12): [True: 0, False: 5.77k]
  ------------------
  177|      0|      if(ext->get_is_ca() == true) {
  ------------------
  |  Branch (177:10): [True: 0, False: 0]
  ------------------
  178|       |         /*
  179|       |         * RFC 5280 section 4.2.1.3 requires that CAs include KeyUsage in all
  180|       |         * intermediate CA certificates they issue. Currently we accept it being
  181|       |         * missing, as do most other implementations. But it may be worth
  182|       |         * removing this entirely, or alternately adding a warning level
  183|       |         * validation failure for it.
  184|       |         */
  185|      0|         if(data->m_key_constraints.empty() || data->m_key_constraints.includes(Key_Constraints::KeyCertSign)) {
  ------------------
  |  Branch (185:13): [True: 0, False: 0]
  |  Branch (185:48): [True: 0, False: 0]
  ------------------
  186|      0|            data->m_is_ca_certificate = true;
  187|      0|            data->m_path_len_constraint = ext->get_path_limit();
  188|      0|         }
  189|      0|      }
  190|      0|   }
  191|       |
  192|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Issuer_Alternative_Name>()) {
  ------------------
  |  Branch (192:12): [True: 0, False: 5.77k]
  ------------------
  193|      0|      data->m_issuer_alt_name = ext->get_alt_name();
  194|      0|   }
  195|       |
  196|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
  ------------------
  |  Branch (196:12): [True: 0, False: 5.77k]
  ------------------
  197|      0|      data->m_subject_alt_name = ext->get_alt_name();
  198|      0|   }
  199|       |
  200|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Extended_Key_Usage>()) {
  ------------------
  |  Branch (200:12): [True: 0, False: 5.77k]
  ------------------
  201|      0|      data->m_extended_key_usage = ext->object_identifiers();
  202|      0|   }
  203|       |
  204|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Certificate_Policies>()) {
  ------------------
  |  Branch (204:12): [True: 0, False: 5.77k]
  ------------------
  205|      0|      data->m_cert_policies = ext->get_policy_oids();
  206|      0|   }
  207|       |
  208|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Information_Access>()) {
  ------------------
  |  Branch (208:12): [True: 0, False: 5.77k]
  ------------------
  209|      0|      data->m_ocsp_responder = ext->ocsp_responder();
  210|      0|      data->m_ca_issuers = ext->ca_issuers();
  211|      0|   }
  212|       |
  213|  5.77k|   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::CRL_Distribution_Points>()) {
  ------------------
  |  Branch (213:12): [True: 0, False: 5.77k]
  ------------------
  214|      0|      data->m_crl_distribution_points = ext->crl_distribution_urls();
  215|      0|   }
  216|       |
  217|       |   // Check for self-signed vs self-issued certificates
  218|  5.77k|   if(data->m_subject_dn == data->m_issuer_dn) {
  ------------------
  |  Branch (218:7): [True: 5.77k, False: 0]
  ------------------
  219|  5.77k|      if(data->m_subject_key_id.empty() == false && data->m_authority_key_id.empty() == false) {
  ------------------
  |  Branch (219:10): [True: 0, False: 5.77k]
  |  Branch (219:53): [True: 0, False: 0]
  ------------------
  220|      0|         data->m_self_signed = (data->m_subject_key_id == data->m_authority_key_id);
  221|  5.77k|      } else {
  222|       |         /*
  223|       |         If a parse error or unknown algorithm is encountered, default
  224|       |         to assuming it is self signed. We have no way of being certain but
  225|       |         that is usually the default case (self-issued is rare in practice).
  226|       |         */
  227|  5.77k|         data->m_self_signed = true;
  228|       |
  229|  5.77k|         try {
  230|  5.77k|            auto pub_key = X509::load_key(data->m_subject_public_key_bits_seq);
  231|       |
  232|  5.77k|            const auto sig_status = obj.verify_signature(*pub_key);
  233|       |
  234|  5.77k|            if(sig_status.first == Certificate_Status_Code::OK ||
  ------------------
  |  Branch (234:16): [True: 5.77k, False: 0]
  ------------------
  235|  5.77k|               sig_status.first == Certificate_Status_Code::SIGNATURE_ALGO_UNKNOWN) {
  ------------------
  |  Branch (235:16): [True: 0, False: 0]
  ------------------
  236|  5.77k|               data->m_self_signed = true;
  237|  5.77k|            } else {
  238|      0|               data->m_self_signed = false;
  239|      0|            }
  240|  5.77k|         } catch(...) {
  241|       |            // ignore errors here to allow parsing to continue
  242|      0|         }
  243|  5.77k|      }
  244|  5.77k|   }
  245|       |
  246|  5.77k|   const std::vector<uint8_t> full_encoding = obj.BER_encode();
  247|       |
  248|  5.77k|   auto sha1 = HashFunction::create("SHA-1");
  249|  5.77k|   if(sha1) {
  ------------------
  |  Branch (249:7): [True: 5.77k, False: 0]
  ------------------
  250|  5.77k|      sha1->update(data->m_subject_public_key_bitstring);
  251|  5.77k|      data->m_subject_public_key_bitstring_sha1 = sha1->final_stdvec();
  252|       |      // otherwise left as empty, and we will throw if subject_public_key_bitstring_sha1 is called
  253|       |
  254|  5.77k|      data->m_fingerprint_sha1 = create_hex_fingerprint(full_encoding, "SHA-1");
  255|  5.77k|   }
  256|       |
  257|  5.77k|   auto sha256 = HashFunction::create("SHA-256");
  258|  5.77k|   if(sha256) {
  ------------------
  |  Branch (258:7): [True: 5.77k, False: 0]
  ------------------
  259|  5.77k|      sha256->update(data->m_issuer_dn_bits);
  260|  5.77k|      data->m_issuer_dn_bits_sha256 = sha256->final_stdvec();
  261|       |
  262|  5.77k|      sha256->update(data->m_subject_dn_bits);
  263|  5.77k|      data->m_subject_dn_bits_sha256 = sha256->final_stdvec();
  264|       |
  265|  5.77k|      data->m_fingerprint_sha256 = create_hex_fingerprint(full_encoding, "SHA-256");
  266|  5.77k|   }
  267|       |
  268|  5.77k|   return data;
  269|  5.77k|}