_ZNK5Botan17Barrett_Reduction4cubeERKNS_6BigIntE:
   66|      7|      BigInt cube(const BigInt& x) const { return this->multiply(x, this->square(x)); }

_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_:
   37|  2.03k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|  2.03k|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|  2.03k|}
_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_:
   28|  2.03k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|  2.03k|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|  2.03k|   return static_cast<T>(0) - top;
   31|  2.03k|}
_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_:
   28|  1.16M|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|  1.16M|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|  1.16M|   return static_cast<T>(0) - top;
   31|  1.16M|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_:
   37|  1.14M|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|  1.14M|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|  1.14M|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_:
  216|  3.37M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  217|       |   //return (mask & a) | (~mask & b);
  218|  3.37M|   return (b ^ (mask & (a ^ b)));
  219|  3.37M|}
_ZN5Botan8high_bitITkNSt3__117unsigned_integralEjEEmT_:
   73|      7|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) {
   74|      7|   size_t hb = 0;
   75|       |
   76|     42|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (76:38): [True: 35, False: 7]
  ------------------
   77|       |      // Equivalent to: ((n >> s) == 0) ? 0 : s;
   78|     35|      const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
   79|     35|      hb += z;
   80|     35|      n >>= z;
   81|     35|   }
   82|       |
   83|      7|   hb += n;
   84|       |
   85|      7|   return hb;
   86|      7|}
_ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEjEEmT_m:
   45|     35|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) {
   46|       |   /*
   47|       |   Similar to `return ct_is_zero(x) & s` but has to account for possibility that
   48|       |   sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking
   49|       |   */
   50|     35|   const T a = ~x & (x - 1);
   51|     35|   const size_t a_top = static_cast<size_t>(CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1)));
   52|     35|   const size_t mask = static_cast<size_t>(0) - a_top;
   53|     35|   return mask & s;
   54|     35|}
_ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m:
   45|    336|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) {
   46|       |   /*
   47|       |   Similar to `return ct_is_zero(x) & s` but has to account for possibility that
   48|       |   sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking
   49|       |   */
   50|    336|   const T a = ~x & (x - 1);
   51|    336|   const size_t a_top = static_cast<size_t>(CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1)));
   52|    336|   const size_t mask = static_cast<size_t>(0) - a_top;
   53|    336|   return mask & s;
   54|    336|}
_ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_:
   73|     56|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) {
   74|     56|   size_t hb = 0;
   75|       |
   76|    392|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (76:38): [True: 336, False: 56]
  ------------------
   77|       |      // Equivalent to: ((n >> s) == 0) ? 0 : s;
   78|    336|      const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
   79|    336|      hb += z;
   80|    336|      n >>= z;
   81|    336|   }
   82|       |
   83|     56|   hb += n;
   84|       |
   85|     56|   return hb;
   86|     56|}

_ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_:
   27|  33.9k|inline constexpr T reverse_bytes(T x) {
   28|       |   if constexpr(sizeof(T) == 1) {
   29|       |      return x;
   30|       |   } else if constexpr(sizeof(T) == 2) {
   31|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   32|       |      return static_cast<T>(__builtin_bswap16(x));
   33|       |#else
   34|       |      return static_cast<T>((x << 8) | (x >> 8));
   35|       |#endif
   36|       |   } else if constexpr(sizeof(T) == 4) {
   37|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   38|       |      return static_cast<T>(__builtin_bswap32(x));
   39|       |#else
   40|       |      // MSVC at least recognizes this as a bswap
   41|       |      return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
   42|       |                            ((x & 0xFF000000) >> 24));
   43|       |#endif
   44|  33.9k|   } else if constexpr(sizeof(T) == 8) {
   45|  33.9k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   46|  33.9k|      return static_cast<T>(__builtin_bswap64(x));
   47|       |#else
   48|       |      uint32_t hi = static_cast<uint32_t>(x >> 32);
   49|       |      uint32_t lo = static_cast<uint32_t>(x);
   50|       |
   51|       |      hi = reverse_bytes(hi);
   52|       |      lo = reverse_bytes(lo);
   53|       |
   54|       |      return (static_cast<T>(lo) << 32) | hi;
   55|       |#endif
   56|  33.9k|   }
   57|  33.9k|}

_ZN5Botan13BufferStufferC2ENSt3__14spanIhLm18446744073709551615EEE:
   26|  1.51k|      constexpr explicit BufferStuffer(std::span<uint8_t> buffer) : m_buffer(buffer) {}
_ZN5Botan13BufferStuffer6appendEhm:
   64|  1.51k|      constexpr void append(uint8_t b, size_t repeat = 1) {
   65|  1.51k|         auto sink = next(repeat);
   66|  1.51k|         std::fill(sink.begin(), sink.end(), b);
   67|  1.51k|      }
_ZN5Botan13BufferStuffer4nextEm:
   32|  1.51k|      constexpr std::span<uint8_t> next(size_t bytes) {
   33|  1.51k|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|  1.51k|   do {                                                         \
  |  |   52|  1.51k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|  1.51k|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 1.51k]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|  1.51k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 1.51k]
  |  |  ------------------
  ------------------
   34|       |
   35|  1.51k|         auto result = m_buffer.first(bytes);
   36|  1.51k|         m_buffer = m_buffer.subspan(bytes);
   37|  1.51k|         return result;
   38|  1.51k|      }
_ZN5Botan13BufferStuffer4nextILm32EEENSt3__14spanIhXT_EEEv:
   41|    992|      constexpr std::span<uint8_t, bytes> next() {
   42|    992|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    992|   do {                                                         \
  |  |   52|    992|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    992|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 992]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    992|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 992]
  |  |  ------------------
  ------------------
   43|       |
   44|    992|         auto result = m_buffer.first<bytes>();
   45|    992|         m_buffer = m_buffer.subspan(bytes);
   46|    992|         return result;
   47|    992|      }
_ZN5Botan13BufferStuffer4nextILm48EEENSt3__14spanIhXT_EEEv:
   41|    332|      constexpr std::span<uint8_t, bytes> next() {
   42|    332|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    332|   do {                                                         \
  |  |   52|    332|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    332|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 332]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    332|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 332]
  |  |  ------------------
  ------------------
   43|       |
   44|    332|         auto result = m_buffer.first<bytes>();
   45|    332|         m_buffer = m_buffer.subspan(bytes);
   46|    332|         return result;
   47|    332|      }
_ZN5Botan13BufferStuffer4nextILm64EEENSt3__14spanIhXT_EEEv:
   41|    316|      constexpr std::span<uint8_t, bytes> next() {
   42|    316|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    316|   do {                                                         \
  |  |   52|    316|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    316|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 316]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    316|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 316]
  |  |  ------------------
  ------------------
   43|       |
   44|    316|         auto result = m_buffer.first<bytes>();
   45|    316|         m_buffer = m_buffer.subspan(bytes);
   46|    316|         return result;
   47|    316|      }
_ZN5Botan13BufferStuffer4nextILm24EEENSt3__14spanIhXT_EEEv:
   41|    352|      constexpr std::span<uint8_t, bytes> next() {
   42|    352|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    352|   do {                                                         \
  |  |   52|    352|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    352|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 352]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    352|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 352]
  |  |  ------------------
  ------------------
   43|       |
   44|    352|         auto result = m_buffer.first<bytes>();
   45|    352|         m_buffer = m_buffer.subspan(bytes);
   46|    352|         return result;
   47|    352|      }
_ZN5Botan13BufferStuffer4nextILm28EEENSt3__14spanIhXT_EEEv:
   41|    384|      constexpr std::span<uint8_t, bytes> next() {
   42|    384|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    384|   do {                                                         \
  |  |   52|    384|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    384|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 384]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    384|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 384]
  |  |  ------------------
  ------------------
   43|       |
   44|    384|         auto result = m_buffer.first<bytes>();
   45|    384|         m_buffer = m_buffer.subspan(bytes);
   46|    384|         return result;
   47|    384|      }
_ZN5Botan13BufferStuffer4nextILm66EEENSt3__14spanIhXT_EEEv:
   41|    648|      constexpr std::span<uint8_t, bytes> next() {
   42|    648|         BOTAN_STATE_CHECK(m_buffer.size() >= bytes);
  ------------------
  |  |   51|    648|   do {                                                         \
  |  |   52|    648|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    648|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 648]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    648|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 648]
  |  |  ------------------
  ------------------
   43|       |
   44|    648|         auto result = m_buffer.first<bytes>();
   45|    648|         m_buffer = m_buffer.subspan(bytes);
   46|    648|         return result;
   47|    648|      }

_ZN5Botan2CT4MaskIhE7is_zeroEh:
  437|  2.03k|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT4MaskIhEC2Eh:
  637|  2.03k|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskIhE16unpoisoned_valueEv:
  598|  2.03k|      constexpr T unpoisoned_value() const {
  599|  2.03k|         T r = value();
  600|  2.03k|         CT::unpoison(r);
  601|  2.03k|         return r;
  602|  2.03k|      }
_ZNK5Botan2CT4MaskIhE5valueEv:
  630|  2.03k|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZN5Botan2CT8unpoisonITkNSt3__18integralEhEEvRKT_:
  112|  2.03k|constexpr void unpoison(const T& p) {
  113|  2.03k|   unpoison(&p, 1);
  114|  2.03k|}
_ZN5Botan2CT8unpoisonIhEEvPKT_m:
   67|  2.03k|constexpr inline void unpoison(const T* p, size_t n) {
   68|       |#if defined(BOTAN_HAS_VALGRIND)
   69|       |   if(!std::is_constant_evaluated()) {
   70|       |      VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   71|       |   }
   72|       |#endif
   73|       |
   74|  2.03k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  144|  2.03k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   75|  2.03k|}
_ZN5Botan2CT6Choice9from_maskEm:
  303|  76.5k|      constexpr static Choice from_mask(underlying_type v) { return Choice(v); }
_ZN5Botan2CT6Choice2noEv:
  307|      7|      constexpr static Choice no() { return Choice(0); }
_ZNK5Botan2CT6ChoicentEv:
  309|  67.5k|      constexpr Choice operator!() const { return Choice(~value()); }
_ZNK5Botan2CT6ChoiceaaERKS1_:
  311|  23.1k|      constexpr Choice operator&&(const Choice& other) const { return Choice(value() & other.value()); }
_ZNK5Botan2CT6ChoiceooERKS1_:
  313|  14.2k|      constexpr Choice operator||(const Choice& other) const { return Choice(value() | other.value()); }
_ZNK5Botan2CT6ChoiceneERKS1_:
  315|  1.51k|      constexpr Choice operator!=(const Choice& other) const { return Choice(value() ^ other.value()); }
_ZNK5Botan2CT6Choice7as_boolEv:
  329|  12.3k|      constexpr bool as_bool() const { return m_value != 0; }
_ZNK5Botan2CT6Choice5valueEv:
  332|   215k|      constexpr underlying_type value() const { return value_barrier(m_value); }
_ZN5Botan2CT6ChoiceC2Em:
  341|   186k|      constexpr explicit Choice(underlying_type v) : m_value(CT::value_barrier<underlying_type>(v)) {}
_ZN5Botan2CT4MaskImE7is_zeroEm:
  437|  1.13M|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZNK5Botan2CT4MaskImE5valueEv:
  630|  1.69M|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZNK5Botan2CT4MaskImEcoEv:
  533|   525k|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CT4MaskImE6expandEm:
  392|   525k|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZN5Botan2CT6poisonImEEvPKT_m:
   56|     56|constexpr inline void poison(const T* p, size_t n) {
   57|       |#if defined(BOTAN_HAS_VALGRIND)
   58|       |   if(!std::is_constant_evaluated()) {
   59|       |      VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
   60|       |   }
   61|       |#endif
   62|       |
   63|     56|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  144|     56|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   64|     56|}
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   67|  81.2k|constexpr inline void unpoison(const T* p, size_t n) {
   68|       |#if defined(BOTAN_HAS_VALGRIND)
   69|       |   if(!std::is_constant_evaluated()) {
   70|       |      VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   71|       |   }
   72|       |#endif
   73|       |
   74|  81.2k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  144|  81.2k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   75|  81.2k|}
_ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_:
  128|    168|constexpr void unpoison(const R& r) {
  129|    168|   const std::span s{r};
  130|    168|   unpoison(s.data(), s.size());
  131|    168|}
_ZNK5Botan2CT4MaskImE6selectEmm:
  548|  21.2k|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CT9all_zerosImEENS0_4MaskIT_EEPKS3_m:
  785|  48.5k|constexpr inline CT::Mask<T> all_zeros(const T elem[], size_t len) {
  786|  48.5k|   T sum = 0;
  787|   345k|   for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (787:22): [True: 296k, False: 48.5k]
  ------------------
  788|   296k|      sum |= elem[i];
  789|   296k|   }
  790|  48.5k|   return CT::Mask<T>::is_zero(sum);
  791|  48.5k|}
_ZN5Botan2CT4MaskImEC2Em:
  637|  1.69M|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE7as_boolEv:
  614|  3.24k|      constexpr bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  598|  79.7k|      constexpr T unpoisoned_value() const {
  599|  79.7k|         T r = value();
  600|  79.7k|         CT::unpoison(r);
  601|  79.7k|         return r;
  602|  79.7k|      }
_ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_:
  112|  80.5k|constexpr void unpoison(const T& p) {
  113|  80.5k|   unpoison(&p, 1);
  114|  80.5k|}
_ZN5Botan2CT4MaskImE8is_equalEmm:
  442|  19.8k|      static constexpr Mask<T> is_equal(T x, T y) {
  443|  19.8k|         const T diff = value_barrier(x) ^ value_barrier(y);
  444|  19.8k|         return Mask<T>::is_zero(diff);
  445|  19.8k|      }
_ZNK5Botan2CT4MaskImE13if_set_returnEm:
  538|  2.82k|      constexpr T if_set_return(T x) const { return value() & x; }
_ZN5Botan2CT4MaskImE5is_ltEmm:
  450|  19.7k|      static constexpr Mask<T> is_lt(T x, T y) {
  451|  19.7k|         T u = x ^ ((x ^ y) | ((x - y) ^ x));
  452|  19.7k|         return Mask<T>::expand_top_bit(u);
  453|  19.7k|      }
_ZN5Botan2CT4MaskImE14expand_top_bitEm:
  415|  19.7k|      static constexpr Mask<T> expand_top_bit(T v) { return Mask<T>(ct_expand_top_bit<T>(v)); }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  738|     56|constexpr inline Mask<T> conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  739|     56|   const auto mask = CT::Mask<T>::expand(cnd);
  740|     56|   return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems);
  741|     56|}
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m:
  732|     56|constexpr inline Mask<T> conditional_copy_mem(Mask<T> mask, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  733|     56|   mask.select_n(dest, if_set, if_unset, elems);
  734|     56|   return mask;
  735|     56|}
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  565|   453k|      constexpr void select_n(T output[], const T x[], const T y[], size_t len) const {
  566|   453k|         const T mask = value();
  567|  3.32M|         for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (567:28): [True: 2.86M, False: 453k]
  ------------------
  568|  2.86M|            output[i] = choose(mask, x[i], y[i]);
  569|  2.86M|         }
  570|   453k|      }
_ZNK5Botan2CT4MaskImE11select_maskES2_S2_:
  559|  18.3k|      Mask<T> select_mask(Mask<T> x, Mask<T> y) const { return Mask<T>(select(x.value(), y.value())); }
_ZN5Botan2CT4MaskImEaNES2_:
  494|     58|      Mask<T>& operator&=(Mask<T> o) {
  495|     58|         m_mask &= o.value();
  496|     58|         return (*this);
  497|     58|      }
_ZNK5Botan2CT4MaskImE9as_choiceEv:
  619|  76.5k|      constexpr CT::Choice as_choice() const {
  620|  76.5k|         if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) {
  621|  76.5k|            return CT::Choice::from_mask(static_cast<Choice::underlying_type>(unpoisoned_value()));
  622|       |         } else {
  623|       |            return CT::Choice::from_int(unpoisoned_value());
  624|       |         }
  625|  76.5k|      }
_ZN5Botan2CT6Choice8from_intIjQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_:
  268|     63|      constexpr static Choice from_int(T v) {
  269|     63|         if constexpr(sizeof(T) <= sizeof(underlying_type)) {
  270|     63|            return !Choice(ct_is_zero<underlying_type>(v));
  271|       |         } else {
  272|       |            // Mask of T that is either |0| or |1|
  273|       |            const T v_is_0 = ct_is_zero<T>(value_barrier<T>(v));
  274|       |
  275|       |            // We want the mask to be set if v != 0 so we must check that
  276|       |            // v_is_0 is itself zero.
  277|       |            //
  278|       |            // Also sizeof(T) may not equal sizeof(underlying_type) so we must
  279|       |            // use ct_is_zero<underlying_type>. It's ok to either truncate or
  280|       |            // zero extend v_is_0 to 32 bits since we know it is |0| or |1|
  281|       |            // so even just the low bit is sufficient.
  282|       |            return Choice(ct_is_zero<underlying_type>(static_cast<underlying_type>(v_is_0)));
  283|       |         }
  284|     63|      }
_ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_:
  121|     56|constexpr void poison(const R& r) {
  122|     56|   const std::span s{r};
  123|     56|   poison(s.data(), s.size());
  124|     56|}
_ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_:
  128|     56|constexpr void unpoison(const R& r) {
  129|     56|   const std::span s{r};
  130|     56|   unpoison(s.data(), s.size());
  131|     56|}
_ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m:
  749|   453k|constexpr inline Mask<T> conditional_assign_mem(T cnd, T* dest, const T* src, size_t elems) {
  750|   453k|   const auto mask = CT::Mask<T>::expand(cnd);
  751|   453k|   mask.select_n(dest, src, dest, elems);
  752|   453k|   return mask;
  753|   453k|}
_ZNK5Botan2CT6Choice12into_bitmaskImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES3_v:
  291|  70.6k|      constexpr T into_bitmask() const {
  292|  70.6k|         if constexpr(sizeof(T) <= sizeof(underlying_type)) {
  293|       |            // The inner mask is already |0| or |1| so just truncate
  294|  70.6k|            return static_cast<T>(value());
  295|       |         } else {
  296|       |            return ~ct_is_zero<T>(value());
  297|       |         }
  298|  70.6k|      }
_ZN5Botan2CT8is_equalImEENS0_4MaskIT_EEPKS3_S6_m:
  798|  29.4k|constexpr inline CT::Mask<T> is_equal(const T x[], const T y[], size_t len) {
  799|  29.4k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (799:7): [Folded, False: 29.4k]
  ------------------
  800|      0|      T difference = 0;
  801|       |
  802|      0|      for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (802:25): [True: 0, False: 0]
  ------------------
  803|      0|         difference = difference | (x[i] ^ y[i]);
  804|      0|      }
  805|       |
  806|      0|      return CT::Mask<T>::is_zero(difference);
  807|  29.4k|   } else {
  808|  29.4k|      volatile T difference = 0;
  809|       |
  810|   151k|      for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (810:25): [True: 121k, False: 29.4k]
  ------------------
  811|   121k|         difference = difference | (x[i] ^ y[i]);
  812|   121k|      }
  813|       |
  814|  29.4k|      return CT::Mask<T>::is_zero(difference);
  815|  29.4k|   }
  816|  29.4k|}
_ZN5Botan2CT4MaskIhE8is_equalEhh:
  442|  2.03k|      static constexpr Mask<T> is_equal(T x, T y) {
  443|  2.03k|         const T diff = value_barrier(x) ^ value_barrier(y);
  444|  2.03k|         return Mask<T>::is_zero(diff);
  445|  2.03k|      }
_ZNK5Botan2CT4MaskIhE9as_choiceEv:
  619|  2.03k|      constexpr CT::Choice as_choice() const {
  620|       |         if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) {
  621|       |            return CT::Choice::from_mask(static_cast<Choice::underlying_type>(unpoisoned_value()));
  622|  2.03k|         } else {
  623|  2.03k|            return CT::Choice::from_int(unpoisoned_value());
  624|  2.03k|         }
  625|  2.03k|      }
_ZN5Botan2CT6Choice8from_intIhQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_:
  268|  2.03k|      constexpr static Choice from_int(T v) {
  269|  2.03k|         if constexpr(sizeof(T) <= sizeof(underlying_type)) {
  270|  2.03k|            return !Choice(ct_is_zero<underlying_type>(v));
  271|       |         } else {
  272|       |            // Mask of T that is either |0| or |1|
  273|       |            const T v_is_0 = ct_is_zero<T>(value_barrier<T>(v));
  274|       |
  275|       |            // We want the mask to be set if v != 0 so we must check that
  276|       |            // v_is_0 is itself zero.
  277|       |            //
  278|       |            // Also sizeof(T) may not equal sizeof(underlying_type) so we must
  279|       |            // use ct_is_zero<underlying_type>. It's ok to either truncate or
  280|       |            // zero extend v_is_0 to 32 bits since we know it is |0| or |1|
  281|       |            // so even just the low bit is sufficient.
  282|       |            return Choice(ct_is_zero<underlying_type>(static_cast<underlying_type>(v_is_0)));
  283|       |         }
  284|  2.03k|      }
pcurves_brainpool256r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    360|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_brainpool256r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    360|      constexpr std::optional<T> as_optional_vartime() const {
  711|    360|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 214, False: 146]
  ------------------
  712|    214|            return {m_value};
  713|    214|         } else {
  714|    146|            return {};
  715|    146|         }
  716|    360|      }
_ZN5Botan2CT6Choice8from_intImQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_:
  268|  1.51k|      constexpr static Choice from_int(T v) {
  269|  1.51k|         if constexpr(sizeof(T) <= sizeof(underlying_type)) {
  270|  1.51k|            return !Choice(ct_is_zero<underlying_type>(v));
  271|       |         } else {
  272|       |            // Mask of T that is either |0| or |1|
  273|       |            const T v_is_0 = ct_is_zero<T>(value_barrier<T>(v));
  274|       |
  275|       |            // We want the mask to be set if v != 0 so we must check that
  276|       |            // v_is_0 is itself zero.
  277|       |            //
  278|       |            // Also sizeof(T) may not equal sizeof(underlying_type) so we must
  279|       |            // use ct_is_zero<underlying_type>. It's ok to either truncate or
  280|       |            // zero extend v_is_0 to 32 bits since we know it is |0| or |1|
  281|       |            // so even just the low bit is sufficient.
  282|       |            return Choice(ct_is_zero<underlying_type>(static_cast<underlying_type>(v_is_0)));
  283|       |         }
  284|  1.51k|      }
pcurves_brainpool512r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    238|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_brainpool512r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    238|      constexpr std::optional<T> as_optional_vartime() const {
  711|    238|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 158, False: 80]
  ------------------
  712|    158|            return {m_value};
  713|    158|         } else {
  714|     80|            return {};
  715|     80|         }
  716|    238|      }
pcurves_secp192r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    179|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_secp192r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    179|      constexpr std::optional<T> as_optional_vartime() const {
  711|    179|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 176, False: 3]
  ------------------
  712|    176|            return {m_value};
  713|    176|         } else {
  714|      3|            return {};
  715|      3|         }
  716|    179|      }
pcurves_secp224r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    283|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_secp224r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    283|      constexpr std::optional<T> as_optional_vartime() const {
  711|    283|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 192, False: 91]
  ------------------
  712|    192|            return {m_value};
  713|    192|         } else {
  714|     91|            return {};
  715|     91|         }
  716|    283|      }
pcurves_secp256r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    386|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_secp256r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    386|      constexpr std::optional<T> as_optional_vartime() const {
  711|    386|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 282, False: 104]
  ------------------
  712|    282|            return {m_value};
  713|    282|         } else {
  714|    104|            return {};
  715|    104|         }
  716|    386|      }
pcurves_secp384r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    168|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_secp384r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    168|      constexpr std::optional<T> as_optional_vartime() const {
  711|    168|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 166, False: 2]
  ------------------
  712|    166|            return {m_value};
  713|    166|         } else {
  714|      2|            return {};
  715|      2|         }
  716|    168|      }
pcurves_secp521r1.cpp:_ZN5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEEC2ESC_NS0_6ChoiceE:
  653|    374|      constexpr Option(T v, Choice valid) : m_has_value(valid), m_value(std::move(v)) {}
pcurves_secp521r1.cpp:_ZNK5Botan2CT6OptionINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEEE19as_optional_vartimeEv:
  710|    374|      constexpr std::optional<T> as_optional_vartime() const {
  711|    374|         if(m_has_value.as_bool()) {
  ------------------
  |  Branch (711:13): [True: 324, False: 50]
  ------------------
  712|    324|            return {m_value};
  713|    324|         } else {
  714|     50|            return {};
  715|     50|         }
  716|    374|      }

_ZNK5Botan13EC_Group_Data3oidEv:
  165|     28|      const OID& oid() const { return m_oid; }
_ZNK5Botan13EC_Group_Data1pEv:
  169|     14|      const BigInt& p() const { return m_p; }
_ZNK5Botan13EC_Group_Data5montyEv:
  184|     35|      const Montgomery_Params& monty() const { return m_monty; }
_ZNK5Botan13EC_Group_Data7p_wordsEv:
  201|      7|      size_t p_words() const { return m_p_words; }
_ZNK5Botan13EC_Group_Data6pcurveEv:
  282|  3.03k|      const PCurve::PrimeOrderCurve& pcurve() const {
  283|  3.03k|         BOTAN_ASSERT_NONNULL(m_pcurve);
  ------------------
  |  |  116|  3.03k|   do {                                                                                   \
  |  |  117|  3.03k|      if((ptr) == nullptr) {                                                              \
  |  |  ------------------
  |  |  |  Branch (117:10): [True: 0, False: 3.03k]
  |  |  ------------------
  |  |  118|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                              \
  |  |  119|      0|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |  120|      0|      }                                                                                   \
  |  |  121|  3.03k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (121:12): [Folded, False: 3.03k]
  |  |  ------------------
  ------------------
  284|  3.03k|         return *m_pcurve;
  285|  3.03k|      }
_ZN5Botan19EC_AffinePoint_DataD2Ev:
   73|  1.52k|      virtual ~EC_AffinePoint_Data() = default;

_ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_:
   46|  2.21k|constexpr inline std::optional<T> checked_mul(T a, T b) {
   47|       |   // Multiplication by 1U is a hack to work around C's insane
   48|       |   // integer promotion rules.
   49|       |   // https://stackoverflow.com/questions/24795651
   50|  2.21k|   const T r = (1U * a) * b;
   51|       |   // If a == 0 then the multiply certainly did not overflow
   52|       |   // Otherwise r / a == b unless overflow occurred
   53|  2.21k|   if(a != 0 && r / a != b) {
  ------------------
  |  Branch (53:7): [True: 2.21k, False: 0]
  |  Branch (53:17): [True: 0, False: 2.21k]
  ------------------
   54|      0|      return {};
   55|      0|   }
   56|  2.21k|   return r;
   57|  2.21k|}
_ZN5Botan11checked_addITkNSt3__117unsigned_integralEjEENS1_8optionalIT_EES3_S3_:
   19|      7|constexpr inline std::optional<T> checked_add(T a, T b) {
   20|      7|   const T r = a + b;
   21|      7|   if(r < a || r < b) {
  ------------------
  |  Branch (21:7): [True: 0, False: 7]
  |  Branch (21:16): [True: 0, False: 7]
  ------------------
   22|      0|      return {};
   23|      0|   }
   24|      7|   return r;
   25|      7|}
_ZN5Botan13swar_in_rangeITkNSt3__117unsigned_integralEmEET_S2_S2_S2_:
  114|  3.52k|constexpr T swar_in_range(T v, T lower, T upper) {
  115|       |   // The constant 0x808080... as a T
  116|  3.52k|   constexpr T hi1 = (static_cast<T>(-1) / 255) << 7;
  117|       |   // The constant 0x7F7F7F... as a T
  118|  3.52k|   constexpr T lo7 = ~hi1;
  119|       |
  120|  3.52k|   const T sub = ((v | hi1) - (lower & lo7)) ^ ((v ^ (~lower)) & hi1);
  121|  3.52k|   const T a_lo = sub & lo7;
  122|  3.52k|   const T a_hi = sub & hi1;
  123|  3.52k|   return (lo7 - a_lo + upper) & hi1 & ~a_hi;
  124|  3.52k|}
_ZN5Botan23index_of_first_set_byteITkNSt3__117unsigned_integralEmEEmT_:
  130|  3.52k|constexpr size_t index_of_first_set_byte(T v) {
  131|       |   // The constant 0x010101... as a T
  132|  3.52k|   constexpr T lo1 = (static_cast<T>(-1) / 255);
  133|       |   // The constant 0x808080... as a T
  134|  3.52k|   constexpr T hi1 = lo1 << 7;
  135|       |   // How many bits to shift in order to get the top byte
  136|  3.52k|   constexpr size_t bits = (sizeof(T) * 8) - 8;
  137|       |
  138|  3.52k|   return static_cast<size_t>((((((v & hi1) - 1) & lo1) * lo1) >> bits) - 1);
  139|  3.52k|}

_ZN5Botan6detail9store_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEEQnt15custom_storableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEEvS9_OT1_:
  525|  16.9k|inline constexpr void store_any(WrappedInT wrapped_in, OutR&& out_range) {
  526|  16.9k|   const auto in = detail::unwrap_strong_type_or_enum(wrapped_in);
  527|  16.9k|   using InT = decltype(in);
  528|  16.9k|   ranges::assert_exact_byte_length<sizeof(in)>(out_range);
  529|  16.9k|   const std::span out{out_range};
  530|       |
  531|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  532|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  533|       |   // in a `constexpr` context.
  534|  16.9k|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (534:7): [Folded, False: 16.9k]
  ------------------
  535|      0|      return fallback_store_any<endianness, InT>(in, std::forward<OutR>(out_range));
  536|  16.9k|   } else {
  537|       |      if constexpr(sizeof(InT) == 1) {
  538|       |         out[0] = static_cast<uint8_t>(in);
  539|       |      } else if constexpr(endianness == std::endian::native) {
  540|       |         typecast_copy(out, in);
  541|  16.9k|      } else {
  542|  16.9k|         static_assert(opposite(endianness) == std::endian::native);
  543|  16.9k|         typecast_copy(out, reverse_bytes(in));
  544|  16.9k|      }
  545|  16.9k|   }
  546|  16.9k|}
_ZN5Botan6detail26unwrap_strong_type_or_enumITkNS0_20unsigned_integralishEmEEDaT_:
  190|  16.9k|constexpr auto unwrap_strong_type_or_enum(InT t) {
  191|       |   if constexpr(std::is_enum_v<InT>) {
  192|       |      // TODO: C++23: use std::to_underlying(in) instead
  193|       |      return static_cast<std::underlying_type_t<InT>>(t);
  194|  16.9k|   } else {
  195|  16.9k|      return Botan::unwrap_strong_type(t);
  196|  16.9k|   }
  197|  16.9k|}
_ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_:
  504|    216|inline constexpr auto load_be(ParamTs&&... params) {
  505|    216|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|    216|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  17.0k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  17.0k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  17.0k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  17.0k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  17.0k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  17.0k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  17.0k|      } else {
  289|  17.0k|         const std::span in{in_range};
  290|  17.0k|         if constexpr(sizeof(OutT) == 1) {
  291|  17.0k|            return static_cast<OutT>(in[0]);
  292|  17.0k|         } else if constexpr(endianness == std::endian::native) {
  293|  17.0k|            return typecast_copy<OutT>(in);
  294|  17.0k|         } else {
  295|  17.0k|            static_assert(opposite(endianness) == std::endian::native);
  296|  17.0k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  17.0k|         }
  298|  17.0k|      }
  299|  17.0k|   }());
  300|  17.0k|}
_ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_:
  200|  17.0k|constexpr auto wrap_strong_type_or_enum(T t) {
  201|       |   if constexpr(std::is_enum_v<OutT>) {
  202|       |      return static_cast<OutT>(t);
  203|  17.0k|   } else {
  204|  17.0k|      return Botan::wrap_strong_type<OutT>(t);
  205|  17.0k|   }
  206|  17.0k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  17.0k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  17.0k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 17.0k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  17.0k|      } else {
  289|  17.0k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  17.0k|         } else {
  295|  17.0k|            static_assert(opposite(endianness) == std::endian::native);
  296|  17.0k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  17.0k|         }
  298|  17.0k|      }
  299|  17.0k|   }());
_ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_:
  504|     12|inline constexpr auto load_be(ParamTs&&... params) {
  505|     12|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|     12|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|     12|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|     12|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|     12|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|     12|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|     12|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|     12|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|     12|      } else {
  289|     12|         const std::span in{in_range};
  290|     12|         if constexpr(sizeof(OutT) == 1) {
  291|     12|            return static_cast<OutT>(in[0]);
  292|     12|         } else if constexpr(endianness == std::endian::native) {
  293|     12|            return typecast_copy<OutT>(in);
  294|     12|         } else {
  295|     12|            static_assert(opposite(endianness) == std::endian::native);
  296|     12|            return reverse_bytes(typecast_copy<OutT>(in));
  297|     12|         }
  298|     12|      }
  299|     12|   }());
  300|     12|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|     12|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|     12|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 12]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|     12|      } else {
  289|     12|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|     12|         } else {
  295|     12|            static_assert(opposite(endianness) == std::endian::native);
  296|     12|            return reverse_bytes(typecast_copy<OutT>(in));
  297|     12|         }
  298|     12|      }
  299|     12|   }());
_ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_:
  582|  16.9k|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, Ts... ins) {
  583|  16.9k|   ranges::assert_exact_byte_length<(sizeof(Ts) + ...)>(out);
  584|  16.9k|   auto store_one = [off = 0]<typename T>(auto o, T i) mutable {
  585|  16.9k|      store_any<endianness, T>(i, o.subspan(off).template first<sizeof(T)>());
  586|  16.9k|      off += sizeof(T);
  587|  16.9k|   };
  588|       |
  589|  16.9k|   (store_one(std::span{out}, ins), ...);
  590|  16.9k|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEENS2_4spanIhLm8EEETpTkNS0_20unsigned_integralishEJmEQaagtsZT2_Li0Eooaasr3stdE7same_asINS0_10AutoDetectET0_E10all_same_vIDpT2_Eaa20unsigned_integralishIS9_E10all_same_vIS9_SB_EEEvOT1_SB_ENUlTyS9_T_E_clImS7_EEDaS9_SE_:
  584|  16.9k|   auto store_one = [off = 0]<typename T>(auto o, T i) mutable {
  585|  16.9k|      store_any<endianness, T>(i, o.subspan(off).template first<sizeof(T)>());
  586|  16.9k|      off += sizeof(T);
  587|  16.9k|   };
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm32EEERNS3_5arrayImLm4EEEEEEDaDpOT0_:
  745|    992|inline constexpr auto store_be(ParamTs&&... params) {
  746|    992|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    992|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_:
  603|    992|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    992|   ranges::assert_equal_byte_lengths(out, in);
  605|    992|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    992|   auto store_elementwise = [&] {
  608|    992|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    992|      std::span<uint8_t> out_s(out);
  610|    992|      for(auto in_elem : in) {
  611|    992|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    992|         out_s = out_s.subspan(bytes_per_element);
  613|    992|      }
  614|    992|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    992|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 992]
  ------------------
  620|      0|      store_elementwise();
  621|    992|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    992|      } else {
  625|    992|         store_elementwise();
  626|    992|      }
  627|    992|   }
  628|    992|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm32EEETkNS5_14spanable_rangeENS2_5arrayImLm4EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv:
  607|    992|   auto store_elementwise = [&] {
  608|    992|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    992|      std::span<uint8_t> out_s(out);
  610|  3.96k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 3.96k, False: 992]
  ------------------
  611|  3.96k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  3.96k|         out_s = out_s.subspan(bytes_per_element);
  613|  3.96k|      }
  614|    992|   };
_ZN5Botan7load_beImJPKhmEEEDaDpOT0_:
  504|  16.8k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  16.8k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  16.8k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmEET0_PKhm:
  454|  16.8k|inline constexpr OutT load_any(const uint8_t in[], size_t off) {
  455|       |   // asserts that *in points to enough bytes to read at offset off
  456|  16.8k|   constexpr size_t out_size = sizeof(OutT);
  457|  16.8k|   return load_any<endianness, OutT>(std::span<const uint8_t, out_size>(in + off * out_size, out_size));
  458|  16.8k|}
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm48EEERNS3_5arrayImLm6EEEEEEDaDpOT0_:
  745|    332|inline constexpr auto store_be(ParamTs&&... params) {
  746|    332|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    332|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_:
  603|    332|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    332|   ranges::assert_equal_byte_lengths(out, in);
  605|    332|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    332|   auto store_elementwise = [&] {
  608|    332|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    332|      std::span<uint8_t> out_s(out);
  610|    332|      for(auto in_elem : in) {
  611|    332|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    332|         out_s = out_s.subspan(bytes_per_element);
  613|    332|      }
  614|    332|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    332|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 332]
  ------------------
  620|      0|      store_elementwise();
  621|    332|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    332|      } else {
  625|    332|         store_elementwise();
  626|    332|      }
  627|    332|   }
  628|    332|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm48EEETkNS5_14spanable_rangeENS2_5arrayImLm6EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv:
  607|    332|   auto store_elementwise = [&] {
  608|    332|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    332|      std::span<uint8_t> out_s(out);
  610|  1.99k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 1.99k, False: 332]
  ------------------
  611|  1.99k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  1.99k|         out_s = out_s.subspan(bytes_per_element);
  613|  1.99k|      }
  614|    332|   };
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm64EEERNS3_5arrayImLm8EEEEEEDaDpOT0_:
  745|    316|inline constexpr auto store_be(ParamTs&&... params) {
  746|    316|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    316|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_:
  603|    316|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    316|   ranges::assert_equal_byte_lengths(out, in);
  605|    316|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    316|   auto store_elementwise = [&] {
  608|    316|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    316|      std::span<uint8_t> out_s(out);
  610|    316|      for(auto in_elem : in) {
  611|    316|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    316|         out_s = out_s.subspan(bytes_per_element);
  613|    316|      }
  614|    316|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    316|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 316]
  ------------------
  620|      0|      store_elementwise();
  621|    316|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    316|      } else {
  625|    316|         store_elementwise();
  626|    316|      }
  627|    316|   }
  628|    316|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm64EEETkNS5_14spanable_rangeENS2_5arrayImLm8EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv:
  607|    316|   auto store_elementwise = [&] {
  608|    316|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    316|      std::span<uint8_t> out_s(out);
  610|  2.52k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 2.52k, False: 316]
  ------------------
  611|  2.52k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  2.52k|         out_s = out_s.subspan(bytes_per_element);
  613|  2.52k|      }
  614|    316|   };
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm9EEEEEEDaDpOT0_:
  745|    648|inline constexpr auto store_be(ParamTs&&... params) {
  746|    648|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    648|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_:
  663|    648|inline constexpr auto store_any(InR&& in_range) {
  664|    648|   auto out = []([[maybe_unused]] const auto& in) {
  665|    648|      if constexpr(std::same_as<AutoDetect, OutR>) {
  666|    648|         if constexpr(ranges::statically_spanable_range<InR>) {
  667|    648|            constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t<InR>);
  668|    648|            return std::array<uint8_t, bytes>();
  669|    648|         } else {
  670|    648|            static_assert(
  671|    648|               !std::same_as<AutoDetect, OutR>,
  672|    648|               "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly");
  673|    648|         }
  674|    648|      } else if constexpr(concepts::resizable_byte_buffer<OutR>) {
  675|    648|         return OutR(std::span{in}.size_bytes());
  676|    648|      } else {
  677|    648|         return OutR{};
  678|    648|      }
  679|    648|   }(in_range);
  680|       |
  681|    648|   store_any<endianness, std::ranges::range_value_t<InR>>(out, std::forward<InR>(in_range));
  682|    648|   return out;
  683|    648|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm9EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_:
  664|    648|   auto out = []([[maybe_unused]] const auto& in) {
  665|    648|      if constexpr(std::same_as<AutoDetect, OutR>) {
  666|    648|         if constexpr(ranges::statically_spanable_range<InR>) {
  667|    648|            constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t<InR>);
  668|    648|            return std::array<uint8_t, bytes>();
  669|       |         } else {
  670|       |            static_assert(
  671|       |               !std::same_as<AutoDetect, OutR>,
  672|       |               "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly");
  673|       |         }
  674|       |      } else if constexpr(concepts::resizable_byte_buffer<OutR>) {
  675|       |         return OutR(std::span{in}.size_bytes());
  676|       |      } else {
  677|       |         return OutR{};
  678|       |      }
  679|    648|   }(in_range);
_ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_:
  603|    648|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    648|   ranges::assert_equal_byte_lengths(out, in);
  605|    648|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    648|   auto store_elementwise = [&] {
  608|    648|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    648|      std::span<uint8_t> out_s(out);
  610|    648|      for(auto in_elem : in) {
  611|    648|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    648|         out_s = out_s.subspan(bytes_per_element);
  613|    648|      }
  614|    648|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    648|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 648]
  ------------------
  620|      0|      store_elementwise();
  621|    648|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    648|      } else {
  625|    648|         store_elementwise();
  626|    648|      }
  627|    648|   }
  628|    648|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm72EEETkNS4_14spanable_rangeENS6_ImLm9EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv:
  607|    648|   auto store_elementwise = [&] {
  608|    648|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    648|      std::span<uint8_t> out_s(out);
  610|  5.83k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 5.83k, False: 648]
  ------------------
  611|  5.83k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  5.83k|         out_s = out_s.subspan(bytes_per_element);
  613|  5.83k|      }
  614|    648|   };
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__14spanIhLm24EEERNS3_5arrayImLm3EEEEEEDaDpOT0_:
  745|    352|inline constexpr auto store_be(ParamTs&&... params) {
  746|    352|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    352|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm24EEETkNS5_14spanable_rangeENS2_5arrayImLm3EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_:
  603|    352|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    352|   ranges::assert_equal_byte_lengths(out, in);
  605|    352|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    352|   auto store_elementwise = [&] {
  608|    352|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    352|      std::span<uint8_t> out_s(out);
  610|    352|      for(auto in_elem : in) {
  611|    352|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    352|         out_s = out_s.subspan(bytes_per_element);
  613|    352|      }
  614|    352|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    352|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 352]
  ------------------
  620|      0|      store_elementwise();
  621|    352|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    352|      } else {
  625|    352|         store_elementwise();
  626|    352|      }
  627|    352|   }
  628|    352|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges23contiguous_output_rangeIhEERNS2_4spanIhLm24EEETkNS5_14spanable_rangeENS2_5arrayImLm3EEEQoosr3stdE7same_asIS4_T0_Esr3stdE7same_asISC_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISK_EESL_E4type10value_typeEEEEvOT1_RKSH_ENKUlvE_clEv:
  607|    352|   auto store_elementwise = [&] {
  608|    352|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    352|      std::span<uint8_t> out_s(out);
  610|  1.05k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 1.05k, False: 352]
  ------------------
  611|  1.05k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  1.05k|         out_s = out_s.subspan(bytes_per_element);
  613|  1.05k|      }
  614|    352|   };
_ZN5Botan8store_beINS_6detail10AutoDetectEJRNSt3__15arrayImLm4EEEEEEDaDpOT0_:
  745|    384|inline constexpr auto store_be(ParamTs&&... params) {
  746|    384|   return detail::store_any<std::endian::big, ModifierT>(std::forward<ParamTs>(params)...);
  747|    384|}
_ZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_:
  663|    384|inline constexpr auto store_any(InR&& in_range) {
  664|    384|   auto out = []([[maybe_unused]] const auto& in) {
  665|    384|      if constexpr(std::same_as<AutoDetect, OutR>) {
  666|    384|         if constexpr(ranges::statically_spanable_range<InR>) {
  667|    384|            constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t<InR>);
  668|    384|            return std::array<uint8_t, bytes>();
  669|    384|         } else {
  670|    384|            static_assert(
  671|    384|               !std::same_as<AutoDetect, OutR>,
  672|    384|               "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly");
  673|    384|         }
  674|    384|      } else if constexpr(concepts::resizable_byte_buffer<OutR>) {
  675|    384|         return OutR(std::span{in}.size_bytes());
  676|    384|      } else {
  677|    384|         return OutR{};
  678|    384|      }
  679|    384|   }(in_range);
  680|       |
  681|    384|   store_any<endianness, std::ranges::range_value_t<InR>>(out, std::forward<InR>(in_range));
  682|    384|   return out;
  683|    384|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206ENS0_10AutoDetectETkNS_6ranges14spanable_rangeERNS2_5arrayImLm4EEEQoooosr3stdE7same_asIS4_T0_Eaasr6rangesE25statically_spanable_rangeIS9_Esr3stdE21default_initializableIS9_Esr8conceptsE21resizable_byte_bufferIS9_EEEDaOT1_ENKUlRKT_E_clIS7_EEDaSE_:
  664|    384|   auto out = []([[maybe_unused]] const auto& in) {
  665|    384|      if constexpr(std::same_as<AutoDetect, OutR>) {
  666|    384|         if constexpr(ranges::statically_spanable_range<InR>) {
  667|    384|            constexpr size_t bytes = decltype(std::span{in})::extent * sizeof(std::ranges::range_value_t<InR>);
  668|    384|            return std::array<uint8_t, bytes>();
  669|       |         } else {
  670|       |            static_assert(
  671|       |               !std::same_as<AutoDetect, OutR>,
  672|       |               "cannot infer a suitable result container type from the given parameters at compile time, please specify it explicitly");
  673|       |         }
  674|       |      } else if constexpr(concepts::resizable_byte_buffer<OutR>) {
  675|       |         return OutR(std::span{in}.size_bytes());
  676|       |      } else {
  677|       |         return OutR{};
  678|       |      }
  679|    384|   }(in_range);
_ZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_:
  603|    384|inline constexpr void store_any(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  604|    384|   ranges::assert_equal_byte_lengths(out, in);
  605|    384|   using element_type = std::ranges::range_value_t<InR>;
  606|       |
  607|    384|   auto store_elementwise = [&] {
  608|    384|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    384|      std::span<uint8_t> out_s(out);
  610|    384|      for(auto in_elem : in) {
  611|    384|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|    384|         out_s = out_s.subspan(bytes_per_element);
  613|    384|      }
  614|    384|   };
  615|       |
  616|       |   // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  617|       |   // internally to copy ranges on a byte-by-byte basis, which is not allowed
  618|       |   // in a `constexpr` context.
  619|    384|   if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (619:7): [Folded, False: 384]
  ------------------
  620|      0|      store_elementwise();
  621|    384|   } else {
  622|       |      if constexpr(endianness == std::endian::native && !custom_storable<element_type>) {
  623|       |         typecast_copy(out, in);
  624|    384|      } else {
  625|    384|         store_elementwise();
  626|    384|      }
  627|    384|   }
  628|    384|}
_ZZN5Botan6detail9store_anyILNSt3__16endianE64206EmTkNS_6ranges23contiguous_output_rangeIhEERNS2_5arrayIhLm32EEETkNS4_14spanable_rangeENS6_ImLm4EEEQoosr3stdE7same_asINS0_10AutoDetectET0_Esr3stdE7same_asISB_NS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT2_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISJ_EESK_E4type10value_typeEEEEvOT1_RKSG_ENKUlvE_clEv:
  607|    384|   auto store_elementwise = [&] {
  608|    384|      constexpr size_t bytes_per_element = sizeof(element_type);
  609|    384|      std::span<uint8_t> out_s(out);
  610|  1.53k|      for(auto in_elem : in) {
  ------------------
  |  Branch (610:24): [True: 1.53k, False: 384]
  ------------------
  611|  1.53k|         store_any<endianness, element_type>(out_s.template first<bytes_per_element>(), in_elem);
  612|  1.53k|         out_s = out_s.subspan(bytes_per_element);
  613|  1.53k|      }
  614|    384|   };

_ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m:
   37|    417|inline void zeroize_buffer(T buf[], size_t n) {
   38|    417|   if(n > 0) {
  ------------------
  |  Branch (38:7): [True: 411, False: 6]
  ------------------
   39|    411|      std::memset(buf, 0, sizeof(T) * n);
   40|    411|   }
   41|    417|}
_ZN5Botan21unchecked_copy_memoryITkNSt3__117unsigned_integralEmEEvPT_PKS2_m:
   44|    162|inline void unchecked_copy_memory(T* out, const T* in, size_t n) {
   45|    162|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (45:7): [True: 162, False: 0]
  |  Branch (45:24): [True: 162, False: 0]
  |  Branch (45:42): [True: 162, False: 0]
  ------------------
   46|    162|      std::memmove(out, in, sizeof(T) * n);
   47|    162|   }
   48|    162|}

_ZNK5Botan17Montgomery_Params1pEv:
   41|     28|      const BigInt& p() const { return m_data->p(); }
_ZNK5Botan17Montgomery_Params2R1Ev:
   43|      7|      const BigInt& R1() const { return m_data->r1(); }
_ZNK5Botan17Montgomery_Params2R2Ev:
   45|     28|      const BigInt& R2() const { return m_data->r2(); }
_ZNK5Botan17Montgomery_Params6p_dashEv:
   49|     28|      word p_dash() const { return m_data->p_dash(); }
_ZNK5Botan17Montgomery_Params7p_wordsEv:
   51|     42|      size_t p_words() const { return m_data->p_size(); }
_ZNK5Botan17Montgomery_Params4Data1pEv:
   76|     28|            const BigInt& p() const { return m_p; }
_ZNK5Botan17Montgomery_Params4Data2r1Ev:
   78|      7|            const BigInt& r1() const { return m_r1; }
_ZNK5Botan17Montgomery_Params4Data2r2Ev:
   80|     28|            const BigInt& r2() const { return m_r2; }
_ZNK5Botan17Montgomery_Params4Data6p_dashEv:
   84|     28|            word p_dash() const { return m_p_dash; }
_ZNK5Botan17Montgomery_Params4Data6p_sizeEv:
   86|     42|            size_t p_size() const { return m_p_words; }

_ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  268|    471|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W {
  269|    471|#if defined(BOTAN_MP_USE_X86_64_ASM)
  270|    471|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (270:7): [True: 0, Folded]
  |  Branch (270:36): [True: 0, Folded]
  ------------------
  271|    471|      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  272|    471|                   : [carry] "=r"(carry)
  273|    471|                   : [x] "r"(x), [y] "r"(y), "0"(carry)
  274|    471|                   : "cc", "memory");
  275|    471|      return carry;
  276|    471|   }
  277|      0|#endif
  278|       |
  279|      0|   x[0] = word_add(x[0], y[0], &carry);
  280|      0|   x[1] = word_add(x[1], y[1], &carry);
  281|      0|   x[2] = word_add(x[2], y[2], &carry);
  282|      0|   x[3] = word_add(x[3], y[3], &carry);
  283|      0|   x[4] = word_add(x[4], y[4], &carry);
  284|      0|   x[5] = word_add(x[5], y[5], &carry);
  285|      0|   x[6] = word_add(x[6], y[6], &carry);
  286|      0|   x[7] = word_add(x[7], y[7], &carry);
  287|      0|   return carry;
  288|    471|}
_ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_:
  231|  9.80M|inline constexpr auto word_add(W x, W y, W* carry) -> W {
  232|  9.80M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
  233|  9.80M|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (233:7): [True: 9.80M, Folded]
  ------------------
  234|       |      if constexpr(std::same_as<W, unsigned int>) {
  235|       |         return __builtin_addc(x, y, *carry & 1, carry);
  236|  9.80M|      } else if constexpr(std::same_as<W, unsigned long>) {
  237|  9.80M|         return __builtin_addcl(x, y, *carry & 1, carry);
  238|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  239|       |         return __builtin_addcll(x, y, *carry & 1, carry);
  240|       |      }
  241|  9.80M|   }
  242|      0|#endif
  243|       |
  244|       |   if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
  245|       |      /*
  246|       |      TODO(Botan4) this is largely a performance hack for GCCs that don't
  247|       |      support __builtin_addc, if we increase the minimum supported version of
  248|       |      GCC to GCC 14 then we can remove this and not worry about it
  249|       |      */
  250|       |      const W cb = *carry & 1;
  251|       |      const auto s = typename WordInfo<W>::dword(x) + y + cb;
  252|       |      *carry = static_cast<W>(s >> WordInfo<W>::bits);
  253|       |      return static_cast<W>(s);
  254|  9.80M|   } else {
  255|  9.80M|      const W cb = *carry & 1;
  256|  9.80M|      W z = x + y;
  257|  9.80M|      W c1 = (z < x);
  258|  9.80M|      z += cb;
  259|  9.80M|      *carry = c1 | (z < cb);
  260|  9.80M|      return z;
  261|  9.80M|   }
  262|  9.80M|}
_ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  345|     95|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W {
  346|     95|#if defined(BOTAN_MP_USE_X86_64_ASM)
  347|     95|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (347:7): [True: 0, Folded]
  |  Branch (347:36): [True: 0, Folded]
  ------------------
  348|     95|      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
  349|     95|                   : [carry] "=r"(carry)
  350|     95|                   : [x] "r"(x), [y] "r"(y), "0"(carry)
  351|     95|                   : "cc", "memory");
  352|     95|      return carry;
  353|     95|   }
  354|      0|#endif
  355|       |
  356|      0|   x[0] = word_sub(x[0], y[0], &carry);
  357|      0|   x[1] = word_sub(x[1], y[1], &carry);
  358|      0|   x[2] = word_sub(x[2], y[2], &carry);
  359|      0|   x[3] = word_sub(x[3], y[3], &carry);
  360|      0|   x[4] = word_sub(x[4], y[4], &carry);
  361|      0|   x[5] = word_sub(x[5], y[5], &carry);
  362|      0|   x[6] = word_sub(x[6], y[6], &carry);
  363|      0|   x[7] = word_sub(x[7], y[7], &carry);
  364|      0|   return carry;
  365|     95|}
_ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_:
  320|  12.7M|inline constexpr auto word_sub(W x, W y, W* carry) -> W {
  321|  12.7M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
  322|  12.7M|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (322:7): [True: 12.7M, Folded]
  ------------------
  323|       |      if constexpr(std::same_as<W, unsigned int>) {
  324|       |         return __builtin_subc(x, y, *carry & 1, carry);
  325|  12.7M|      } else if constexpr(std::same_as<W, unsigned long>) {
  326|  12.7M|         return __builtin_subcl(x, y, *carry & 1, carry);
  327|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  328|       |         return __builtin_subcll(x, y, *carry & 1, carry);
  329|       |      }
  330|  12.7M|   }
  331|      0|#endif
  332|       |
  333|      0|   const W cb = *carry & 1;
  334|  12.7M|   W t0 = x - y;
  335|  12.7M|   W c1 = (t0 > x);
  336|  12.7M|   W z = t0 - cb;
  337|  12.7M|   *carry = c1 | (z > t0);
  338|  12.7M|   return z;
  339|  12.7M|}
_ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  371|  1.17k|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W {
  372|  1.17k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  373|  1.17k|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (373:7): [True: 0, Folded]
  |  Branch (373:36): [True: 0, Folded]
  ------------------
  374|  1.17k|      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  375|  1.17k|                   : [carry] "=r"(carry)
  376|  1.17k|                   : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  377|  1.17k|                   : "cc", "memory");
  378|  1.17k|      return carry;
  379|  1.17k|   }
  380|      0|#endif
  381|       |
  382|      0|   z[0] = word_sub(x[0], y[0], &carry);
  383|      0|   z[1] = word_sub(x[1], y[1], &carry);
  384|      0|   z[2] = word_sub(x[2], y[2], &carry);
  385|      0|   z[3] = word_sub(x[3], y[3], &carry);
  386|      0|   z[4] = word_sub(x[4], y[4], &carry);
  387|      0|   z[5] = word_sub(x[5], y[5], &carry);
  388|      0|   z[6] = word_sub(x[6], y[6], &carry);
  389|      0|   z[7] = word_sub(x[7], y[7], &carry);
  390|      0|   return carry;
  391|  1.17k|}
_ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  294|      4|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W {
  295|      4|#if defined(BOTAN_MP_USE_X86_64_ASM)
  296|      4|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (296:7): [True: 0, Folded]
  |  Branch (296:36): [True: 0, Folded]
  ------------------
  297|      4|      asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  298|      4|                   : [carry] "=r"(carry)
  299|      4|                   : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  300|      4|                   : "cc", "memory");
  301|      4|      return carry;
  302|      4|   }
  303|      0|#endif
  304|       |
  305|      0|   z[0] = word_add(x[0], y[0], &carry);
  306|      0|   z[1] = word_add(x[1], y[1], &carry);
  307|      0|   z[2] = word_add(x[2], y[2], &carry);
  308|      0|   z[3] = word_add(x[3], y[3], &carry);
  309|      0|   z[4] = word_add(x[4], y[4], &carry);
  310|      0|   z[5] = word_add(x[5], y[5], &carry);
  311|      0|   z[6] = word_add(x[6], y[6], &carry);
  312|      0|   z[7] = word_add(x[7], y[7], &carry);
  313|      0|   return carry;
  314|      4|}
_ZN5Botan13word8_linmul3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  397|     42|inline constexpr auto word8_linmul3(W z[8], const W x[8], W y, W carry) -> W {
  398|     42|#if defined(BOTAN_MP_USE_X86_64_ASM)
  399|     42|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (399:7): [True: 0, Folded]
  |  Branch (399:36): [True: 0, Folded]
  ------------------
  400|     42|      asm(DO_8_TIMES(LINMUL_OP, "z")
  401|     42|          : [carry] "=r"(carry)
  402|     42|          : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  403|     42|          : "cc", "%rax", "%rdx", "memory");
  404|     42|      return carry;
  405|     42|   }
  406|      0|#endif
  407|       |
  408|      0|   z[0] = word_madd2(x[0], y, &carry);
  409|      0|   z[1] = word_madd2(x[1], y, &carry);
  410|      0|   z[2] = word_madd2(x[2], y, &carry);
  411|      0|   z[3] = word_madd2(x[3], y, &carry);
  412|      0|   z[4] = word_madd2(x[4], y, &carry);
  413|      0|   z[5] = word_madd2(x[5], y, &carry);
  414|      0|   z[6] = word_madd2(x[6], y, &carry);
  415|      0|   z[7] = word_madd2(x[7], y, &carry);
  416|      0|   return carry;
  417|     42|}
_ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_:
   90|    640|inline constexpr auto word_madd2(W a, W b, W* c) -> W {
   91|    640|#if defined(BOTAN_MP_USE_X86_64_ASM)
   92|    640|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (92:7): [True: 0, Folded]
  |  Branch (92:36): [True: 0, Folded]
  ------------------
   93|    640|      asm(R"(
   94|    640|         mulq %[b]
   95|    640|         addq %[c],%[a]
   96|    640|         adcq $0,%[carry]
   97|    640|         )"
   98|    640|          : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
   99|    640|          : "0"(a), "1"(b), [c] "g"(*c)
  100|    640|          : "cc");
  101|       |
  102|    640|      return a;
  103|    640|   }
  104|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  105|       |   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  106|       |      W lo = 0;
  107|       |      W hi = 0;
  108|       |      asm(R"(
  109|       |         mul  %[lo], %[a], %[b]
  110|       |         umulh %[hi], %[a], %[b]
  111|       |         adds %[lo], %[lo], %[c]
  112|       |         adc  %[hi], %[hi], xzr
  113|       |         )"
  114|       |          : [lo] "=&r"(lo), [hi] "=&r"(hi)
  115|       |          : [a] "r"(a), [b] "r"(b), [c] "r"(*c)
  116|       |          : "cc");
  117|       |
  118|       |      *c = hi;
  119|       |      return lo;
  120|       |   }
  121|       |#endif
  122|       |
  123|      0|   typedef typename WordInfo<W>::dword dword;
  124|      0|   const dword s = dword(a) * b + *c;
  125|      0|   *c = static_cast<W>(s >> WordInfo<W>::bits);
  126|      0|   return static_cast<W>(s);
  127|    640|}
_ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  423|    152|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W {
  424|    152|#if defined(BOTAN_MP_USE_X86_64_ASM)
  425|    152|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (425:7): [True: 0, Folded]
  |  Branch (425:36): [True: 0, Folded]
  ------------------
  426|    152|      asm(DO_8_TIMES(MULADD_OP, "")
  427|    152|          : [carry] "=r"(carry)
  428|    152|          : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  429|    152|          : "cc", "%rax", "%rdx", "memory");
  430|    152|      return carry;
  431|    152|   }
  432|      0|#endif
  433|       |
  434|      0|   z[0] = word_madd3(x[0], y, z[0], &carry);
  435|      0|   z[1] = word_madd3(x[1], y, z[1], &carry);
  436|      0|   z[2] = word_madd3(x[2], y, z[2], &carry);
  437|      0|   z[3] = word_madd3(x[3], y, z[3], &carry);
  438|      0|   z[4] = word_madd3(x[4], y, z[4], &carry);
  439|      0|   z[5] = word_madd3(x[5], y, z[5], &carry);
  440|      0|   z[6] = word_madd3(x[6], y, z[6], &carry);
  441|      0|   z[7] = word_madd3(x[7], y, z[7], &carry);
  442|      0|   return carry;
  443|    152|}
_ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_:
  133|    376|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W {
  134|    376|#if defined(BOTAN_MP_USE_X86_64_ASM)
  135|    376|   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  ------------------
  |  Branch (135:7): [True: 0, Folded]
  |  Branch (135:36): [True: 0, Folded]
  ------------------
  136|    376|      asm(R"(
  137|    376|         mulq %[b]
  138|    376|
  139|    376|         addq %[c],%[a]
  140|    376|         adcq $0,%[carry]
  141|    376|
  142|    376|         addq %[d],%[a]
  143|    376|         adcq $0,%[carry]
  144|    376|         )"
  145|    376|          : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  146|    376|          : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  147|    376|          : "cc");
  148|       |
  149|    376|      return a;
  150|    376|   }
  151|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  152|       |   if(std::same_as<W, uint64_t> && !std::is_constant_evaluated()) {
  153|       |      W lo = 0;
  154|       |      W hi = 0;
  155|       |      asm(R"(
  156|       |         mul  %[lo], %[a], %[b]
  157|       |         umulh %[hi], %[a], %[b]
  158|       |         adds %[lo], %[lo], %[c]
  159|       |         adc  %[hi], %[hi], xzr
  160|       |         adds %[lo], %[lo], %[d]
  161|       |         adc  %[hi], %[hi], xzr
  162|       |         )"
  163|       |          : [lo] "=&r"(lo), [hi] "=&r"(hi)
  164|       |          : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d)
  165|       |          : "cc");
  166|       |
  167|       |      *d = hi;
  168|       |      return lo;
  169|       |   }
  170|       |#endif
  171|       |
  172|      0|   typedef typename WordInfo<W>::dword dword;
  173|      0|   const dword s = dword(a) * b + c + *d;
  174|      0|   *d = static_cast<W>(s >> WordInfo<W>::bits);
  175|      0|   return static_cast<W>(s);
  176|    376|}
_ZN5Botan5word3ImE3mulEmm:
  460|  38.2M|      inline constexpr void mul(W x, W y) { m_w += static_cast<W3>(x) * y; }
_ZN5Botan5word3ImE7extractEv:
  466|  26.2M|      inline constexpr W extract() {
  467|  26.2M|         W r = static_cast<W>(m_w);
  468|  26.2M|         m_w >>= WordInfo<W>::bits;
  469|  26.2M|         return r;
  470|  26.2M|      }
_ZN5Botan5word3ImE3addEm:
  464|  4.63M|      inline constexpr void add(W x) { m_w += x; }
_ZN5Botan5word3ImE10monty_stepEmm:
  472|  2.31M|      inline constexpr W monty_step(W p0, W p_dash) {
  473|  2.31M|         const W w0 = static_cast<W>(m_w);
  474|  2.31M|         const W r = w0 * p_dash;
  475|  2.31M|         mul(r, p0);
  476|  2.31M|         m_w >>= WordInfo<W>::bits;
  477|  2.31M|         return r;
  478|  2.31M|      }
_ZN5Botan5word3ImEC2Ev:
  458|  2.73M|      constexpr word3() : m_w(0) {}
_ZN5Botan5word3ImE6mul_x2Emm:
  462|  22.2M|      inline constexpr void mul_x2(W x, W y) { m_w += static_cast<W3>(x) * y * 2; }

_ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
   94|  1.35k|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
   95|  1.35k|   W carry = 0;
   96|       |
   97|  1.35k|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   64|  1.35k|   do {                                                                                 \
  |  |   65|  1.35k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   66|  1.35k|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (66:10): [True: 0, False: 1.35k]
  |  |  ------------------
  |  |   67|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   68|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   69|      0|      }                                                                                 \
  |  |   70|  1.35k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (70:12): [Folded, False: 1.35k]
  |  |  ------------------
  ------------------
   98|       |
   99|  1.35k|   const size_t blocks = y_size - (y_size % 8);
  100|       |
  101|  1.82k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (101:22): [True: 471, False: 1.35k]
  ------------------
  102|    471|      carry = word8_add2(x + i, y + i, carry);
  103|    471|   }
  104|       |
  105|  5.36k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (105:27): [True: 4.01k, False: 1.35k]
  ------------------
  106|  4.01k|      x[i] = word_add(x[i], y[i], &carry);
  107|  4.01k|   }
  108|       |
  109|  1.35k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (109:27): [True: 0, False: 1.35k]
  ------------------
  110|      0|      x[i] = word_add(x[i], static_cast<W>(0), &carry);
  111|      0|   }
  112|       |
  113|  1.35k|   return carry;
  114|  1.35k|}
_ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m:
  439|    185|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) {
  440|    185|   static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption");
  441|       |
  442|    185|   const W LT = static_cast<W>(-1);
  443|    185|   const W EQ = 0;
  444|    185|   const W GT = 1;
  445|       |
  446|    185|   const size_t common_elems = std::min(x_size, y_size);
  447|       |
  448|    185|   W result = EQ;  // until found otherwise
  449|       |
  450|  1.62k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (450:22): [True: 1.43k, False: 185]
  ------------------
  451|  1.43k|      const auto is_eq = CT::Mask<W>::is_equal(x[i], y[i]);
  452|  1.43k|      const auto is_lt = CT::Mask<W>::is_lt(x[i], y[i]);
  453|       |
  454|  1.43k|      result = is_eq.select(result, is_lt.select(LT, GT));
  455|  1.43k|   }
  456|       |
  457|    185|   if(x_size < y_size) {
  ------------------
  |  Branch (457:7): [True: 0, False: 185]
  ------------------
  458|      0|      W mask = 0;
  459|      0|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (459:30): [True: 0, False: 0]
  ------------------
  460|      0|         mask |= y[i];
  461|      0|      }
  462|       |
  463|       |      // If any bits were set in high part of y, then x < y
  464|      0|      result = CT::Mask<W>::is_zero(mask).select(result, LT);
  465|    185|   } else if(y_size < x_size) {
  ------------------
  |  Branch (465:14): [True: 28, False: 157]
  ------------------
  466|     28|      W mask = 0;
  467|     80|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (467:30): [True: 52, False: 28]
  ------------------
  468|     52|         mask |= x[i];
  469|     52|      }
  470|       |
  471|       |      // If any bits were set in high part of x, then x > y
  472|     28|      result = CT::Mask<W>::is_zero(mask).select(result, GT);
  473|     28|   }
  474|       |
  475|    185|   CT::unpoison(result);
  476|    185|   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
  ------------------
  |  |  130|    185|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    185|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 185]
  |  |  ------------------
  ------------------
  477|    185|   return static_cast<int32_t>(result);
  478|    185|}
_ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
  148|    157|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
  149|    157|   W borrow = 0;
  150|       |
  151|    157|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   64|    157|   do {                                                                                 \
  |  |   65|    157|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   66|    157|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (66:10): [True: 0, False: 157]
  |  |  ------------------
  |  |   67|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   68|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   69|      0|      }                                                                                 \
  |  |   70|    157|   } while(0)
  |  |  ------------------
  |  |  |  Branch (70:12): [Folded, False: 157]
  |  |  ------------------
  ------------------
  152|       |
  153|    157|   const size_t blocks = y_size - (y_size % 8);
  154|       |
  155|    252|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (155:22): [True: 95, False: 157]
  ------------------
  156|     95|      borrow = word8_sub2(x + i, y + i, borrow);
  157|     95|   }
  158|       |
  159|    747|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (159:27): [True: 590, False: 157]
  ------------------
  160|    590|      x[i] = word_sub(x[i], y[i], &borrow);
  161|    590|   }
  162|       |
  163|    178|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (163:27): [True: 21, False: 157]
  ------------------
  164|     21|      x[i] = word_sub(x[i], static_cast<W>(0), &borrow);
  165|     21|   }
  166|       |
  167|    157|   return borrow;
  168|    157|}
_ZN5Botan11bigint_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  192|  2.56k|inline constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  193|  2.56k|   W borrow = 0;
  194|       |
  195|  2.56k|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   64|  2.56k|   do {                                                                                 \
  |  |   65|  2.56k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   66|  2.56k|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (66:10): [True: 0, False: 2.56k]
  |  |  ------------------
  |  |   67|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   68|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   69|      0|      }                                                                                 \
  |  |   70|  2.56k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (70:12): [Folded, False: 2.56k]
  |  |  ------------------
  ------------------
  196|       |
  197|  2.56k|   const size_t blocks = y_size - (y_size % 8);
  198|       |
  199|  3.70k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (199:22): [True: 1.13k, False: 2.56k]
  ------------------
  200|  1.13k|      borrow = word8_sub3(z + i, x + i, y + i, borrow);
  201|  1.13k|   }
  202|       |
  203|  9.43k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (203:27): [True: 6.86k, False: 2.56k]
  ------------------
  204|  6.86k|      z[i] = word_sub(x[i], y[i], &borrow);
  205|  6.86k|   }
  206|       |
  207|  2.72k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (207:27): [True: 164, False: 2.56k]
  ------------------
  208|    164|      z[i] = word_sub(x[i], static_cast<W>(0), &borrow);
  209|    164|   }
  210|       |
  211|  2.56k|   return borrow;
  212|  2.56k|}
_ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  120|     14|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  121|     14|   if(x_size < y_size) {
  ------------------
  |  Branch (121:7): [True: 0, False: 14]
  ------------------
  122|      0|      return bigint_add3(z, y, y_size, x, x_size);
  123|      0|   }
  124|       |
  125|     14|   W carry = 0;
  126|       |
  127|     14|   const size_t blocks = y_size - (y_size % 8);
  128|       |
  129|     18|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (129:22): [True: 4, False: 14]
  ------------------
  130|      4|      carry = word8_add3(z + i, x + i, y + i, carry);
  131|      4|   }
  132|       |
  133|     58|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (133:27): [True: 44, False: 14]
  ------------------
  134|     44|      z[i] = word_add(x[i], y[i], &carry);
  135|     44|   }
  136|       |
  137|     15|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (137:27): [True: 1, False: 14]
  ------------------
  138|      1|      z[i] = word_add(x[i], static_cast<W>(0), &carry);
  139|      1|   }
  140|       |
  141|     14|   return carry;
  142|     14|}
_ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_:
  416|     80|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) {
  417|     80|   const size_t blocks = x_size - (x_size % 8);
  418|       |
  419|     80|   W carry = 0;
  420|       |
  421|    122|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (421:22): [True: 42, False: 80]
  ------------------
  422|     42|      carry = word8_linmul3(z + i, x + i, y, carry);
  423|     42|   }
  424|       |
  425|    418|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (425:27): [True: 338, False: 80]
  ------------------
  426|    338|      z[i] = word_madd2(x[i], y, &carry);
  427|    338|   }
  428|       |
  429|     80|   z[x_size] = carry;
  430|     80|}
_ZN5Botan14divide_precompImEC2Em:
  574|     21|      explicit constexpr divide_precomp(W divisor) : m_divisor(divisor) {
  575|     21|         BOTAN_ARG_CHECK(m_divisor != 0, "Division by zero");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  576|     21|      }
_ZNK5Botan14divide_precompImE16vartime_div_2to1Emm:
  581|    133|      inline constexpr W vartime_div_2to1(W n1, W n0) const {
  582|    133|         BOTAN_ASSERT_NOMSG(n1 < m_divisor);
  ------------------
  |  |   77|    133|   do {                                                                     \
  |  |   78|    133|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|    133|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 133]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|    133|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 133]
  |  |  ------------------
  ------------------
  583|       |
  584|    133|         if(m_divisor == WordInfo<W>::max) {
  ------------------
  |  Branch (584:13): [True: 76, False: 57]
  ------------------
  585|     76|            return vartime_div_2to1_max_d(n1, n0);
  586|     76|         }
  587|       |
  588|     57|         if(m_divisor == WordInfo<W>::top_bit) {
  ------------------
  |  Branch (588:13): [True: 0, False: 57]
  ------------------
  589|       |            // Simply a shift by N-1 bits
  590|      0|            return (n1 << 1) | (n0 >> (WordInfo<W>::bits - 1));
  591|      0|         }
  592|       |
  593|     57|         if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (593:13): [True: 57, Folded]
  ------------------
  594|     57|#if defined(BOTAN_MP_USE_X86_64_ASM)
  595|     57|            if constexpr(std::same_as<W, uint64_t>) {
  596|     57|               W quotient = 0;
  597|     57|               W remainder = 0;
  598|       |               // NOLINTNEXTLINE(*-no-assembler)
  599|     57|               asm("divq %[v]" : "=a"(quotient), "=d"(remainder) : [v] "r"(m_divisor), "a"(n0), "d"(n1) : "cc");
  600|     57|               return quotient;
  601|     57|            }
  602|      0|#endif
  603|       |
  604|      0|#if !defined(BOTAN_BUILD_COMPILER_IS_CLANGCL)
  605|       |
  606|       |            /* clang-cl has a bug where on encountering a 128/64 division it emits
  607|       |            * a call to __udivti3() but then fails to link the relevant builtin into
  608|       |            * the binary, causing a link failure. Work around this by simply omitting
  609|       |            * such code for clang-cl
  610|       |            *
  611|       |            * See https://github.com/llvm/llvm-project/issues/25679
  612|       |            */
  613|     57|            if constexpr(WordInfo<W>::dword_is_native) {
  614|     57|               typename WordInfo<W>::dword n = n1;
  615|     57|               n <<= WordInfo<W>::bits;
  616|     57|               n |= n0;
  617|     57|               return static_cast<W>(n / m_divisor);
  618|     57|            }
  619|     57|#endif
  620|     57|         }
  621|       |
  622|      0|         W high = n1;
  623|     57|         W quotient = 0;
  624|       |
  625|     57|         for(size_t i = 0; i != WordInfo<W>::bits; ++i) {
  ------------------
  |  Branch (625:28): [True: 0, False: 57]
  ------------------
  626|      0|            const W high_top_bit = high >> (WordInfo<W>::bits - 1);
  627|       |
  628|      0|            high <<= 1;
  629|      0|            high |= (n0 >> (WordInfo<W>::bits - 1 - i)) & 1;
  630|      0|            quotient <<= 1;
  631|       |
  632|      0|            if(high_top_bit || high >= m_divisor) {
  ------------------
  |  Branch (632:16): [True: 0, False: 0]
  |  Branch (632:32): [True: 0, False: 0]
  ------------------
  633|      0|               high -= m_divisor;
  634|      0|               quotient |= 1;
  635|      0|            }
  636|      0|         }
  637|       |
  638|     57|         return quotient;
  639|     57|      }
_ZN5Botan14divide_precompImE22vartime_div_2to1_max_dEmm:
  657|     76|      static inline constexpr W vartime_div_2to1_max_d(W n1, W n0) {
  658|       |         /*
  659|       |         Use k to refer to WordInfo<W>::bits
  660|       |
  661|       |         We are dividing n = (n1 * 2^k) + n0 by 2^k - 1
  662|       |
  663|       |         Recall that 2^k = 1 (mod 2^k - 1)
  664|       |
  665|       |         Rewrite n = n1*2^k + n0 as n1*(2^k - 1) + n1 + n0
  666|       |
  667|       |         The result of dividing n by (2^k - 1) will be equal to
  668|       |         (n1*(2^k-1) + n1 + n0) / (2^k-1) =
  669|       |         n1 + ((n1 + n0) / (2^k-1)
  670|       |
  671|       |         Use c to refer to ((n1 + n0) / (2^k-1))
  672|       |
  673|       |         If (n1 + n0) < (2^k - 1) then c is 0
  674|       |         If (n1 + n0) >= (2^k - 1) then c is 1
  675|       |
  676|       |         Since n1 < 2^k - 1 [*] and n0 <= 2^k - 1 it is impossible for (n1 + n0) / (2^k -1)
  677|       |         to be greater than 1.
  678|       |
  679|       |         [*] We require n1 be strictly less than the divisor to ensure that the
  680|       |         output fits in a single word; this is checked at the start of vartime_div_2to1.
  681|       |         */
  682|       |
  683|     76|         const W s = n0 + n1;
  684|       |         // did n0 + n1 overflow? or does (n0 + n1) == 2^k - 1? if either, c == 1
  685|     76|         if(s < n0 || s == WordInfo<W>::max) {
  ------------------
  |  Branch (685:13): [True: 12, False: 64]
  |  Branch (685:23): [True: 0, False: 64]
  ------------------
  686|     12|            n1 += 1;
  687|     12|         }
  688|       |
  689|     76|         return n1;
  690|     76|      }
_ZN5Botan11bigint_shl1ITkNS_8WordTypeEmEEvPT_mmm:
  309|      6|inline constexpr void bigint_shl1(W x[], size_t x_size, size_t x_words, size_t shift) {
  310|      6|   const size_t word_shift = shift / WordInfo<W>::bits;
  311|      6|   const size_t bit_shift = shift % WordInfo<W>::bits;
  312|       |
  313|      6|   BOTAN_ASSERT_NOMSG(word_shift <= x_size);
  ------------------
  |  |   77|      6|   do {                                                                     \
  |  |   78|      6|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      6|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 6]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      6|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 6]
  |  |  ------------------
  ------------------
  314|      6|   BOTAN_ASSERT_NOMSG(x_words <= x_size - word_shift);
  ------------------
  |  |   77|      6|   do {                                                                     \
  |  |   78|      6|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      6|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 6]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      6|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 6]
  |  |  ------------------
  ------------------
  315|       |
  316|      6|   unchecked_copy_memory(x + word_shift, x, x_words);
  317|      6|   zeroize_buffer(x, word_shift);
  318|       |
  319|      6|   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
  320|      6|   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
  321|       |
  322|      6|   W carry = 0;
  323|     51|   for(size_t i = word_shift; i != x_size; ++i) {
  ------------------
  |  Branch (323:31): [True: 45, False: 6]
  ------------------
  324|     45|      const W w = x[i];
  325|     45|      x[i] = (w << bit_shift) | carry;
  326|     45|      carry = carry_mask.if_set_return(w >> carry_shift);
  327|     45|   }
  328|      6|}
_ZN5Botan11bigint_shr1ITkNS_8WordTypeEmEEvPT_mm:
  331|    135|inline constexpr void bigint_shr1(W x[], size_t x_size, size_t shift) {
  332|    135|   const size_t word_shift = shift / WordInfo<W>::bits;
  333|    135|   const size_t bit_shift = shift % WordInfo<W>::bits;
  334|       |
  335|    135|   const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
  ------------------
  |  Branch (335:23): [True: 135, False: 0]
  ------------------
  336|       |
  337|    135|   if(top > 0) {
  ------------------
  |  Branch (337:7): [True: 135, False: 0]
  ------------------
  338|    135|      unchecked_copy_memory(x, x + word_shift, top);
  339|    135|   }
  340|    135|   zeroize_buffer(x + top, std::min(word_shift, x_size));
  341|       |
  342|    135|   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
  343|    135|   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
  344|       |
  345|    135|   W carry = 0;
  346|       |
  347|  2.61k|   for(size_t i = 0; i != top; ++i) {
  ------------------
  |  Branch (347:22): [True: 2.48k, False: 135]
  ------------------
  348|  2.48k|      const W w = x[top - i - 1];
  349|  2.48k|      x[top - i - 1] = (w >> bit_shift) | carry;
  350|  2.48k|      carry = carry_mask.if_set_return(w << carry_shift);
  351|  2.48k|   }
  352|    135|}
_ZN5Botan17bigint_monty_redcEPmPKmS2_mmS0_m:
  924|     28|   word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  925|     28|   const size_t z_size = 2 * p_size;
  926|       |
  927|     28|   BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small");
  ------------------
  |  |   35|     28|   do {                                                          \
  |  |   36|     28|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     28|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 28]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     28|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 28]
  |  |  ------------------
  ------------------
  928|       |
  929|     28|   if(p_size == 4) {
  ------------------
  |  Branch (929:7): [True: 12, False: 16]
  ------------------
  930|     12|      bigint_monty_redc_4(r, z, p, p_dash, ws);
  931|     16|   } else if(p_size == 6) {
  ------------------
  |  Branch (931:14): [True: 4, False: 12]
  ------------------
  932|      4|      bigint_monty_redc_6(r, z, p, p_dash, ws);
  933|     12|   } else if(p_size == 8) {
  ------------------
  |  Branch (933:14): [True: 4, False: 8]
  ------------------
  934|      4|      bigint_monty_redc_8(r, z, p, p_dash, ws);
  935|      8|   } else if(p_size == 12) {
  ------------------
  |  Branch (935:14): [True: 0, False: 8]
  ------------------
  936|      0|      bigint_monty_redc_12(r, z, p, p_dash, ws);
  937|      8|   } else if(p_size == 16) {
  ------------------
  |  Branch (937:14): [True: 0, False: 8]
  ------------------
  938|      0|      bigint_monty_redc_16(r, z, p, p_dash, ws);
  939|      8|   } else if(p_size == 24) {
  ------------------
  |  Branch (939:14): [True: 0, False: 8]
  ------------------
  940|      0|      bigint_monty_redc_24(r, z, p, p_dash, ws);
  941|      8|   } else if(p_size == 32) {
  ------------------
  |  Branch (941:14): [True: 0, False: 8]
  ------------------
  942|      0|      bigint_monty_redc_32(r, z, p, p_dash, ws);
  943|      8|   } else {
  944|      8|      bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws);
  945|      8|   }
  946|     28|}
_ZN5Botan25bigint_monty_redc_inplaceEPmPKmmmS0_m:
  948|     28|inline void bigint_monty_redc_inplace(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  949|     28|   bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size);
  950|     28|   zeroize_buffer(z + p_size, p_size);
  951|     28|}
_ZN5Botan11bigint_shl2ITkNS_8WordTypeEmEEvPT_mPKS1_mm:
  355|     21|inline constexpr void bigint_shl2(W y[], size_t y_size, const W x[], size_t x_size, size_t shift) {
  356|     21|   const size_t word_shift = shift / WordInfo<W>::bits;
  357|     21|   const size_t bit_shift = shift % WordInfo<W>::bits;
  358|       |
  359|     21|   BOTAN_ASSERT_NOMSG(word_shift <= y_size);
  ------------------
  |  |   77|     21|   do {                                                                     \
  |  |   78|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     21|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  360|     21|   BOTAN_ASSERT_NOMSG(x_size < y_size - word_shift);
  ------------------
  |  |   77|     21|   do {                                                                     \
  |  |   78|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     21|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  361|       |
  362|     21|   unchecked_copy_memory(y + word_shift, x, x_size);
  363|     21|   zeroize_buffer(y, word_shift);
  364|     21|   zeroize_buffer(y + word_shift + x_size, y_size - word_shift - x_size);
  365|       |
  366|     21|   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
  367|     21|   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
  368|       |
  369|     21|   W carry = 0;
  370|    156|   for(size_t i = word_shift; i != x_size + word_shift + 1; ++i) {
  ------------------
  |  Branch (370:31): [True: 135, False: 21]
  ------------------
  371|    135|      const W w = y[i];
  372|    135|      y[i] = (w << bit_shift) | carry;
  373|    135|      carry = carry_mask.if_set_return(w >> carry_shift);
  374|    135|   }
  375|     21|}
_ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m:
  519|     14|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask<W> {
  520|     14|   const size_t common_elems = std::min(x_size, y_size);
  521|       |
  522|     14|   W diff = 0;
  523|       |
  524|    182|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (524:22): [True: 168, False: 14]
  ------------------
  525|    168|      diff |= (x[i] ^ y[i]);
  526|    168|   }
  527|       |
  528|       |   // If any bits were set in high part of x/y, then they are not equal
  529|     14|   if(x_size < y_size) {
  ------------------
  |  Branch (529:7): [True: 1, False: 13]
  ------------------
  530|      9|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (530:30): [True: 8, False: 1]
  ------------------
  531|      8|         diff |= y[i];
  532|      8|      }
  533|     13|   } else if(y_size < x_size) {
  ------------------
  |  Branch (533:14): [True: 0, False: 13]
  ------------------
  534|      0|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (534:30): [True: 0, False: 0]
  ------------------
  535|      0|         diff |= x[i];
  536|      0|      }
  537|      0|   }
  538|       |
  539|     14|   return CT::Mask<W>::is_zero(diff);
  540|     14|}
_ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb:
  487|  3.29k|   -> CT::Mask<W> {
  488|  3.29k|   const size_t common_elems = std::min(x_size, y_size);
  489|       |
  490|  3.29k|   auto is_lt = CT::Mask<W>::expand(lt_or_equal);
  491|       |
  492|  21.6k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (492:22): [True: 18.3k, False: 3.29k]
  ------------------
  493|  18.3k|      const auto eq = CT::Mask<W>::is_equal(x[i], y[i]);
  494|  18.3k|      const auto lt = CT::Mask<W>::is_lt(x[i], y[i]);
  495|  18.3k|      is_lt = eq.select_mask(is_lt, lt);
  496|  18.3k|   }
  497|       |
  498|  3.29k|   if(x_size < y_size) {
  ------------------
  |  Branch (498:7): [True: 0, False: 3.29k]
  ------------------
  499|      0|      W mask = 0;
  500|      0|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (500:30): [True: 0, False: 0]
  ------------------
  501|      0|         mask |= y[i];
  502|      0|      }
  503|       |      // If any bits were set in high part of y, then is_lt should be forced true
  504|      0|      is_lt |= CT::Mask<W>::expand(mask);
  505|  3.29k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (505:14): [True: 58, False: 3.24k]
  ------------------
  506|     58|      W mask = 0;
  507|    452|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (507:30): [True: 394, False: 58]
  ------------------
  508|    394|         mask |= x[i];
  509|    394|      }
  510|       |
  511|       |      // If any bits were set in high part of x, then is_lt should be false
  512|     58|      is_lt &= CT::Mask<W>::is_zero(mask);
  513|     58|   }
  514|       |
  515|  3.29k|   return is_lt;
  516|  3.29k|}
_ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_:
  279|     56|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask<W> {
  280|       |   // Subtract in both direction then conditional copy out the result
  281|       |
  282|     56|   W* ws0 = ws;
  283|     56|   W* ws1 = ws + N;
  284|       |
  285|     56|   W borrow0 = 0;
  286|     56|   W borrow1 = 0;
  287|       |
  288|     56|   const size_t blocks = N - (N % 8);
  289|       |
  290|     72|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (290:22): [True: 16, False: 56]
  ------------------
  291|     16|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  292|     16|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  293|     16|   }
  294|       |
  295|    288|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (295:27): [True: 232, False: 56]
  ------------------
  296|    232|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  297|    232|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  298|    232|   }
  299|       |
  300|     56|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  301|     56|}
_ZN5Botan13monty_inverseITkNS_8WordTypeEmEET_S1_:
  703|      7|inline constexpr auto monty_inverse(W a) -> W {
  704|      7|   BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer");
  ------------------
  |  |   35|      7|   do {                                                          \
  |  |   36|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|      7|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
  705|       |
  706|       |   // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/
  707|       |
  708|      7|   constexpr size_t iter = WordInfo<W>::bits == 64 ? 4 : 3;
  ------------------
  |  Branch (708:28): [True: 0, Folded]
  ------------------
  709|       |
  710|       |   // Initial guess provides 5 bits of accuracy
  711|      7|   W r = (3 * a) ^ 2;
  712|       |
  713|       |   // Each iteration doubles the accuracy
  714|     35|   for(size_t i = 0; i != iter; ++i) {
  ------------------
  |  Branch (714:22): [True: 28, False: 7]
  ------------------
  715|     28|      r = r * (2 - r * a);
  716|     28|   }
  717|       |
  718|       |   // Now invert in addition space
  719|      7|   r = (WordInfo<W>::max - r) + 1;
  720|       |
  721|      7|   return r;
  722|      7|}
_ZN5Botan22bigint_monty_maybe_subITkNS_8WordTypeEmEEvmPT_S1_PKS1_S4_:
  225|      8|inline constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[]) {
  226|      8|   W borrow = 0;
  227|       |
  228|      8|   const size_t blocks = N - (N % 8);
  229|       |
  230|     12|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (230:22): [True: 4, False: 8]
  ------------------
  231|      4|      borrow = word8_sub3(z + i, x + i, p + i, borrow);
  232|      4|   }
  233|       |
  234|     24|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (234:27): [True: 16, False: 8]
  ------------------
  235|     16|      z[i] = word_sub(x[i], p[i], &borrow);
  236|     16|   }
  237|       |
  238|      8|   borrow = (x0 - borrow) > x0;
  239|       |
  240|      8|   CT::conditional_assign_mem(borrow, z, x, N);
  241|      8|}
_ZN5Botan9comba_sqrILm4ETkNS_8WordTypeEmEEvPT0_PKS1_:
  854|  1.57M|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) {
  855|  1.57M|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (855:7): [True: 1.57M, Folded]
  ------------------
  856|  1.57M|      if constexpr(std::same_as<W, word> && N == 4) {
  857|  1.57M|         return bigint_comba_sqr4(z, x);
  858|  1.57M|      }
  859|       |      if constexpr(std::same_as<W, word> && N == 6) {
  860|       |         return bigint_comba_sqr6(z, x);
  861|       |      }
  862|       |      if constexpr(std::same_as<W, word> && N == 7) {
  863|       |         return bigint_comba_sqr7(z, x);
  864|       |      }
  865|       |      if constexpr(std::same_as<W, word> && N == 8) {
  866|       |         return bigint_comba_sqr8(z, x);
  867|       |      }
  868|       |      if constexpr(std::same_as<W, word> && N == 9) {
  869|       |         return bigint_comba_sqr9(z, x);
  870|       |      }
  871|       |      if constexpr(std::same_as<W, word> && N == 16) {
  872|       |         return bigint_comba_sqr16(z, x);
  873|       |      }
  874|  1.57M|   }
  875|       |
  876|      0|   word3<W> accum;
  877|       |
  878|  1.57M|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (878:22): [True: 0, False: 1.57M]
  ------------------
  879|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (879:28): [True: 0, False: 0]
  ------------------
  880|      0|      const size_t end = std::min(N, i + 1);
  881|       |
  882|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (882:29): [True: 0, False: 0]
  ------------------
  883|      0|         accum.mul(x[j], x[i - j]);
  884|      0|      }
  885|      0|      z[i] = accum.extract();
  886|      0|   }
  887|  1.57M|}
_ZN5Botan22bigint_monty_maybe_subILm4ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  254|   178k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  255|   178k|   W borrow = 0;
  256|       |
  257|   894k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (257:22): [True: 715k, False: 178k]
  ------------------
  258|   715k|      z[i] = word_sub(x[i], y[i], &borrow);
  259|   715k|   }
  260|       |
  261|   178k|   borrow = (x0 - borrow) > x0;
  262|       |
  263|   178k|   CT::conditional_assign_mem(borrow, z, x, N);
  264|   178k|}
_ZN5Botan9comba_mulILm4ETkNS_8WordTypeEmEEvPT0_PKS1_S4_:
  818|   154k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) {
  819|   154k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (819:7): [True: 154k, Folded]
  ------------------
  820|   154k|      if constexpr(std::same_as<W, word> && N == 4) {
  821|   154k|         return bigint_comba_mul4(z, x, y);
  822|   154k|      }
  823|       |      if constexpr(std::same_as<W, word> && N == 6) {
  824|       |         return bigint_comba_mul6(z, x, y);
  825|       |      }
  826|       |      if constexpr(std::same_as<W, word> && N == 7) {
  827|       |         return bigint_comba_mul7(z, x, y);
  828|       |      }
  829|       |      if constexpr(std::same_as<W, word> && N == 8) {
  830|       |         return bigint_comba_mul8(z, x, y);
  831|       |      }
  832|       |      if constexpr(std::same_as<W, word> && N == 9) {
  833|       |         return bigint_comba_mul9(z, x, y);
  834|       |      }
  835|       |      if constexpr(std::same_as<W, word> && N == 16) {
  836|       |         return bigint_comba_mul16(z, x, y);
  837|       |      }
  838|   154k|   }
  839|       |
  840|      0|   word3<W> accum;
  841|       |
  842|   154k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (842:22): [True: 0, False: 154k]
  ------------------
  843|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (843:28): [True: 0, False: 0]
  ------------------
  844|      0|      const size_t end = std::min(N, i + 1);
  845|       |
  846|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (846:29): [True: 0, False: 0]
  ------------------
  847|      0|         accum.mul(x[j], y[i - j]);
  848|      0|      }
  849|      0|      z[i] = accum.extract();
  850|      0|   }
  851|   154k|}
_ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|  19.1k|inline constexpr W shift_left(std::array<W, N>& x) {
  726|  19.1k|   static_assert(N >= 1, "Invalid input size");
  727|  19.1k|   static_assert(S > 0, "Zero shift not supported");
  728|  19.1k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|  19.1k|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|  76.7k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 57.5k, False: 19.1k]
  ------------------
  733|  57.5k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  57.5k|   }
  735|  19.1k|   x[0] <<= S;
  736|       |
  737|  19.1k|   return carry;
  738|  19.1k|}
_ZN5Botan16read_window_bitsILm4EmLm4EEEmNSt3__14spanIKT0_XT1_EEEm:
 1071|  38.8k|constexpr size_t read_window_bits(std::span<const W, N> words, size_t offset) {
 1072|  38.8k|   static_assert(WindowBits >= 1 && WindowBits <= 7);
 1073|       |
 1074|  38.8k|   constexpr uint8_t WindowMask = static_cast<uint8_t>(1 << WindowBits) - 1;
 1075|       |
 1076|  38.8k|   constexpr size_t W_bits = sizeof(W) * 8;
 1077|  38.8k|   const auto bit_shift = offset % W_bits;
 1078|  38.8k|   const auto word_offset = words.size() - 1 - (offset / W_bits);
 1079|       |
 1080|  38.8k|   const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0;
  ------------------
  |  Branch (1080:36): [True: 38.8k, False: 0]
  |  Branch (1080:74): [True: 0, False: 0]
  ------------------
 1081|       |
 1082|  38.8k|   const auto w0 = words[word_offset];
 1083|       |
 1084|  38.8k|   if(single_byte_window) {
  ------------------
  |  Branch (1084:7): [True: 38.8k, False: 0]
  ------------------
 1085|  38.8k|      return (w0 >> bit_shift) & WindowMask;
 1086|  38.8k|   } else {
 1087|       |      // Otherwise we must join two words and extract the result
 1088|      0|      const auto w1 = words[word_offset - 1];
 1089|      0|      const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift)));
 1090|      0|      return combined & WindowMask;
 1091|      0|   }
 1092|  38.8k|}
_ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE:
  741|  2.13k|inline constexpr W shift_right(std::array<W, N>& x) {
  742|  2.13k|   static_assert(N >= 1, "Invalid input size");
  743|  2.13k|   static_assert(S > 0, "Zero shift not supported");
  744|  2.13k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  745|       |
  746|  2.13k|   const W carry = x[0] << (WordInfo<W>::bits - S);
  747|       |
  748|  8.54k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (748:22): [True: 6.40k, False: 2.13k]
  ------------------
  749|  6.40k|      x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
  750|  6.40k|   }
  751|  2.13k|   x[N - 1] >>= S;
  752|       |
  753|  2.13k|   return carry;
  754|  2.13k|}
_ZN5Botan9comba_sqrILm6ETkNS_8WordTypeEmEEvPT0_PKS1_:
  854|  76.1k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) {
  855|  76.1k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (855:7): [True: 76.1k, Folded]
  ------------------
  856|       |      if constexpr(std::same_as<W, word> && N == 4) {
  857|       |         return bigint_comba_sqr4(z, x);
  858|       |      }
  859|  76.1k|      if constexpr(std::same_as<W, word> && N == 6) {
  860|  76.1k|         return bigint_comba_sqr6(z, x);
  861|  76.1k|      }
  862|       |      if constexpr(std::same_as<W, word> && N == 7) {
  863|       |         return bigint_comba_sqr7(z, x);
  864|       |      }
  865|       |      if constexpr(std::same_as<W, word> && N == 8) {
  866|       |         return bigint_comba_sqr8(z, x);
  867|       |      }
  868|       |      if constexpr(std::same_as<W, word> && N == 9) {
  869|       |         return bigint_comba_sqr9(z, x);
  870|       |      }
  871|       |      if constexpr(std::same_as<W, word> && N == 16) {
  872|       |         return bigint_comba_sqr16(z, x);
  873|       |      }
  874|  76.1k|   }
  875|       |
  876|      0|   word3<W> accum;
  877|       |
  878|  76.1k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (878:22): [True: 0, False: 76.1k]
  ------------------
  879|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (879:28): [True: 0, False: 0]
  ------------------
  880|      0|      const size_t end = std::min(N, i + 1);
  881|       |
  882|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (882:29): [True: 0, False: 0]
  ------------------
  883|      0|         accum.mul(x[j], x[i - j]);
  884|      0|      }
  885|      0|      z[i] = accum.extract();
  886|      0|   }
  887|  76.1k|}
_ZN5Botan22bigint_monty_maybe_subILm6ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  254|  14.2k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  255|  14.2k|   W borrow = 0;
  256|       |
  257|  99.4k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (257:22): [True: 85.2k, False: 14.2k]
  ------------------
  258|  85.2k|      z[i] = word_sub(x[i], y[i], &borrow);
  259|  85.2k|   }
  260|       |
  261|  14.2k|   borrow = (x0 - borrow) > x0;
  262|       |
  263|  14.2k|   CT::conditional_assign_mem(borrow, z, x, N);
  264|  14.2k|}
_ZN5Botan9comba_mulILm6ETkNS_8WordTypeEmEEvPT0_PKS1_S4_:
  818|  34.6k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) {
  819|  34.6k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (819:7): [True: 34.6k, Folded]
  ------------------
  820|       |      if constexpr(std::same_as<W, word> && N == 4) {
  821|       |         return bigint_comba_mul4(z, x, y);
  822|       |      }
  823|  34.6k|      if constexpr(std::same_as<W, word> && N == 6) {
  824|  34.6k|         return bigint_comba_mul6(z, x, y);
  825|  34.6k|      }
  826|       |      if constexpr(std::same_as<W, word> && N == 7) {
  827|       |         return bigint_comba_mul7(z, x, y);
  828|       |      }
  829|       |      if constexpr(std::same_as<W, word> && N == 8) {
  830|       |         return bigint_comba_mul8(z, x, y);
  831|       |      }
  832|       |      if constexpr(std::same_as<W, word> && N == 9) {
  833|       |         return bigint_comba_mul9(z, x, y);
  834|       |      }
  835|       |      if constexpr(std::same_as<W, word> && N == 16) {
  836|       |         return bigint_comba_mul16(z, x, y);
  837|       |      }
  838|  34.6k|   }
  839|       |
  840|      0|   word3<W> accum;
  841|       |
  842|  34.6k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (842:22): [True: 0, False: 34.6k]
  ------------------
  843|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (843:28): [True: 0, False: 0]
  ------------------
  844|      0|      const size_t end = std::min(N, i + 1);
  845|       |
  846|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (846:29): [True: 0, False: 0]
  ------------------
  847|      0|         accum.mul(x[j], y[i - j]);
  848|      0|      }
  849|      0|      z[i] = accum.extract();
  850|      0|   }
  851|  34.6k|}
_ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|  9.92k|inline constexpr W shift_left(std::array<W, N>& x) {
  726|  9.92k|   static_assert(N >= 1, "Invalid input size");
  727|  9.92k|   static_assert(S > 0, "Zero shift not supported");
  728|  9.92k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|  9.92k|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|  59.5k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 49.6k, False: 9.92k]
  ------------------
  733|  49.6k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  49.6k|   }
  735|  9.92k|   x[0] <<= S;
  736|       |
  737|  9.92k|   return carry;
  738|  9.92k|}
_ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm6EEET0_RNSt3__15arrayIS1_XT1_EEE:
  741|  1.11k|inline constexpr W shift_right(std::array<W, N>& x) {
  742|  1.11k|   static_assert(N >= 1, "Invalid input size");
  743|  1.11k|   static_assert(S > 0, "Zero shift not supported");
  744|  1.11k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  745|       |
  746|  1.11k|   const W carry = x[0] << (WordInfo<W>::bits - S);
  747|       |
  748|  6.67k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (748:22): [True: 5.56k, False: 1.11k]
  ------------------
  749|  5.56k|      x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
  750|  5.56k|   }
  751|  1.11k|   x[N - 1] >>= S;
  752|       |
  753|  1.11k|   return carry;
  754|  1.11k|}
_ZN5Botan9comba_sqrILm8ETkNS_8WordTypeEmEEvPT0_PKS1_:
  854|   144k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) {
  855|   144k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (855:7): [True: 144k, Folded]
  ------------------
  856|       |      if constexpr(std::same_as<W, word> && N == 4) {
  857|       |         return bigint_comba_sqr4(z, x);
  858|       |      }
  859|       |      if constexpr(std::same_as<W, word> && N == 6) {
  860|       |         return bigint_comba_sqr6(z, x);
  861|       |      }
  862|       |      if constexpr(std::same_as<W, word> && N == 7) {
  863|       |         return bigint_comba_sqr7(z, x);
  864|       |      }
  865|   144k|      if constexpr(std::same_as<W, word> && N == 8) {
  866|   144k|         return bigint_comba_sqr8(z, x);
  867|   144k|      }
  868|       |      if constexpr(std::same_as<W, word> && N == 9) {
  869|       |         return bigint_comba_sqr9(z, x);
  870|       |      }
  871|       |      if constexpr(std::same_as<W, word> && N == 16) {
  872|       |         return bigint_comba_sqr16(z, x);
  873|       |      }
  874|   144k|   }
  875|       |
  876|      0|   word3<W> accum;
  877|       |
  878|   144k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (878:22): [True: 0, False: 144k]
  ------------------
  879|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (879:28): [True: 0, False: 0]
  ------------------
  880|      0|      const size_t end = std::min(N, i + 1);
  881|       |
  882|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (882:29): [True: 0, False: 0]
  ------------------
  883|      0|         accum.mul(x[j], x[i - j]);
  884|      0|      }
  885|      0|      z[i] = accum.extract();
  886|      0|   }
  887|   144k|}
_ZN5Botan22bigint_monty_maybe_subILm8ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  254|   233k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  255|   233k|   W borrow = 0;
  256|       |
  257|  2.10M|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (257:22): [True: 1.87M, False: 233k]
  ------------------
  258|  1.87M|      z[i] = word_sub(x[i], y[i], &borrow);
  259|  1.87M|   }
  260|       |
  261|   233k|   borrow = (x0 - borrow) > x0;
  262|       |
  263|   233k|   CT::conditional_assign_mem(borrow, z, x, N);
  264|   233k|}
_ZN5Botan9comba_mulILm8ETkNS_8WordTypeEmEEvPT0_PKS1_S4_:
  818|  70.0k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) {
  819|  70.0k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (819:7): [True: 70.0k, Folded]
  ------------------
  820|       |      if constexpr(std::same_as<W, word> && N == 4) {
  821|       |         return bigint_comba_mul4(z, x, y);
  822|       |      }
  823|       |      if constexpr(std::same_as<W, word> && N == 6) {
  824|       |         return bigint_comba_mul6(z, x, y);
  825|       |      }
  826|       |      if constexpr(std::same_as<W, word> && N == 7) {
  827|       |         return bigint_comba_mul7(z, x, y);
  828|       |      }
  829|  70.0k|      if constexpr(std::same_as<W, word> && N == 8) {
  830|  70.0k|         return bigint_comba_mul8(z, x, y);
  831|  70.0k|      }
  832|       |      if constexpr(std::same_as<W, word> && N == 9) {
  833|       |         return bigint_comba_mul9(z, x, y);
  834|       |      }
  835|       |      if constexpr(std::same_as<W, word> && N == 16) {
  836|       |         return bigint_comba_mul16(z, x, y);
  837|       |      }
  838|  70.0k|   }
  839|       |
  840|      0|   word3<W> accum;
  841|       |
  842|  70.0k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (842:22): [True: 0, False: 70.0k]
  ------------------
  843|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (843:28): [True: 0, False: 0]
  ------------------
  844|      0|      const size_t end = std::min(N, i + 1);
  845|       |
  846|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (846:29): [True: 0, False: 0]
  ------------------
  847|      0|         accum.mul(x[j], y[i - j]);
  848|      0|      }
  849|      0|      z[i] = accum.extract();
  850|      0|   }
  851|  70.0k|}
_ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|  13.1k|inline constexpr W shift_left(std::array<W, N>& x) {
  726|  13.1k|   static_assert(N >= 1, "Invalid input size");
  727|  13.1k|   static_assert(S > 0, "Zero shift not supported");
  728|  13.1k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|  13.1k|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|   105k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 92.3k, False: 13.1k]
  ------------------
  733|  92.3k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  92.3k|   }
  735|  13.1k|   x[0] <<= S;
  736|       |
  737|  13.1k|   return carry;
  738|  13.1k|}
_ZN5Botan16read_window_bitsILm5EmLm8EEEmNSt3__14spanIKT0_XT1_EEEm:
 1071|  24.5k|constexpr size_t read_window_bits(std::span<const W, N> words, size_t offset) {
 1072|  24.5k|   static_assert(WindowBits >= 1 && WindowBits <= 7);
 1073|       |
 1074|  24.5k|   constexpr uint8_t WindowMask = static_cast<uint8_t>(1 << WindowBits) - 1;
 1075|       |
 1076|  24.5k|   constexpr size_t W_bits = sizeof(W) * 8;
 1077|  24.5k|   const auto bit_shift = offset % W_bits;
 1078|  24.5k|   const auto word_offset = words.size() - 1 - (offset / W_bits);
 1079|       |
 1080|  24.5k|   const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0;
  ------------------
  |  Branch (1080:36): [True: 22.8k, False: 1.66k]
  |  Branch (1080:74): [True: 238, False: 1.42k]
  ------------------
 1081|       |
 1082|  24.5k|   const auto w0 = words[word_offset];
 1083|       |
 1084|  24.5k|   if(single_byte_window) {
  ------------------
  |  Branch (1084:7): [True: 23.0k, False: 1.42k]
  ------------------
 1085|  23.0k|      return (w0 >> bit_shift) & WindowMask;
 1086|  23.0k|   } else {
 1087|       |      // Otherwise we must join two words and extract the result
 1088|  1.42k|      const auto w1 = words[word_offset - 1];
 1089|  1.42k|      const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift)));
 1090|  1.42k|      return combined & WindowMask;
 1091|  1.42k|   }
 1092|  24.5k|}
_ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm8EEET0_RNSt3__15arrayIS1_XT1_EEE:
  741|  1.42k|inline constexpr W shift_right(std::array<W, N>& x) {
  742|  1.42k|   static_assert(N >= 1, "Invalid input size");
  743|  1.42k|   static_assert(S > 0, "Zero shift not supported");
  744|  1.42k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  745|       |
  746|  1.42k|   const W carry = x[0] << (WordInfo<W>::bits - S);
  747|       |
  748|  11.4k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (748:22): [True: 9.98k, False: 1.42k]
  ------------------
  749|  9.98k|      x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
  750|  9.98k|   }
  751|  1.42k|   x[N - 1] >>= S;
  752|       |
  753|  1.42k|   return carry;
  754|  1.42k|}
_ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|  13.1k|inline constexpr W shift_left(std::array<W, N>& x) {
  726|  13.1k|   static_assert(N >= 1, "Invalid input size");
  727|  13.1k|   static_assert(S > 0, "Zero shift not supported");
  728|  13.1k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|  13.1k|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|   118k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 105k, False: 13.1k]
  ------------------
  733|   105k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|   105k|   }
  735|  13.1k|   x[0] <<= S;
  736|       |
  737|  13.1k|   return carry;
  738|  13.1k|}
_ZN5Botan22bigint_monty_maybe_subILm9ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  254|  19.3k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  255|  19.3k|   W borrow = 0;
  256|       |
  257|   193k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (257:22): [True: 173k, False: 19.3k]
  ------------------
  258|   173k|      z[i] = word_sub(x[i], y[i], &borrow);
  259|   173k|   }
  260|       |
  261|  19.3k|   borrow = (x0 - borrow) > x0;
  262|       |
  263|  19.3k|   CT::conditional_assign_mem(borrow, z, x, N);
  264|  19.3k|}
_ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE:
  741|  1.48k|inline constexpr W shift_right(std::array<W, N>& x) {
  742|  1.48k|   static_assert(N >= 1, "Invalid input size");
  743|  1.48k|   static_assert(S > 0, "Zero shift not supported");
  744|  1.48k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  745|       |
  746|  1.48k|   const W carry = x[0] << (WordInfo<W>::bits - S);
  747|       |
  748|  13.3k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (748:22): [True: 11.8k, False: 1.48k]
  ------------------
  749|  11.8k|      x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
  750|  11.8k|   }
  751|  1.48k|   x[N - 1] >>= S;
  752|       |
  753|  1.48k|   return carry;
  754|  1.48k|}
_ZN5Botan9comba_sqrILm3ETkNS_8WordTypeEmEEvPT0_PKS1_:
  854|  41.3k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) {
  855|  41.3k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (855:7): [True: 41.3k, Folded]
  ------------------
  856|       |      if constexpr(std::same_as<W, word> && N == 4) {
  857|       |         return bigint_comba_sqr4(z, x);
  858|       |      }
  859|       |      if constexpr(std::same_as<W, word> && N == 6) {
  860|       |         return bigint_comba_sqr6(z, x);
  861|       |      }
  862|       |      if constexpr(std::same_as<W, word> && N == 7) {
  863|       |         return bigint_comba_sqr7(z, x);
  864|       |      }
  865|       |      if constexpr(std::same_as<W, word> && N == 8) {
  866|       |         return bigint_comba_sqr8(z, x);
  867|       |      }
  868|       |      if constexpr(std::same_as<W, word> && N == 9) {
  869|       |         return bigint_comba_sqr9(z, x);
  870|       |      }
  871|       |      if constexpr(std::same_as<W, word> && N == 16) {
  872|       |         return bigint_comba_sqr16(z, x);
  873|       |      }
  874|  41.3k|   }
  875|       |
  876|  41.3k|   word3<W> accum;
  877|       |
  878|   289k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (878:22): [True: 248k, False: 41.3k]
  ------------------
  879|   248k|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (879:28): [True: 82.6k, False: 165k]
  ------------------
  880|   248k|      const size_t end = std::min(N, i + 1);
  881|       |
  882|   620k|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (882:29): [True: 372k, False: 248k]
  ------------------
  883|   372k|         accum.mul(x[j], x[i - j]);
  884|   372k|      }
  885|   248k|      z[i] = accum.extract();
  886|   248k|   }
  887|  41.3k|}
_ZN5Botan9comba_mulILm3ETkNS_8WordTypeEmEEvPT0_PKS1_S4_:
  818|  23.5k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) {
  819|  23.5k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (819:7): [True: 23.5k, Folded]
  ------------------
  820|       |      if constexpr(std::same_as<W, word> && N == 4) {
  821|       |         return bigint_comba_mul4(z, x, y);
  822|       |      }
  823|       |      if constexpr(std::same_as<W, word> && N == 6) {
  824|       |         return bigint_comba_mul6(z, x, y);
  825|       |      }
  826|       |      if constexpr(std::same_as<W, word> && N == 7) {
  827|       |         return bigint_comba_mul7(z, x, y);
  828|       |      }
  829|       |      if constexpr(std::same_as<W, word> && N == 8) {
  830|       |         return bigint_comba_mul8(z, x, y);
  831|       |      }
  832|       |      if constexpr(std::same_as<W, word> && N == 9) {
  833|       |         return bigint_comba_mul9(z, x, y);
  834|       |      }
  835|       |      if constexpr(std::same_as<W, word> && N == 16) {
  836|       |         return bigint_comba_mul16(z, x, y);
  837|       |      }
  838|  23.5k|   }
  839|       |
  840|  23.5k|   word3<W> accum;
  841|       |
  842|   164k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (842:22): [True: 141k, False: 23.5k]
  ------------------
  843|   141k|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (843:28): [True: 47.0k, False: 94.0k]
  ------------------
  844|   141k|      const size_t end = std::min(N, i + 1);
  845|       |
  846|   352k|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (846:29): [True: 211k, False: 141k]
  ------------------
  847|   211k|         accum.mul(x[j], y[i - j]);
  848|   211k|      }
  849|   141k|      z[i] = accum.extract();
  850|   141k|   }
  851|  23.5k|}
_ZN5Botan22bigint_monty_maybe_subILm3ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  254|  7.50k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  255|  7.50k|   W borrow = 0;
  256|       |
  257|  30.0k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (257:22): [True: 22.5k, False: 7.50k]
  ------------------
  258|  22.5k|      z[i] = word_sub(x[i], y[i], &borrow);
  259|  22.5k|   }
  260|       |
  261|  7.50k|   borrow = (x0 - borrow) > x0;
  262|       |
  263|  7.50k|   CT::conditional_assign_mem(borrow, z, x, N);
  264|  7.50k|}
_ZN5Botan10shift_leftILm1ETkNS_8WordTypeEmLm3EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|  5.03k|inline constexpr W shift_left(std::array<W, N>& x) {
  726|  5.03k|   static_assert(N >= 1, "Invalid input size");
  727|  5.03k|   static_assert(S > 0, "Zero shift not supported");
  728|  5.03k|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|  5.03k|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|  15.0k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 10.0k, False: 5.03k]
  ------------------
  733|  10.0k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  10.0k|   }
  735|  5.03k|   x[0] <<= S;
  736|       |
  737|  5.03k|   return carry;
  738|  5.03k|}
_ZN5Botan11shift_rightILm1ETkNS_8WordTypeEmLm3EEET0_RNSt3__15arrayIS1_XT1_EEE:
  741|    514|inline constexpr W shift_right(std::array<W, N>& x) {
  742|    514|   static_assert(N >= 1, "Invalid input size");
  743|    514|   static_assert(S > 0, "Zero shift not supported");
  744|    514|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  745|       |
  746|    514|   const W carry = x[0] << (WordInfo<W>::bits - S);
  747|       |
  748|  1.54k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (748:22): [True: 1.02k, False: 514]
  ------------------
  749|  1.02k|      x[i] = (x[i] >> S) | (x[i + 1] << (WordInfo<W>::bits - S));
  750|  1.02k|   }
  751|    514|   x[N - 1] >>= S;
  752|       |
  753|    514|   return carry;
  754|    514|}
_ZN5Botan16read_window_bitsILm4EmLm3EEEmNSt3__14spanIKT0_XT1_EEEm:
 1071|  8.59k|constexpr size_t read_window_bits(std::span<const W, N> words, size_t offset) {
 1072|  8.59k|   static_assert(WindowBits >= 1 && WindowBits <= 7);
 1073|       |
 1074|  8.59k|   constexpr uint8_t WindowMask = static_cast<uint8_t>(1 << WindowBits) - 1;
 1075|       |
 1076|  8.59k|   constexpr size_t W_bits = sizeof(W) * 8;
 1077|  8.59k|   const auto bit_shift = offset % W_bits;
 1078|  8.59k|   const auto word_offset = words.size() - 1 - (offset / W_bits);
 1079|       |
 1080|  8.59k|   const bool single_byte_window = bit_shift <= (W_bits - WindowBits) || word_offset == 0;
  ------------------
  |  Branch (1080:36): [True: 8.59k, False: 0]
  |  Branch (1080:74): [True: 0, False: 0]
  ------------------
 1081|       |
 1082|  8.59k|   const auto w0 = words[word_offset];
 1083|       |
 1084|  8.59k|   if(single_byte_window) {
  ------------------
  |  Branch (1084:7): [True: 8.59k, False: 0]
  ------------------
 1085|  8.59k|      return (w0 >> bit_shift) & WindowMask;
 1086|  8.59k|   } else {
 1087|       |      // Otherwise we must join two words and extract the result
 1088|      0|      const auto w1 = words[word_offset - 1];
 1089|      0|      const auto combined = ((w0 >> bit_shift) | (w1 << (W_bits - bit_shift)));
 1090|      0|      return combined & WindowMask;
 1091|      0|   }
 1092|  8.59k|}
_ZN5Botan10shift_leftILm32ETkNS_8WordTypeEmLm4EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|    449|inline constexpr W shift_left(std::array<W, N>& x) {
  726|    449|   static_assert(N >= 1, "Invalid input size");
  727|    449|   static_assert(S > 0, "Zero shift not supported");
  728|    449|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|    449|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|  1.79k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 1.34k, False: 449]
  ------------------
  733|  1.34k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  1.34k|   }
  735|    449|   x[0] <<= S;
  736|       |
  737|    449|   return carry;
  738|    449|}
_ZN5Botan9comba_sqrILm9ETkNS_8WordTypeEmEEvPT0_PKS1_:
  854|   210k|constexpr inline void comba_sqr(W z[2 * N], const W x[N]) {
  855|   210k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (855:7): [True: 210k, Folded]
  ------------------
  856|       |      if constexpr(std::same_as<W, word> && N == 4) {
  857|       |         return bigint_comba_sqr4(z, x);
  858|       |      }
  859|       |      if constexpr(std::same_as<W, word> && N == 6) {
  860|       |         return bigint_comba_sqr6(z, x);
  861|       |      }
  862|       |      if constexpr(std::same_as<W, word> && N == 7) {
  863|       |         return bigint_comba_sqr7(z, x);
  864|       |      }
  865|       |      if constexpr(std::same_as<W, word> && N == 8) {
  866|       |         return bigint_comba_sqr8(z, x);
  867|       |      }
  868|   210k|      if constexpr(std::same_as<W, word> && N == 9) {
  869|   210k|         return bigint_comba_sqr9(z, x);
  870|   210k|      }
  871|       |      if constexpr(std::same_as<W, word> && N == 16) {
  872|       |         return bigint_comba_sqr16(z, x);
  873|       |      }
  874|   210k|   }
  875|       |
  876|      0|   word3<W> accum;
  877|       |
  878|   210k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (878:22): [True: 0, False: 210k]
  ------------------
  879|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (879:28): [True: 0, False: 0]
  ------------------
  880|      0|      const size_t end = std::min(N, i + 1);
  881|       |
  882|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (882:29): [True: 0, False: 0]
  ------------------
  883|      0|         accum.mul(x[j], x[i - j]);
  884|      0|      }
  885|      0|      z[i] = accum.extract();
  886|      0|   }
  887|   210k|}
_ZN5Botan9comba_mulILm9ETkNS_8WordTypeEmEEvPT0_PKS1_S4_:
  818|  43.1k|constexpr inline void comba_mul(W z[2 * N], const W x[N], const W y[N]) {
  819|  43.1k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (819:7): [True: 43.1k, Folded]
  ------------------
  820|       |      if constexpr(std::same_as<W, word> && N == 4) {
  821|       |         return bigint_comba_mul4(z, x, y);
  822|       |      }
  823|       |      if constexpr(std::same_as<W, word> && N == 6) {
  824|       |         return bigint_comba_mul6(z, x, y);
  825|       |      }
  826|       |      if constexpr(std::same_as<W, word> && N == 7) {
  827|       |         return bigint_comba_mul7(z, x, y);
  828|       |      }
  829|       |      if constexpr(std::same_as<W, word> && N == 8) {
  830|       |         return bigint_comba_mul8(z, x, y);
  831|       |      }
  832|  43.1k|      if constexpr(std::same_as<W, word> && N == 9) {
  833|  43.1k|         return bigint_comba_mul9(z, x, y);
  834|  43.1k|      }
  835|       |      if constexpr(std::same_as<W, word> && N == 16) {
  836|       |         return bigint_comba_mul16(z, x, y);
  837|       |      }
  838|  43.1k|   }
  839|       |
  840|      0|   word3<W> accum;
  841|       |
  842|  43.1k|   for(size_t i = 0; i != 2 * N; ++i) {
  ------------------
  |  Branch (842:22): [True: 0, False: 43.1k]
  ------------------
  843|      0|      const size_t start = i + 1 < N ? 0 : i + 1 - N;
  ------------------
  |  Branch (843:28): [True: 0, False: 0]
  ------------------
  844|      0|      const size_t end = std::min(N, i + 1);
  845|       |
  846|      0|      for(size_t j = start; j != end; ++j) {
  ------------------
  |  Branch (846:29): [True: 0, False: 0]
  ------------------
  847|      0|         accum.mul(x[j], y[i - j]);
  848|      0|      }
  849|      0|      z[i] = accum.extract();
  850|      0|   }
  851|  43.1k|}
_ZN5Botan10shift_leftILm16ETkNS_8WordTypeEmLm9EEET0_RNSt3__15arrayIS1_XT1_EEE:
  725|    660|inline constexpr W shift_left(std::array<W, N>& x) {
  726|    660|   static_assert(N >= 1, "Invalid input size");
  727|    660|   static_assert(S > 0, "Zero shift not supported");
  728|    660|   static_assert(S < WordInfo<W>::bits, "Shift too large");
  729|       |
  730|    660|   const W carry = x[N - 1] >> (WordInfo<W>::bits - S);
  731|       |
  732|  5.94k|   for(size_t i = N - 1; i != 0; --i) {
  ------------------
  |  Branch (732:26): [True: 5.28k, False: 660]
  ------------------
  733|  5.28k|      x[i] = (x[i] << S) | (x[i - 1] >> (WordInfo<W>::bits - S));
  734|  5.28k|   }
  735|    660|   x[0] <<= S;
  736|       |
  737|    660|   return carry;
  738|    660|}

_ZN5Botan6PCurve15PrimeOrderCurve11AffinePointD2Ev:
  100|  6.08k|            ~AffinePoint() = default;
_ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2EOS2_:
   97|  4.56k|            AffinePoint(AffinePoint&& other) = default;
_ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint6_curveEv:
  104|  3.03k|            const auto& _curve() const { return m_curve; }
_ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_xEv:
  106|  3.03k|            const auto& _x() const { return m_x; }
_ZNK5Botan6PCurve15PrimeOrderCurve11AffinePoint2_yEv:
  108|  3.03k|            const auto& _y() const { return m_y; }
_ZN5Botan6PCurve15PrimeOrderCurve11AffinePoint7_createENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_:
  110|  1.52k|            static AffinePoint _create(CurvePtr curve, StorageUnit x, StorageUnit y) {
  111|  1.52k|               return AffinePoint(std::move(curve), x, y);
  112|  1.52k|            }
_ZN5Botan6PCurve15PrimeOrderCurve11AffinePointC2ENSt3__110shared_ptrIKS1_EENS3_5arrayImLm9EEES8_:
  115|  1.52k|            AffinePoint(CurvePtr curve, StorageUnit x, StorageUnit y) : m_curve(std::move(curve)), m_x(x), m_y(y) {}
_ZN5Botan6PCurve15PrimeOrderCurveD2Ev:
  163|      7|      virtual ~PrimeOrderCurve() = default;

pcurves_brainpool256r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_:
  397|    833|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) {
  398|       |   // Cost: 1M + 3S + 1A + 1*3
  399|    833|   const auto z2 = pt.z().square();
  400|    833|   const auto m = pt.x().square().mul3() + A * z2.square();
  401|       |
  402|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  403|    833|   const auto y2 = pt.y().square();
  404|    833|   const auto s = pt.x().mul4() * y2;
  405|    833|   const auto nx = m.square() - s.mul2();
  406|    833|   const auto ny = m * (s - nx) - y2.square().mul8();
  407|    833|   const auto nz = pt.y().mul2() * pt.z();
  408|       |
  409|    833|   return ProjectivePoint(nx, ny, nz);
  410|    833|}
pcurves_brainpool256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|    735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|    735|   const auto a_is_identity = a.is_identity();
  189|    735|   const auto b_is_identity = b.is_identity();
  190|       |
  191|    735|   const auto Z1Z1 = a.z().square();
  192|    735|   const auto Z2Z2 = b.z().square();
  193|    735|   const auto U1 = a.x() * Z2Z2;
  194|    735|   const auto U2 = b.x() * Z1Z1;
  195|    735|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|    735|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|    735|   const auto H = U2 - U1;
  198|    735|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|    735|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 735]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|    735|   const auto HH = H.square();
  215|    735|   const auto HHH = H * HH;
  216|    735|   const auto V = U1 * HH;
  217|    735|   const auto t2 = r.square();
  218|    735|   const auto t3 = V + V;
  219|    735|   const auto t4 = t2 - HHH;
  220|    735|   auto X3 = t4 - t3;
  221|    735|   const auto t5 = V - X3;
  222|    735|   const auto t6 = S1 * HHH;
  223|    735|   const auto t7 = r * t5;
  224|    735|   auto Y3 = t7 - t6;
  225|    735|   const auto t8 = b.z() * H;
  226|    735|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|    735|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|    735|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|    735|   return ProjectivePoint(X3, Y3, Z3);
  235|    735|}
pcurves_brainpool256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  1.56k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 1.56k, False: 1]
  ------------------
  117|  1.56k|      any_identity = any_identity || pt.is_identity();
  118|  1.56k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  1.56k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 1.56k, False: 1]
  ------------------
  146|  1.56k|         c.push_back(c[i - 1] * projective[i].z());
  147|  1.56k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  1.56k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 1.56k, False: 1]
  ------------------
  158|  1.56k|         const auto& p = projective[i];
  159|       |
  160|  1.56k|         const auto z_inv = s_inv * c[i - 1];
  161|  1.56k|         const auto z2_inv = z_inv.square();
  162|  1.56k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  1.56k|         s_inv = s_inv * p.z();
  165|       |
  166|  1.56k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  1.56k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_brainpool256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_brainpool256r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    360|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|       |   if constexpr(curve_supports_fe_sqrt<C>) {
   62|       |      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|       |      const CT::Choice correct = (z.square() == fe);
   65|       |      z.conditional_assign(!correct, C::FieldElement::zero());
   66|       |      return CT::Option(z, correct);
   67|    360|   } else {
   68|    360|      return fe.sqrt();
   69|    360|   }
   70|    360|}
pcurves_brainpool512r1.cpp:_ZN5Botan11dbl_genericINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_RKT0_:
  397|  1.64k|inline constexpr ProjectivePoint dbl_generic(const ProjectivePoint& pt, const FieldElement& A) {
  398|       |   // Cost: 1M + 3S + 1A + 1*3
  399|  1.64k|   const auto z2 = pt.z().square();
  400|  1.64k|   const auto m = pt.x().square().mul3() + A * z2.square();
  401|       |
  402|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  403|  1.64k|   const auto y2 = pt.y().square();
  404|  1.64k|   const auto s = pt.x().mul4() * y2;
  405|  1.64k|   const auto nx = m.square() - s.mul2();
  406|  1.64k|   const auto ny = m * (s - nx) - y2.square().mul8();
  407|  1.64k|   const auto nz = pt.y().mul2() * pt.z();
  408|       |
  409|  1.64k|   return ProjectivePoint(nx, ny, nz);
  410|  1.64k|}
pcurves_brainpool512r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES3_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|  1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|  1.45k|   const auto a_is_identity = a.is_identity();
  189|  1.45k|   const auto b_is_identity = b.is_identity();
  190|       |
  191|  1.45k|   const auto Z1Z1 = a.z().square();
  192|  1.45k|   const auto Z2Z2 = b.z().square();
  193|  1.45k|   const auto U1 = a.x() * Z2Z2;
  194|  1.45k|   const auto U2 = b.x() * Z1Z1;
  195|  1.45k|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|  1.45k|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|  1.45k|   const auto H = U2 - U1;
  198|  1.45k|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|  1.45k|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 1.45k]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|  1.45k|   const auto HH = H.square();
  215|  1.45k|   const auto HHH = H * HH;
  216|  1.45k|   const auto V = U1 * HH;
  217|  1.45k|   const auto t2 = r.square();
  218|  1.45k|   const auto t3 = V + V;
  219|  1.45k|   const auto t4 = t2 - HHH;
  220|  1.45k|   auto X3 = t4 - t3;
  221|  1.45k|   const auto t5 = V - X3;
  222|  1.45k|   const auto t6 = S1 * HHH;
  223|  1.45k|   const auto t7 = r * t5;
  224|  1.45k|   auto Y3 = t7 - t6;
  225|  1.45k|   const auto t8 = b.z() * H;
  226|  1.45k|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|  1.45k|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|  1.45k|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|  1.45k|   return ProjectivePoint(X3, Y3, Z3);
  235|  1.45k|}
pcurves_brainpool512r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  3.10k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 3.10k, False: 1]
  ------------------
  117|  3.10k|      any_identity = any_identity || pt.is_identity();
  118|  3.10k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  3.10k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 3.10k, False: 1]
  ------------------
  146|  3.10k|         c.push_back(c[i - 1] * projective[i].z());
  147|  3.10k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  3.10k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 3.10k, False: 1]
  ------------------
  158|  3.10k|         const auto& p = projective[i];
  159|       |
  160|  3.10k|         const auto z_inv = s_inv * c[i - 1];
  161|  3.10k|         const auto z2_inv = z_inv.square();
  162|  3.10k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  3.10k|         s_inv = s_inv * p.z();
  165|       |
  166|  3.10k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  3.10k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_brainpool512r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_brainpool512r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    238|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|       |   if constexpr(curve_supports_fe_sqrt<C>) {
   62|       |      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|       |      const CT::Choice correct = (z.square() == fe);
   65|       |      z.conditional_assign(!correct, C::FieldElement::zero());
   66|       |      return CT::Option(z, correct);
   67|    238|   } else {
   68|    238|      return fe.sqrt();
   69|    238|   }
   70|    238|}
pcurves_secp192r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_:
  362|    629|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) {
  363|       |   /*
  364|       |   if a == -3 then
  365|       |   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  366|       |   */
  367|    629|   const auto z2 = pt.z().square();
  368|    629|   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
  369|       |
  370|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  371|    629|   const auto y2 = pt.y().square();
  372|    629|   const auto s = pt.x().mul4() * y2;
  373|    629|   const auto nx = m.square() - s.mul2();
  374|    629|   const auto ny = m * (s - nx) - y2.square().mul8();
  375|    629|   const auto nz = pt.y().mul2() * pt.z();
  376|       |
  377|    629|   return ProjectivePoint(nx, ny, nz);
  378|    629|}
pcurves_secp192r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|    555|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|    555|   const auto a_is_identity = a.is_identity();
  189|    555|   const auto b_is_identity = b.is_identity();
  190|       |
  191|    555|   const auto Z1Z1 = a.z().square();
  192|    555|   const auto Z2Z2 = b.z().square();
  193|    555|   const auto U1 = a.x() * Z2Z2;
  194|    555|   const auto U2 = b.x() * Z1Z1;
  195|    555|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|    555|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|    555|   const auto H = U2 - U1;
  198|    555|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|    555|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 555]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|    555|   const auto HH = H.square();
  215|    555|   const auto HHH = H * HH;
  216|    555|   const auto V = U1 * HH;
  217|    555|   const auto t2 = r.square();
  218|    555|   const auto t3 = V + V;
  219|    555|   const auto t4 = t2 - HHH;
  220|    555|   auto X3 = t4 - t3;
  221|    555|   const auto t5 = V - X3;
  222|    555|   const auto t6 = S1 * HHH;
  223|    555|   const auto t7 = r * t5;
  224|    555|   auto Y3 = t7 - t6;
  225|    555|   const auto t8 = b.z() * H;
  226|    555|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|    555|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|    555|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|    555|   return ProjectivePoint(X3, Y3, Z3);
  235|    555|}
pcurves_secp192r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp192r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  1.18k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 1.18k, False: 1]
  ------------------
  117|  1.18k|      any_identity = any_identity || pt.is_identity();
  118|  1.18k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  1.18k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 1.18k, False: 1]
  ------------------
  146|  1.18k|         c.push_back(c[i - 1] * projective[i].z());
  147|  1.18k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  1.18k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 1.18k, False: 1]
  ------------------
  158|  1.18k|         const auto& p = projective[i];
  159|       |
  160|  1.18k|         const auto z_inv = s_inv * c[i - 1];
  161|  1.18k|         const auto z2_inv = z_inv.square();
  162|  1.18k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  1.18k|         s_inv = s_inv * p.z();
  165|       |
  166|  1.18k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  1.18k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_secp192r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp192r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_secp192r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp192r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    179|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|       |   if constexpr(curve_supports_fe_sqrt<C>) {
   62|       |      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|       |      const CT::Choice correct = (z.square() == fe);
   65|       |      z.conditional_assign(!correct, C::FieldElement::zero());
   66|       |      return CT::Option(z, correct);
   67|    179|   } else {
   68|    179|      return fe.sqrt();
   69|    179|   }
   70|    179|}
pcurves_secp224r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_:
  362|    731|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) {
  363|       |   /*
  364|       |   if a == -3 then
  365|       |   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  366|       |   */
  367|    731|   const auto z2 = pt.z().square();
  368|    731|   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
  369|       |
  370|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  371|    731|   const auto y2 = pt.y().square();
  372|    731|   const auto s = pt.x().mul4() * y2;
  373|    731|   const auto nx = m.square() - s.mul2();
  374|    731|   const auto ny = m * (s - nx) - y2.square().mul8();
  375|    731|   const auto nz = pt.y().mul2() * pt.z();
  376|       |
  377|    731|   return ProjectivePoint(nx, ny, nz);
  378|    731|}
pcurves_secp224r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|    645|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|    645|   const auto a_is_identity = a.is_identity();
  189|    645|   const auto b_is_identity = b.is_identity();
  190|       |
  191|    645|   const auto Z1Z1 = a.z().square();
  192|    645|   const auto Z2Z2 = b.z().square();
  193|    645|   const auto U1 = a.x() * Z2Z2;
  194|    645|   const auto U2 = b.x() * Z1Z1;
  195|    645|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|    645|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|    645|   const auto H = U2 - U1;
  198|    645|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|    645|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 645]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|    645|   const auto HH = H.square();
  215|    645|   const auto HHH = H * HH;
  216|    645|   const auto V = U1 * HH;
  217|    645|   const auto t2 = r.square();
  218|    645|   const auto t3 = V + V;
  219|    645|   const auto t4 = t2 - HHH;
  220|    645|   auto X3 = t4 - t3;
  221|    645|   const auto t5 = V - X3;
  222|    645|   const auto t6 = S1 * HHH;
  223|    645|   const auto t7 = r * t5;
  224|    645|   auto Y3 = t7 - t6;
  225|    645|   const auto t8 = b.z() * H;
  226|    645|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|    645|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|    645|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|    645|   return ProjectivePoint(X3, Y3, Z3);
  235|    645|}
pcurves_secp224r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  1.37k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 1.37k, False: 1]
  ------------------
  117|  1.37k|      any_identity = any_identity || pt.is_identity();
  118|  1.37k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  1.37k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 1.37k, False: 1]
  ------------------
  146|  1.37k|         c.push_back(c[i - 1] * projective[i].z());
  147|  1.37k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  1.37k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 1.37k, False: 1]
  ------------------
  158|  1.37k|         const auto& p = projective[i];
  159|       |
  160|  1.37k|         const auto z_inv = s_inv * c[i - 1];
  161|  1.37k|         const auto z2_inv = z_inv.square();
  162|  1.37k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  1.37k|         s_inv = s_inv * p.z();
  165|       |
  166|  1.37k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  1.37k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_secp224r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp224r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_secp224r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp224r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    283|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|       |   if constexpr(curve_supports_fe_sqrt<C>) {
   62|       |      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|       |      const CT::Choice correct = (z.square() == fe);
   65|       |      z.conditional_assign(!correct, C::FieldElement::zero());
   66|       |      return CT::Option(z, correct);
   67|    283|   } else {
   68|    283|      return fe.sqrt();
   69|    283|   }
   70|    283|}
pcurves_secp256r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_:
  362|    833|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) {
  363|       |   /*
  364|       |   if a == -3 then
  365|       |   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  366|       |   */
  367|    833|   const auto z2 = pt.z().square();
  368|    833|   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
  369|       |
  370|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  371|    833|   const auto y2 = pt.y().square();
  372|    833|   const auto s = pt.x().mul4() * y2;
  373|    833|   const auto nx = m.square() - s.mul2();
  374|    833|   const auto ny = m * (s - nx) - y2.square().mul8();
  375|    833|   const auto nz = pt.y().mul2() * pt.z();
  376|       |
  377|    833|   return ProjectivePoint(nx, ny, nz);
  378|    833|}
pcurves_secp256r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS4_9secp256r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|    735|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|    735|   const auto a_is_identity = a.is_identity();
  189|    735|   const auto b_is_identity = b.is_identity();
  190|       |
  191|    735|   const auto Z1Z1 = a.z().square();
  192|    735|   const auto Z2Z2 = b.z().square();
  193|    735|   const auto U1 = a.x() * Z2Z2;
  194|    735|   const auto U2 = b.x() * Z1Z1;
  195|    735|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|    735|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|    735|   const auto H = U2 - U1;
  198|    735|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|    735|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 735]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|    735|   const auto HH = H.square();
  215|    735|   const auto HHH = H * HH;
  216|    735|   const auto V = U1 * HH;
  217|    735|   const auto t2 = r.square();
  218|    735|   const auto t3 = V + V;
  219|    735|   const auto t4 = t2 - HHH;
  220|    735|   auto X3 = t4 - t3;
  221|    735|   const auto t5 = V - X3;
  222|    735|   const auto t6 = S1 * HHH;
  223|    735|   const auto t7 = r * t5;
  224|    735|   auto Y3 = t7 - t6;
  225|    735|   const auto t8 = b.z() * H;
  226|    735|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|    735|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|    735|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|    735|   return ProjectivePoint(X3, Y3, Z3);
  235|    735|}
pcurves_secp256r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  1.56k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 1.56k, False: 1]
  ------------------
  117|  1.56k|      any_identity = any_identity || pt.is_identity();
  118|  1.56k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  1.56k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 1.56k, False: 1]
  ------------------
  146|  1.56k|         c.push_back(c[i - 1] * projective[i].z());
  147|  1.56k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  1.56k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 1.56k, False: 1]
  ------------------
  158|  1.56k|         const auto& p = projective[i];
  159|       |
  160|  1.56k|         const auto z_inv = s_inv * c[i - 1];
  161|  1.56k|         const auto z2_inv = z_inv.square();
  162|  1.56k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  1.56k|         s_inv = s_inv * p.z();
  165|       |
  166|  1.56k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  1.56k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_secp256r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp256r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_secp256r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp256r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    386|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|    386|   if constexpr(curve_supports_fe_sqrt<C>) {
   62|    386|      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|    386|      const CT::Choice correct = (z.square() == fe);
   65|    386|      z.conditional_assign(!correct, C::FieldElement::zero());
   66|    386|      return CT::Option(z, correct);
   67|       |   } else {
   68|       |      return fe.sqrt();
   69|       |   }
   70|    386|}
pcurves_secp384r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EEEET_RKSE_:
  362|  1.24k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) {
  363|       |   /*
  364|       |   if a == -3 then
  365|       |   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  366|       |   */
  367|  1.24k|   const auto z2 = pt.z().square();
  368|  1.24k|   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
  369|       |
  370|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  371|  1.24k|   const auto y2 = pt.y().square();
  372|  1.24k|   const auto s = pt.x().mul4() * y2;
  373|  1.24k|   const auto nx = m.square() - s.mul2();
  374|  1.24k|   const auto ny = m * (s - nx) - y2.square().mul8();
  375|  1.24k|   const auto nz = pt.y().mul2() * pt.z();
  376|       |
  377|  1.24k|   return ProjectivePoint(nx, ny, nz);
  378|  1.24k|}
pcurves_secp384r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS4_9secp384r16ParamsES5_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|  1.09k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|  1.09k|   const auto a_is_identity = a.is_identity();
  189|  1.09k|   const auto b_is_identity = b.is_identity();
  190|       |
  191|  1.09k|   const auto Z1Z1 = a.z().square();
  192|  1.09k|   const auto Z2Z2 = b.z().square();
  193|  1.09k|   const auto U1 = a.x() * Z2Z2;
  194|  1.09k|   const auto U2 = b.x() * Z1Z1;
  195|  1.09k|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|  1.09k|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|  1.09k|   const auto H = U2 - U1;
  198|  1.09k|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|  1.09k|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 1.09k]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|  1.09k|   const auto HH = H.square();
  215|  1.09k|   const auto HHH = H * HH;
  216|  1.09k|   const auto V = U1 * HH;
  217|  1.09k|   const auto t2 = r.square();
  218|  1.09k|   const auto t3 = V + V;
  219|  1.09k|   const auto t4 = t2 - HHH;
  220|  1.09k|   auto X3 = t4 - t3;
  221|  1.09k|   const auto t5 = V - X3;
  222|  1.09k|   const auto t6 = S1 * HHH;
  223|  1.09k|   const auto t7 = r * t5;
  224|  1.09k|   auto Y3 = t7 - t6;
  225|  1.09k|   const auto t8 = b.z() * H;
  226|  1.09k|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|  1.09k|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|  1.09k|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|  1.09k|   return ProjectivePoint(X3, Y3, Z3);
  235|  1.09k|}
pcurves_secp384r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  2.33k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 2.33k, False: 1]
  ------------------
  117|  2.33k|      any_identity = any_identity || pt.is_identity();
  118|  2.33k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  2.33k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 2.33k, False: 1]
  ------------------
  146|  2.33k|         c.push_back(c[i - 1] * projective[i].z());
  147|  2.33k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  2.33k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 2.33k, False: 1]
  ------------------
  158|  2.33k|         const auto& p = projective[i];
  159|       |
  160|  2.33k|         const auto z_inv = s_inv * c[i - 1];
  161|  2.33k|         const auto z2_inv = z_inv.square();
  162|  2.33k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  2.33k|         s_inv = s_inv * p.z();
  165|       |
  166|  2.33k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  2.33k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_secp384r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp384r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_secp384r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp384r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    168|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|    168|   if constexpr(curve_supports_fe_sqrt<C>) {
   62|    168|      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|    168|      const CT::Choice correct = (z.square() == fe);
   65|    168|      z.conditional_assign(!correct, C::FieldElement::zero());
   66|    168|      return CT::Option(z, correct);
   67|       |   } else {
   68|       |      return fe.sqrt();
   69|       |   }
   70|    168|}
pcurves_secp521r1.cpp:_ZN5Botan13dbl_a_minus_3INS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EEEET_RKSE_:
  362|  1.64k|inline constexpr ProjectivePoint dbl_a_minus_3(const ProjectivePoint& pt) {
  363|       |   /*
  364|       |   if a == -3 then
  365|       |   3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
  366|       |   */
  367|  1.64k|   const auto z2 = pt.z().square();
  368|  1.64k|   const auto m = (pt.x() - z2).mul3() * (pt.x() + z2);
  369|       |
  370|       |   // Remaining cost: 3M + 3S + 3A + 2*2 + 1*4 + 1*8
  371|  1.64k|   const auto y2 = pt.y().square();
  372|  1.64k|   const auto s = pt.x().mul4() * y2;
  373|  1.64k|   const auto nx = m.square() - s.mul2();
  374|  1.64k|   const auto ny = m * (s - nx) - y2.square().mul8();
  375|  1.64k|   const auto nz = pt.y().mul2() * pt.z();
  376|       |
  377|  1.64k|   return ProjectivePoint(nx, ny, nz);
  378|  1.64k|}
pcurves_secp521r1.cpp:_ZN5Botan9point_addINS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS5_6ParamsES6_E11FieldParamsEEEEES8_EESC_EET_RKSE_SG_:
  187|  1.45k|inline constexpr ProjectivePoint point_add(const ProjectivePoint& a, const ProjectivePoint& b) {
  188|  1.45k|   const auto a_is_identity = a.is_identity();
  189|  1.45k|   const auto b_is_identity = b.is_identity();
  190|       |
  191|  1.45k|   const auto Z1Z1 = a.z().square();
  192|  1.45k|   const auto Z2Z2 = b.z().square();
  193|  1.45k|   const auto U1 = a.x() * Z2Z2;
  194|  1.45k|   const auto U2 = b.x() * Z1Z1;
  195|  1.45k|   const auto S1 = a.y() * b.z() * Z2Z2;
  196|  1.45k|   const auto S2 = b.y() * a.z() * Z1Z1;
  197|  1.45k|   const auto H = U2 - U1;
  198|  1.45k|   const auto r = S2 - S1;
  199|       |
  200|       |   /* Risky conditional
  201|       |   *
  202|       |   * This implementation uses projective coordinates, which do not have an efficient complete
  203|       |   * addition formula. We rely on the design of the multiplication algorithms to avoid doublings.
  204|       |   *
  205|       |   * This conditional only comes into play for the actual doubling case, not x + (-x) which
  206|       |   * is another exceptional case in some circumstances. Here if a == -b then H == 0 && r != 0,
  207|       |   * in which case at the end we'll set z to a.z * b.z * H = 0, resulting in the correct
  208|       |   * output (the identity element)
  209|       |   */
  210|  1.45k|   if((r.is_zero() && H.is_zero() && !(a_is_identity && b_is_identity)).as_bool()) {
  ------------------
  |  Branch (210:7): [True: 0, False: 1.45k]
  ------------------
  211|      0|      return a.dbl();
  212|      0|   }
  213|       |
  214|  1.45k|   const auto HH = H.square();
  215|  1.45k|   const auto HHH = H * HH;
  216|  1.45k|   const auto V = U1 * HH;
  217|  1.45k|   const auto t2 = r.square();
  218|  1.45k|   const auto t3 = V + V;
  219|  1.45k|   const auto t4 = t2 - HHH;
  220|  1.45k|   auto X3 = t4 - t3;
  221|  1.45k|   const auto t5 = V - X3;
  222|  1.45k|   const auto t6 = S1 * HHH;
  223|  1.45k|   const auto t7 = r * t5;
  224|  1.45k|   auto Y3 = t7 - t6;
  225|  1.45k|   const auto t8 = b.z() * H;
  226|  1.45k|   auto Z3 = a.z() * t8;
  227|       |
  228|       |   // if a is identity then return b
  229|  1.45k|   FieldElement::conditional_assign(X3, Y3, Z3, a_is_identity, b.x(), b.y(), b.z());
  230|       |
  231|       |   // if b is identity then return a
  232|  1.45k|   FieldElement::conditional_assign(X3, Y3, Z3, b_is_identity, a.x(), a.y(), a.z());
  233|       |
  234|  1.45k|   return ProjectivePoint(X3, Y3, Z3);
  235|  1.45k|}
pcurves_secp521r1.cpp:_ZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEE:
  107|      1|auto to_affine_batch(std::span<const typename C::ProjectivePoint> projective) {
  108|      1|   using AffinePoint = typename C::AffinePoint;
  109|       |
  110|      1|   const size_t N = projective.size();
  111|      1|   std::vector<AffinePoint> affine;
  112|      1|   affine.reserve(N);
  113|       |
  114|      1|   CT::Choice any_identity = CT::Choice::no();
  115|       |
  116|  3.10k|   for(const auto& pt : projective) {
  ------------------
  |  Branch (116:23): [True: 3.10k, False: 1]
  ------------------
  117|  3.10k|      any_identity = any_identity || pt.is_identity();
  118|  3.10k|   }
  119|       |
  120|       |   // Conditional acceptable: N is public. State of points is not necessarily
  121|       |   // public, but we don't leak which point was the identity. In practice with
  122|       |   // the algorithms currently in use, the only time an identity can occur is
  123|       |   // during mul2 where the two points g/h have a small relation (ie h = g*k for
  124|       |   // some k < 16)
  125|       |
  126|      1|   if(N <= 2 || any_identity.as_bool()) {
  ------------------
  |  Branch (126:7): [True: 0, False: 1]
  |  Branch (126:17): [True: 0, False: 1]
  ------------------
  127|       |      // If there are identity elements, using the batch inversion gets
  128|       |      // tricky. It can be done, but this should be a rare situation so
  129|       |      // just punt to the serial conversion if it occurs
  130|      0|      for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (130:25): [True: 0, False: 0]
  ------------------
  131|      0|         affine.push_back(to_affine<C>(projective[i]));
  132|      0|      }
  133|      1|   } else {
  134|      1|      std::vector<typename C::FieldElement> c;
  135|      1|      c.reserve(N);
  136|       |
  137|       |      /*
  138|       |      Batch projective->affine using Montgomery's trick
  139|       |
  140|       |      See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
  141|       |      (Hankerson, Menezes, Vanstone)
  142|       |      */
  143|       |
  144|      1|      c.push_back(projective[0].z());
  145|  3.10k|      for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (145:25): [True: 3.10k, False: 1]
  ------------------
  146|  3.10k|         c.push_back(c[i - 1] * projective[i].z());
  147|  3.10k|      }
  148|       |
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|      1|         } else {
  153|      1|            return invert_field_element<C>(c[N - 1]);
  154|      1|         }
  155|      1|      }();
  156|       |
  157|  3.10k|      for(size_t i = N - 1; i > 0; --i) {
  ------------------
  |  Branch (157:29): [True: 3.10k, False: 1]
  ------------------
  158|  3.10k|         const auto& p = projective[i];
  159|       |
  160|  3.10k|         const auto z_inv = s_inv * c[i - 1];
  161|  3.10k|         const auto z2_inv = z_inv.square();
  162|  3.10k|         const auto z3_inv = z_inv * z2_inv;
  163|       |
  164|  3.10k|         s_inv = s_inv * p.z();
  165|       |
  166|  3.10k|         affine.push_back(AffinePoint(p.x() * z2_inv, p.y() * z3_inv));
  167|  3.10k|      }
  168|       |
  169|      1|      const auto z2_inv = s_inv.square();
  170|      1|      const auto z3_inv = s_inv * z2_inv;
  171|      1|      affine.push_back(AffinePoint(projective[0].x() * z2_inv, projective[0].y() * z3_inv));
  172|      1|      std::reverse(affine.begin(), affine.end());
  173|      1|      return affine;
  174|      1|   }
  175|       |
  176|      0|   return affine;
  177|      1|}
pcurves_secp521r1.cpp:_ZZN5Botan15to_affine_batchINS_6PCurve12_GLOBAL__N_19secp521r15CurveELb1EEEDaNSt3__14spanIKNT_15ProjectivePointELm18446744073709551615EEEENKUlvE_clEv:
  149|      1|      auto s_inv = [&]() {
  150|      1|         if constexpr(VariableTime) {
  151|      1|            return c[N - 1].invert_vartime();
  152|       |         } else {
  153|       |            return invert_field_element<C>(c[N - 1]);
  154|       |         }
  155|      1|      }();
pcurves_secp521r1.cpp:_ZN5Botan18sqrt_field_elementINS_6PCurve12_GLOBAL__N_19secp521r15CurveEEENS_2CT6OptionINT_12FieldElementEEERKS8_:
   60|    374|inline constexpr CT::Option<typename C::FieldElement> sqrt_field_element(const typename C::FieldElement& fe) {
   61|    374|   if constexpr(curve_supports_fe_sqrt<C>) {
   62|    374|      auto z = C::fe_sqrt(fe);
   63|       |      // Zero out the return value if it would otherwise be incorrect
   64|    374|      const CT::Choice correct = (z.square() == fe);
   65|    374|      z.conditional_assign(!correct, C::FieldElement::zero());
   66|    374|      return CT::Option(z, correct);
   67|       |   } else {
   68|       |      return fe.sqrt();
   69|       |   }
   70|    374|}

pcurves_brainpool256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1xEv:
  971|    860|      constexpr const FieldElement& x() const { return m_x; }
pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE1yEv:
  976|    860|      constexpr const FieldElement& y() const { return m_y; }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE3oneEv:
  200|    361|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE3oneEv:
   99|    361|      constexpr static std::array<W, N> one() { return R1; }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE:
  898|  56.7k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      5|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 4, False: 1]
  ------------------
  414|      4|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      4|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      4|            x.m_val[i] = nx;
  417|      4|            y.m_val[i] = ny;
  418|      4|         }
  419|      1|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv:
  928|    430|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_zeroEv:
  225|  5.36k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  1.56k|            m_x(x), m_y(y), m_z(z) {}
pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv:
 1121|    833|      constexpr Self dbl() const {
 1122|       |         if constexpr(Self::A_is_minus_3) {
 1123|       |            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|    833|         } else {
 1127|    833|            return dbl_generic(*this, A);
 1128|    833|         }
 1129|    833|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1zEv:
 1172|  13.7k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6squareEv:
  426|  12.8k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  12.8k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  12.8k|         comba_sqr<N>(z.data(), this->data());
  429|  12.8k|         return Self(Rep::redc(z));
  430|  12.8k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4dataEv:
  896|   195k|      constexpr const W* data() const { return m_val.data(); }
pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE:
  104|   149k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
  105|       |         if constexpr(P_dash == 1) {
  106|       |            return monty_redc_pdash1(z, P);
  107|   149k|         } else {
  108|   149k|            return monty_redc(z, P, P_dash);
  109|   149k|         }
  110|   149k|      }
pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_:
  265|  3.43k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  3.43k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  3.43k|         W carry = 0;
  269|  17.1k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 13.7k, False: 3.43k]
  ------------------
  270|  13.7k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  13.7k|         }
  272|       |
  273|  3.43k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  3.43k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  3.43k|         return Self(r);
  276|  3.43k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1xEv:
 1162|  6.17k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul3Ev:
  335|    833|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_brainpool256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_:
  346|  24.5k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  24.5k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  24.5k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  24.5k|         return Self(Rep::redc(z));
  350|  24.5k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E1yEv:
 1167|  6.17k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul4Ev:
  338|    833|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_brainpool256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEESC_:
  281|  6.90k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  6.90k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  6.90k|         W carry = 0;
  284|  34.5k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 27.6k, False: 6.90k]
  ------------------
  285|  27.6k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|  27.6k|         }
  287|       |
  288|  6.90k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  6.90k|         carry = 0;
  291|       |
  292|  34.5k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 27.6k, False: 6.90k]
  ------------------
  293|  27.6k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|  27.6k|         }
  295|       |
  296|  6.90k|         return Self(r);
  297|  6.90k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul2Ev:
  325|  6.66k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  6.66k|         std::array<W, N> t = value();
  327|  6.66k|         const W carry = shift_left<1>(t);
  328|       |
  329|  6.66k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  6.66k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  6.66k|         return Self(r);
  332|  6.66k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE5valueEv:
  894|  6.66k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4mul8Ev:
  341|    833|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_brainpool256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_EESE_:
 1064|    735|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_brainpool256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|    735|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_brainpool256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  3.03k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  1.47k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  1.47k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  7.35k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 5.88k, False: 1.47k]
  ------------------
  399|  5.88k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  5.88k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  5.88k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  5.88k|         }
  403|  1.47k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE:
  477|    360|      constexpr Self pow_vartime(const std::array<W, N>& exp) const {
  478|    360|         constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5;
  ------------------
  |  Branch (478:40): [True: 0, Folded]
  ------------------
  479|    360|         constexpr size_t WindowElements = (1 << WindowBits) - 1;
  480|       |
  481|    360|         constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits;
  482|       |
  483|       |         /*
  484|       |         A simple fixed width window modular multiplication.
  485|       |
  486|       |         TODO: investigate using sliding window here
  487|       |         */
  488|       |
  489|    360|         std::array<Self, WindowElements> tbl;
  490|       |
  491|    360|         tbl[0] = (*this);
  492|       |
  493|  5.40k|         for(size_t i = 1; i != WindowElements; ++i) {
  ------------------
  |  Branch (493:28): [True: 5.04k, False: 360]
  ------------------
  494|       |            // Conditional ok: table indexes are public here
  495|  5.04k|            if(i % 2 == 1) {
  ------------------
  |  Branch (495:16): [True: 2.52k, False: 2.52k]
  ------------------
  496|  2.52k|               tbl[i] = tbl[i / 2].square();
  497|  2.52k|            } else {
  498|  2.52k|               tbl[i] = tbl[i - 1] * tbl[0];
  499|  2.52k|            }
  500|  5.04k|         }
  501|       |
  502|    360|         auto r = Self::one();
  503|       |
  504|    360|         const size_t w0 = read_window_bits<WindowBits>(std::span{exp}, (Windows - 1) * WindowBits);
  505|       |
  506|       |         // Conditional ok: this function is variable time
  507|    360|         if(w0 > 0) {
  ------------------
  |  Branch (507:13): [True: 360, False: 0]
  ------------------
  508|    360|            r = tbl[w0 - 1];
  509|    360|         }
  510|       |
  511|  23.0k|         for(size_t i = 1; i != Windows; ++i) {
  ------------------
  |  Branch (511:28): [True: 22.6k, False: 360]
  ------------------
  512|  22.6k|            r.square_n(WindowBits);
  513|       |
  514|  22.6k|            const size_t w = read_window_bits<WindowBits>(std::span{exp}, (Windows - i - 1) * WindowBits);
  515|       |
  516|       |            // Conditional ok: this function is variable time
  517|  22.6k|            if(w > 0) {
  ------------------
  |  Branch (517:16): [True: 20.5k, False: 2.16k]
  ------------------
  518|  20.5k|               r *= tbl[w - 1];
  519|  20.5k|            }
  520|  22.6k|         }
  521|       |
  522|    360|         return r;
  523|    360|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEC2Ev:
  180|  5.40k|      constexpr IntMod() : m_val({}) {}
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8square_nEm:
  439|  22.6k|      constexpr void square_n(size_t n) {
  440|  22.6k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|   113k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 90.7k, False: 22.6k]
  ------------------
  442|  90.7k|            comba_sqr<N>(z.data(), this->data());
  443|  90.7k|            m_val = Rep::redc(z);
  444|  90.7k|         }
  445|  22.6k|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEmLERKSA_:
  355|  20.5k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  20.5k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  20.5k|         comba_mul<N>(z.data(), data(), other.data());
  358|  20.5k|         m_val = Rep::redc(z);
  359|  20.5k|         return (*this);
  360|  20.5k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    177|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    177|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 176]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    176|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    176|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    176|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    176|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 94, False: 82]
  ------------------
  644|       |               // b > a
  645|     94|               b.m_val = r;
  646|     94|               x = nx;
  647|     94|               Self::_invert_vartime_div2_helper(b, x);
  648|     94|            } else {
  649|       |               // We know this can't underflow because a > b
  650|     82|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|     82|               a.m_val = r;
  652|     82|               y = nx;
  653|     82|               Self::_invert_vartime_div2_helper(a, y);
  654|     82|            }
  655|    176|         }
  656|      1|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4zeroEv:
  195|    362|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE:
  137|    643|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) {
  138|    643|         std::array<W, 2 * N> ze = {};
  139|    643|         copy_mem(std::span{ze}.template first<N>(), z);
  140|    643|         return Self::redc(ze);
  141|    643|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    178|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    178|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|    553|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 375, False: 178]
  ------------------
  552|    375|            shift_right<1>(a.m_val);
  553|       |
  554|    375|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    375|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 193, False: 182]
  ------------------
  558|    193|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    193|            }
  560|    375|         }
  561|    178|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6negateEv:
  452|    216|      constexpr Self negate() const {
  453|    216|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    216|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    216|         W carry = 0;
  457|  1.08k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 864, False: 216]
  ------------------
  458|    864|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|    864|         }
  460|       |
  461|    216|         return Self(r);
  462|    216|      }
pcurves_brainpool256r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE:
  115|    514|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) {
  116|    514|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  117|    514|         comba_mul<N>(z.data(), x.data(), R2.data());
  118|    514|         return Self::redc(z);
  119|    514|      }
pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  2.21k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    430|      std::array<W, L> stash_value() const {
  760|    430|         static_assert(L >= N);
  761|    430|         std::array<W, L> stash = {};
  762|  2.15k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 1.72k, False: 430]
  ------------------
  763|  1.72k|            stash[i] = m_val[i];
  764|  1.72k|         }
  765|    430|         return stash;
  766|    430|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    574|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    574|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  2.87k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 2.29k, False: 574]
  ------------------
  371|  2.29k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  2.29k|         }
  373|    574|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    556|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    556|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 556]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    556|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    556|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 43, False: 513]
  ------------------
  802|     43|            return {};
  803|     43|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    513|         return Self::from_words(words);
  807|    556|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE:
  211|    513|      static constexpr Self from_words(std::array<W, L> w) {
  212|    513|         if constexpr(L == N) {
  213|    513|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    513|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE:
  739|    428|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    428|         auto v = Rep::from_rep(m_val);
  741|    428|         std::reverse(v.begin(), v.end());
  742|       |
  743|    428|         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|    428|            store_be(bytes, v);
  745|       |         } else {
  746|       |            // Remove leading zero bytes
  747|       |            const auto padded_bytes = store_be(v);
  748|       |            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|       |            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|       |         }
  751|    428|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|    858|      static Self from_stash(const std::array<W, L>& stash) {
  775|    858|         static_assert(L >= N);
  776|    858|         std::array<W, N> val = {};
  777|  4.29k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 3.43k, False: 858]
  ------------------
  778|  3.43k|            val[i] = stash[i];
  779|  3.43k|         }
  780|    858|         return Self(val);
  781|    858|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEEeqERKSA_:
  722|    431|      constexpr CT::Choice operator==(const Self& other) const {
  723|    431|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    431|      }
pcurves_brainpool256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_brainpool256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    431|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE4sqrtEv:
  663|    360|      constexpr CT::Option<Self> sqrt() const {
  664|    360|         if constexpr(Self::P_MOD_4 == 3) {
  665|       |            // The easy case for square root is when p == 3 (mod 4)
  666|       |
  667|    360|            constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P);
  668|    360|            auto z = pow_vartime(P_PLUS_1_OVER_4);
  669|       |
  670|       |            // Zero out the return value if it would otherwise be incorrect
  671|    360|            const CT::Choice correct = (z.square() == *this);
  672|    360|            z.conditional_assign(!correct, Self::zero());
  673|    360|            return CT::Option<Self>(z, correct);
  674|       |         } else {
  675|       |            // Shanks-Tonelli, following I.4 in RFC 9380
  676|       |
  677|       |            /*
  678|       |            Constants:
  679|       |            1. c1, the largest integer such that 2^c1 divides q - 1.
  680|       |            2. c2 = (q - 1) / (2^c1)        # Integer arithmetic
  681|       |            3. c3 = (c2 - 1) / 2            # Integer arithmetic
  682|       |            4. c4, a non-square value in F
  683|       |            5. c5 = c4^c2 in F
  684|       |            */
  685|       |            constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P);
  686|       |            constexpr std::array<W, N> C3 = shanks_tonelli_c3(C1_C2.second);
  687|       |            constexpr std::array<W, N> P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P);
  688|       |            constexpr Self C4 = shanks_tonelli_c4<Self>(P_MINUS_1_OVER_2);
  689|       |            constexpr Self C5 = C4.pow_vartime(C1_C2.second);
  690|       |
  691|       |            const Self& x = (*this);
  692|       |
  693|       |            auto z = x.pow_vartime(C3);
  694|       |            auto t = z.square();
  695|       |            t *= x;
  696|       |            z *= x;
  697|       |            auto b = t;
  698|       |            auto c = C5;
  699|       |
  700|       |            for(size_t i = C1_C2.first; i >= 2; i--) {
  701|       |               b.square_n(i - 2);
  702|       |               const CT::Choice e = b.is_one();
  703|       |               z.conditional_assign(!e, z * c);
  704|       |               c.square_n(1);
  705|       |               t.conditional_assign(!e, t * c);
  706|       |               b = t;
  707|       |            }
  708|       |
  709|       |            // Zero out the return value if it would otherwise be incorrect
  710|       |            const CT::Choice correct = (z.square() == *this);
  711|       |            z.conditional_assign(!correct, Self::zero());
  712|       |            return CT::Option<Self>(z, correct);
  713|       |         }
  714|    360|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    214|      constexpr Self correct_sign(CT::Choice even) const {
  249|    214|         const auto flip = (even != this->is_even());
  250|    214|         return Self::choose(flip, this->negate(), *this);
  251|    214|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE7is_evenEv:
  240|    214|      constexpr CT::Choice is_even() const {
  241|    214|         auto v = Rep::from_rep(m_val);
  242|    214|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    214|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES1_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    214|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    214|         auto r = y;
  258|    214|         r.conditional_assign(choice, x);
  259|    214|         return r;
  260|    214|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool256r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE:
  941|    214|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    214|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    214|   do {                                                         \
  |  |   52|    214|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    214|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 214]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    214|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 214]
  |  |  ------------------
  ------------------
  943|    214|         BufferStuffer pack(bytes);
  944|    214|         pack.append(0x04);
  945|    214|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    214|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    214|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    214|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    214|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 214]
  |  |  ------------------
  ------------------
  948|    214|      }
pcurves_brainpool512r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1xEv:
  971|    636|      constexpr const FieldElement& x() const { return m_x; }
pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE1yEv:
  976|    636|      constexpr const FieldElement& y() const { return m_y; }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE3oneEv:
  200|    239|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE3oneEv:
   99|    239|      constexpr static std::array<W, N> one() { return R1; }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2ENSt3__15arrayImLm8EEE:
  898|   103k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      9|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 8, False: 1]
  ------------------
  414|      8|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      8|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      8|            x.m_val[i] = nx;
  417|      8|            y.m_val[i] = ny;
  418|      8|         }
  419|      1|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE11is_identityEv:
  928|    318|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_zeroEv:
  225|  9.56k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  3.10k|            m_x(x), m_y(y), m_z(z) {}
pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3dblEv:
 1121|  1.64k|      constexpr Self dbl() const {
 1122|       |         if constexpr(Self::A_is_minus_3) {
 1123|       |            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|  1.64k|         } else {
 1127|  1.64k|            return dbl_generic(*this, A);
 1128|  1.64k|         }
 1129|  1.64k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1zEv:
 1172|  27.1k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6squareEv:
  426|  22.9k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  22.9k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  22.9k|         comba_sqr<N>(z.data(), this->data());
  429|  22.9k|         return Self(Rep::redc(z));
  430|  22.9k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4dataEv:
  896|   285k|      constexpr const W* data() const { return m_val.data(); }
pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE4redcERKNSt3__15arrayImLm16EEE:
  104|   214k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
  105|       |         if constexpr(P_dash == 1) {
  106|       |            return monty_redc_pdash1(z, P);
  107|   214k|         } else {
  108|   214k|            return monty_redc(z, P, P_dash);
  109|   214k|         }
  110|   214k|      }
pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_:
  265|  5.72k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  5.72k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  5.72k|         W carry = 0;
  269|  51.4k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 45.7k, False: 5.72k]
  ------------------
  270|  45.7k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  45.7k|         }
  272|       |
  273|  5.72k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  5.72k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  5.72k|         return Self(r);
  276|  5.72k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1xEv:
 1162|  12.2k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul3Ev:
  335|  1.64k|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_brainpool512r1.cpp:_ZN5BotanmlERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_:
  346|  46.5k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  46.5k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  46.5k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  46.5k|         return Self(Rep::redc(z));
  350|  46.5k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E1yEv:
 1167|  12.2k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul4Ev:
  338|  1.64k|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_brainpool512r1.cpp:_ZN5BotanmiERKNS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEESC_:
  281|  13.6k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  13.6k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  13.6k|         W carry = 0;
  284|   123k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 109k, False: 13.6k]
  ------------------
  285|   109k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|   109k|         }
  287|       |
  288|  13.6k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  13.6k|         carry = 0;
  291|       |
  292|   123k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 109k, False: 13.6k]
  ------------------
  293|   109k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|   109k|         }
  295|       |
  296|  13.6k|         return Self(r);
  297|  13.6k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul2Ev:
  325|  13.1k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  13.1k|         std::array<W, N> t = value();
  327|  13.1k|         const W carry = shift_left<1>(t);
  328|       |
  329|  13.1k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  13.1k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  13.1k|         return Self(r);
  332|  13.1k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE5valueEv:
  894|  13.1k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4mul8Ev:
  341|  1.64k|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_brainpool512r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_EESE_:
 1064|  1.45k|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_brainpool512r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|  1.45k|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_brainpool512r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  6.01k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  2.91k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  2.91k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  26.1k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 23.2k, False: 2.91k]
  ------------------
  399|  23.2k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  23.2k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  23.2k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  23.2k|         }
  403|  2.91k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm8EEE:
  477|    238|      constexpr Self pow_vartime(const std::array<W, N>& exp) const {
  478|    238|         constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5;
  ------------------
  |  Branch (478:40): [Folded, False: 238]
  ------------------
  479|    238|         constexpr size_t WindowElements = (1 << WindowBits) - 1;
  480|       |
  481|    238|         constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits;
  482|       |
  483|       |         /*
  484|       |         A simple fixed width window modular multiplication.
  485|       |
  486|       |         TODO: investigate using sliding window here
  487|       |         */
  488|       |
  489|    238|         std::array<Self, WindowElements> tbl;
  490|       |
  491|    238|         tbl[0] = (*this);
  492|       |
  493|  7.37k|         for(size_t i = 1; i != WindowElements; ++i) {
  ------------------
  |  Branch (493:28): [True: 7.14k, False: 238]
  ------------------
  494|       |            // Conditional ok: table indexes are public here
  495|  7.14k|            if(i % 2 == 1) {
  ------------------
  |  Branch (495:16): [True: 3.57k, False: 3.57k]
  ------------------
  496|  3.57k|               tbl[i] = tbl[i / 2].square();
  497|  3.57k|            } else {
  498|  3.57k|               tbl[i] = tbl[i - 1] * tbl[0];
  499|  3.57k|            }
  500|  7.14k|         }
  501|       |
  502|    238|         auto r = Self::one();
  503|       |
  504|    238|         const size_t w0 = read_window_bits<WindowBits>(std::span{exp}, (Windows - 1) * WindowBits);
  505|       |
  506|       |         // Conditional ok: this function is variable time
  507|    238|         if(w0 > 0) {
  ------------------
  |  Branch (507:13): [True: 0, False: 238]
  ------------------
  508|      0|            r = tbl[w0 - 1];
  509|      0|         }
  510|       |
  511|  24.5k|         for(size_t i = 1; i != Windows; ++i) {
  ------------------
  |  Branch (511:28): [True: 24.2k, False: 238]
  ------------------
  512|  24.2k|            r.square_n(WindowBits);
  513|       |
  514|  24.2k|            const size_t w = read_window_bits<WindowBits>(std::span{exp}, (Windows - i - 1) * WindowBits);
  515|       |
  516|       |            // Conditional ok: this function is variable time
  517|  24.2k|            if(w > 0) {
  ------------------
  |  Branch (517:16): [True: 23.0k, False: 1.19k]
  ------------------
  518|  23.0k|               r *= tbl[w - 1];
  519|  23.0k|            }
  520|  24.2k|         }
  521|       |
  522|    238|         return r;
  523|    238|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEC2Ev:
  180|  7.37k|      constexpr IntMod() : m_val({}) {}
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8square_nEm:
  439|  24.2k|      constexpr void square_n(size_t n) {
  440|  24.2k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|   145k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 121k, False: 24.2k]
  ------------------
  442|   121k|            comba_sqr<N>(z.data(), this->data());
  443|   121k|            m_val = Rep::redc(z);
  444|   121k|         }
  445|  24.2k|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEmLERKSA_:
  355|  23.0k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  23.0k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  23.0k|         comba_mul<N>(z.data(), data(), other.data());
  358|  23.0k|         m_val = Rep::redc(z);
  359|  23.0k|         return (*this);
  360|  23.0k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    366|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    366|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 365]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    365|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    365|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    365|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    365|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 175, False: 190]
  ------------------
  644|       |               // b > a
  645|    175|               b.m_val = r;
  646|    175|               x = nx;
  647|    175|               Self::_invert_vartime_div2_helper(b, x);
  648|    190|            } else {
  649|       |               // We know this can't underflow because a > b
  650|    190|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|    190|               a.m_val = r;
  652|    190|               y = nx;
  653|    190|               Self::_invert_vartime_div2_helper(a, y);
  654|    190|            }
  655|    365|         }
  656|      1|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4zeroEv:
  195|    240|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE8from_repERKNSt3__15arrayImLm8EEE:
  137|    475|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) {
  138|    475|         std::array<W, 2 * N> ze = {};
  139|    475|         copy_mem(std::span{ze}.template first<N>(), z);
  140|    475|         return Self::redc(ze);
  141|    475|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    367|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    367|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|  1.08k|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 713, False: 367]
  ------------------
  552|    713|            shift_right<1>(a.m_val);
  553|       |
  554|    713|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    713|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 362, False: 351]
  ------------------
  558|    362|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    362|            }
  560|    713|         }
  561|    367|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6negateEv:
  452|    160|      constexpr Self negate() const {
  453|    160|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    160|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    160|         W carry = 0;
  457|  1.44k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 1.28k, False: 160]
  ------------------
  458|  1.28k|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|  1.28k|         }
  460|       |
  461|    160|         return Self(r);
  462|    160|      }
pcurves_brainpool512r1.cpp:_ZN5Botan13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES0_E11FieldParamsEE6to_repERKNSt3__15arrayImLm8EEE:
  115|    369|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) {
  116|    369|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  117|    369|         comba_mul<N>(z.data(), x.data(), R2.data());
  118|    369|         return Self::redc(z);
  119|    369|      }
pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  3.58k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    318|      std::array<W, L> stash_value() const {
  760|    318|         static_assert(L >= N);
  761|    318|         std::array<W, L> stash = {};
  762|  2.86k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 2.54k, False: 318]
  ------------------
  763|  2.54k|            stash[i] = m_val[i];
  764|  2.54k|         }
  765|    318|         return stash;
  766|    318|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    396|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    396|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  3.56k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 3.16k, False: 396]
  ------------------
  371|  3.16k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  3.16k|         }
  373|    396|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    373|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    373|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 373]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    373|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    373|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 5, False: 368]
  ------------------
  802|      5|            return {};
  803|      5|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    368|         return Self::from_words(words);
  807|    373|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10from_wordsILm8EEESA_NSt3__15arrayImXT_EEE:
  211|    368|      static constexpr Self from_words(std::array<W, L> w) {
  212|    368|         if constexpr(L == N) {
  213|    368|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    368|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm64EEE:
  739|    316|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    316|         auto v = Rep::from_rep(m_val);
  741|    316|         std::reverse(v.begin(), v.end());
  742|       |
  743|    316|         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|    316|            store_be(bytes, v);
  745|       |         } else {
  746|       |            // Remove leading zero bytes
  747|       |            const auto padded_bytes = store_be(v);
  748|       |            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|       |            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|       |         }
  751|    316|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|    634|      static Self from_stash(const std::array<W, L>& stash) {
  775|    634|         static_assert(L >= N);
  776|    634|         std::array<W, N> val = {};
  777|  5.70k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 5.07k, False: 634]
  ------------------
  778|  5.07k|            val[i] = stash[i];
  779|  5.07k|         }
  780|    634|         return Self(val);
  781|    634|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEEeqERKSA_:
  722|    302|      constexpr CT::Choice operator==(const Self& other) const {
  723|    302|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    302|      }
pcurves_brainpool512r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_brainpool512r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsENS_13MontgomeryRepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    302|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE4sqrtEv:
  663|    238|      constexpr CT::Option<Self> sqrt() const {
  664|    238|         if constexpr(Self::P_MOD_4 == 3) {
  665|       |            // The easy case for square root is when p == 3 (mod 4)
  666|       |
  667|    238|            constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P);
  668|    238|            auto z = pow_vartime(P_PLUS_1_OVER_4);
  669|       |
  670|       |            // Zero out the return value if it would otherwise be incorrect
  671|    238|            const CT::Choice correct = (z.square() == *this);
  672|    238|            z.conditional_assign(!correct, Self::zero());
  673|    238|            return CT::Option<Self>(z, correct);
  674|       |         } else {
  675|       |            // Shanks-Tonelli, following I.4 in RFC 9380
  676|       |
  677|       |            /*
  678|       |            Constants:
  679|       |            1. c1, the largest integer such that 2^c1 divides q - 1.
  680|       |            2. c2 = (q - 1) / (2^c1)        # Integer arithmetic
  681|       |            3. c3 = (c2 - 1) / 2            # Integer arithmetic
  682|       |            4. c4, a non-square value in F
  683|       |            5. c5 = c4^c2 in F
  684|       |            */
  685|       |            constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P);
  686|       |            constexpr std::array<W, N> C3 = shanks_tonelli_c3(C1_C2.second);
  687|       |            constexpr std::array<W, N> P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P);
  688|       |            constexpr Self C4 = shanks_tonelli_c4<Self>(P_MINUS_1_OVER_2);
  689|       |            constexpr Self C5 = C4.pow_vartime(C1_C2.second);
  690|       |
  691|       |            const Self& x = (*this);
  692|       |
  693|       |            auto z = x.pow_vartime(C3);
  694|       |            auto t = z.square();
  695|       |            t *= x;
  696|       |            z *= x;
  697|       |            auto b = t;
  698|       |            auto c = C5;
  699|       |
  700|       |            for(size_t i = C1_C2.first; i >= 2; i--) {
  701|       |               b.square_n(i - 2);
  702|       |               const CT::Choice e = b.is_one();
  703|       |               z.conditional_assign(!e, z * c);
  704|       |               c.square_n(1);
  705|       |               t.conditional_assign(!e, t * c);
  706|       |               b = t;
  707|       |            }
  708|       |
  709|       |            // Zero out the return value if it would otherwise be incorrect
  710|       |            const CT::Choice correct = (z.square() == *this);
  711|       |            z.conditional_assign(!correct, Self::zero());
  712|       |            return CT::Option<Self>(z, correct);
  713|       |         }
  714|    238|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    158|      constexpr Self correct_sign(CT::Choice even) const {
  249|    158|         const auto flip = (even != this->is_even());
  250|    158|         return Self::choose(flip, this->negate(), *this);
  251|    158|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE7is_evenEv:
  240|    158|      constexpr CT::Choice is_even() const {
  241|    158|         auto v = Rep::from_rep(m_val);
  242|    158|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    158|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES1_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    158|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    158|         auto r = y;
  258|    158|         r.conditional_assign(choice, x);
  259|    158|         return r;
  260|    158|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS_6PCurve12_GLOBAL__N_114brainpool512r16ParamsES2_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm129EEE:
  941|    158|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    158|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    158|   do {                                                         \
  |  |   52|    158|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    158|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 158]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    158|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 158]
  |  |  ------------------
  ------------------
  943|    158|         BufferStuffer pack(bytes);
  944|    158|         pack.append(0x04);
  945|    158|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    158|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    158|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    158|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    158|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 158]
  |  |  ------------------
  ------------------
  948|    158|      }
pcurves_secp192r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp192r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp192r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv:
  971|    708|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv:
  976|    708|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv:
  200|    180|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm3EEE:
  898|  40.4k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      4|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 3, False: 1]
  ------------------
  414|      3|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      3|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      3|            x.m_val[i] = nx;
  417|      3|            y.m_val[i] = ny;
  418|      3|         }
  419|      1|      }
pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv:
  928|    354|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv:
  225|  4.11k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  1.18k|            m_x(x), m_y(y), m_z(z) {}
pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv:
 1121|    629|      constexpr Self dbl() const {
 1122|    629|         if constexpr(Self::A_is_minus_3) {
 1123|    629|            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|       |         } else {
 1127|       |            return dbl_generic(*this, A);
 1128|       |         }
 1129|    629|      }
pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv:
 1172|  10.3k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv:
  426|  7.69k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  7.69k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  7.69k|         comba_sqr<N>(z.data(), this->data());
  429|  7.69k|         return Self(Rep::redc(z));
  430|  7.69k|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv:
  896|  89.4k|      constexpr const W* data() const { return m_val.data(); }
pcurves_secp192r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  346|  17.7k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  17.7k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  17.7k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  17.7k|         return Self(Rep::redc(z));
  350|  17.7k|      }
pcurves_secp192r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  281|  5.84k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  5.84k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  5.84k|         W carry = 0;
  284|  23.3k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 17.5k, False: 5.84k]
  ------------------
  285|  17.5k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|  17.5k|         }
  287|       |
  288|  5.84k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  5.84k|         carry = 0;
  291|       |
  292|  23.3k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 17.5k, False: 5.84k]
  ------------------
  293|  17.5k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|  17.5k|         }
  295|       |
  296|  5.84k|         return Self(r);
  297|  5.84k|      }
pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv:
 1162|  5.29k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev:
  335|    629|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_secp192r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  265|  2.47k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  2.47k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  2.47k|         W carry = 0;
  269|  9.89k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 7.42k, False: 2.47k]
  ------------------
  270|  7.42k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  7.42k|         }
  272|       |
  273|  2.47k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  2.47k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  2.47k|         return Self(r);
  276|  2.47k|      }
pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv:
 1167|  4.66k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev:
  338|    629|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev:
  325|  5.03k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  5.03k|         std::array<W, N> t = value();
  327|  5.03k|         const W carry = shift_left<1>(t);
  328|       |
  329|  5.03k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  5.03k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  5.03k|         return Self(r);
  332|  5.03k|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv:
  894|  5.03k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev:
  341|    629|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_secp192r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_:
 1064|    555|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_secp192r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|    555|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_secp192r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  2.29k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  1.11k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  1.11k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  4.44k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 3.33k, False: 1.11k]
  ------------------
  399|  3.33k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  3.33k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  3.33k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  3.33k|         }
  403|  1.11k|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_:
  355|  5.72k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  5.72k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  5.72k|         comba_mul<N>(z.data(), data(), other.data());
  358|  5.72k|         m_val = Rep::redc(z);
  359|  5.72k|         return (*this);
  360|  5.72k|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm:
  439|  8.41k|      constexpr void square_n(size_t n) {
  440|  8.41k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|  42.0k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 33.6k, False: 8.41k]
  ------------------
  442|  33.6k|            comba_sqr<N>(z.data(), this->data());
  443|  33.6k|            m_val = Rep::redc(z);
  444|  33.6k|         }
  445|  8.41k|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    144|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    144|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 143]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    143|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    143|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    143|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    143|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 74, False: 69]
  ------------------
  644|       |               // b > a
  645|     74|               b.m_val = r;
  646|     74|               x = nx;
  647|     74|               Self::_invert_vartime_div2_helper(b, x);
  648|     74|            } else {
  649|       |               // We know this can't underflow because a > b
  650|     69|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|     69|               a.m_val = r;
  652|     69|               y = nx;
  653|     69|               Self::_invert_vartime_div2_helper(a, y);
  654|     69|            }
  655|    143|         }
  656|      1|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv:
  195|    181|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    145|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    145|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|    402|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 257, False: 145]
  ------------------
  552|    257|            shift_right<1>(a.m_val);
  553|       |
  554|    257|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    257|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 110, False: 147]
  ------------------
  558|    110|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    110|            }
  560|    257|         }
  561|    145|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv:
  452|    178|      constexpr Self negate() const {
  453|    178|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    178|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    178|         W carry = 0;
  457|    712|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 534, False: 178]
  ------------------
  458|    534|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|    534|         }
  460|       |
  461|    178|         return Self(r);
  462|    178|      }
pcurves_secp192r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  1.71k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    354|      std::array<W, L> stash_value() const {
  760|    354|         static_assert(L >= N);
  761|    354|         std::array<W, L> stash = {};
  762|  1.41k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 1.06k, False: 354]
  ------------------
  763|  1.06k|            stash[i] = m_val[i];
  764|  1.06k|         }
  765|    354|         return stash;
  766|    354|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    355|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    355|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  1.42k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 1.06k, False: 355]
  ------------------
  371|  1.06k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  1.06k|         }
  373|    355|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    345|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    345|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 345]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    345|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    345|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 5, False: 340]
  ------------------
  802|      5|            return {};
  803|      5|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    340|         return Self::from_words(words);
  807|    345|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm3EEESA_NSt3__15arrayImXT_EEE:
  211|    340|      static constexpr Self from_words(std::array<W, L> w) {
  212|    340|         if constexpr(L == N) {
  213|    340|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    340|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm24EEE:
  739|    352|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    352|         auto v = Rep::from_rep(m_val);
  741|    352|         std::reverse(v.begin(), v.end());
  742|       |
  743|    352|         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|    352|            store_be(bytes, v);
  745|       |         } else {
  746|       |            // Remove leading zero bytes
  747|       |            const auto padded_bytes = store_be(v);
  748|       |            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|       |            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|       |         }
  751|    352|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|    706|      static Self from_stash(const std::array<W, L>& stash) {
  775|    706|         static_assert(L >= N);
  776|    706|         std::array<W, N> val = {};
  777|  2.82k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 2.11k, False: 706]
  ------------------
  778|  2.11k|            val[i] = stash[i];
  779|  2.11k|         }
  780|    706|         return Self(val);
  781|    706|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_:
  722|    259|      constexpr CT::Choice operator==(const Self& other) const {
  723|    259|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    259|      }
pcurves_secp192r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_secp192r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp192r16ParamsENS3_12Secp192r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    259|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4sqrtEv:
  663|    179|      constexpr CT::Option<Self> sqrt() const {
  664|    179|         if constexpr(Self::P_MOD_4 == 3) {
  665|       |            // The easy case for square root is when p == 3 (mod 4)
  666|       |
  667|    179|            constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P);
  668|    179|            auto z = pow_vartime(P_PLUS_1_OVER_4);
  669|       |
  670|       |            // Zero out the return value if it would otherwise be incorrect
  671|    179|            const CT::Choice correct = (z.square() == *this);
  672|    179|            z.conditional_assign(!correct, Self::zero());
  673|    179|            return CT::Option<Self>(z, correct);
  674|       |         } else {
  675|       |            // Shanks-Tonelli, following I.4 in RFC 9380
  676|       |
  677|       |            /*
  678|       |            Constants:
  679|       |            1. c1, the largest integer such that 2^c1 divides q - 1.
  680|       |            2. c2 = (q - 1) / (2^c1)        # Integer arithmetic
  681|       |            3. c3 = (c2 - 1) / 2            # Integer arithmetic
  682|       |            4. c4, a non-square value in F
  683|       |            5. c5 = c4^c2 in F
  684|       |            */
  685|       |            constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P);
  686|       |            constexpr std::array<W, N> C3 = shanks_tonelli_c3(C1_C2.second);
  687|       |            constexpr std::array<W, N> P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P);
  688|       |            constexpr Self C4 = shanks_tonelli_c4<Self>(P_MINUS_1_OVER_2);
  689|       |            constexpr Self C5 = C4.pow_vartime(C1_C2.second);
  690|       |
  691|       |            const Self& x = (*this);
  692|       |
  693|       |            auto z = x.pow_vartime(C3);
  694|       |            auto t = z.square();
  695|       |            t *= x;
  696|       |            z *= x;
  697|       |            auto b = t;
  698|       |            auto c = C5;
  699|       |
  700|       |            for(size_t i = C1_C2.first; i >= 2; i--) {
  701|       |               b.square_n(i - 2);
  702|       |               const CT::Choice e = b.is_one();
  703|       |               z.conditional_assign(!e, z * c);
  704|       |               c.square_n(1);
  705|       |               t.conditional_assign(!e, t * c);
  706|       |               b = t;
  707|       |            }
  708|       |
  709|       |            // Zero out the return value if it would otherwise be incorrect
  710|       |            const CT::Choice correct = (z.square() == *this);
  711|       |            z.conditional_assign(!correct, Self::zero());
  712|       |            return CT::Option<Self>(z, correct);
  713|       |         }
  714|    179|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm3EEE:
  477|    179|      constexpr Self pow_vartime(const std::array<W, N>& exp) const {
  478|    179|         constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5;
  ------------------
  |  Branch (478:40): [True: 0, Folded]
  ------------------
  479|    179|         constexpr size_t WindowElements = (1 << WindowBits) - 1;
  480|       |
  481|    179|         constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits;
  482|       |
  483|       |         /*
  484|       |         A simple fixed width window modular multiplication.
  485|       |
  486|       |         TODO: investigate using sliding window here
  487|       |         */
  488|       |
  489|    179|         std::array<Self, WindowElements> tbl;
  490|       |
  491|    179|         tbl[0] = (*this);
  492|       |
  493|  2.68k|         for(size_t i = 1; i != WindowElements; ++i) {
  ------------------
  |  Branch (493:28): [True: 2.50k, False: 179]
  ------------------
  494|       |            // Conditional ok: table indexes are public here
  495|  2.50k|            if(i % 2 == 1) {
  ------------------
  |  Branch (495:16): [True: 1.25k, False: 1.25k]
  ------------------
  496|  1.25k|               tbl[i] = tbl[i / 2].square();
  497|  1.25k|            } else {
  498|  1.25k|               tbl[i] = tbl[i - 1] * tbl[0];
  499|  1.25k|            }
  500|  2.50k|         }
  501|       |
  502|    179|         auto r = Self::one();
  503|       |
  504|    179|         const size_t w0 = read_window_bits<WindowBits>(std::span{exp}, (Windows - 1) * WindowBits);
  505|       |
  506|       |         // Conditional ok: this function is variable time
  507|    179|         if(w0 > 0) {
  ------------------
  |  Branch (507:13): [True: 179, False: 0]
  ------------------
  508|    179|            r = tbl[w0 - 1];
  509|    179|         }
  510|       |
  511|  8.59k|         for(size_t i = 1; i != Windows; ++i) {
  ------------------
  |  Branch (511:28): [True: 8.41k, False: 179]
  ------------------
  512|  8.41k|            r.square_n(WindowBits);
  513|       |
  514|  8.41k|            const size_t w = read_window_bits<WindowBits>(std::span{exp}, (Windows - i - 1) * WindowBits);
  515|       |
  516|       |            // Conditional ok: this function is variable time
  517|  8.41k|            if(w > 0) {
  ------------------
  |  Branch (517:16): [True: 5.72k, False: 2.68k]
  ------------------
  518|  5.72k|               r *= tbl[w - 1];
  519|  5.72k|            }
  520|  8.41k|         }
  521|       |
  522|    179|         return r;
  523|    179|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2Ev:
  180|  2.68k|      constexpr IntMod() : m_val({}) {}
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    176|      constexpr Self correct_sign(CT::Choice even) const {
  249|    176|         const auto flip = (even != this->is_even());
  250|    176|         return Self::choose(flip, this->negate(), *this);
  251|    176|      }
pcurves_secp192r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_evenEv:
  240|    176|      constexpr CT::Choice is_even() const {
  241|    176|         auto v = Rep::from_rep(m_val);
  242|    176|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    176|      }
pcurves_secp192r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    176|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    176|         auto r = y;
  258|    176|         r.conditional_assign(choice, x);
  259|    176|         return r;
  260|    176|      }
pcurves_secp192r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm49EEE:
  941|    176|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    176|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    176|   do {                                                         \
  |  |   52|    176|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    176|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 176]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    176|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 176]
  |  |  ------------------
  ------------------
  943|    176|         BufferStuffer pack(bytes);
  944|    176|         pack.append(0x04);
  945|    176|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    176|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    176|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    176|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    176|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 176]
  |  |  ------------------
  ------------------
  948|    176|      }
pcurves_secp224r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv:
  971|    772|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv:
  976|    772|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv:
  200|  27.1k|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE:
  898|   129k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      5|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 4, False: 1]
  ------------------
  414|      4|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      4|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      4|            x.m_val[i] = nx;
  417|      4|            y.m_val[i] = ny;
  418|      4|         }
  419|      1|      }
pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv:
  928|    386|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv:
  225|  4.72k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  1.37k|            m_x(x), m_y(y), m_z(z) {}
pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv:
 1121|    731|      constexpr Self dbl() const {
 1122|    731|         if constexpr(Self::A_is_minus_3) {
 1123|    731|            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|       |         } else {
 1127|       |            return dbl_generic(*this, A);
 1128|       |         }
 1129|    731|      }
pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv:
 1172|  12.0k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv:
  426|  9.87k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  9.87k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  9.87k|         comba_sqr<N>(z.data(), this->data());
  429|  9.87k|         return Self(Rep::redc(z));
  430|  9.87k|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv:
  896|  1.58M|      constexpr const W* data() const { return m_val.data(); }
pcurves_secp224r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  346|  75.0k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  75.0k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  75.0k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  75.0k|         return Self(Rep::redc(z));
  350|  75.0k|      }
pcurves_secp224r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  281|  6.79k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  6.79k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  6.79k|         W carry = 0;
  284|  33.9k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 27.1k, False: 6.79k]
  ------------------
  285|  27.1k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|  27.1k|         }
  287|       |
  288|  6.79k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  6.79k|         carry = 0;
  291|       |
  292|  33.9k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 27.1k, False: 6.79k]
  ------------------
  293|  27.1k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|  27.1k|         }
  295|       |
  296|  6.79k|         return Self(r);
  297|  6.79k|      }
pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv:
 1162|  6.14k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev:
  335|    731|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_secp224r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  265|  2.98k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  2.98k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  2.98k|         W carry = 0;
  269|  14.9k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 11.9k, False: 2.98k]
  ------------------
  270|  11.9k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  11.9k|         }
  272|       |
  273|  2.98k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  2.98k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  2.98k|         return Self(r);
  276|  2.98k|      }
pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv:
 1167|  5.41k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev:
  338|    731|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev:
  325|  5.84k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  5.84k|         std::array<W, N> t = value();
  327|  5.84k|         const W carry = shift_left<1>(t);
  328|       |
  329|  5.84k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  5.84k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  5.84k|         return Self(r);
  332|  5.84k|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv:
  894|  5.84k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev:
  341|    731|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_secp224r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_:
 1064|    645|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_secp224r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|    645|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_secp224r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  2.66k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  1.29k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  1.29k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  6.45k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 5.16k, False: 1.29k]
  ------------------
  399|  5.16k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  5.16k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  5.16k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  5.16k|         }
  403|  1.29k|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEmLERKSA_:
  355|  9.62k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  9.62k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  9.62k|         comba_mul<N>(z.data(), data(), other.data());
  358|  9.62k|         m_val = Rep::redc(z);
  359|  9.62k|         return (*this);
  360|  9.62k|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm:
  439|  69.3k|      constexpr void square_n(size_t n) {
  440|  69.3k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|  1.42M|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 1.35M, False: 69.3k]
  ------------------
  442|  1.35M|            comba_sqr<N>(z.data(), this->data());
  443|  1.35M|            m_val = Rep::redc(z);
  444|  1.35M|         }
  445|  69.3k|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    153|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    153|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 152]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    152|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    152|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    152|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    152|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 81, False: 71]
  ------------------
  644|       |               // b > a
  645|     81|               b.m_val = r;
  646|     81|               x = nx;
  647|     81|               Self::_invert_vartime_div2_helper(b, x);
  648|     81|            } else {
  649|       |               // We know this can't underflow because a > b
  650|     71|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|     71|               a.m_val = r;
  652|     71|               y = nx;
  653|     71|               Self::_invert_vartime_div2_helper(a, y);
  654|     71|            }
  655|    152|         }
  656|      1|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv:
  195|    285|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    154|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    154|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|    479|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 325, False: 154]
  ------------------
  552|    325|            shift_right<1>(a.m_val);
  553|       |
  554|    325|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    325|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 200, False: 125]
  ------------------
  558|    200|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    200|            }
  560|    325|         }
  561|    154|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv:
  452|    194|      constexpr Self negate() const {
  453|    194|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    194|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    194|         W carry = 0;
  457|    970|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 776, False: 194]
  ------------------
  458|    776|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|    776|         }
  460|       |
  461|    194|         return Self(r);
  462|    194|      }
pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  1.95k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    386|      std::array<W, L> stash_value() const {
  760|    386|         static_assert(L >= N);
  761|    386|         std::array<W, L> stash = {};
  762|  1.93k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 1.54k, False: 386]
  ------------------
  763|  1.54k|            stash[i] = m_val[i];
  764|  1.54k|         }
  765|    386|         return stash;
  766|    386|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|  54.2k|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|  54.2k|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|   271k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 216k, False: 54.2k]
  ------------------
  371|   216k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|   216k|         }
  373|  54.2k|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    449|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    449|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 449]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    449|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    449|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 5, False: 444]
  ------------------
  802|      5|            return {};
  803|      5|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    444|         return Self::from_words(words);
  807|    449|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE:
  211|    444|      static constexpr Self from_words(std::array<W, L> w) {
  212|    444|         if constexpr(L == N) {
  213|    444|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    444|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm28EEE:
  739|    384|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    384|         auto v = Rep::from_rep(m_val);
  741|    384|         std::reverse(v.begin(), v.end());
  742|       |
  743|       |         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|       |            store_be(bytes, v);
  745|    384|         } else {
  746|       |            // Remove leading zero bytes
  747|    384|            const auto padded_bytes = store_be(v);
  748|    384|            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|    384|            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|    384|         }
  751|    384|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|    770|      static Self from_stash(const std::array<W, L>& stash) {
  775|    770|         static_assert(L >= N);
  776|    770|         std::array<W, N> val = {};
  777|  3.85k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 3.08k, False: 770]
  ------------------
  778|  3.08k|            val[i] = stash[i];
  779|  3.08k|         }
  780|    770|         return Self(val);
  781|    770|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_:
  722|  27.2k|      constexpr CT::Choice operator==(const Self& other) const {
  723|  27.2k|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|  27.2k|      }
pcurves_secp224r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_secp224r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp224r16ParamsENS3_12Secp224r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    363|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4sqrtEv:
  663|    283|      constexpr CT::Option<Self> sqrt() const {
  664|       |         if constexpr(Self::P_MOD_4 == 3) {
  665|       |            // The easy case for square root is when p == 3 (mod 4)
  666|       |
  667|       |            constexpr auto P_PLUS_1_OVER_4 = p_plus_1_over_4(P);
  668|       |            auto z = pow_vartime(P_PLUS_1_OVER_4);
  669|       |
  670|       |            // Zero out the return value if it would otherwise be incorrect
  671|       |            const CT::Choice correct = (z.square() == *this);
  672|       |            z.conditional_assign(!correct, Self::zero());
  673|       |            return CT::Option<Self>(z, correct);
  674|    283|         } else {
  675|       |            // Shanks-Tonelli, following I.4 in RFC 9380
  676|       |
  677|       |            /*
  678|       |            Constants:
  679|       |            1. c1, the largest integer such that 2^c1 divides q - 1.
  680|       |            2. c2 = (q - 1) / (2^c1)        # Integer arithmetic
  681|       |            3. c3 = (c2 - 1) / 2            # Integer arithmetic
  682|       |            4. c4, a non-square value in F
  683|       |            5. c5 = c4^c2 in F
  684|       |            */
  685|    283|            constexpr auto C1_C2 = shanks_tonelli_c1c2(Self::P);
  686|    283|            constexpr std::array<W, N> C3 = shanks_tonelli_c3(C1_C2.second);
  687|    283|            constexpr std::array<W, N> P_MINUS_1_OVER_2 = p_minus_1_over_2(Self::P);
  688|    283|            constexpr Self C4 = shanks_tonelli_c4<Self>(P_MINUS_1_OVER_2);
  689|    283|            constexpr Self C5 = C4.pow_vartime(C1_C2.second);
  690|       |
  691|    283|            const Self& x = (*this);
  692|       |
  693|    283|            auto z = x.pow_vartime(C3);
  694|    283|            auto t = z.square();
  695|    283|            t *= x;
  696|    283|            z *= x;
  697|    283|            auto b = t;
  698|    283|            auto c = C5;
  699|       |
  700|  27.1k|            for(size_t i = C1_C2.first; i >= 2; i--) {
  ------------------
  |  Branch (700:41): [True: 26.8k, False: 283]
  ------------------
  701|  26.8k|               b.square_n(i - 2);
  702|  26.8k|               const CT::Choice e = b.is_one();
  703|  26.8k|               z.conditional_assign(!e, z * c);
  704|  26.8k|               c.square_n(1);
  705|  26.8k|               t.conditional_assign(!e, t * c);
  706|  26.8k|               b = t;
  707|  26.8k|            }
  708|       |
  709|       |            // Zero out the return value if it would otherwise be incorrect
  710|    283|            const CT::Choice correct = (z.square() == *this);
  711|    283|            z.conditional_assign(!correct, Self::zero());
  712|    283|            return CT::Option<Self>(z, correct);
  713|    283|         }
  714|    283|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11pow_vartimeERKNSt3__15arrayImLm4EEE:
  477|    283|      constexpr Self pow_vartime(const std::array<W, N>& exp) const {
  478|    283|         constexpr size_t WindowBits = (Self::BITS <= 256) ? 4 : 5;
  ------------------
  |  Branch (478:40): [True: 0, Folded]
  ------------------
  479|    283|         constexpr size_t WindowElements = (1 << WindowBits) - 1;
  480|       |
  481|    283|         constexpr size_t Windows = (Self::BITS + WindowBits - 1) / WindowBits;
  482|       |
  483|       |         /*
  484|       |         A simple fixed width window modular multiplication.
  485|       |
  486|       |         TODO: investigate using sliding window here
  487|       |         */
  488|       |
  489|    283|         std::array<Self, WindowElements> tbl;
  490|       |
  491|    283|         tbl[0] = (*this);
  492|       |
  493|  4.24k|         for(size_t i = 1; i != WindowElements; ++i) {
  ------------------
  |  Branch (493:28): [True: 3.96k, False: 283]
  ------------------
  494|       |            // Conditional ok: table indexes are public here
  495|  3.96k|            if(i % 2 == 1) {
  ------------------
  |  Branch (495:16): [True: 1.98k, False: 1.98k]
  ------------------
  496|  1.98k|               tbl[i] = tbl[i / 2].square();
  497|  1.98k|            } else {
  498|  1.98k|               tbl[i] = tbl[i - 1] * tbl[0];
  499|  1.98k|            }
  500|  3.96k|         }
  501|       |
  502|    283|         auto r = Self::one();
  503|       |
  504|    283|         const size_t w0 = read_window_bits<WindowBits>(std::span{exp}, (Windows - 1) * WindowBits);
  505|       |
  506|       |         // Conditional ok: this function is variable time
  507|    283|         if(w0 > 0) {
  ------------------
  |  Branch (507:13): [True: 0, False: 283]
  ------------------
  508|      0|            r = tbl[w0 - 1];
  509|      0|         }
  510|       |
  511|  15.8k|         for(size_t i = 1; i != Windows; ++i) {
  ------------------
  |  Branch (511:28): [True: 15.5k, False: 283]
  ------------------
  512|  15.5k|            r.square_n(WindowBits);
  513|       |
  514|  15.5k|            const size_t w = read_window_bits<WindowBits>(std::span{exp}, (Windows - i - 1) * WindowBits);
  515|       |
  516|       |            // Conditional ok: this function is variable time
  517|  15.5k|            if(w > 0) {
  ------------------
  |  Branch (517:16): [True: 9.05k, False: 6.50k]
  ------------------
  518|  9.05k|               r *= tbl[w - 1];
  519|  9.05k|            }
  520|  15.5k|         }
  521|       |
  522|    283|         return r;
  523|    283|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2Ev:
  180|  4.24k|      constexpr IntMod() : m_val({}) {}
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6is_oneEv:
  235|  26.8k|      constexpr CT::Choice is_one() const { return (*this == Self::one()); }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    192|      constexpr Self correct_sign(CT::Choice even) const {
  249|    192|         const auto flip = (even != this->is_even());
  250|    192|         return Self::choose(flip, this->negate(), *this);
  251|    192|      }
pcurves_secp224r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_evenEv:
  240|    192|      constexpr CT::Choice is_even() const {
  241|    192|         auto v = Rep::from_rep(m_val);
  242|    192|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    192|      }
pcurves_secp224r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    192|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    192|         auto r = y;
  258|    192|         r.conditional_assign(choice, x);
  259|    192|         return r;
  260|    192|      }
pcurves_secp224r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm57EEE:
  941|    192|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    192|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    192|   do {                                                         \
  |  |   52|    192|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    192|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 192]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    192|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 192]
  |  |  ------------------
  ------------------
  943|    192|         BufferStuffer pack(bytes);
  944|    192|         pack.append(0x04);
  945|    192|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    192|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    192|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    192|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    192|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 192]
  |  |  ------------------
  ------------------
  948|    192|      }
pcurves_secp256r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1xEv:
  971|  1.13k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE1yEv:
  976|  1.13k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE3oneEv:
  200|      1|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm4EEE:
  898|  51.4k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      5|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 4, False: 1]
  ------------------
  414|      4|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      4|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      4|            x.m_val[i] = nx;
  417|      4|            y.m_val[i] = ny;
  418|      4|         }
  419|      1|      }
pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv:
  928|    566|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_zeroEv:
  225|  5.64k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  1.56k|            m_x(x), m_y(y), m_z(z) {}
pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv:
 1121|    833|      constexpr Self dbl() const {
 1122|    833|         if constexpr(Self::A_is_minus_3) {
 1123|    833|            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|       |         } else {
 1127|       |            return dbl_generic(*this, A);
 1128|       |         }
 1129|    833|      }
pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1zEv:
 1172|  13.7k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6squareEv:
  426|  9.16k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  9.16k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  9.16k|         comba_sqr<N>(z.data(), this->data());
  429|  9.16k|         return Self(Rep::redc(z));
  430|  9.16k|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4dataEv:
  896|   157k|      constexpr const W* data() const { return m_val.data(); }
pcurves_secp256r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_:
  346|  22.0k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  22.0k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  22.0k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  22.0k|         return Self(Rep::redc(z));
  350|  22.0k|      }
pcurves_secp256r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_:
  281|  7.74k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  7.74k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  7.74k|         W carry = 0;
  284|  38.7k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 30.9k, False: 7.74k]
  ------------------
  285|  30.9k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|  30.9k|         }
  287|       |
  288|  7.74k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  7.74k|         carry = 0;
  291|       |
  292|  38.7k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 30.9k, False: 7.74k]
  ------------------
  293|  30.9k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|  30.9k|         }
  295|       |
  296|  7.74k|         return Self(r);
  297|  7.74k|      }
pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1xEv:
 1162|  7.00k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul3Ev:
  335|    833|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_secp256r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEESC_:
  265|  3.51k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  3.51k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  3.51k|         W carry = 0;
  269|  17.5k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 14.0k, False: 3.51k]
  ------------------
  270|  14.0k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  14.0k|         }
  272|       |
  273|  3.51k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  3.51k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  3.51k|         return Self(r);
  276|  3.51k|      }
pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E1yEv:
 1167|  6.17k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul4Ev:
  338|    833|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul2Ev:
  325|  6.66k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  6.66k|         std::array<W, N> t = value();
  327|  6.66k|         const W carry = shift_left<1>(t);
  328|       |
  329|  6.66k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  6.66k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  6.66k|         return Self(r);
  332|  6.66k|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE5valueEv:
  894|  6.66k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4mul8Ev:
  341|    833|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_secp256r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_EESE_:
 1064|    735|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_secp256r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|    735|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_secp256r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  3.03k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  1.47k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  1.47k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  7.35k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 5.88k, False: 1.47k]
  ------------------
  399|  5.88k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  5.88k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  5.88k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  5.88k|         }
  403|  1.47k|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEmLERKSA_:
  355|  2.70k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  2.70k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  2.70k|         comba_mul<N>(z.data(), data(), other.data());
  358|  2.70k|         m_val = Rep::redc(z);
  359|  2.70k|         return (*this);
  360|  2.70k|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8square_nEm:
  439|  2.70k|      constexpr void square_n(size_t n) {
  440|  2.70k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|  99.9k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 97.2k, False: 2.70k]
  ------------------
  442|  97.2k|            comba_sqr<N>(z.data(), this->data());
  443|  97.2k|            m_val = Rep::redc(z);
  444|  97.2k|         }
  445|  2.70k|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    176|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    176|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 175]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    175|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    175|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    175|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    175|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 85, False: 90]
  ------------------
  644|       |               // b > a
  645|     85|               b.m_val = r;
  646|     85|               x = nx;
  647|     85|               Self::_invert_vartime_div2_helper(b, x);
  648|     90|            } else {
  649|       |               // We know this can't underflow because a > b
  650|     90|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|     90|               a.m_val = r;
  652|     90|               y = nx;
  653|     90|               Self::_invert_vartime_div2_helper(a, y);
  654|     90|            }
  655|    175|         }
  656|      1|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE4zeroEv:
  195|    388|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    177|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    177|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|    545|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 368, False: 177]
  ------------------
  552|    368|            shift_right<1>(a.m_val);
  553|       |
  554|    368|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    368|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 129, False: 239]
  ------------------
  558|    129|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    129|            }
  560|    368|         }
  561|    177|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6negateEv:
  452|    284|      constexpr Self negate() const {
  453|    284|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    284|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    284|         W carry = 0;
  457|  1.42k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 1.13k, False: 284]
  ------------------
  458|  1.13k|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|  1.13k|         }
  460|       |
  461|    284|         return Self(r);
  462|    284|      }
pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  2.41k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    566|      std::array<W, L> stash_value() const {
  760|    566|         static_assert(L >= N);
  761|    566|         std::array<W, L> stash = {};
  762|  2.83k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 2.26k, False: 566]
  ------------------
  763|  2.26k|            stash[i] = m_val[i];
  764|  2.26k|         }
  765|    566|         return stash;
  766|    566|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    668|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    668|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  3.34k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 2.67k, False: 668]
  ------------------
  371|  2.67k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  2.67k|         }
  373|    668|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    556|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    556|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 556]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    556|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    556|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 5, False: 551]
  ------------------
  802|      5|            return {};
  803|      5|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    551|         return Self::from_words(words);
  807|    556|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10from_wordsILm4EEESA_NSt3__15arrayImXT_EEE:
  211|    551|      static constexpr Self from_words(std::array<W, L> w) {
  212|    551|         if constexpr(L == N) {
  213|    551|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    551|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm32EEE:
  739|    564|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    564|         auto v = Rep::from_rep(m_val);
  741|    564|         std::reverse(v.begin(), v.end());
  742|       |
  743|    564|         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|    564|            store_be(bytes, v);
  745|       |         } else {
  746|       |            // Remove leading zero bytes
  747|       |            const auto padded_bytes = store_be(v);
  748|       |            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|       |            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|       |         }
  751|    564|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|  1.13k|      static Self from_stash(const std::array<W, L>& stash) {
  775|  1.13k|         static_assert(L >= N);
  776|  1.13k|         std::array<W, N> val = {};
  777|  5.65k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 4.52k, False: 1.13k]
  ------------------
  778|  4.52k|            val[i] = stash[i];
  779|  4.52k|         }
  780|  1.13k|         return Self(val);
  781|  1.13k|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEEeqERKSA_:
  722|    468|      constexpr CT::Choice operator==(const Self& other) const {
  723|    468|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    468|      }
pcurves_secp256r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_secp256r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp256r16ParamsENS2_12Secp256r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    468|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    282|      constexpr Self correct_sign(CT::Choice even) const {
  249|    282|         const auto flip = (even != this->is_even());
  250|    282|         return Self::choose(flip, this->negate(), *this);
  251|    282|      }
pcurves_secp256r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE7is_evenEv:
  240|    282|      constexpr CT::Choice is_even() const {
  241|    282|         auto v = Rep::from_rep(m_val);
  242|    282|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    282|      }
pcurves_secp256r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS2_9secp256r16ParamsES3_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    282|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    282|         auto r = y;
  258|    282|         r.conditional_assign(choice, x);
  259|    282|         return r;
  260|    282|      }
pcurves_secp256r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS3_9secp256r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm65EEE:
  941|    282|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    282|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    282|   do {                                                         \
  |  |   52|    282|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    282|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 282]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    282|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 282]
  |  |  ------------------
  ------------------
  943|    282|         BufferStuffer pack(bytes);
  944|    282|         pack.append(0x04);
  945|    282|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    282|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    282|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    282|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    282|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 282]
  |  |  ------------------
  ------------------
  948|    282|      }
pcurves_secp384r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1xEv:
  971|    668|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE1yEv:
  976|    668|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE3oneEv:
  200|      1|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEC2ENSt3__15arrayImLm6EEE:
  898|  72.6k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|      7|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 6, False: 1]
  ------------------
  414|      6|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      6|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      6|            x.m_val[i] = nx;
  417|      6|            y.m_val[i] = ny;
  418|      6|         }
  419|      1|      }
pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE11is_identityEv:
  928|    334|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_zeroEv:
  225|  7.38k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  2.33k|            m_x(x), m_y(y), m_z(z) {}
pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3dblEv:
 1121|  1.24k|      constexpr Self dbl() const {
 1122|  1.24k|         if constexpr(Self::A_is_minus_3) {
 1123|  1.24k|            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|       |         } else {
 1127|       |            return dbl_generic(*this, A);
 1128|       |         }
 1129|  1.24k|      }
pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1zEv:
 1172|  20.4k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6squareEv:
  426|  12.8k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  12.8k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  12.8k|         comba_sqr<N>(z.data(), this->data());
  429|  12.8k|         return Self(Rep::redc(z));
  430|  12.8k|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4dataEv:
  896|   146k|      constexpr const W* data() const { return m_val.data(); }
pcurves_secp384r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_:
  346|  32.8k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  32.8k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  32.8k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  32.8k|         return Self(Rep::redc(z));
  350|  32.8k|      }
pcurves_secp384r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_:
  281|  11.5k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  11.5k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  11.5k|         W carry = 0;
  284|  80.7k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 69.2k, False: 11.5k]
  ------------------
  285|  69.2k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|  69.2k|         }
  287|       |
  288|  11.5k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  11.5k|         carry = 0;
  291|       |
  292|  80.7k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 69.2k, False: 11.5k]
  ------------------
  293|  69.2k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|  69.2k|         }
  295|       |
  296|  11.5k|         return Self(r);
  297|  11.5k|      }
pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1xEv:
 1162|  10.4k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul3Ev:
  335|  1.24k|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_secp384r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEESC_:
  265|  4.28k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  4.28k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  4.28k|         W carry = 0;
  269|  29.9k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 25.6k, False: 4.28k]
  ------------------
  270|  25.6k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  25.6k|         }
  272|       |
  273|  4.28k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  4.28k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  4.28k|         return Self(r);
  276|  4.28k|      }
pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E1yEv:
 1167|  9.19k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul4Ev:
  338|  1.24k|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul2Ev:
  325|  9.92k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  9.92k|         std::array<W, N> t = value();
  327|  9.92k|         const W carry = shift_left<1>(t);
  328|       |
  329|  9.92k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  9.92k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  9.92k|         return Self(r);
  332|  9.92k|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE5valueEv:
  894|  9.92k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4mul8Ev:
  341|  1.24k|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_secp384r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_EESE_:
 1064|  1.09k|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_secp384r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|  1.09k|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_secp384r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  4.52k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  2.19k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  2.19k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  15.3k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 13.1k, False: 2.19k]
  ------------------
  399|  13.1k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  13.1k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  13.1k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  13.1k|         }
  403|  2.19k|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEmLERKSA_:
  355|  1.84k|      constexpr BOTAN_FORCE_INLINE Self& operator*=(const Self& other) {
  356|  1.84k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  357|  1.84k|         comba_mul<N>(z.data(), data(), other.data());
  358|  1.84k|         m_val = Rep::redc(z);
  359|  1.84k|         return (*this);
  360|  1.84k|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8square_nEm:
  439|  1.84k|      constexpr void square_n(size_t n) {
  440|  1.84k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|  65.1k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 63.3k, False: 1.84k]
  ------------------
  442|  63.3k|            comba_sqr<N>(z.data(), this->data());
  443|  63.3k|            m_val = Rep::redc(z);
  444|  63.3k|         }
  445|  1.84k|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    252|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    252|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 251]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    251|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    251|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    251|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    251|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 118, False: 133]
  ------------------
  644|       |               // b > a
  645|    118|               b.m_val = r;
  646|    118|               x = nx;
  647|    118|               Self::_invert_vartime_div2_helper(b, x);
  648|    133|            } else {
  649|       |               // We know this can't underflow because a > b
  650|    133|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|    133|               a.m_val = r;
  652|    133|               y = nx;
  653|    133|               Self::_invert_vartime_div2_helper(a, y);
  654|    133|            }
  655|    251|         }
  656|      1|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE4zeroEv:
  195|    170|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    253|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    253|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|    809|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 556, False: 253]
  ------------------
  552|    556|            shift_right<1>(a.m_val);
  553|       |
  554|    556|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    556|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 248, False: 308]
  ------------------
  558|    248|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    248|            }
  560|    556|         }
  561|    253|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6negateEv:
  452|    168|      constexpr Self negate() const {
  453|    168|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    168|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    168|         W carry = 0;
  457|  1.17k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 1.00k, False: 168]
  ------------------
  458|  1.00k|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|  1.00k|         }
  460|       |
  461|    168|         return Self(r);
  462|    168|      }
pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  2.83k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    334|      std::array<W, L> stash_value() const {
  760|    334|         static_assert(L >= N);
  761|    334|         std::array<W, L> stash = {};
  762|  2.33k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 2.00k, False: 334]
  ------------------
  763|  2.00k|            stash[i] = m_val[i];
  764|  2.00k|         }
  765|    334|         return stash;
  766|    334|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    334|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    334|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  2.33k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 2.00k, False: 334]
  ------------------
  371|  2.00k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  2.00k|         }
  373|    334|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    289|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    289|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 289]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    289|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    289|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 4, False: 285]
  ------------------
  802|      4|            return {};
  803|      4|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    285|         return Self::from_words(words);
  807|    289|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10from_wordsILm6EEESA_NSt3__15arrayImXT_EEE:
  211|    285|      static constexpr Self from_words(std::array<W, L> w) {
  212|    285|         if constexpr(L == N) {
  213|    285|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    285|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm48EEE:
  739|    332|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    332|         auto v = Rep::from_rep(m_val);
  741|    332|         std::reverse(v.begin(), v.end());
  742|       |
  743|    332|         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|    332|            store_be(bytes, v);
  745|       |         } else {
  746|       |            // Remove leading zero bytes
  747|       |            const auto padded_bytes = store_be(v);
  748|       |            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|       |            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|       |         }
  751|    332|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|    666|      static Self from_stash(const std::array<W, L>& stash) {
  775|    666|         static_assert(L >= N);
  776|    666|         std::array<W, N> val = {};
  777|  4.66k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 3.99k, False: 666]
  ------------------
  778|  3.99k|            val[i] = stash[i];
  779|  3.99k|         }
  780|    666|         return Self(val);
  781|    666|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEEeqERKSA_:
  722|    226|      constexpr CT::Choice operator==(const Self& other) const {
  723|    226|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    226|      }
pcurves_secp384r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE8identityEv:
  921|      1|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_secp384r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp384r16ParamsENS2_12Secp384r1RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    226|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    166|      constexpr Self correct_sign(CT::Choice even) const {
  249|    166|         const auto flip = (even != this->is_even());
  250|    166|         return Self::choose(flip, this->negate(), *this);
  251|    166|      }
pcurves_secp384r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE7is_evenEv:
  240|    166|      constexpr CT::Choice is_even() const {
  241|    166|         auto v = Rep::from_rep(m_val);
  242|    166|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    166|      }
pcurves_secp384r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS2_9secp384r16ParamsES3_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    166|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    166|         auto r = y;
  258|    166|         r.conditional_assign(choice, x);
  259|    166|         return r;
  260|    166|      }
pcurves_secp384r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS3_9secp384r16ParamsES4_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm97EEE:
  941|    166|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    166|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    166|   do {                                                         \
  |  |   52|    166|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    166|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 166]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    166|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 166]
  |  |  ------------------
  ------------------
  943|    166|         BufferStuffer pack(bytes);
  944|    166|         pack.append(0x04);
  945|    166|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    166|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    166|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    166|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    166|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 166]
  |  |  ------------------
  ------------------
  948|    166|      }
pcurves_secp521r1.cpp:_ZN5Botan23PrecomputedBaseMulTableINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEC2ERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
 1405|      1|            m_table(basemul_booth_setup<C, WindowBits>(p, BlindedScalar::Bits + 1)) {}
pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11from_affineERKNS_16AffineCurvePointISB_EE:
 1016|      1|      static constexpr Self from_affine(const AffinePoint& pt) {
 1017|       |         /*
 1018|       |         * If the point is the identity element (x=0, y=0) then instead of
 1019|       |         * creating (x, y, 1) = (0, 0, 1) we want our projective identity
 1020|       |         * encoding of (0, 1, 0)
 1021|       |         *
 1022|       |         * Which we can achieve by a conditional swap of y and z if the
 1023|       |         * affine point is the identity.
 1024|       |         */
 1025|       |
 1026|      1|         auto x = pt.x();
 1027|      1|         auto y = pt.y();
 1028|      1|         auto z = FieldElement::one();
 1029|       |
 1030|      1|         FieldElement::conditional_swap(pt.is_identity(), y, z);
 1031|       |
 1032|      1|         return ProjectiveCurvePoint(x, y, z);
 1033|      1|      }
pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1xEv:
  971|  1.30k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE1yEv:
  976|  1.30k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE3oneEv:
  200|      1|      static constexpr Self one() { return Self(Rep::one()); }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEC2ENSt3__15arrayImLm9EEE:
  898|  96.9k|      explicit constexpr IntMod(std::array<W, N> v) : m_val(v) {}
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE16conditional_swapENS_2CT6ChoiceERSA_SD_:
  410|      1|      static constexpr void conditional_swap(CT::Choice cond, Self& x, Self& y) {
  411|      1|         const W mask = cond.into_bitmask<W>();
  412|       |
  413|     10|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (413:28): [True: 9, False: 1]
  ------------------
  414|      9|            auto nx = Botan::choose(mask, y.m_val[i], x.m_val[i]);
  415|      9|            auto ny = Botan::choose(mask, x.m_val[i], y.m_val[i]);
  416|      9|            x.m_val[i] = nx;
  417|      9|            y.m_val[i] = ny;
  418|      9|         }
  419|      1|      }
pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE11is_identityEv:
  928|    651|      constexpr CT::Choice is_identity() const { return x().is_zero() && y().is_zero(); }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_zeroEv:
  225|  10.2k|      constexpr CT::Choice is_zero() const { return CT::all_zeros(m_val.data(), m_val.size()).as_choice(); }
pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EC2ERKSB_SE_SE_:
 1056|  3.10k|            m_x(x), m_y(y), m_z(z) {}
pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3dblEv:
 1121|  1.64k|      constexpr Self dbl() const {
 1122|  1.64k|         if constexpr(Self::A_is_minus_3) {
 1123|  1.64k|            return dbl_a_minus_3(*this);
 1124|       |         } else if constexpr(Self::A_is_zero) {
 1125|       |            return dbl_a_zero(*this);
 1126|       |         } else {
 1127|       |            return dbl_generic(*this, A);
 1128|       |         }
 1129|  1.64k|      }
pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1zEv:
 1172|  27.1k|      constexpr const FieldElement& z() const { return m_z; }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6squareEv:
  426|  16.5k|      constexpr BOTAN_FORCE_INLINE Self square() const {
  427|  16.5k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  428|  16.5k|         comba_sqr<N>(z.data(), this->data());
  429|  16.5k|         return Self(Rep::redc(z));
  430|  16.5k|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4dataEv:
  896|   299k|      constexpr const W* data() const { return m_val.data(); }
pcurves_secp521r1.cpp:_ZN5BotanmlERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  346|  43.1k|      friend constexpr BOTAN_FORCE_INLINE Self operator*(const Self& a, const Self& b) {
  347|  43.1k|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  348|  43.1k|         comba_mul<N>(z.data(), a.data(), b.data());
  349|  43.1k|         return Self(Rep::redc(z));
  350|  43.1k|      }
pcurves_secp521r1.cpp:_ZN5BotanmiERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  281|  15.3k|      friend constexpr BOTAN_FORCE_INLINE Self operator-(const Self& a, const Self& b) {
  282|  15.3k|         std::array<W, N> r;  // NOLINT(*-member-init)
  283|  15.3k|         W carry = 0;
  284|   153k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (284:28): [True: 137k, False: 15.3k]
  ------------------
  285|   137k|            r[i] = word_sub(a.m_val[i], b.m_val[i], &carry);
  286|   137k|         }
  287|       |
  288|  15.3k|         const auto mask = CT::Mask<W>::expand(carry).value();
  289|       |
  290|  15.3k|         carry = 0;
  291|       |
  292|   153k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (292:28): [True: 137k, False: 15.3k]
  ------------------
  293|   137k|            r[i] = word_add(r[i], P[i] & mask, &carry);
  294|   137k|         }
  295|       |
  296|  15.3k|         return Self(r);
  297|  15.3k|      }
pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1xEv:
 1162|  13.8k|      constexpr const FieldElement& x() const { return m_x; }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul3Ev:
  335|  1.64k|      constexpr inline Self mul3() const { return mul2() + (*this); }
pcurves_secp521r1.cpp:_ZN5BotanplERKNS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEESC_:
  265|  6.11k|      friend constexpr BOTAN_FORCE_INLINE Self operator+(const Self& a, const Self& b) {
  266|  6.11k|         std::array<W, N> t;  // NOLINT(*-member-init)
  267|       |
  268|  6.11k|         W carry = 0;
  269|  61.1k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (269:28): [True: 55.0k, False: 6.11k]
  ------------------
  270|  55.0k|            t[i] = word_add(a.m_val[i], b.m_val[i], &carry);
  271|  55.0k|         }
  272|       |
  273|  6.11k|         std::array<W, N> r;  // NOLINT(*-member-init)
  274|  6.11k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  275|  6.11k|         return Self(r);
  276|  6.11k|      }
pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E1yEv:
 1167|  12.2k|      constexpr const FieldElement& y() const { return m_y; }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul4Ev:
  338|  1.64k|      constexpr inline Self mul4() const { return mul2().mul2(); }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul2Ev:
  325|  13.1k|      constexpr BOTAN_FORCE_INLINE Self mul2() const {
  326|  13.1k|         std::array<W, N> t = value();
  327|  13.1k|         const W carry = shift_left<1>(t);
  328|       |
  329|  13.1k|         std::array<W, N> r;  // NOLINT(*-member-init)
  330|  13.1k|         bigint_monty_maybe_sub<N>(r.data(), carry, t.data(), P.data());
  331|  13.1k|         return Self(r);
  332|  13.1k|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE5valueEv:
  894|  13.1k|      constexpr const std::array<W, N>& value() const { return m_val; }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4mul8Ev:
  341|  1.64k|      constexpr inline Self mul8() const { return mul2().mul2().mul2(); }
pcurves_secp521r1.cpp:_ZN5BotanplERKNS_20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_EESE_:
 1064|  1.45k|      friend constexpr Self operator+(const Self& a, const Self& b) { return Self::add(a, b); }
pcurves_secp521r1.cpp:_ZN5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E3addERKSC_SE_:
 1103|  1.45k|      constexpr static Self add(const Self& a, const Self& b) { return point_add<Self, FieldElement>(a, b); }
pcurves_secp521r1.cpp:_ZNK5Botan20ProjectiveCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEES7_E11is_identityEv:
 1082|  6.01k|      constexpr CT::Choice is_identity() const { return z().is_zero(); }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignERSA_SB_SB_NS_2CT6ChoiceERKSA_SF_SF_:
  395|  2.91k|         Self& x, Self& y, Self& z, CT::Choice cond, const Self& nx, const Self& ny, const Self& nz) {
  396|  2.91k|         const W mask = cond.into_bitmask<W>();
  397|       |
  398|  29.1k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (398:28): [True: 26.1k, False: 2.91k]
  ------------------
  399|  26.1k|            x.m_val[i] = Botan::choose(mask, nx.m_val[i], x.m_val[i]);
  400|  26.1k|            y.m_val[i] = Botan::choose(mask, ny.m_val[i], y.m_val[i]);
  401|  26.1k|            z.m_val[i] = Botan::choose(mask, nz.m_val[i], z.m_val[i]);
  402|  26.1k|         }
  403|  2.91k|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8square_nEm:
  439|    374|      constexpr void square_n(size_t n) {
  440|    374|         std::array<W, 2 * N> z;  // NOLINT(*-member-init)
  441|   194k|         for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (441:28): [True: 194k, False: 374]
  ------------------
  442|   194k|            comba_sqr<N>(z.data(), this->data());
  443|   194k|            m_val = Rep::redc(z);
  444|   194k|         }
  445|    374|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE14invert_vartimeEv:
  598|      1|      constexpr Self invert_vartime() const {
  599|       |         // Conditional ok: this function is variable time
  600|      1|         if(this->is_zero().as_bool()) {
  ------------------
  |  Branch (600:13): [True: 0, False: 1]
  ------------------
  601|      0|            return Self::zero();
  602|      0|         }
  603|       |
  604|      1|         auto x = Self(std::array<W, N>{1});  // 1 in standard domain
  605|      1|         auto b = Self(this->to_words());     // *this in standard domain
  606|       |
  607|       |         // First loop iteration
  608|      1|         Self::_invert_vartime_div2_helper(b, x);
  609|       |
  610|      1|         auto a = b.negate();
  611|       |         // y += x but y is zero at the outset
  612|      1|         auto y = x;
  613|       |
  614|       |         // First half of second loop iteration
  615|      1|         Self::_invert_vartime_div2_helper(a, y);
  616|       |
  617|    350|         for(;;) {
  618|       |            // Conditional ok: this function is variable time
  619|    350|            if(a.m_val == b.m_val) {
  ------------------
  |  Branch (619:16): [True: 1, False: 349]
  ------------------
  620|       |               // At this point it should be that a == b == 1
  621|      1|               auto r = y.negate();
  622|       |
  623|       |               // Convert back to Montgomery if required
  624|      1|               r.m_val = Rep::to_rep(r.m_val);
  625|      1|               return r;
  626|      1|            }
  627|       |
  628|    349|            auto nx = x + y;
  629|       |
  630|       |            /*
  631|       |            * Otherwise either b > a or a > b
  632|       |            *
  633|       |            * If b > a we want to set b to b - a
  634|       |            * Otherwise we want to set a to a - b
  635|       |            *
  636|       |            * Compute r = b - a and check if it underflowed
  637|       |            * If it did not then we are in the b > a path
  638|       |            */
  639|    349|            std::array<W, N> r;  // NOLINT(*-member-init)
  640|    349|            const word carry = bigint_sub3(r.data(), b.data(), N, a.data(), N);
  641|       |
  642|       |            // Conditional ok: this function is variable time
  643|    349|            if(carry == 0) {
  ------------------
  |  Branch (643:16): [True: 170, False: 179]
  ------------------
  644|       |               // b > a
  645|    170|               b.m_val = r;
  646|    170|               x = nx;
  647|    170|               Self::_invert_vartime_div2_helper(b, x);
  648|    179|            } else {
  649|       |               // We know this can't underflow because a > b
  650|    179|               bigint_sub3(r.data(), a.data(), N, b.data(), N);
  651|    179|               a.m_val = r;
  652|    179|               y = nx;
  653|    179|               Self::_invert_vartime_div2_helper(a, y);
  654|    179|            }
  655|    349|         }
  656|      1|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE4zeroEv:
  195|    378|      static constexpr Self zero() { return Self(std::array<W, N>{0}); }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE8to_wordsEv:
  734|      1|      constexpr std::array<W, Self::N> to_words() const { return Rep::from_rep(m_val); }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE27_invert_vartime_div2_helperERSA_SB_:
  547|    351|      static constexpr void _invert_vartime_div2_helper(Self& a, Self& x) {
  548|    351|         constexpr auto INV_2 = p_div_2_plus_1(Rep::P);
  549|       |
  550|       |         // Conditional ok: this function is variable time
  551|  1.09k|         while((a.m_val[0] & 1) != 1) {
  ------------------
  |  Branch (551:16): [True: 742, False: 351]
  ------------------
  552|    742|            shift_right<1>(a.m_val);
  553|       |
  554|    742|            const W borrow = shift_right<1>(x.m_val);
  555|       |
  556|       |            // Conditional ok: this function is variable time
  557|    742|            if(borrow) {
  ------------------
  |  Branch (557:16): [True: 109, False: 633]
  ------------------
  558|    109|               bigint_add2(x.m_val.data(), N, INV_2.data(), N);
  559|    109|            }
  560|    742|         }
  561|    351|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6negateEv:
  452|    326|      constexpr Self negate() const {
  453|    326|         const W x_is_zero = ~CT::all_zeros(this->data(), N).value();
  454|       |
  455|    326|         std::array<W, N> r;  // NOLINT(*-member-init)
  456|    326|         W carry = 0;
  457|  3.26k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (457:28): [True: 2.93k, False: 326]
  ------------------
  458|  2.93k|            r[i] = word_sub(P[i] & x_is_zero, m_val[i], &carry);
  459|  2.93k|         }
  460|       |
  461|    326|         return Self(r);
  462|    326|      }
pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEEC2ERKSB_SE_:
  917|  4.08k|      constexpr AffineCurvePoint(const FieldElement& x, const FieldElement& y) : m_x(x), m_y(y) {}
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11stash_valueILm9EEENSt3__15arrayImXT_EEEv:
  759|    652|      std::array<W, L> stash_value() const {
  760|    652|         static_assert(L >= N);
  761|    652|         std::array<W, L> stash = {};
  762|  6.52k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (762:28): [True: 5.86k, False: 652]
  ------------------
  763|  5.86k|            stash[i] = m_val[i];
  764|  5.86k|         }
  765|    652|         return stash;
  766|    652|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE18conditional_assignENS_2CT6ChoiceERKSA_:
  367|    698|      constexpr void conditional_assign(CT::Choice cond, const Self& nx) {
  368|    698|         const W mask = cond.into_bitmask<W>();
  369|       |
  370|  6.98k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (370:28): [True: 6.28k, False: 698]
  ------------------
  371|  6.28k|            m_val[i] = Botan::choose(mask, nx.m_val[i], m_val[i]);
  372|  6.28k|         }
  373|    698|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE11deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  792|    660|      static std::optional<Self> deserialize(std::span<const uint8_t> bytes) {
  793|       |         // Conditional ok: input length is public
  794|    660|         if(bytes.size() != Self::BYTES) {
  ------------------
  |  Branch (794:13): [True: 0, False: 660]
  ------------------
  795|      0|            return {};
  796|      0|         }
  797|       |
  798|    660|         const auto words = bytes_to_words<W, N, BYTES>(bytes.first<Self::BYTES>());
  799|       |
  800|       |         // Conditional acceptable: std::optional is implicitly not constant time
  801|    660|         if(!bigint_ct_is_lt(words.data(), N, P.data(), N).as_bool()) {
  ------------------
  |  Branch (801:13): [True: 20, False: 640]
  ------------------
  802|     20|            return {};
  803|     20|         }
  804|       |
  805|       |         // Safe because we checked above that words is an integer < P
  806|    640|         return Self::from_words(words);
  807|    660|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_wordsILm9EEESA_NSt3__15arrayImXT_EEE:
  211|    640|      static constexpr Self from_words(std::array<W, L> w) {
  212|    640|         if constexpr(L == N) {
  213|    640|            return Self(Rep::to_rep(w));
  214|       |         } else {
  215|       |            static_assert(L < N);
  216|       |            std::array<W, N> ew = {};
  217|       |            copy_mem(std::span{ew}.template first<L>(), w);
  218|       |            return Self(Rep::to_rep(ew));
  219|       |         }
  220|    640|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12serialize_toENSt3__14spanIhLm66EEE:
  739|    648|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  740|    648|         auto v = Rep::from_rep(m_val);
  741|    648|         std::reverse(v.begin(), v.end());
  742|       |
  743|       |         if constexpr(Self::BYTES == N * WordInfo<W>::bytes) {
  744|       |            store_be(bytes, v);
  745|    648|         } else {
  746|       |            // Remove leading zero bytes
  747|    648|            const auto padded_bytes = store_be(v);
  748|    648|            constexpr size_t extra = N * WordInfo<W>::bytes - Self::BYTES;
  749|    648|            copy_mem(bytes, std::span{padded_bytes}.template subspan<extra, Self::BYTES>());
  750|    648|         }
  751|    648|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE10from_stashILm9EEESA_RKNSt3__15arrayImXT_EEE:
  774|  1.30k|      static Self from_stash(const std::array<W, L>& stash) {
  775|  1.30k|         static_assert(L >= N);
  776|  1.30k|         std::array<W, N> val = {};
  777|  13.0k|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (777:28): [True: 11.7k, False: 1.30k]
  ------------------
  778|  11.7k|            val[i] = stash[i];
  779|  11.7k|         }
  780|  1.30k|         return Self(val);
  781|  1.30k|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEEeqERKSA_:
  722|    506|      constexpr CT::Choice operator==(const Self& other) const {
  723|    506|         return CT::is_equal(this->data(), other.data(), N).as_choice();
  724|    506|      }
pcurves_secp521r1.cpp:_ZN5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE8identityEv:
  921|      2|      static constexpr Self identity() { return Self(FieldElement::zero(), FieldElement::zero()); }
pcurves_secp521r1.cpp:_ZN5Botan13EllipticCurveINS_6PCurve12_GLOBAL__N_19secp521r16ParamsENS3_7P521RepEE7x3_ax_bERKNS_6IntModINS5_INS6_11FieldParamsEEEEE:
 1275|    506|      static constexpr FieldElement x3_ax_b(const FieldElement& x) { return (x.square() + A) * x + B; }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE12correct_signENS_2CT6ChoiceE:
  248|    324|      constexpr Self correct_sign(CT::Choice even) const {
  249|    324|         const auto flip = (even != this->is_even());
  250|    324|         return Self::choose(flip, this->negate(), *this);
  251|    324|      }
pcurves_secp521r1.cpp:_ZNK5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE7is_evenEv:
  240|    324|      constexpr CT::Choice is_even() const {
  241|    324|         auto v = Rep::from_rep(m_val);
  242|    324|         return !CT::Choice::from_int(v[0] & 0x01);
  243|    324|      }
pcurves_secp521r1.cpp:_ZN5Botan6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS3_6ParamsES4_E11FieldParamsEEEE6chooseENS_2CT6ChoiceERKSA_SE_:
  256|    324|      static constexpr Self choose(CT::Choice choice, const Self& x, const Self& y) {
  257|    324|         auto r = y;
  258|    324|         r.conditional_assign(choice, x);
  259|    324|         return r;
  260|    324|      }
pcurves_secp521r1.cpp:_ZNK5Botan16AffineCurvePointINS_6IntModINS_6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS4_6ParamsES5_E11FieldParamsEEEEEE12serialize_toENSt3__14spanIhLm133EEE:
  941|    324|      constexpr void serialize_to(std::span<uint8_t, Self::BYTES> bytes) const {
  942|    324|         BOTAN_STATE_CHECK(this->is_identity().as_bool() == false);
  ------------------
  |  |   51|    324|   do {                                                         \
  |  |   52|    324|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|    324|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 324]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|    324|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 324]
  |  |  ------------------
  ------------------
  943|    324|         BufferStuffer pack(bytes);
  944|    324|         pack.append(0x04);
  945|    324|         x().serialize_to(pack.next<FieldElement::BYTES>());
  946|    324|         y().serialize_to(pack.next<FieldElement::BYTES>());
  947|    324|         BOTAN_DEBUG_ASSERT(pack.full());
  ------------------
  |  |  130|    324|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|    324|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 324]
  |  |  ------------------
  ------------------
  948|    324|      }

pcurves_brainpool256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     50|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 49, False: 1]
  ------------------
  270|     49|      table.push_back(accum);
  271|       |
  272|  1.56k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 1.51k, False: 49]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  1.51k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 784, False: 735]
  ------------------
  275|    784|            table.emplace_back(table[i + j / 2].dbl());
  276|    784|         } else {
  277|    735|            table.emplace_back(table[i + j - 1] + table[i]);
  278|    735|         }
  279|  1.51k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     49|      accum = table[i + WindowElements - 1].dbl();
  284|     49|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_brainpool512r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_114brainpool512r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     98|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 97, False: 1]
  ------------------
  270|     97|      table.push_back(accum);
  271|       |
  272|  3.10k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 3.00k, False: 97]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  3.00k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 1.55k, False: 1.45k]
  ------------------
  275|  1.55k|            table.emplace_back(table[i + j / 2].dbl());
  276|  1.55k|         } else {
  277|  1.45k|            table.emplace_back(table[i + j - 1] + table[i]);
  278|  1.45k|         }
  279|  3.00k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     97|      accum = table[i + WindowElements - 1].dbl();
  284|     97|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_secp192r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp192r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     38|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 37, False: 1]
  ------------------
  270|     37|      table.push_back(accum);
  271|       |
  272|  1.18k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 1.14k, False: 37]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  1.14k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 592, False: 555]
  ------------------
  275|    592|            table.emplace_back(table[i + j / 2].dbl());
  276|    592|         } else {
  277|    555|            table.emplace_back(table[i + j - 1] + table[i]);
  278|    555|         }
  279|  1.14k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     37|      accum = table[i + WindowElements - 1].dbl();
  284|     37|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_secp224r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp224r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     44|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 43, False: 1]
  ------------------
  270|     43|      table.push_back(accum);
  271|       |
  272|  1.37k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 1.33k, False: 43]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  1.33k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 688, False: 645]
  ------------------
  275|    688|            table.emplace_back(table[i + j / 2].dbl());
  276|    688|         } else {
  277|    645|            table.emplace_back(table[i + j - 1] + table[i]);
  278|    645|         }
  279|  1.33k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     43|      accum = table[i + WindowElements - 1].dbl();
  284|     43|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_secp256r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp256r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     50|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 49, False: 1]
  ------------------
  270|     49|      table.push_back(accum);
  271|       |
  272|  1.56k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 1.51k, False: 49]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  1.51k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 784, False: 735]
  ------------------
  275|    784|            table.emplace_back(table[i + j / 2].dbl());
  276|    784|         } else {
  277|    735|            table.emplace_back(table[i + j - 1] + table[i]);
  278|    735|         }
  279|  1.51k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     49|      accum = table[i + WindowElements - 1].dbl();
  284|     49|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_secp384r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp384r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     74|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 73, False: 1]
  ------------------
  270|     73|      table.push_back(accum);
  271|       |
  272|  2.33k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 2.26k, False: 73]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  2.26k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 1.16k, False: 1.09k]
  ------------------
  275|  1.16k|            table.emplace_back(table[i + j / 2].dbl());
  276|  1.16k|         } else {
  277|  1.09k|            table.emplace_back(table[i + j - 1] + table[i]);
  278|  1.09k|         }
  279|  2.26k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     73|      accum = table[i + WindowElements - 1].dbl();
  284|     73|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}
pcurves_secp521r1.cpp:_ZN5Botan19basemul_booth_setupINS_6PCurve12_GLOBAL__N_19secp521r15CurveELm6EEENSt3__16vectorINT_11AffinePointENS5_9allocatorIS8_EEEERKS8_m:
  254|      1|std::vector<typename C::AffinePoint> basemul_booth_setup(const typename C::AffinePoint& p, size_t max_scalar_bits) {
  255|      1|   static_assert(WindowBits >= 1 && WindowBits <= 8);
  256|       |
  257|       |   // 2^(W-1) elements per window [1*base .. 2^(W-1)*base]
  258|      1|   constexpr size_t WindowElements = 1 << (WindowBits - 1);
  259|       |
  260|      1|   const size_t Windows = (max_scalar_bits + WindowBits - 1) / WindowBits;
  261|       |
  262|      1|   const size_t TableSize = Windows * WindowElements;
  263|       |
  264|      1|   std::vector<typename C::ProjectivePoint> table;
  265|      1|   table.reserve(TableSize);
  266|       |
  267|      1|   auto accum = C::ProjectivePoint::from_affine(p);
  268|       |
  269|     98|   for(size_t i = 0; i != TableSize; i += WindowElements) {
  ------------------
  |  Branch (269:22): [True: 97, False: 1]
  ------------------
  270|     97|      table.push_back(accum);
  271|       |
  272|  3.10k|      for(size_t j = 1; j != WindowElements; ++j) {
  ------------------
  |  Branch (272:25): [True: 3.00k, False: 97]
  ------------------
  273|       |         // Conditional ok: loop iteration count is public
  274|  3.00k|         if(j % 2 == 1) {
  ------------------
  |  Branch (274:13): [True: 1.55k, False: 1.45k]
  ------------------
  275|  1.55k|            table.emplace_back(table[i + j / 2].dbl());
  276|  1.55k|         } else {
  277|  1.45k|            table.emplace_back(table[i + j - 1] + table[i]);
  278|  1.45k|         }
  279|  3.00k|      }
  280|       |
  281|       |      // Advance to next window's base: 2^W * current_base
  282|       |      // The last entry is 2^(W-1) * base, so doubling gives 2^W * base
  283|     97|      accum = table[i + WindowElements - 1].dbl();
  284|     97|   }
  285|       |
  286|       |   // Variable time batch conversion is fine since generator is public
  287|      1|   return to_affine_batch<C, true>(table);
  288|      1|}

_ZN5Botan20solinas_correct_redcILm3ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_:
   84|  64.8k|constexpr inline void solinas_correct_redc(std::array<W, N>& r, const std::array<W, N>& P, const std::array<W, N>& C) {
   85|  64.8k|   W borrow = 0;
   86|   259k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (86:22): [True: 194k, False: 64.8k]
  ------------------
   87|   194k|      r[i] = word_sub(r[i], C[i], &borrow);
   88|   194k|   }
   89|       |
   90|       |   // borrow is either 0 or 1, perfect for setting up a mask without extra work
   91|  64.8k|   const W mask = CT::value_barrier<W>(0 - borrow);
   92|       |
   93|  64.8k|   W carry = 0;
   94|       |
   95|   259k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (95:22): [True: 194k, False: 64.8k]
  ------------------
   96|   194k|      r[i] = word_add(r[i], P[i] & mask, &carry);
   97|   194k|   }
   98|  64.8k|}
_ZN5Botan10get_uint32ITkNS_8WordTypeEmEEjPKT_m:
   33|  25.0M|constexpr uint32_t get_uint32(const W xw[], size_t i) {
   34|  25.0M|   static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
   35|       |
   36|       |   if constexpr(WordInfo<W>::bits == 32) {
   37|       |      return xw[i];
   38|  25.0M|   } else {
   39|  25.0M|      return static_cast<uint32_t>(xw[i / 2] >> ((i % 2) * 32));
   40|  25.0M|   }
   41|  25.0M|}
_ZN5Botan12SolinasAccumImLm4EEC2ERNSt3__15arrayImLm4EEE:
   50|  1.57M|      constexpr explicit SolinasAccum(std::array<W, N>& r) : m_r(r) {}
_ZN5Botan12SolinasAccumImLm4EE5accumEl:
   52|  11.1M|      constexpr void accum(int64_t v) {
   53|  11.1M|         BOTAN_DEBUG_ASSERT(m_idx < N32);
  ------------------
  |  |  130|  11.1M|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  11.1M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 11.1M]
  |  |  ------------------
  ------------------
   54|       |
   55|  11.1M|         m_S += v;
   56|  11.1M|         const uint32_t r = static_cast<uint32_t>(m_S);
   57|  11.1M|         m_S >>= 32;
   58|       |
   59|       |         if constexpr(WordInfo<W>::bits == 32) {
   60|       |            m_r[m_idx] = r;
   61|  11.1M|         } else {
   62|  11.1M|            m_r[m_idx / 2] |= static_cast<uint64_t>(r) << (32 * (m_idx % 2));
   63|  11.1M|         }
   64|       |
   65|  11.1M|         m_idx += 1;
   66|  11.1M|      }
_ZN5Botan12SolinasAccumImLm4EE11final_carryEl:
   68|  1.57M|      constexpr W final_carry(int64_t C) {
   69|  1.57M|         m_S += C;
   70|  1.57M|         BOTAN_DEBUG_ASSERT(m_S >= 0);
  ------------------
  |  |  130|  1.57M|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  1.57M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 1.57M]
  |  |  ------------------
  ------------------
   71|  1.57M|         return static_cast<W>(m_S);
   72|  1.57M|      }
_ZN5Botan20solinas_correct_redcILm4ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_:
   84|  1.57M|constexpr inline void solinas_correct_redc(std::array<W, N>& r, const std::array<W, N>& P, const std::array<W, N>& C) {
   85|  1.57M|   W borrow = 0;
   86|  7.89M|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (86:22): [True: 6.31M, False: 1.57M]
  ------------------
   87|  6.31M|      r[i] = word_sub(r[i], C[i], &borrow);
   88|  6.31M|   }
   89|       |
   90|       |   // borrow is either 0 or 1, perfect for setting up a mask without extra work
   91|  1.57M|   const W mask = CT::value_barrier<W>(0 - borrow);
   92|       |
   93|  1.57M|   W carry = 0;
   94|       |
   95|  7.89M|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (95:22): [True: 6.31M, False: 1.57M]
  ------------------
   96|  6.31M|      r[i] = word_add(r[i], P[i] & mask, &carry);
   97|  6.31M|   }
   98|  1.57M|}
_ZN5Botan12SolinasAccumImLm6EEC2ERNSt3__15arrayImLm6EEE:
   50|   110k|      constexpr explicit SolinasAccum(std::array<W, N>& r) : m_r(r) {}
_ZN5Botan12SolinasAccumImLm6EE5accumEl:
   52|  1.33M|      constexpr void accum(int64_t v) {
   53|  1.33M|         BOTAN_DEBUG_ASSERT(m_idx < N32);
  ------------------
  |  |  130|  1.33M|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  1.33M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 1.33M]
  |  |  ------------------
  ------------------
   54|       |
   55|  1.33M|         m_S += v;
   56|  1.33M|         const uint32_t r = static_cast<uint32_t>(m_S);
   57|  1.33M|         m_S >>= 32;
   58|       |
   59|       |         if constexpr(WordInfo<W>::bits == 32) {
   60|       |            m_r[m_idx] = r;
   61|  1.33M|         } else {
   62|  1.33M|            m_r[m_idx / 2] |= static_cast<uint64_t>(r) << (32 * (m_idx % 2));
   63|  1.33M|         }
   64|       |
   65|  1.33M|         m_idx += 1;
   66|  1.33M|      }
_ZN5Botan12SolinasAccumImLm6EE11final_carryEl:
   68|   110k|      constexpr W final_carry(int64_t C) {
   69|   110k|         m_S += C;
   70|   110k|         BOTAN_DEBUG_ASSERT(m_S >= 0);
  ------------------
  |  |  130|   110k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|   110k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 110k]
  |  |  ------------------
  ------------------
   71|   110k|         return static_cast<W>(m_S);
   72|   110k|      }
_ZN5Botan20solinas_correct_redcILm6ETkNS_8WordTypeEmEEvRNSt3__15arrayIT0_XT_EEERKS4_S7_:
   84|   110k|constexpr inline void solinas_correct_redc(std::array<W, N>& r, const std::array<W, N>& P, const std::array<W, N>& C) {
   85|   110k|   W borrow = 0;
   86|   775k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (86:22): [True: 665k, False: 110k]
  ------------------
   87|   665k|      r[i] = word_sub(r[i], C[i], &borrow);
   88|   665k|   }
   89|       |
   90|       |   // borrow is either 0 or 1, perfect for setting up a mask without extra work
   91|   110k|   const W mask = CT::value_barrier<W>(0 - borrow);
   92|       |
   93|   110k|   W carry = 0;
   94|       |
   95|   775k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (95:22): [True: 665k, False: 110k]
  ------------------
   96|   665k|      r[i] = word_add(r[i], P[i] & mask, &carry);
   97|   665k|   }
   98|   110k|}

_ZN5Botan10monty_redcITkNS_8WordTypeEmLm4EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_:
  110|   149k|   -> std::array<W, N> {
  111|   149k|   static_assert(N >= 1);
  112|       |
  113|   149k|   std::array<W, N> ws;  // NOLINT(*-member-init)
  114|   149k|   std::array<W, N> r;   // NOLINT(*-member-init)
  115|       |
  116|       |   // Conditional ok: the parameter size is public
  117|   149k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (117:7): [True: 149k, Folded]
  ------------------
  118|       |      // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words
  119|   149k|      if constexpr(N == 4) {
  120|   149k|         bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data());
  121|   149k|         return r;
  122|       |      } else if constexpr(N == 6) {
  123|       |         bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data());
  124|       |         return r;
  125|       |      } else if constexpr(N == 8) {
  126|       |         bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data());
  127|       |         return r;
  128|       |      } else if constexpr(N == 12) {
  129|       |         bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data());
  130|       |         return r;
  131|       |      } else if constexpr(N == 16) {
  132|       |         bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data());
  133|       |         return r;
  134|       |      }
  135|   149k|   }
  136|       |
  137|      0|   word3<W> accum;
  138|       |
  139|   149k|   accum.add(z[0]);
  140|       |
  141|   149k|   ws[0] = accum.monty_step(p[0], p_dash);
  142|       |
  143|   149k|   for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (143:22): [True: 0, False: 149k]
  ------------------
  144|      0|      for(size_t j = 0; j < i; ++j) {
  ------------------
  |  Branch (144:25): [True: 0, False: 0]
  ------------------
  145|      0|         accum.mul(ws[j], p[i - j]);
  146|      0|      }
  147|       |
  148|      0|      accum.add(z[i]);
  149|       |
  150|      0|      ws[i] = accum.monty_step(p[0], p_dash);
  151|      0|   }
  152|       |
  153|   149k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (153:22): [True: 0, False: 149k]
  ------------------
  154|      0|      for(size_t j = i + 1; j != N; ++j) {
  ------------------
  |  Branch (154:29): [True: 0, False: 0]
  ------------------
  155|      0|         accum.mul(ws[j], p[N + i - j]);
  156|      0|      }
  157|       |
  158|      0|      accum.add(z[N + i]);
  159|       |
  160|      0|      ws[i] = accum.extract();
  161|      0|   }
  162|       |
  163|   149k|   accum.add(z[2 * N - 1]);
  164|       |
  165|   149k|   ws[N - 1] = accum.extract();
  166|       |   // w1 is the final part, which is not stored in the workspace
  167|   149k|   const W w1 = accum.extract();
  168|       |
  169|   149k|   bigint_monty_maybe_sub<N>(r.data(), w1, ws.data(), p.data());
  170|       |
  171|   149k|   return r;
  172|   149k|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm32EEEDaNSt3__14spanIKhXT1_EEE:
  287|  1.11k|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|  1.11k|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|  1.11k|   std::array<W, N> r = {};
  291|       |
  292|  1.11k|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|  1.11k|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|  1.11k|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  5.56k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 4.44k, False: 1.11k]
  ------------------
  298|  4.44k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  4.44k|   }
  300|       |
  301|       |   if constexpr(extra_bytes > 0) {
  302|       |      constexpr size_t shift = extra_bytes * 8;
  303|       |      shift_left<shift>(r);
  304|       |
  305|       |      for(size_t i = 0; i != extra_bytes; ++i) {
  306|       |         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|       |         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|       |      }
  309|       |   }
  310|       |
  311|  1.11k|   return r;
  312|  1.11k|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm8ELm64EEEDaNSt3__14spanIKhXT1_EEE:
  287|    373|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|    373|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|    373|   std::array<W, N> r = {};
  291|       |
  292|    373|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|    373|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|    373|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  3.35k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 2.98k, False: 373]
  ------------------
  298|  2.98k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  2.98k|   }
  300|       |
  301|       |   if constexpr(extra_bytes > 0) {
  302|       |      constexpr size_t shift = extra_bytes * 8;
  303|       |      shift_left<shift>(r);
  304|       |
  305|       |      for(size_t i = 0; i != extra_bytes; ++i) {
  306|       |         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|       |         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|       |      }
  309|       |   }
  310|       |
  311|    373|   return r;
  312|    373|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm6ELm48EEEDaNSt3__14spanIKhXT1_EEE:
  287|    289|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|    289|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|    289|   std::array<W, N> r = {};
  291|       |
  292|    289|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|    289|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|    289|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  2.02k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 1.73k, False: 289]
  ------------------
  298|  1.73k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  1.73k|   }
  300|       |
  301|       |   if constexpr(extra_bytes > 0) {
  302|       |      constexpr size_t shift = extra_bytes * 8;
  303|       |      shift_left<shift>(r);
  304|       |
  305|       |      for(size_t i = 0; i != extra_bytes; ++i) {
  306|       |         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|       |         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|       |      }
  309|       |   }
  310|       |
  311|    289|   return r;
  312|    289|}
_ZN5Botan10monty_redcITkNS_8WordTypeEmLm8EEENSt3__15arrayIT_XT0_EEERKNS2_IS3_XmlLi2ET0_EEERKS4_S3_:
  110|   214k|   -> std::array<W, N> {
  111|   214k|   static_assert(N >= 1);
  112|       |
  113|   214k|   std::array<W, N> ws;  // NOLINT(*-member-init)
  114|   214k|   std::array<W, N> r;   // NOLINT(*-member-init)
  115|       |
  116|       |   // Conditional ok: the parameter size is public
  117|   214k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (117:7): [True: 214k, Folded]
  ------------------
  118|       |      // This range ensures we cover fields of 256, 384 and 512 bits for both 32 and 64 bit words
  119|       |      if constexpr(N == 4) {
  120|       |         bigint_monty_redc_4(r.data(), z.data(), p.data(), p_dash, ws.data());
  121|       |         return r;
  122|       |      } else if constexpr(N == 6) {
  123|       |         bigint_monty_redc_6(r.data(), z.data(), p.data(), p_dash, ws.data());
  124|       |         return r;
  125|   214k|      } else if constexpr(N == 8) {
  126|   214k|         bigint_monty_redc_8(r.data(), z.data(), p.data(), p_dash, ws.data());
  127|   214k|         return r;
  128|       |      } else if constexpr(N == 12) {
  129|       |         bigint_monty_redc_12(r.data(), z.data(), p.data(), p_dash, ws.data());
  130|       |         return r;
  131|       |      } else if constexpr(N == 16) {
  132|       |         bigint_monty_redc_16(r.data(), z.data(), p.data(), p_dash, ws.data());
  133|       |         return r;
  134|       |      }
  135|   214k|   }
  136|       |
  137|      0|   word3<W> accum;
  138|       |
  139|   214k|   accum.add(z[0]);
  140|       |
  141|   214k|   ws[0] = accum.monty_step(p[0], p_dash);
  142|       |
  143|   214k|   for(size_t i = 1; i != N; ++i) {
  ------------------
  |  Branch (143:22): [True: 0, False: 214k]
  ------------------
  144|      0|      for(size_t j = 0; j < i; ++j) {
  ------------------
  |  Branch (144:25): [True: 0, False: 0]
  ------------------
  145|      0|         accum.mul(ws[j], p[i - j]);
  146|      0|      }
  147|       |
  148|      0|      accum.add(z[i]);
  149|       |
  150|      0|      ws[i] = accum.monty_step(p[0], p_dash);
  151|      0|   }
  152|       |
  153|   214k|   for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (153:22): [True: 0, False: 214k]
  ------------------
  154|      0|      for(size_t j = i + 1; j != N; ++j) {
  ------------------
  |  Branch (154:29): [True: 0, False: 0]
  ------------------
  155|      0|         accum.mul(ws[j], p[N + i - j]);
  156|      0|      }
  157|       |
  158|      0|      accum.add(z[N + i]);
  159|       |
  160|      0|      ws[i] = accum.extract();
  161|      0|   }
  162|       |
  163|   214k|   accum.add(z[2 * N - 1]);
  164|       |
  165|   214k|   ws[N - 1] = accum.extract();
  166|       |   // w1 is the final part, which is not stored in the workspace
  167|   214k|   const W w1 = accum.extract();
  168|       |
  169|   214k|   bigint_monty_maybe_sub<N>(r.data(), w1, ws.data(), p.data());
  170|       |
  171|   214k|   return r;
  172|   214k|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm3ELm24EEEDaNSt3__14spanIKhXT1_EEE:
  287|    345|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|    345|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|    345|   std::array<W, N> r = {};
  291|       |
  292|    345|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|    345|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|    345|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  1.38k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 1.03k, False: 345]
  ------------------
  298|  1.03k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  1.03k|   }
  300|       |
  301|       |   if constexpr(extra_bytes > 0) {
  302|       |      constexpr size_t shift = extra_bytes * 8;
  303|       |      shift_left<shift>(r);
  304|       |
  305|       |      for(size_t i = 0; i != extra_bytes; ++i) {
  306|       |         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|       |         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|       |      }
  309|       |   }
  310|       |
  311|    345|   return r;
  312|    345|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm4ELm28EEEDaNSt3__14spanIKhXT1_EEE:
  287|    449|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|    449|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|    449|   std::array<W, N> r = {};
  291|       |
  292|    449|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|    449|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|    449|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  1.79k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 1.34k, False: 449]
  ------------------
  298|  1.34k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  1.34k|   }
  300|       |
  301|    449|   if constexpr(extra_bytes > 0) {
  302|    449|      constexpr size_t shift = extra_bytes * 8;
  303|    449|      shift_left<shift>(r);
  304|       |
  305|  2.24k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (305:25): [True: 1.79k, False: 449]
  ------------------
  306|  1.79k|         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|  1.79k|         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|  1.79k|      }
  309|    449|   }
  310|       |
  311|    449|   return r;
  312|    449|}
_ZN5Botan14bytes_to_wordsITkNS_8WordTypeEmLm9ELm66EEEDaNSt3__14spanIKhXT1_EEE:
  287|    660|inline constexpr auto bytes_to_words(std::span<const uint8_t, L> bytes) {
  288|    660|   static_assert(L <= WordInfo<W>::bytes * N);
  289|       |
  290|    660|   std::array<W, N> r = {};
  291|       |
  292|    660|   constexpr size_t full_words = L / WordInfo<W>::bytes;
  293|    660|   constexpr size_t extra_bytes = L % WordInfo<W>::bytes;
  294|       |
  295|    660|   static_assert(full_words + (extra_bytes ? 1 : 0) <= N);
  296|       |
  297|  5.94k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (297:22): [True: 5.28k, False: 660]
  ------------------
  298|  5.28k|      r[i] = load_be<W>(bytes.data(), full_words - 1 - i);
  299|  5.28k|   }
  300|       |
  301|    660|   if constexpr(extra_bytes > 0) {
  302|    660|      constexpr size_t shift = extra_bytes * 8;
  303|    660|      shift_left<shift>(r);
  304|       |
  305|  1.98k|      for(size_t i = 0; i != extra_bytes; ++i) {
  ------------------
  |  Branch (305:25): [True: 1.32k, False: 660]
  ------------------
  306|  1.32k|         const W b0 = bytes[WordInfo<W>::bytes * full_words + i];
  307|  1.32k|         r[0] |= (b0 << (8 * (extra_bytes - 1 - i)));
  308|  1.32k|      }
  309|    660|   }
  310|       |
  311|    660|   return r;
  312|    660|}

pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE8instanceEv:
  338|    645|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    645|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    645|         return g_curve;
  341|    645|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE19field_element_bytesEv:
   36|    214|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    429|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    429|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 429]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    429|         auto x = C::FieldElement::from_stash(pt._x());
  366|    429|         auto y = C::FieldElement::from_stash(pt._y());
  367|    429|         return typename C::AffinePoint(x, y);
  368|    429|      }
pcurves_brainpool256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    215|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    215|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    215|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    215|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    215|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 331, False: 1.73k]
  |  Branch (253:50): [True: 84, False: 247]
  ------------------
  254|     84|            const auto encoded_point = bytes.subspan(1);
  255|     84|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     84|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     84|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 79, False: 5]
  |  Branch (258:21): [True: 71, False: 8]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     71|               const auto lhs = (*y).square();
  261|     71|               const auto rhs = C::x3_ax_b(*x);
  262|     71|               const auto valid = (lhs == rhs);
  263|     71|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 71]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     71|            }
  267|  1.98k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 398, False: 1.58k]
  |  Branch (267:56): [True: 263, False: 135]
  |  Branch (267:76): [True: 125, False: 10]
  ------------------
  268|    388|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    388|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 360, False: 28]
  ------------------
  271|    360|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 214, False: 146]
  ------------------
  272|    214|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    214|               }
  274|    360|            }
  275|    388|         }
  276|       |
  277|  1.85k|         return {};
  278|  2.07k|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    215|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    215|         return from_stash(pt).is_identity().as_bool();
  212|    215|      }
pcurves_brainpool256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    214|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    214|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    214|   do {                                                          \
  |  |   36|    214|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    214|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 214]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    214|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 214]
  |  |  ------------------
  ------------------
  216|    214|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    214|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE8instanceEv:
  338|    477|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    477|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    477|         return g_curve;
  341|    477|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE19field_element_bytesEv:
   36|    158|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    317|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    317|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 317]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    317|         auto x = C::FieldElement::from_stash(pt._x());
  366|    317|         auto y = C::FieldElement::from_stash(pt._y());
  367|    317|         return typename C::AffinePoint(x, y);
  368|    317|      }
pcurves_brainpool512r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS_13MontgomeryRepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    159|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    159|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    159|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    159|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    159|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 74, False: 1.99k]
  |  Branch (253:50): [True: 67, False: 7]
  ------------------
  254|     67|            const auto encoded_point = bytes.subspan(1);
  255|     67|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     67|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     67|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 65, False: 2]
  |  Branch (258:21): [True: 64, False: 1]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     64|               const auto lhs = (*y).square();
  261|     64|               const auto rhs = C::x3_ax_b(*x);
  262|     64|               const auto valid = (lhs == rhs);
  263|     64|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 64]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     64|            }
  267|  2.00k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 331, False: 1.67k]
  |  Branch (267:56): [True: 130, False: 201]
  |  Branch (267:76): [True: 109, False: 92]
  ------------------
  268|    239|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    239|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 238, False: 1]
  ------------------
  271|    238|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 158, False: 80]
  ------------------
  272|    158|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    158|               }
  274|    238|            }
  275|    239|         }
  276|       |
  277|  1.91k|         return {};
  278|  2.07k|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    159|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    159|         return from_stash(pt).is_identity().as_bool();
  212|    159|      }
pcurves_brainpool512r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_114brainpool512r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    158|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    158|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    158|   do {                                                          \
  |  |   36|    158|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    158|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 158]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    158|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 158]
  |  |  ------------------
  ------------------
  216|    158|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    158|      }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE8instanceEv:
  338|    531|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    531|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    531|         return g_curve;
  341|    531|      }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE19field_element_bytesEv:
   36|    176|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    353|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    353|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 353]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    353|         auto x = C::FieldElement::from_stash(pt._x());
  366|    353|         auto y = C::FieldElement::from_stash(pt._y());
  367|    353|         return typename C::AffinePoint(x, y);
  368|    353|      }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_12Secp192r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    177|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    177|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    177|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    177|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    177|      }
pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 261, False: 1.80k]
  |  Branch (253:50): [True: 82, False: 179]
  ------------------
  254|     82|            const auto encoded_point = bytes.subspan(1);
  255|     82|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     82|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     82|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 81, False: 1]
  |  Branch (258:21): [True: 80, False: 1]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     80|               const auto lhs = (*y).square();
  261|     80|               const auto rhs = C::x3_ax_b(*x);
  262|     80|               const auto valid = (lhs == rhs);
  263|     80|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 80]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     80|            }
  267|  1.98k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 192, False: 1.79k]
  |  Branch (267:56): [True: 126, False: 66]
  |  Branch (267:76): [True: 55, False: 11]
  ------------------
  268|    181|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    181|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 179, False: 2]
  ------------------
  271|    179|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 176, False: 3]
  ------------------
  272|    176|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    176|               }
  274|    179|            }
  275|    181|         }
  276|       |
  277|  1.89k|         return {};
  278|  2.07k|      }
pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    177|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    177|         return from_stash(pt).is_identity().as_bool();
  212|    177|      }
pcurves_secp192r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp192r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    176|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    176|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    176|   do {                                                          \
  |  |   36|    176|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    176|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 176]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    176|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 176]
  |  |  ------------------
  ------------------
  216|    176|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    176|      }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE8instanceEv:
  338|    579|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    579|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    579|         return g_curve;
  341|    579|      }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE19field_element_bytesEv:
   36|    192|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    385|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    385|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 385]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    385|         auto x = C::FieldElement::from_stash(pt._x());
  366|    385|         auto y = C::FieldElement::from_stash(pt._y());
  367|    385|         return typename C::AffinePoint(x, y);
  368|    385|      }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_12Secp224r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    193|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    193|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    193|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    193|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    193|      }
pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 89, False: 1.98k]
  |  Branch (253:50): [True: 82, False: 7]
  ------------------
  254|     82|            const auto encoded_point = bytes.subspan(1);
  255|     82|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     82|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     82|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 81, False: 1]
  |  Branch (258:21): [True: 80, False: 1]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     80|               const auto lhs = (*y).square();
  261|     80|               const auto rhs = C::x3_ax_b(*x);
  262|     80|               const auto valid = (lhs == rhs);
  263|     80|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 80]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     80|            }
  267|  1.98k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 295, False: 1.69k]
  |  Branch (267:56): [True: 182, False: 113]
  |  Branch (267:76): [True: 103, False: 10]
  ------------------
  268|    285|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    285|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 283, False: 2]
  ------------------
  271|    283|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 192, False: 91]
  ------------------
  272|    192|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    192|               }
  274|    283|            }
  275|    285|         }
  276|       |
  277|  1.87k|         return {};
  278|  2.07k|      }
pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    193|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    193|         return from_stash(pt).is_identity().as_bool();
  212|    193|      }
pcurves_secp224r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp224r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    192|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    192|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    192|   do {                                                          \
  |  |   36|    192|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    192|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 192]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    192|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 192]
  |  |  ------------------
  ------------------
  216|    192|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    192|      }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE8instanceEv:
  338|    849|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    849|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    849|         return g_curve;
  341|    849|      }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE19field_element_bytesEv:
   36|    282|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    565|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    565|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 565]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    565|         auto x = C::FieldElement::from_stash(pt._x());
  366|    565|         auto y = C::FieldElement::from_stash(pt._y());
  367|    565|         return typename C::AffinePoint(x, y);
  368|    565|      }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_12Secp256r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    283|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    283|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    283|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    283|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    283|      }
pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 331, False: 1.73k]
  |  Branch (253:50): [True: 84, False: 247]
  ------------------
  254|     84|            const auto encoded_point = bytes.subspan(1);
  255|     84|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     84|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     84|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 83, False: 1]
  |  Branch (258:21): [True: 82, False: 1]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     82|               const auto lhs = (*y).square();
  261|     82|               const auto rhs = C::x3_ax_b(*x);
  262|     82|               const auto valid = (lhs == rhs);
  263|     82|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 82]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     82|            }
  267|  1.98k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 398, False: 1.58k]
  |  Branch (267:56): [True: 263, False: 135]
  |  Branch (267:76): [True: 125, False: 10]
  ------------------
  268|    388|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    388|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 386, False: 2]
  ------------------
  271|    386|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 282, False: 104]
  ------------------
  272|    282|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    282|               }
  274|    386|            }
  275|    388|         }
  276|       |
  277|  1.78k|         return {};
  278|  2.07k|      }
pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    283|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    283|         return from_stash(pt).is_identity().as_bool();
  212|    283|      }
pcurves_secp256r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp256r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    282|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    282|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    282|   do {                                                          \
  |  |   36|    282|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    282|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 282]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    282|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 282]
  |  |  ------------------
  ------------------
  216|    282|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    282|      }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE8instanceEv:
  338|    501|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    501|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    501|         return g_curve;
  341|    501|      }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE19field_element_bytesEv:
   36|    166|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    333|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    333|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 333]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    333|         auto x = C::FieldElement::from_stash(pt._x());
  366|    333|         auto y = C::FieldElement::from_stash(pt._y());
  367|    333|         return typename C::AffinePoint(x, y);
  368|    333|      }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS2_12Secp384r1RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    167|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    167|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    167|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    167|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    167|      }
pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  2.07k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  2.07k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 10, False: 2.06k]
  |  Branch (245:34): [True: 1, False: 9]
  ------------------
  246|      1|            return stash(C::AffinePoint::identity());
  247|      1|         }
  248|       |
  249|  2.07k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  2.07k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  2.07k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  2.07k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 68, False: 2.00k]
  |  Branch (253:50): [True: 60, False: 8]
  ------------------
  254|     60|            const auto encoded_point = bytes.subspan(1);
  255|     60|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|     60|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|     60|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 59, False: 1]
  |  Branch (258:21): [True: 58, False: 1]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|     58|               const auto lhs = (*y).square();
  261|     58|               const auto rhs = C::x3_ax_b(*x);
  262|     58|               const auto valid = (lhs == rhs);
  263|     58|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 58]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|     58|            }
  267|  2.01k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 261, False: 1.74k]
  |  Branch (267:56): [True: 113, False: 148]
  |  Branch (267:76): [True: 56, False: 92]
  ------------------
  268|    169|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    169|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 168, False: 1]
  ------------------
  271|    168|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 166, False: 2]
  ------------------
  272|    166|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    166|               }
  274|    168|            }
  275|    169|         }
  276|       |
  277|  1.90k|         return {};
  278|  2.07k|      }
pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    167|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    167|         return from_stash(pt).is_identity().as_bool();
  212|    167|      }
pcurves_secp384r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp384r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    166|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    166|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    166|   do {                                                          \
  |  |   36|    166|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    166|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 166]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    166|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 166]
  |  |  ------------------
  ------------------
  216|    166|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    166|      }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE8instanceEv:
  338|    977|      static std::shared_ptr<const PrimeOrderCurve> instance() {
  339|    977|         static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
  340|    977|         return g_curve;
  341|    977|      }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEEC2Ev:
  336|      1|      PrimeOrderCurveImpl() : m_mul_by_g(C::G) {}
pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE19field_element_bytesEv:
   36|    324|      size_t field_element_bytes() const override { return C::FieldElement::BYTES; }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE10from_stashERKNS0_15PrimeOrderCurve11AffinePointE:
  361|    650|      static typename C::AffinePoint from_stash(const AffinePoint& pt) {
  362|    650|         if(pt._curve() != instance()) {
  ------------------
  |  Branch (362:13): [True: 0, False: 650]
  ------------------
  363|      0|            throw Invalid_Argument("Curve mismatch");
  364|      0|         }
  365|    650|         auto x = C::FieldElement::from_stash(pt._x());
  366|    650|         auto y = C::FieldElement::from_stash(pt._y());
  367|    650|         return typename C::AffinePoint(x, y);
  368|    650|      }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE5stashERKNS_16AffineCurvePointINS_6IntModINS3_7P521RepINS_13EllipticCurveINS3_6ParamsES8_E11FieldParamsEEEEEEE:
  355|    326|      static AffinePoint stash(const typename C::AffinePoint& pt) {
  356|    326|         auto x_w = pt.x().template stash_value<StorageWords>();
  357|    326|         auto y_w = pt.y().template stash_value<StorageWords>();
  358|    326|         return AffinePoint::_create(instance(), x_w, y_w);
  359|    326|      }
pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE17deserialize_pointENSt3__14spanIKhLm18446744073709551615EEE:
  242|  4.14k|      std::optional<AffinePoint> deserialize_point(std::span<const uint8_t> bytes) const override {
  243|       |         // The identity element (see SEC1 section 2.3.4)
  244|       |         // TODO(Botan4) remove this - we should reject the identity encoding
  245|  4.14k|         if(bytes.size() == 1 && bytes[0] == 0x00) {
  ------------------
  |  Branch (245:13): [True: 20, False: 4.12k]
  |  Branch (245:34): [True: 2, False: 18]
  ------------------
  246|      2|            return stash(C::AffinePoint::identity());
  247|      2|         }
  248|       |
  249|  4.14k|         constexpr size_t FieldElementBytes = C::FieldElement::BYTES;
  250|  4.14k|         constexpr size_t CompressedBytes = C::FieldElement::BYTES + 1;
  251|  4.14k|         constexpr size_t UncompressedBytes = 2 * C::FieldElement::BYTES + 1;
  252|       |
  253|  4.14k|         if(bytes.size() == UncompressedBytes && bytes[0] == 0x04) {
  ------------------
  |  Branch (253:13): [True: 152, False: 3.98k]
  |  Branch (253:50): [True: 138, False: 14]
  ------------------
  254|    138|            const auto encoded_point = bytes.subspan(1);
  255|    138|            auto x = C::FieldElement::deserialize(encoded_point.first(FieldElementBytes));
  256|    138|            auto y = C::FieldElement::deserialize(encoded_point.last(FieldElementBytes));
  257|       |
  258|    138|            if(x && y) {
  ------------------
  |  Branch (258:16): [True: 134, False: 4]
  |  Branch (258:21): [True: 132, False: 2]
  ------------------
  259|       |               // Check that y^2 = x^3 + ax + b
  260|    132|               const auto lhs = (*y).square();
  261|    132|               const auto rhs = C::x3_ax_b(*x);
  262|    132|               const auto valid = (lhs == rhs);
  263|    132|               if(valid.as_bool()) {
  ------------------
  |  Branch (263:19): [True: 0, False: 132]
  ------------------
  264|      0|                  return stash(typename C::AffinePoint(*x, *y));
  265|      0|               }
  266|    132|            }
  267|  4.00k|         } else if(bytes.size() == CompressedBytes && (bytes[0] == 0x02 || bytes[0] == 0x03)) {
  ------------------
  |  Branch (267:20): [True: 404, False: 3.59k]
  |  Branch (267:56): [True: 212, False: 192]
  |  Branch (267:76): [True: 172, False: 20]
  ------------------
  268|    384|            const CT::Choice y_is_even = CT::Mask<uint8_t>::is_equal(bytes[0], 0x02).as_choice();
  269|       |
  270|    384|            if(auto x = C::FieldElement::deserialize(bytes.subspan(1, FieldElementBytes))) {
  ------------------
  |  Branch (270:21): [True: 374, False: 10]
  ------------------
  271|    374|               if(auto y = sqrt_field_element<C>(C::x3_ax_b(*x)).as_optional_vartime()) {
  ------------------
  |  Branch (271:24): [True: 324, False: 50]
  ------------------
  272|    324|                  return stash(typename C::AffinePoint(*x, y->correct_sign(y_is_even)));
  273|    324|               }
  274|    374|            }
  275|    384|         }
  276|       |
  277|  3.81k|         return {};
  278|  4.14k|      }
pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE24affine_point_is_identityERKNS0_15PrimeOrderCurve11AffinePointE:
  210|    326|      bool affine_point_is_identity(const AffinePoint& pt) const override {
  211|    326|         return from_stash(pt).is_identity().as_bool();
  212|    326|      }
pcurves_secp521r1.cpp:_ZNK5Botan6PCurve19PrimeOrderCurveImplINS0_12_GLOBAL__N_19secp521r15CurveEE15serialize_pointENSt3__14spanIhLm18446744073709551615EEERKNS0_15PrimeOrderCurve11AffinePointE:
  214|    324|      void serialize_point(std::span<uint8_t> bytes, const AffinePoint& pt) const override {
  215|    324|         BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
  ------------------
  |  |   35|    324|   do {                                                          \
  |  |   36|    324|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    324|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 324]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    324|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 324]
  |  |  ------------------
  ------------------
  216|    324|         from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
  217|    324|      }

_ZN5Botan8round_upEmm:
   26|     42|constexpr inline size_t round_up(size_t n, size_t align_to) {
   27|       |   // Arguably returning n in this case would also be sensible
   28|     42|   BOTAN_ARG_CHECK(align_to != 0, "align_to must not be 0");
  ------------------
  |  |   35|     42|   do {                                                          \
  |  |   36|     42|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     42|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 42]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     42|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 42]
  |  |  ------------------
  ------------------
   29|       |
   30|     42|   if(n % align_to > 0) {
  ------------------
  |  Branch (30:7): [True: 36, False: 6]
  ------------------
   31|     36|      const size_t adj = align_to - (n % align_to);
   32|     36|      BOTAN_ARG_CHECK(n + adj >= n, "Integer overflow during rounding");
  ------------------
  |  |   35|     36|   do {                                                          \
  |  |   36|     36|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     36|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 36]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     36|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 36]
  |  |  ------------------
  ------------------
   33|     36|      n += adj;
   34|     36|   }
   35|     42|   return n;
   36|     42|}

_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  10.1k|constexpr inline T value_barrier(T x) {
   44|  10.1k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 10.1k]
  ------------------
   45|      0|      return x;
   46|  10.1k|   } else {
   47|  10.1k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  10.1k|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  10.1k|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  10.1k|   }
   64|  10.1k|}
_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  6.71M|constexpr inline T value_barrier(T x) {
   44|  6.71M|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 6.71M]
  ------------------
   45|      0|      return x;
   46|  6.71M|   } else {
   47|  6.71M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  6.71M|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  6.71M|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  6.71M|   }
   64|  6.71M|}
_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEjQntsr3stdE7same_asIbT_EEES3_S3_:
   43|     35|constexpr inline T value_barrier(T x) {
   44|     35|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 35]
  ------------------
   45|      0|      return x;
   46|     35|   } else {
   47|     35|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|     35|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|     35|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|     35|   }
   64|     35|}

_ZN5Botan21Allocator_InitializerC2Ev:
   50|      1|      Allocator_Initializer() { initialize_allocator(); }

_ZNK5Botan3OID5emptyEv:
  265|     21|      bool empty() const { return m_id.empty(); }
_ZNK5Botan3OID9has_valueEv:
  271|     14|      bool has_value() const { return !empty(); }
_ZNK5Botan3OIDeqERKS0_:
  301|     93|      bool operator==(const OID& other) const { return m_id == other.m_id; }
_ZN5BotanneERKNS_3OIDES2_:
  342|      7|inline bool operator!=(const OID& a, const OID& b) {
  343|      7|   return !(a == b);
  344|      7|}
_ZNKSt3__14hashIN5Botan3OIDEEclERKS2_:
  441|      4|      size_t operator()(const Botan::OID& oid) const noexcept { return static_cast<size_t>(oid.hash_code()); }
_ZN5Botan11ASN1_ObjectC2Ev:
  117|     94|      ASN1_Object() = default;
_ZN5Botan11ASN1_ObjectD2Ev:
  122|    166|      virtual ~ASN1_Object() = default;
_ZN5Botan11ASN1_ObjectC2ERKS0_:
  118|     36|      ASN1_Object(const ASN1_Object&) = default;
_ZN5Botan11ASN1_ObjectC2EOS0_:
  120|     36|      ASN1_Object(ASN1_Object&&) = default;

_ZN5Botan13ignore_paramsIJPKhmEEEvDpRKT_:
  142|  2.03k|constexpr void ignore_params([[maybe_unused]] const T&... args) {}
_ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_:
  142|  81.3k|constexpr void ignore_params([[maybe_unused]] const T&... args) {}

_ZN5Botan6BigInt4zeroEv:
   50|     21|      static BigInt zero() { return BigInt(); }
_ZN5Botan6BigIntC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   98|     42|      explicit BigInt(std::string_view str) { *this = BigInt::from_string(str); }
_ZN5Botan6BigIntC2EOS0_:
  183|     35|      BigInt(BigInt&& other) noexcept { this->swap(other); }
_ZN5Botan6BigIntD2Ev:
  185|    542|      ~BigInt() { _const_time_unpoison(); }
_ZN5Botan6BigIntaSEOS0_:
  190|     77|      BigInt& operator=(BigInt&& other) noexcept {
  191|     77|         if(this != &other) {
  ------------------
  |  Branch (191:13): [True: 77, False: 0]
  ------------------
  192|     77|            this->swap(other);
  193|     77|         }
  194|       |
  195|     77|         return (*this);
  196|     77|      }
_ZN5Botan6BigInt4swapERS0_:
  207|    133|      void swap(BigInt& other) noexcept {
  208|    133|         m_data.swap(other.m_data);
  209|    133|         std::swap(m_signedness, other.m_signedness);
  210|    133|      }
_ZN5Botan6BigInt3subEPKmmNS0_4SignE:
  332|    101|      BigInt& sub(const word y[], size_t y_words, Sign sign) {
  333|    101|         return add(y, y_words, sign == Positive ? Negative : Positive);
  ------------------
  |  Branch (333:33): [True: 101, False: 0]
  ------------------
  334|    101|      }
_ZN5Botan6BigInt5clearEv:
  415|     42|      void clear() {
  416|     42|         m_data.set_to_zero();
  417|     42|         m_signedness = Positive;
  418|     42|      }
_ZNK5Botan6BigInt7is_evenEv:
  455|      7|      bool is_even() const { return !get_bit(0); }
_ZNK5Botan6BigInt6signumEv:
  467|    395|      int signum() const {
  468|    395|         if(sig_words() == 0) {
  ------------------
  |  Branch (468:13): [True: 0, False: 395]
  ------------------
  469|      0|            return 0;
  470|      0|         }
  471|    395|         return (sign() == Negative) ? -1 : 1;
  ------------------
  |  Branch (471:17): [True: 0, False: 395]
  ------------------
  472|    395|      }
_ZNK5Botan6BigInt7is_zeroEv:
  484|     28|      bool is_zero() const { return sig_words() == 0; }
_ZN5Botan6BigInt7set_bitEm:
  490|     28|      void set_bit(size_t n) { conditionally_set_bit(n, true); }
_ZN5Botan6BigInt21conditionally_set_bitEmb:
  500|     28|      void conditionally_set_bit(size_t n, bool set_it) {
  501|     28|         const size_t which = n / (sizeof(word) * 8);
  502|     28|         const word mask = static_cast<word>(set_it) << (n % (sizeof(word) * 8));
  503|     28|         m_data.set_word_at(which, word_at(which) | mask);
  504|     28|      }
_ZNK5Botan6BigInt7get_bitEm:
  523|      7|      bool get_bit(size_t n) const { return ((word_at(n / (sizeof(word) * 8)) >> (n % (sizeof(word) * 8))) & 1) == 1; }
_ZNK5Botan6BigInt7word_atEm:
  574|    545|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZNK5Botan6BigInt4signEv:
  604|    782|      Sign sign() const { return (m_signedness); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  625|    164|      void set_sign(Sign sign) {
  626|    164|         if(sign == Negative && is_zero()) {
  ------------------
  |  Branch (626:13): [True: 0, False: 164]
  |  Branch (626:33): [True: 0, False: 0]
  ------------------
  627|      0|            sign = Positive;
  628|      0|         }
  629|       |
  630|    164|         m_signedness = sign;
  631|    164|      }
_ZNK5Botan6BigInt4sizeEv:
  642|    567|      size_t size() const { return m_data.size(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  648|  1.30k|      size_t sig_words() const { return m_data.sig_words(); }
_ZN5Botan6BigInt12mutable_dataEv:
  673|    300|      BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); }
_ZNK5Botan6BigInt4dataEv:
  679|     14|      BOTAN_DEPRECATED("Deprecated no replacement") const word* data() const { return m_data.const_data(); }
_ZNK5Botan6BigInt7grow_toEm:
  699|    320|      BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); }
_ZN5Botan6BigInt10power_of_2Em:
  856|      7|      static BigInt power_of_2(size_t n) {
  857|      7|         BigInt b;
  858|      7|         b.set_bit(n);
  859|      7|         return b;
  860|      7|      }
_ZNK5Botan6BigInt8_as_spanEv:
  962|     14|      std::span<const word> _as_span() const { return m_data.const_span(); }
_ZNK5Botan6BigInt5_dataEv:
  972|    947|      const word* _data() const { return m_data.const_data(); }
_ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  991|     56|      static BigInt _from_words(secure_vector<word>& words) {
  992|     56|         BigInt bn;
  993|     56|         bn.m_data.swap(words);
  994|     56|         return bn;
  995|     56|      }
_ZN5Botan6BigInt4Data12mutable_dataEv:
 1022|    441|            word* mutable_data() {
 1023|    441|               invalidate_sig_words();
 1024|    441|               return m_reg.data();
 1025|    441|            }
_ZNK5Botan6BigInt4Data10const_dataEv:
 1027|  1.50k|            const word* const_data() const { return m_reg.data(); }
_ZNK5Botan6BigInt4Data10const_spanEv:
 1029|     14|            std::span<const word> const_span() const { return std::span{m_reg}; }
_ZNK5Botan6BigInt4Data11get_word_atEm:
 1038|    545|            word get_word_at(size_t n) const {
 1039|    545|               if(n < m_reg.size()) {
  ------------------
  |  Branch (1039:19): [True: 517, False: 28]
  ------------------
 1040|    517|                  return m_reg[n];
 1041|    517|               }
 1042|     28|               return 0;
 1043|    545|            }
_ZN5Botan6BigInt4Data11set_word_atEmm:
 1045|     35|            void set_word_at(size_t i, word w) {
 1046|     35|               invalidate_sig_words();
 1047|     35|               if(i >= m_reg.size()) {
  ------------------
  |  Branch (1047:19): [True: 35, False: 0]
  ------------------
 1048|     35|                  if(w == 0) {
  ------------------
  |  Branch (1048:22): [True: 0, False: 35]
  ------------------
 1049|      0|                     return;
 1050|      0|                  }
 1051|     35|                  grow_to(i + 1);
 1052|     35|               }
 1053|     35|               m_reg[i] = w;
 1054|     35|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
 1065|    361|            void grow_to(size_t n) const {
 1066|    361|               if(n > size()) {
  ------------------
  |  Branch (1066:19): [True: 238, False: 123]
  ------------------
 1067|    238|                  if(n <= m_reg.capacity()) {
  ------------------
  |  Branch (1067:22): [True: 0, False: 238]
  ------------------
 1068|      0|                     m_reg.resize(n);
 1069|    238|                  } else {
 1070|    238|                     m_reg.resize(n + (8 - (n % 8)));
 1071|    238|                  }
 1072|    238|               }
 1073|    361|            }
_ZNK5Botan6BigInt4Data4sizeEv:
 1075|  1.60k|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERS1_:
 1090|    133|            void swap(Data& other) noexcept {
 1091|    133|               m_reg.swap(other.m_reg);
 1092|    133|               std::swap(m_sig_words, other.m_sig_words);
 1093|    133|            }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1095|     98|            void swap(secure_vector<word>& reg) noexcept {
 1096|     98|               m_reg.swap(reg);
 1097|     98|               invalidate_sig_words();
 1098|     98|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
 1100|    574|            void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
 1102|  1.30k|            size_t sig_words() const {
 1103|  1.30k|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (1103:19): [True: 497, False: 811]
  ------------------
 1104|    497|                  m_sig_words = calc_sig_words();
 1105|    497|               }
 1106|  1.30k|               return m_sig_words;
 1107|  1.30k|            }
_ZN5BotanplERKNS_6BigIntES2_:
 1125|     14|inline BigInt operator+(const BigInt& x, const BigInt& y) {
 1126|     14|   return BigInt::add2(x, y._data(), y.sig_words(), y.sign());
 1127|     14|}
_ZN5BotanmiERKNS_6BigIntEm:
 1141|      7|inline BigInt operator-(const BigInt& x, word y) {
 1142|      7|   return BigInt::add2(x, &y, 1, BigInt::Negative);
 1143|      7|}
_ZN5BotanmlEmRKNS_6BigIntE:
 1148|     80|inline BigInt operator*(word x, const BigInt& y) {
 1149|     80|   return y * x;
 1150|     80|}
_ZN5BotaneqERKNS_6BigIntES2_:
 1162|      7|inline bool operator==(const BigInt& a, const BigInt& b) {
 1163|      7|   return a.is_equal(b);
 1164|      7|}
_ZN5BotanneERKNS_6BigIntES2_:
 1166|      7|inline bool operator!=(const BigInt& a, const BigInt& b) {
 1167|      7|   return !a.is_equal(b);
 1168|      7|}
_ZN5BotangeERKNS_6BigIntES2_:
 1174|     14|inline bool operator>=(const BigInt& a, const BigInt& b) {
 1175|     14|   return (a.cmp(b) >= 0);
 1176|     14|}
_ZN5BotanltERKNS_6BigIntES2_:
 1178|      7|inline bool operator<(const BigInt& a, const BigInt& b) {
 1179|      7|   return a.is_less_than(b);
 1180|      7|}
_ZN5BotanneERKNS_6BigIntEm:
 1190|      7|inline bool operator!=(const BigInt& a, word b) {
 1191|      7|   return (a.cmp_word(b) != 0);
 1192|      7|}
_ZN5BotanltERKNS_6BigIntEm:
 1202|     21|inline bool operator<(const BigInt& a, word b) {
 1203|     21|   return (a.cmp_word(b) < 0);
 1204|     21|}
_ZN5Botan6BigIntC2Ev:
   45|    346|      BigInt() = default;
_ZN5Botan6BigIntC2ERKS0_:
   88|    112|      BigInt(const BigInt& other) = default;
_ZN5Botan6BigIntaSERKS0_:
  201|      7|      BigInt& operator=(const BigInt&) = default;

_ZN5Botan8CurveGFp4swapERS0_:
   69|      7|      void swap(CurveGFp& other) noexcept { std::swap(m_group, other.m_group); }
_ZN5Botan8CurveGFpC2Ev:
   62|     14|      CurveGFp() = default;

_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassENSt3__14spanIKhLm18446744073709551615EEE:
  185|      7|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, std::span<const uint8_t> rep) {
  186|      7|         return add_object(type_tag, class_tag, rep.data(), rep.size());
  187|      7|      }
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassERKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  189|      7|      DER_Encoder& add_object(ASN1_Type type_tag, ASN1_Class class_tag, const std::vector<uint8_t>& rep) {
  190|      7|         return add_object(type_tag, class_tag, std::span{rep});
  191|      7|      }

_ZNK5Botan8EC_Group5_dataEv:
  458|  16.5k|      const std::shared_ptr<EC_Group_Data>& _data() const { return m_data; }

_ZN5Botan8EC_PointaSEOS0_:
   72|      7|      EC_Point& operator=(EC_Point&& other) noexcept {
   73|      7|         if(this != &other) {
  ------------------
  |  Branch (73:13): [True: 7, False: 0]
  ------------------
   74|      7|            this->swap(other);
   75|      7|         }
   76|      7|         return (*this);
   77|      7|      }
_ZN5Botan8EC_PointD2Ev:
   79|     14|      ~EC_Point() = default;
_ZN5Botan8EC_PointC2Ev:
   46|      7|      EC_Point() = default;

_ZN5Botan11clear_bytesEPvm:
  101|    222|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
  102|    222|   if(bytes > 0) {
  ------------------
  |  Branch (102:7): [True: 180, False: 42]
  ------------------
  103|    180|      std::memset(ptr, 0, bytes);
  104|    180|   }
  105|    222|}
_ZN5Botan9clear_memImEEvPT_m:
  118|    119|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|    119|   clear_bytes(ptr, sizeof(T) * n);
  120|    119|}
_ZN5Botan9clear_memIhEEvPT_m:
  118|     47|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|     47|   clear_bytes(ptr, sizeof(T) * n);
  120|     47|}
_ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m:
  144|     70|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  145|     70|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |  103|     70|   do {                                                                                          \
  |  |  104|     70|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                              \
  |  |  105|    140|      if((expr1) && !(expr2)) {                                                                  \
  |  |  ------------------
  |  |  |  Branch (105:10): [True: 70, False: 0]
  |  |  |  Branch (105:23): [True: 70, False: 0]
  |  |  |  Branch (105:23): [True: 70, False: 0]
  |  |  ------------------
  |  |  106|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                                     \
  |  |  107|      0|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |  108|      0|      }                                                                                          \
  |  |  109|     70|   } while(0)
  |  |  ------------------
  |  |  |  Branch (109:12): [Folded, False: 70]
  |  |  ------------------
  ------------------
  146|       |
  147|     70|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (147:7): [True: 70, False: 0]
  |  Branch (147:24): [True: 70, False: 0]
  |  Branch (147:42): [True: 70, False: 0]
  ------------------
  148|     70|      std::memmove(out, in, sizeof(T) * n);
  149|     70|   }
  150|     70|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEEmQaaaasr3stdE23is_trivially_copyable_vIT0_Entsr3std6rangesE5rangeIS7_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvOSC_RKS7_:
  199|  16.9k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromT& in) {
  200|  16.9k|   typecast_copy(out, std::span<const FromT, 1>(&in, 1));
  201|  16.9k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeERKNSt3__14spanIhLm8EEETkNS1_16contiguous_rangeENS3_IKmLm1EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISG_EESH_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS9_IXsr21__is_primary_templateINSA_Iu14__remove_cvrefIDTclL_ZNSC_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSI_ISQ_EESR_E4type10value_typeEEEEvOSN_RKSD_:
  176|  16.9k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  16.9k|   ranges::assert_equal_byte_lengths(out, in);
  178|  16.9k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  16.9k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_:
  210|  17.0k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  17.0k|   ToT dst;  // NOLINT(*-member-init)
  212|  17.0k|   typecast_copy(dst, src);
  213|  17.0k|   return dst;
  214|  17.0k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_:
  188|  17.0k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  17.0k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  17.0k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_:
  176|  17.0k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  17.0k|   ranges::assert_equal_byte_lengths(out, in);
  178|  17.0k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  17.0k|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|     12|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|     12|   ranges::assert_equal_byte_lengths(out, in);
  162|     12|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 12]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|     12|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 12, False: 0]
  ------------------
  165|     12|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|     12|   }
  167|     12|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_:
  210|     12|inline constexpr ToT typecast_copy(const FromR& src) {
  211|     12|   ToT dst;  // NOLINT(*-member-init)
  212|     12|   typecast_copy(dst, src);
  213|     12|   return dst;
  214|     12|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_:
  188|     12|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|     12|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|     12|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_:
  176|     12|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|     12|   ranges::assert_equal_byte_lengths(out, in);
  178|     12|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|     12|}
_ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE:
  132|     56|{
  133|     56|   clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem));
  134|     56|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm4EEETkNS1_16contiguous_rangeENS2_5arrayImLm4EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|    643|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|    643|   ranges::assert_equal_byte_lengths(out, in);
  162|    643|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 643]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|    643|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 643, False: 0]
  ------------------
  165|    643|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|    643|   }
  167|    643|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm8EEETkNS1_16contiguous_rangeENS2_5arrayImLm8EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|    475|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|    475|   ranges::assert_equal_byte_lengths(out, in);
  162|    475|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 475]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|    475|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 475, False: 0]
  ------------------
  165|    475|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|    475|   }
  167|    475|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm28EEETkNS1_16contiguous_rangeENS3_IKhLm28EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_:
  160|    384|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|    384|   ranges::assert_equal_byte_lengths(out, in);
  162|    384|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 384]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|    384|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 384, False: 0]
  ------------------
  165|    384|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|    384|   }
  167|    384|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeERNSt3__14spanIhLm66EEETkNS1_16contiguous_rangeENS3_IKhLm66EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeENS8_IXsr21__is_primary_templateINS9_Iu14__remove_cvrefIDTclL_ZNSB_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSH_ISP_EESQ_E4type10value_typeEEsr3stdE23is_trivially_copyable_vISU_EEEvOSC_RKSM_:
  160|    648|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|    648|   ranges::assert_equal_byte_lengths(out, in);
  162|    648|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 648]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|    648|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 648, False: 0]
  ------------------
  165|    648|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|    648|   }
  167|    648|}

_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|     12|{
  101|     12|   const std::span s0{r0};
  102|       |
  103|       |   if constexpr(statically_spanable_range<R0>) {
  104|       |      constexpr size_t expected_size = s0.size_bytes();
  105|       |      (assert_exact_byte_length<expected_size>(rs), ...);
  106|     12|   } else {
  107|     12|      const size_t expected_size = s0.size_bytes();
  108|     12|      const bool correct_size =
  109|     12|         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|     12|      if(!correct_size) {
  ------------------
  |  Branch (111:10): [True: 0, False: 12]
  ------------------
  112|      0|         memory_region_size_violation();
  113|      0|      }
  114|     12|   }
  115|     12|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_:
   59|     24|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|     24|   return std::span{r}.size_bytes();
   61|     24|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm32ETkNS0_14spanable_rangeENSt3__15arrayImLm4EEEEEvRKT0_:
   77|  2.01k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  2.01k|   const std::span s{r};
   79|  2.01k|   if constexpr(statically_spanable_range<R>) {
   80|  2.01k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  2.01k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm32EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    992|{
  101|    992|   const std::span s0{r0};
  102|       |
  103|    992|   if constexpr(statically_spanable_range<R0>) {
  104|    992|      constexpr size_t expected_size = s0.size_bytes();
  105|    992|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    992|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_:
   77|  33.8k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  33.8k|   const std::span s{r};
   79|  33.8k|   if constexpr(statically_spanable_range<R>) {
   80|  33.8k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  33.8k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm8EEETpTkNS0_14spanable_rangeEJNS3_IKmLm1EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  16.9k|{
  101|  16.9k|   const std::span s0{r0};
  102|       |
  103|  16.9k|   if constexpr(statically_spanable_range<R0>) {
  104|  16.9k|      constexpr size_t expected_size = s0.size_bytes();
  105|  16.9k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  16.9k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKmLm1EEEEEvRKT0_:
   77|  16.9k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  16.9k|   const std::span s{r};
   79|  16.9k|   if constexpr(statically_spanable_range<R>) {
   80|  16.9k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  16.9k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEmRKT_:
   59|  16.9k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  16.9k|   return std::span{r}.size_bytes();
   61|  16.9k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_:
   77|  34.0k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  34.0k|   const std::span s{r};
   79|  34.0k|   if constexpr(statically_spanable_range<R>) {
   80|  34.0k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  34.0k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  17.0k|{
  101|  17.0k|   const std::span s0{r0};
  102|       |
  103|  17.0k|   if constexpr(statically_spanable_range<R0>) {
  104|  17.0k|      constexpr size_t expected_size = s0.size_bytes();
  105|  17.0k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  17.0k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_:
   59|  17.0k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  17.0k|   return std::span{r}.size_bytes();
   61|  17.0k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_:
   77|     12|inline constexpr void assert_exact_byte_length(const R& r) {
   78|     12|   const std::span s{r};
   79|     12|   if constexpr(statically_spanable_range<R>) {
   80|     12|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|     12|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|     12|{
  101|     12|   const std::span s0{r0};
  102|       |
  103|     12|   if constexpr(statically_spanable_range<R0>) {
  104|     12|      constexpr size_t expected_size = s0.size_bytes();
  105|     12|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|     12|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEEEEmRKT_:
   59|     56|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|     56|   return std::span{r}.size_bytes();
   61|     56|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm4EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    643|{
  101|    643|   const std::span s0{r0};
  102|       |
  103|    643|   if constexpr(statically_spanable_range<R0>) {
  104|    643|      constexpr size_t expected_size = s0.size_bytes();
  105|    643|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    643|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm4EEEEEmRKT_:
   59|  1.28k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  1.28k|   return std::span{r}.size_bytes();
   61|  1.28k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm48ETkNS0_14spanable_rangeENSt3__15arrayImLm6EEEEEvRKT0_:
   77|    332|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    332|   const std::span s{r};
   79|    332|   if constexpr(statically_spanable_range<R>) {
   80|    332|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    332|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm48EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm6EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    332|{
  101|    332|   const std::span s0{r0};
  102|       |
  103|    332|   if constexpr(statically_spanable_range<R0>) {
  104|    332|      constexpr size_t expected_size = s0.size_bytes();
  105|    332|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    332|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm8EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    475|{
  101|    475|   const std::span s0{r0};
  102|       |
  103|    475|   if constexpr(statically_spanable_range<R0>) {
  104|    475|      constexpr size_t expected_size = s0.size_bytes();
  105|    475|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    475|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm64ETkNS0_14spanable_rangeENSt3__15arrayImLm8EEEEEvRKT0_:
   77|    791|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    791|   const std::span s{r};
   79|    791|   if constexpr(statically_spanable_range<R>) {
   80|    791|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    791|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm8EEEEEmRKT_:
   59|    950|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|    950|   return std::span{r}.size_bytes();
   61|    950|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm64EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    316|{
  101|    316|   const std::span s0{r0};
  102|       |
  103|    316|   if constexpr(statically_spanable_range<R0>) {
  104|    316|      constexpr size_t expected_size = s0.size_bytes();
  105|    316|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    316|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm72ETkNS0_14spanable_rangeENSt3__15arrayImLm9EEEEEvRKT0_:
   77|    648|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    648|   const std::span s{r};
   79|    648|   if constexpr(statically_spanable_range<R>) {
   80|    648|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    648|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm72EEETpTkNS0_14spanable_rangeEJNS3_ImLm9EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    648|{
  101|    648|   const std::span s0{r0};
  102|       |
  103|    648|   if constexpr(statically_spanable_range<R0>) {
  104|    648|      constexpr size_t expected_size = s0.size_bytes();
  105|    648|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    648|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm24ETkNS0_14spanable_rangeENSt3__15arrayImLm3EEEEEvRKT0_:
   77|    352|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    352|   const std::span s{r};
   79|    352|   if constexpr(statically_spanable_range<R>) {
   80|    352|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    352|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm24EEETpTkNS0_14spanable_rangeEJNS2_5arrayImLm3EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    352|{
  101|    352|   const std::span s0{r0};
  102|       |
  103|    352|   if constexpr(statically_spanable_range<R0>) {
  104|    352|      constexpr size_t expected_size = s0.size_bytes();
  105|    352|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    352|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__15arrayIhLm32EEETpTkNS0_14spanable_rangeEJNS3_ImLm4EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    384|{
  101|    384|   const std::span s0{r0};
  102|       |
  103|    384|   if constexpr(statically_spanable_range<R0>) {
  104|    384|      constexpr size_t expected_size = s0.size_bytes();
  105|    384|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    384|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm28EEETpTkNS0_14spanable_rangeEJNS3_IKhLm28EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    384|{
  101|    384|   const std::span s0{r0};
  102|       |
  103|    384|   if constexpr(statically_spanable_range<R0>) {
  104|    384|      constexpr size_t expected_size = s0.size_bytes();
  105|    384|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    384|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm28ETkNS0_14spanable_rangeENSt3__14spanIKhLm28EEEEEvRKT0_:
   77|    384|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    384|   const std::span s{r};
   79|    384|   if constexpr(statically_spanable_range<R>) {
   80|    384|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    384|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm28EEEEEmRKT_:
   59|    768|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|    768|   return std::span{r}.size_bytes();
   61|    768|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm66EEETpTkNS0_14spanable_rangeEJNS3_IKhLm66EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|    648|{
  101|    648|   const std::span s0{r0};
  102|       |
  103|    648|   if constexpr(statically_spanable_range<R0>) {
  104|    648|      constexpr size_t expected_size = s0.size_bytes();
  105|    648|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|    648|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm66ETkNS0_14spanable_rangeENSt3__14spanIKhLm66EEEEEvRKT0_:
   77|    648|inline constexpr void assert_exact_byte_length(const R& r) {
   78|    648|   const std::span s{r};
   79|    648|   if constexpr(statically_spanable_range<R>) {
   80|    648|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|    648|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm66EEEEEmRKT_:
   59|  1.29k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  1.29k|   return std::span{r}.size_bytes();
   61|  1.29k|}

_ZN5Botan16secure_allocatorIhE10deallocateEPhm:
   54|  1.56k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorIhE8allocateEm:
   52|  1.56k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan16secure_allocatorImE10deallocateEPmm:
   54|    651|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE8allocateEm:
   52|    651|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5BotanneIhhEEbRKNS_16secure_allocatorIT_EERKNS1_IT0_EE:
   63|     42|inline bool operator!=(const secure_allocator<T>& /*a*/, const secure_allocator<U>& /*b*/) {
   64|     42|   return false;
   65|     42|}
_ZN5BotanpLIhNS_16secure_allocatorIhEES2_EERNSt3__16vectorIT_T0_EES8_RKNS4_IS5_T1_EE:
   92|      5|std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out, const std::vector<T, Alloc2>& in) {
   93|      5|   out.insert(out.end(), in.begin(), in.end());
   94|      5|   return out;
   95|      5|}

_ZN5Botan18unwrap_strong_typeIRmEEDcOT_:
  243|  16.9k|[[nodiscard]] constexpr decltype(auto) unwrap_strong_type(T&& t) {
  244|  16.9k|   if constexpr(!concepts::strong_type<std::remove_cvref_t<T>>) {
  245|       |      // If the parameter type isn't a strong type, return it as is.
  246|  16.9k|      return std::forward<T>(t);
  247|       |   } else {
  248|       |      // Unwrap the strong type and return the underlying value.
  249|       |      return std::forward<T>(t).get();
  250|       |   }
  251|  16.9k|}
_ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_:
  268|  17.0k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) {
  269|  17.0k|   if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
  270|       |      // Noop, if the parameter type already is the desired return type.
  271|  17.0k|      return std::forward<ParamT>(t);
  272|       |   } else if constexpr(std::constructible_from<T, ParamT>) {
  273|       |      // Implicit conversion from the parameter type to the return type.
  274|       |      return T{std::forward<ParamT>(t)};
  275|       |   } else {
  276|       |      // Explicitly calling the wrapped type's constructor to support
  277|       |      // implicit conversions on types that mark their constructors as explicit.
  278|       |      static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
  279|       |      return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
  280|       |   }
  281|  17.0k|}

LLVMFuzzerInitialize:
   28|      2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) {
   29|       |   /*
   30|       |   * This disables the mlock pool, as overwrites within the pool are
   31|       |   * opaque to ASan or other instrumentation.
   32|       |   */
   33|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   34|      2|   return 0;
   35|      2|}
LLVMFuzzerTestOneInput:
   39|  2.08k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   40|  2.08k|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (40:7): [True: 2.08k, False: 1]
  ------------------
   41|  2.08k|      try {
   42|  2.08k|         fuzz(std::span<const uint8_t>(in, len));
   43|  2.08k|      } catch(const std::exception& e) {
   44|      0|         std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n";
   45|      0|         abort();
   46|      0|      } catch(...) {
   47|      0|         std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n";
   48|      0|         abort();
   49|      0|      }
   50|  2.08k|   }
   51|  2.08k|   return 0;
   52|  2.08k|}

_Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE:
   21|  2.08k|void fuzz(std::span<const uint8_t> in) {
   22|  2.08k|   if(in.size() >= 256) {
  ------------------
  |  Branch (22:7): [True: 11, False: 2.07k]
  ------------------
   23|     11|      return;
   24|     11|   }
   25|       |
   26|  2.07k|   static const Botan::EC_Group p192 = Botan::EC_Group::from_name("secp192r1");
   27|  2.07k|   static const Botan::EC_Group p224 = Botan::EC_Group::from_name("secp224r1");
   28|  2.07k|   static const Botan::EC_Group p256 = Botan::EC_Group::from_name("secp256r1");
   29|  2.07k|   static const Botan::EC_Group p384 = Botan::EC_Group::from_name("secp384r1");
   30|  2.07k|   static const Botan::EC_Group p521 = Botan::EC_Group::from_name("secp521r1");
   31|  2.07k|   static const Botan::EC_Group bp256 = Botan::EC_Group::from_name("brainpool256r1");
   32|  2.07k|   static const Botan::EC_Group bp512 = Botan::EC_Group::from_name("brainpool512r1");
   33|       |
   34|  2.07k|   check_os2ecp(p192, in);
   35|  2.07k|   check_os2ecp(p224, in);
   36|  2.07k|   check_os2ecp(p256, in);
   37|  2.07k|   check_os2ecp(p384, in);
   38|  2.07k|   check_os2ecp(p521, in);
   39|  2.07k|   check_os2ecp(p521, in);
   40|  2.07k|   check_os2ecp(bp256, in);
   41|  2.07k|   check_os2ecp(bp512, in);
   42|  2.07k|}
os2ecp.cpp:_ZN12_GLOBAL__N_112check_os2ecpERKN5Botan8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE:
   13|  16.5k|void check_os2ecp(const Botan::EC_Group& group, std::span<const uint8_t> in) {
   14|  16.5k|   try {
   15|  16.5k|      Botan::EC_AffinePoint(group, in);
   16|  16.5k|   } catch(const Botan::Exception& e) {}
   17|  16.5k|}

_ZN5Botan3OID9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   72|      7|std::optional<OID> OID::from_name(std::string_view name) {
   73|      7|   if(name.empty()) {
  ------------------
  |  Branch (73:7): [True: 0, False: 7]
  ------------------
   74|      0|      throw Invalid_Argument("OID::from_name argument must be non-empty");
   75|      0|   }
   76|       |
   77|      7|   OID o = OID_Map::global_registry().str2oid(name);
   78|      7|   if(o.has_value()) {
  ------------------
  |  Branch (78:7): [True: 7, False: 0]
  ------------------
   79|      7|      return std::optional(o);
   80|      7|   }
   81|       |
   82|      0|   return std::nullopt;
   83|      7|}
_ZN5Botan3OIDC2ESt16initializer_listIjE:
  104|     94|OID::OID(std::initializer_list<uint32_t> init) : m_id(init) {
  105|     94|   oid_valid_check(m_id);
  106|     94|}
_ZNK5Botan3OID19human_name_or_emptyEv:
  147|      7|std::string OID::human_name_or_empty() const {
  148|      7|   return OID_Map::global_registry().oid2str(*this);
  149|      7|}
_ZNK5Botan3OID7matchesESt16initializer_listIjE:
  155|      7|bool OID::matches(std::initializer_list<uint32_t> other) const {
  156|       |   // TODO: once all target compilers support it, use std::ranges::equal
  157|      7|   return std::equal(m_id.begin(), m_id.end(), other.begin(), other.end());
  158|      7|}
_ZNK5Botan3OID9hash_codeEv:
  160|     11|uint64_t OID::hash_code() const {
  161|       |   // If this is changed also update gen_oids.py to match
  162|     11|   uint64_t hash = 0x621F302327D9A49A;
  163|     81|   for(auto id : m_id) {
  ------------------
  |  Branch (163:16): [True: 81, False: 11]
  ------------------
  164|     81|      hash *= 193;
  165|     81|      hash += id;
  166|     81|   }
  167|     11|   return hash;
  168|     11|}
_ZNK5Botan3OID11encode_intoERNS_11DER_EncoderE:
  183|      7|void OID::encode_into(DER_Encoder& der) const {
  184|      7|   if(m_id.size() < 2) {
  ------------------
  |  Branch (184:7): [True: 0, False: 7]
  ------------------
  185|      0|      throw Invalid_Argument("OID::encode_into: OID is invalid");
  186|      0|   }
  187|       |
  188|      7|   auto append = [](std::vector<uint8_t>& encoding, uint32_t z) {
  189|      7|      if(z <= 0x7F) {
  190|      7|         encoding.push_back(static_cast<uint8_t>(z));
  191|      7|      } else {
  192|      7|         const size_t z7 = (high_bit(z) + 7 - 1) / 7;
  193|       |
  194|      7|         for(size_t j = 0; j != z7; ++j) {
  195|      7|            uint8_t zp = static_cast<uint8_t>(z >> (7 * (z7 - j - 1)) & 0x7F);
  196|       |
  197|      7|            if(j != z7 - 1) {
  198|      7|               zp |= 0x80;
  199|      7|            }
  200|       |
  201|      7|            encoding.push_back(zp);
  202|      7|         }
  203|      7|      }
  204|      7|   };
  205|       |
  206|      7|   std::vector<uint8_t> encoding;
  207|       |
  208|       |   // We know 40 * root can't overflow because root is between 0 and 2
  209|      7|   auto first = checked_add(40 * m_id[0], m_id[1]);
  210|      7|   BOTAN_ASSERT_NOMSG(first.has_value());
  ------------------
  |  |   77|      7|   do {                                                                     \
  |  |   78|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      7|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
  211|       |
  212|      7|   append(encoding, *first);
  213|       |
  214|     42|   for(size_t i = 2; i != m_id.size(); ++i) {
  ------------------
  |  Branch (214:22): [True: 35, False: 7]
  ------------------
  215|     35|      append(encoding, m_id[i]);
  216|     35|   }
  217|      7|   der.add_object(ASN1_Type::ObjectId, ASN1_Class::Universal, encoding);
  218|      7|}
asn1_oid.cpp:_ZN5Botan12_GLOBAL__N_115oid_valid_checkENSt3__14spanIKjLm18446744073709551615EEE:
   26|     94|void oid_valid_check(std::span<const uint32_t> oid) {
   27|     94|   BOTAN_ARG_CHECK(oid.size() >= 2, "OID too short to be valid");
  ------------------
  |  |   35|     94|   do {                                                          \
  |  |   36|     94|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     94|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 94]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     94|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 94]
  |  |  ------------------
  ------------------
   28|     94|   BOTAN_ARG_CHECK(oid[0] <= 2, "OID root out of range");
  ------------------
  |  |   35|     94|   do {                                                          \
  |  |   36|     94|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     94|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 94]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     94|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 94]
  |  |  ------------------
  ------------------
   29|     94|   BOTAN_ARG_CHECK(oid[1] <= 39 || oid[0] == 2, "OID second arc too large");
  ------------------
  |  |   35|     94|   do {                                                          \
  |  |   36|     94|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     94|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 94, False: 0]
  |  |  |  Branch (37:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     94|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 94]
  |  |  ------------------
  ------------------
   30|       |   // This last is a limitation of using 32 bit integers when decoding
   31|       |   // not a limitation of ASN.1 object identifiers in general
   32|     94|   BOTAN_ARG_CHECK(oid[1] <= 0xFFFFFFAF, "OID second arc too large");
  ------------------
  |  |   35|     94|   do {                                                          \
  |  |   36|     94|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     94|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 94]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     94|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 94]
  |  |  ------------------
  ------------------
   33|     94|}
asn1_oid.cpp:_ZZNK5Botan3OID11encode_intoERNS_11DER_EncoderEENK3$_0clERNSt3__16vectorIhNS4_9allocatorIhEEEEj:
  188|     42|   auto append = [](std::vector<uint8_t>& encoding, uint32_t z) {
  189|     42|      if(z <= 0x7F) {
  ------------------
  |  Branch (189:10): [True: 35, False: 7]
  ------------------
  190|     35|         encoding.push_back(static_cast<uint8_t>(z));
  191|     35|      } else {
  192|      7|         const size_t z7 = (high_bit(z) + 7 - 1) / 7;
  193|       |
  194|     21|         for(size_t j = 0; j != z7; ++j) {
  ------------------
  |  Branch (194:28): [True: 14, False: 7]
  ------------------
  195|     14|            uint8_t zp = static_cast<uint8_t>(z >> (7 * (z7 - j - 1)) & 0x7F);
  196|       |
  197|     14|            if(j != z7 - 1) {
  ------------------
  |  Branch (197:16): [True: 7, False: 7]
  ------------------
  198|      7|               zp |= 0x80;
  199|      7|            }
  200|       |
  201|     14|            encoding.push_back(zp);
  202|     14|         }
  203|      7|      }
  204|     42|   };

_ZN5Botan11DER_EncoderC2ERNSt3__16vectorIhNS1_9allocatorIhEEEE:
   72|      7|DER_Encoder::DER_Encoder(std::vector<uint8_t>& vec) {
   73|      7|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };
   74|      7|}
_ZN5Botan11DER_Encoder10add_objectENS_9ASN1_TypeENS_10ASN1_ClassEPKhm:
  244|      7|DER_Encoder& DER_Encoder::add_object(ASN1_Type type_tag, ASN1_Class class_tag, const uint8_t rep[], size_t length) {
  245|      7|   std::vector<uint8_t> hdr;
  246|      7|   encode_tag(hdr, type_tag, class_tag);
  247|      7|   encode_length(hdr, length);
  248|       |
  249|      7|   if(!m_subsequences.empty()) {
  ------------------
  |  Branch (249:7): [True: 0, False: 7]
  ------------------
  250|      0|      m_subsequences[m_subsequences.size() - 1].add_bytes(hdr.data(), hdr.size(), rep, length);
  251|      7|   } else if(m_append_output) {
  ------------------
  |  Branch (251:14): [True: 7, False: 0]
  ------------------
  252|      7|      m_append_output(hdr.data(), hdr.size());
  253|      7|      m_append_output(rep, length);
  254|      7|   } else {
  255|      0|      m_default_outbuf += hdr;
  256|      0|      m_default_outbuf += std::make_pair(rep, length);
  257|      0|   }
  258|       |
  259|      7|   return (*this);
  260|      7|}
_ZN5Botan11DER_Encoder6encodeERKNS_11ASN1_ObjectE:
  365|      7|DER_Encoder& DER_Encoder::encode(const ASN1_Object& obj) {
  366|      7|   obj.encode_into(*this);
  367|      7|   return (*this);
  368|      7|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_110encode_tagERNSt3__16vectorIhNS1_9allocatorIhEEEENS_9ASN1_TypeENS_10ASN1_ClassE:
   25|      7|void encode_tag(std::vector<uint8_t>& encoded_tag, ASN1_Type type_tag_e, ASN1_Class class_tag_e) {
   26|      7|   const uint32_t type_tag = static_cast<uint32_t>(type_tag_e);
   27|      7|   const uint32_t class_tag = static_cast<uint32_t>(class_tag_e);
   28|       |
   29|      7|   if((class_tag | 0xE0) != 0xE0) {
  ------------------
  |  Branch (29:7): [True: 0, False: 7]
  ------------------
   30|      0|      throw Encoding_Error(fmt("DER_Encoder: Invalid class tag {}", std::to_string(class_tag)));
   31|      0|   }
   32|       |
   33|      7|   if(type_tag <= 30) {
  ------------------
  |  Branch (33:7): [True: 7, False: 0]
  ------------------
   34|      7|      encoded_tag.push_back(static_cast<uint8_t>(type_tag | class_tag));
   35|      7|   } else {
   36|      0|      size_t blocks = high_bit(static_cast<uint32_t>(type_tag)) + 6;
   37|      0|      blocks = (blocks - (blocks % 7)) / 7;
   38|       |
   39|      0|      BOTAN_ASSERT_NOMSG(blocks > 0);
  ------------------
  |  |   77|      0|   do {                                                                     \
  |  |   78|      0|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      0|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
   40|       |
   41|      0|      encoded_tag.push_back(static_cast<uint8_t>(class_tag | 0x1F));
   42|      0|      for(size_t i = 0; i != blocks - 1; ++i) {
  ------------------
  |  Branch (42:25): [True: 0, False: 0]
  ------------------
   43|      0|         encoded_tag.push_back(0x80 | ((type_tag >> 7 * (blocks - i - 1)) & 0x7F));
   44|      0|      }
   45|      0|      encoded_tag.push_back(type_tag & 0x7F);
   46|      0|   }
   47|      7|}
der_enc.cpp:_ZN5Botan12_GLOBAL__N_113encode_lengthERNSt3__16vectorIhNS1_9allocatorIhEEEEm:
   52|      7|void encode_length(std::vector<uint8_t>& encoded_length, size_t length) {
   53|      7|   if(length <= 127) {
  ------------------
  |  Branch (53:7): [True: 7, False: 0]
  ------------------
   54|      7|      encoded_length.push_back(static_cast<uint8_t>(length));
   55|      7|   } else {
   56|      0|      const size_t bytes_needed = significant_bytes(length);
   57|       |
   58|      0|      encoded_length.push_back(static_cast<uint8_t>(0x80 | bytes_needed));
   59|       |
   60|      0|      for(size_t i = sizeof(length) - bytes_needed; i < sizeof(length); ++i) {
  ------------------
  |  Branch (60:53): [True: 0, False: 0]
  ------------------
   61|      0|         encoded_length.push_back(get_byte_var(i, length));
   62|      0|      }
   63|      0|   }
   64|      7|}
der_enc.cpp:_ZZN5Botan11DER_EncoderC1ERNSt3__16vectorIhNS1_9allocatorIhEEEEENK3$_0clEPKhm:
   73|     14|   m_append_output = [&vec](const uint8_t b[], size_t l) { vec.insert(vec.end(), b, b + l); };

_ZN5Botan7OID_MapC2Ev:
   11|      1|OID_Map::OID_Map() {
   12|      1|   m_str2oid = OID_Map::load_str2oid_map();
   13|      1|   m_oid2str = OID_Map::load_oid2str_map();
   14|      1|}
_ZN5Botan7OID_Map15global_registryEv:
   16|     14|OID_Map& OID_Map::global_registry() {
   17|     14|   static OID_Map g_map;
   18|     14|   return g_map;
   19|     14|}
_ZN5Botan7OID_Map7oid2strERKNS_3OIDE:
   69|      7|std::string OID_Map::oid2str(const OID& oid) {
   70|      7|   if(auto name = lookup_static_oid(oid)) {
  ------------------
  |  Branch (70:12): [True: 7, False: 0]
  ------------------
   71|      7|      return std::string(*name);
   72|      7|   }
   73|       |
   74|      0|   const lock_guard_type<mutex_type> lock(m_mutex);
   75|       |
   76|      0|   auto i = m_oid2str.find(oid);
   77|      0|   if(i != m_oid2str.end()) {
  ------------------
  |  Branch (77:7): [True: 0, False: 0]
  ------------------
   78|      0|      return i->second;
   79|      0|   }
   80|       |
   81|      0|   return "";
   82|      0|}
_ZN5Botan7OID_Map7str2oidENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   84|      7|OID OID_Map::str2oid(std::string_view str) {
   85|      7|   if(auto oid = lookup_static_oid_name(str)) {
  ------------------
  |  Branch (85:12): [True: 7, False: 0]
  ------------------
   86|      7|      return std::move(*oid);
   87|      7|   }
   88|       |
   89|      0|   const lock_guard_type<mutex_type> lock(m_mutex);
   90|      0|   auto i = m_str2oid.find(std::string(str));
   91|      0|   if(i != m_str2oid.end()) {
  ------------------
  |  Branch (91:7): [True: 0, False: 0]
  ------------------
   92|      0|      return i->second;
   93|      0|   }
   94|       |
   95|      0|   return OID();
   96|      0|}

_ZN5Botan7OID_Map17lookup_static_oidERKNS_3OIDE:
   48|      7|std::optional<std::string_view> OID_Map::lookup_static_oid(const OID& oid) {
   49|      7|   const uint32_t hc = static_cast<uint32_t>(oid.hash_code() % 858701);
   50|       |
   51|      7|   switch(hc) {
   52|      0|      case 0x01506:
  ------------------
  |  Branch (52:7): [True: 0, False: 7]
  ------------------
   53|      0|         return if_match(oid, {1, 2, 840, 10045, 4, 3, 1}, "ECDSA/SHA-224");
   54|      0|      case 0x01507:
  ------------------
  |  Branch (54:7): [True: 0, False: 7]
  ------------------
   55|      0|         return if_match(oid, {1, 2, 840, 10045, 4, 3, 2}, "ECDSA/SHA-256");
   56|      0|      case 0x01508:
  ------------------
  |  Branch (56:7): [True: 0, False: 7]
  ------------------
   57|      0|         return if_match(oid, {1, 2, 840, 10045, 4, 3, 3}, "ECDSA/SHA-384");
   58|      0|      case 0x01509:
  ------------------
  |  Branch (58:7): [True: 0, False: 7]
  ------------------
   59|      0|         return if_match(oid, {1, 2, 840, 10045, 4, 3, 4}, "ECDSA/SHA-512");
   60|      0|      case 0x04C1E:
  ------------------
  |  Branch (60:7): [True: 0, False: 7]
  ------------------
   61|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1}, "ElGamal");
   62|      0|      case 0x04E61:
  ------------------
  |  Branch (62:7): [True: 0, False: 7]
  ------------------
   63|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1}, "OpenPGP.Curve25519");
   64|      0|      case 0x0779B:
  ------------------
  |  Branch (64:7): [True: 0, False: 7]
  ------------------
   65|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 5}, "MD5");
   66|      0|      case 0x0779D:
  ------------------
  |  Branch (66:7): [True: 0, False: 7]
  ------------------
   67|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 7}, "HMAC(SHA-1)");
   68|      0|      case 0x0779E:
  ------------------
  |  Branch (68:7): [True: 0, False: 7]
  ------------------
   69|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 8}, "HMAC(SHA-224)");
   70|      0|      case 0x0779F:
  ------------------
  |  Branch (70:7): [True: 0, False: 7]
  ------------------
   71|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 9}, "HMAC(SHA-256)");
   72|      0|      case 0x077A0:
  ------------------
  |  Branch (72:7): [True: 0, False: 7]
  ------------------
   73|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 10}, "HMAC(SHA-384)");
   74|      0|      case 0x077A1:
  ------------------
  |  Branch (74:7): [True: 0, False: 7]
  ------------------
   75|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 11}, "HMAC(SHA-512)");
   76|      0|      case 0x077A3:
  ------------------
  |  Branch (76:7): [True: 0, False: 7]
  ------------------
   77|      0|         return if_match(oid, {1, 2, 840, 113549, 2, 13}, "HMAC(SHA-512-256)");
   78|      0|      case 0x0785E:
  ------------------
  |  Branch (78:7): [True: 0, False: 7]
  ------------------
   79|      0|         return if_match(oid, {1, 2, 840, 113549, 3, 7}, "TripleDES/CBC");
   80|      0|      case 0x0C904:
  ------------------
  |  Branch (80:7): [True: 0, False: 7]
  ------------------
   81|      0|         return if_match(oid, {1, 0, 14888, 3, 0, 5}, "ECKCDSA");
   82|      0|      case 0x11547:
  ------------------
  |  Branch (82:7): [True: 0, False: 7]
  ------------------
   83|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1}, "SphincsPlus-shake-128s-r3.1");
   84|      0|      case 0x11548:
  ------------------
  |  Branch (84:7): [True: 0, False: 7]
  ------------------
   85|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2}, "SphincsPlus-shake-128f-r3.1");
   86|      0|      case 0x11549:
  ------------------
  |  Branch (86:7): [True: 0, False: 7]
  ------------------
   87|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3}, "SphincsPlus-shake-192s-r3.1");
   88|      0|      case 0x1154A:
  ------------------
  |  Branch (88:7): [True: 0, False: 7]
  ------------------
   89|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4}, "SphincsPlus-shake-192f-r3.1");
   90|      0|      case 0x1154B:
  ------------------
  |  Branch (90:7): [True: 0, False: 7]
  ------------------
   91|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5}, "SphincsPlus-shake-256s-r3.1");
   92|      0|      case 0x1154C:
  ------------------
  |  Branch (92:7): [True: 0, False: 7]
  ------------------
   93|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6}, "SphincsPlus-shake-256f-r3.1");
   94|      0|      case 0x11608:
  ------------------
  |  Branch (94:7): [True: 0, False: 7]
  ------------------
   95|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1}, "SphincsPlus-sha2-128s-r3.1");
   96|      0|      case 0x11609:
  ------------------
  |  Branch (96:7): [True: 0, False: 7]
  ------------------
   97|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2}, "SphincsPlus-sha2-128f-r3.1");
   98|      0|      case 0x1160A:
  ------------------
  |  Branch (98:7): [True: 0, False: 7]
  ------------------
   99|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3}, "SphincsPlus-sha2-192s-r3.1");
  100|      0|      case 0x1160B:
  ------------------
  |  Branch (100:7): [True: 0, False: 7]
  ------------------
  101|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4}, "SphincsPlus-sha2-192f-r3.1");
  102|      0|      case 0x1160C:
  ------------------
  |  Branch (102:7): [True: 0, False: 7]
  ------------------
  103|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5}, "SphincsPlus-sha2-256s-r3.1");
  104|      0|      case 0x1160D:
  ------------------
  |  Branch (104:7): [True: 0, False: 7]
  ------------------
  105|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6}, "SphincsPlus-sha2-256f-r3.1");
  106|      0|      case 0x116C9:
  ------------------
  |  Branch (106:7): [True: 0, False: 7]
  ------------------
  107|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1}, "SphincsPlus-haraka-128s-r3.1");
  108|      0|      case 0x116CA:
  ------------------
  |  Branch (108:7): [True: 0, False: 7]
  ------------------
  109|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2}, "SphincsPlus-haraka-128f-r3.1");
  110|      0|      case 0x116CB:
  ------------------
  |  Branch (110:7): [True: 0, False: 7]
  ------------------
  111|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3}, "SphincsPlus-haraka-192s-r3.1");
  112|      0|      case 0x116CC:
  ------------------
  |  Branch (112:7): [True: 0, False: 7]
  ------------------
  113|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4}, "SphincsPlus-haraka-192f-r3.1");
  114|      0|      case 0x116CD:
  ------------------
  |  Branch (114:7): [True: 0, False: 7]
  ------------------
  115|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5}, "SphincsPlus-haraka-256s-r3.1");
  116|      0|      case 0x116CE:
  ------------------
  |  Branch (116:7): [True: 0, False: 7]
  ------------------
  117|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6}, "SphincsPlus-haraka-256f-r3.1");
  118|      0|      case 0x1533B:
  ------------------
  |  Branch (118:7): [True: 0, False: 7]
  ------------------
  119|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 104, 2}, "SM4/CBC");
  120|      0|      case 0x15341:
  ------------------
  |  Branch (120:7): [True: 0, False: 7]
  ------------------
  121|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 104, 8}, "SM4/GCM");
  122|      0|      case 0x1539D:
  ------------------
  |  Branch (122:7): [True: 0, False: 7]
  ------------------
  123|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 104, 100}, "SM4/OCB");
  124|      0|      case 0x187D7:
  ------------------
  |  Branch (124:7): [True: 0, False: 7]
  ------------------
  125|      0|         return if_match(oid, {1, 3, 14, 3, 2, 7}, "DES/CBC");
  126|      0|      case 0x187EA:
  ------------------
  |  Branch (126:7): [True: 0, False: 7]
  ------------------
  127|      0|         return if_match(oid, {1, 3, 14, 3, 2, 26}, "SHA-1");
  128|      0|      case 0x19933:
  ------------------
  |  Branch (128:7): [True: 0, False: 7]
  ------------------
  129|      0|         return if_match(oid, {1, 3, 132, 0, 8}, "secp160r1");
  130|      0|      case 0x19934:
  ------------------
  |  Branch (130:7): [True: 0, False: 7]
  ------------------
  131|      0|         return if_match(oid, {1, 3, 132, 0, 9}, "secp160k1");
  132|      0|      case 0x19935:
  ------------------
  |  Branch (132:7): [True: 0, False: 7]
  ------------------
  133|      0|         return if_match(oid, {1, 3, 132, 0, 10}, "secp256k1");
  134|      0|      case 0x19949:
  ------------------
  |  Branch (134:7): [True: 0, False: 7]
  ------------------
  135|      0|         return if_match(oid, {1, 3, 132, 0, 30}, "secp160r2");
  136|      0|      case 0x1994A:
  ------------------
  |  Branch (136:7): [True: 0, False: 7]
  ------------------
  137|      0|         return if_match(oid, {1, 3, 132, 0, 31}, "secp192k1");
  138|      0|      case 0x1994B:
  ------------------
  |  Branch (138:7): [True: 0, False: 7]
  ------------------
  139|      0|         return if_match(oid, {1, 3, 132, 0, 32}, "secp224k1");
  140|      1|      case 0x1994C:
  ------------------
  |  Branch (140:7): [True: 1, False: 6]
  ------------------
  141|      1|         return if_match(oid, {1, 3, 132, 0, 33}, "secp224r1");
  142|      1|      case 0x1994D:
  ------------------
  |  Branch (142:7): [True: 1, False: 6]
  ------------------
  143|      1|         return if_match(oid, {1, 3, 132, 0, 34}, "secp384r1");
  144|      1|      case 0x1994E:
  ------------------
  |  Branch (144:7): [True: 1, False: 6]
  ------------------
  145|      1|         return if_match(oid, {1, 3, 132, 0, 35}, "secp521r1");
  146|      0|      case 0x199F8:
  ------------------
  |  Branch (146:7): [True: 0, False: 7]
  ------------------
  147|      0|         return if_match(oid, {1, 3, 132, 1, 12}, "ECDH");
  148|      0|      case 0x1E7BF:
  ------------------
  |  Branch (148:7): [True: 0, False: 7]
  ------------------
  149|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 301, 1}, "SM2");
  150|      0|      case 0x1E7C0:
  ------------------
  |  Branch (150:7): [True: 0, False: 7]
  ------------------
  151|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 301, 2}, "SM2_Kex");
  152|      0|      case 0x1E7C1:
  ------------------
  |  Branch (152:7): [True: 0, False: 7]
  ------------------
  153|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 301, 3}, "SM2_Enc");
  154|      0|      case 0x21960:
  ------------------
  |  Branch (154:7): [True: 0, False: 7]
  ------------------
  155|      0|         return if_match(oid, {1, 3, 36, 3, 3, 1, 2}, "RSA/PKCS1v15(RIPEMD-160)");
  156|      0|      case 0x2198A:
  ------------------
  |  Branch (156:7): [True: 0, False: 7]
  ------------------
  157|      0|         return if_match(oid, {1, 2, 840, 113533, 7, 66, 10}, "CAST-128/CBC");
  158|      0|      case 0x2198F:
  ------------------
  |  Branch (158:7): [True: 0, False: 7]
  ------------------
  159|      0|         return if_match(oid, {1, 2, 840, 113533, 7, 66, 15}, "KeyWrap.CAST-128");
  160|      0|      case 0x227C0:
  ------------------
  |  Branch (160:7): [True: 0, False: 7]
  ------------------
  161|      0|         return if_match(oid, {1, 3, 101, 110}, "X25519");
  162|      0|      case 0x227C1:
  ------------------
  |  Branch (162:7): [True: 0, False: 7]
  ------------------
  163|      0|         return if_match(oid, {1, 3, 101, 111}, "X448");
  164|      0|      case 0x227C2:
  ------------------
  |  Branch (164:7): [True: 0, False: 7]
  ------------------
  165|      0|         return if_match(oid, {1, 3, 101, 112}, "Ed25519");
  166|      0|      case 0x227C3:
  ------------------
  |  Branch (166:7): [True: 0, False: 7]
  ------------------
  167|      0|         return if_match(oid, {1, 3, 101, 113}, "Ed448");
  168|      0|      case 0x27565:
  ------------------
  |  Branch (168:7): [True: 0, False: 7]
  ------------------
  169|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 1}, "PKIX.OCSP.BasicResponse");
  170|      0|      case 0x27569:
  ------------------
  |  Branch (170:7): [True: 0, False: 7]
  ------------------
  171|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1, 5}, "PKIX.OCSP.NoCheck");
  172|      0|      case 0x29F7C:
  ------------------
  |  Branch (172:7): [True: 0, False: 7]
  ------------------
  173|      0|         return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 3}, "ECKCDSA/SHA-1");
  174|      0|      case 0x29F7D:
  ------------------
  |  Branch (174:7): [True: 0, False: 7]
  ------------------
  175|      0|         return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 4}, "ECKCDSA/SHA-224");
  176|      0|      case 0x29F7E:
  ------------------
  |  Branch (176:7): [True: 0, False: 7]
  ------------------
  177|      0|         return if_match(oid, {1, 2, 410, 200004, 1, 100, 4, 5}, "ECKCDSA/SHA-256");
  178|      0|      case 0x2AC3B:
  ------------------
  |  Branch (178:7): [True: 0, False: 7]
  ------------------
  179|      0|         return if_match(oid, {2, 5, 29, 32, 0}, "X509v3.AnyPolicy");
  180|      0|      case 0x2B000:
  ------------------
  |  Branch (180:7): [True: 0, False: 7]
  ------------------
  181|      0|         return if_match(oid, {2, 5, 29, 37, 0}, "X509v3.AnyExtendedKeyUsage");
  182|      0|      case 0x2B5C9:
  ------------------
  |  Branch (182:7): [True: 0, False: 7]
  ------------------
  183|      0|         return if_match(oid, {1, 2, 840, 10045, 2, 1}, "ECDSA");
  184|      0|      case 0x2B74B:
  ------------------
  |  Branch (184:7): [True: 0, False: 7]
  ------------------
  185|      0|         return if_match(oid, {1, 2, 840, 10045, 4, 1}, "ECDSA/SHA-1");
  186|      0|      case 0x3474A:
  ------------------
  |  Branch (186:7): [True: 0, False: 7]
  ------------------
  187|      0|         return if_match(oid, {1, 2, 840, 10046, 2, 1}, "DH");
  188|      0|      case 0x38D6D:
  ------------------
  |  Branch (188:7): [True: 0, False: 7]
  ------------------
  189|      0|         return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 1}, "gost_256A");
  190|      0|      case 0x38D6E:
  ------------------
  |  Branch (190:7): [True: 0, False: 7]
  ------------------
  191|      0|         return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 1, 2}, "gost_256B");
  192|      0|      case 0x38E2E:
  ------------------
  |  Branch (192:7): [True: 0, False: 7]
  ------------------
  193|      0|         return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 1}, "gost_512A");
  194|      0|      case 0x38E2F:
  ------------------
  |  Branch (194:7): [True: 0, False: 7]
  ------------------
  195|      0|         return if_match(oid, {1, 2, 643, 7, 1, 2, 1, 2, 2}, "gost_512B");
  196|      0|      case 0x38F2C:
  ------------------
  |  Branch (196:7): [True: 0, False: 7]
  ------------------
  197|      0|         return if_match(oid, {1, 2, 643, 2, 2, 3}, "GOST-34.10/GOST-R-34.11-94");
  198|      0|      case 0x38F3C:
  ------------------
  |  Branch (198:7): [True: 0, False: 7]
  ------------------
  199|      0|         return if_match(oid, {1, 2, 643, 2, 2, 19}, "GOST-34.10");
  200|      0|      case 0x3D7B8:
  ------------------
  |  Branch (200:7): [True: 0, False: 7]
  ------------------
  201|      0|         return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 6}, "Camellia-128/GCM");
  202|      0|      case 0x3D7CC:
  ------------------
  |  Branch (202:7): [True: 0, False: 7]
  ------------------
  203|      0|         return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 26}, "Camellia-192/GCM");
  204|      0|      case 0x3D7E0:
  ------------------
  |  Branch (204:7): [True: 0, False: 7]
  ------------------
  205|      0|         return if_match(oid, {0, 3, 4401, 5, 3, 1, 9, 46}, "Camellia-256/GCM");
  206|      0|      case 0x3F20F:
  ------------------
  |  Branch (206:7): [True: 0, False: 7]
  ------------------
  207|      0|         return if_match(oid, {1, 3, 36, 3, 2, 1}, "RIPEMD-160");
  208|      0|      case 0x4266E:
  ------------------
  |  Branch (208:7): [True: 0, False: 7]
  ------------------
  209|      0|         return if_match(oid, {0, 4, 0, 127, 0, 15, 1, 1, 13, 0}, "XMSS");
  210|      0|      case 0x478C4:
  ------------------
  |  Branch (210:7): [True: 0, False: 7]
  ------------------
  211|      0|         return if_match(oid, {1, 2, 410, 200004, 1, 4}, "SEED/CBC");
  212|      0|      case 0x47D98:
  ------------------
  |  Branch (212:7): [True: 0, False: 7]
  ------------------
  213|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 301}, "sm2p256v1");
  214|      0|      case 0x47DFC:
  ------------------
  |  Branch (214:7): [True: 0, False: 7]
  ------------------
  215|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 401}, "SM3");
  216|      0|      case 0x47E60:
  ------------------
  |  Branch (216:7): [True: 0, False: 7]
  ------------------
  217|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 501}, "SM2_Sig/SM3");
  218|      0|      case 0x47E63:
  ------------------
  |  Branch (218:7): [True: 0, False: 7]
  ------------------
  219|      0|         return if_match(oid, {1, 2, 156, 10197, 1, 504}, "RSA/PKCS1v15(SM3)");
  220|      0|      case 0x52B13:
  ------------------
  |  Branch (220:7): [True: 0, False: 7]
  ------------------
  221|      0|         return if_match(oid, {1, 2, 643, 3, 131, 1, 1}, "GOST.INN");
  222|      0|      case 0x635AE:
  ------------------
  |  Branch (222:7): [True: 0, False: 7]
  ------------------
  223|      0|         return if_match(oid, {1, 2, 250, 1, 223, 101, 256, 1}, "frp256v1");
  224|      0|      case 0x6A784:
  ------------------
  |  Branch (224:7): [True: 0, False: 7]
  ------------------
  225|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 1}, "PKCS12.KeyBag");
  226|      0|      case 0x6A785:
  ------------------
  |  Branch (226:7): [True: 0, False: 7]
  ------------------
  227|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 2}, "PKCS12.PKCS8ShroudedKeyBag");
  228|      0|      case 0x6A786:
  ------------------
  |  Branch (228:7): [True: 0, False: 7]
  ------------------
  229|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 3}, "PKCS12.CertBag");
  230|      0|      case 0x6A787:
  ------------------
  |  Branch (230:7): [True: 0, False: 7]
  ------------------
  231|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 4}, "PKCS12.CRLBag");
  232|      0|      case 0x6A788:
  ------------------
  |  Branch (232:7): [True: 0, False: 7]
  ------------------
  233|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 5}, "PKCS12.SecretBag");
  234|      0|      case 0x6A789:
  ------------------
  |  Branch (234:7): [True: 0, False: 7]
  ------------------
  235|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 10, 1, 6}, "PKCS12.SafeContentsBag");
  236|      0|      case 0x6EB86:
  ------------------
  |  Branch (236:7): [True: 0, False: 7]
  ------------------
  237|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1}, "GOST-34.10-2012-256/SHA-256");
  238|      0|      case 0x6EC47:
  ------------------
  |  Branch (238:7): [True: 0, False: 7]
  ------------------
  239|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1}, "Kyber-512-r3");
  240|      0|      case 0x6EC48:
  ------------------
  |  Branch (240:7): [True: 0, False: 7]
  ------------------
  241|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2}, "Kyber-768-r3");
  242|      0|      case 0x6EC49:
  ------------------
  |  Branch (242:7): [True: 0, False: 7]
  ------------------
  243|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3}, "Kyber-1024-r3");
  244|      0|      case 0x6EDC9:
  ------------------
  |  Branch (244:7): [True: 0, False: 7]
  ------------------
  245|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1}, "Dilithium-4x4-r3");
  246|      0|      case 0x6EDCA:
  ------------------
  |  Branch (246:7): [True: 0, False: 7]
  ------------------
  247|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2}, "Dilithium-6x5-r3");
  248|      0|      case 0x6EDCB:
  ------------------
  |  Branch (248:7): [True: 0, False: 7]
  ------------------
  249|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3}, "Dilithium-8x7-r3");
  250|      0|      case 0x6EE8A:
  ------------------
  |  Branch (250:7): [True: 0, False: 7]
  ------------------
  251|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1}, "Dilithium-4x4-AES-r3");
  252|      0|      case 0x6EE8B:
  ------------------
  |  Branch (252:7): [True: 0, False: 7]
  ------------------
  253|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2}, "Dilithium-6x5-AES-r3");
  254|      0|      case 0x6EE8C:
  ------------------
  |  Branch (254:7): [True: 0, False: 7]
  ------------------
  255|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3}, "Dilithium-8x7-AES-r3");
  256|      0|      case 0x6EF4B:
  ------------------
  |  Branch (256:7): [True: 0, False: 7]
  ------------------
  257|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1}, "Kyber-512-90s-r3");
  258|      0|      case 0x6EF4C:
  ------------------
  |  Branch (258:7): [True: 0, False: 7]
  ------------------
  259|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2}, "Kyber-768-90s-r3");
  260|      0|      case 0x6EF4D:
  ------------------
  |  Branch (260:7): [True: 0, False: 7]
  ------------------
  261|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3}, "Kyber-1024-90s-r3");
  262|      0|      case 0x6F18E:
  ------------------
  |  Branch (262:7): [True: 0, False: 7]
  ------------------
  263|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1}, "FrodoKEM-640-SHAKE");
  264|      0|      case 0x6F18F:
  ------------------
  |  Branch (264:7): [True: 0, False: 7]
  ------------------
  265|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2}, "FrodoKEM-976-SHAKE");
  266|      0|      case 0x6F190:
  ------------------
  |  Branch (266:7): [True: 0, False: 7]
  ------------------
  267|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3}, "FrodoKEM-1344-SHAKE");
  268|      0|      case 0x6F24F:
  ------------------
  |  Branch (268:7): [True: 0, False: 7]
  ------------------
  269|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1}, "FrodoKEM-640-AES");
  270|      0|      case 0x6F250:
  ------------------
  |  Branch (270:7): [True: 0, False: 7]
  ------------------
  271|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2}, "FrodoKEM-976-AES");
  272|      0|      case 0x6F251:
  ------------------
  |  Branch (272:7): [True: 0, False: 7]
  ------------------
  273|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3}, "FrodoKEM-1344-AES");
  274|      0|      case 0x6F310:
  ------------------
  |  Branch (274:7): [True: 0, False: 7]
  ------------------
  275|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1}, "eFrodoKEM-640-SHAKE");
  276|      0|      case 0x6F311:
  ------------------
  |  Branch (276:7): [True: 0, False: 7]
  ------------------
  277|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2}, "eFrodoKEM-976-SHAKE");
  278|      0|      case 0x6F312:
  ------------------
  |  Branch (278:7): [True: 0, False: 7]
  ------------------
  279|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3}, "eFrodoKEM-1344-SHAKE");
  280|      0|      case 0x6F3D1:
  ------------------
  |  Branch (280:7): [True: 0, False: 7]
  ------------------
  281|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1}, "eFrodoKEM-640-AES");
  282|      0|      case 0x6F3D2:
  ------------------
  |  Branch (282:7): [True: 0, False: 7]
  ------------------
  283|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2}, "eFrodoKEM-976-AES");
  284|      0|      case 0x6F3D3:
  ------------------
  |  Branch (284:7): [True: 0, False: 7]
  ------------------
  285|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3}, "eFrodoKEM-1344-AES");
  286|      0|      case 0x6F492:
  ------------------
  |  Branch (286:7): [True: 0, False: 7]
  ------------------
  287|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1}, "ClassicMcEliece_6688128pc");
  288|      0|      case 0x6F493:
  ------------------
  |  Branch (288:7): [True: 0, False: 7]
  ------------------
  289|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2}, "ClassicMcEliece_6688128pcf");
  290|      0|      case 0x6F494:
  ------------------
  |  Branch (290:7): [True: 0, False: 7]
  ------------------
  291|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3}, "ClassicMcEliece_6960119pc");
  292|      0|      case 0x6F495:
  ------------------
  |  Branch (292:7): [True: 0, False: 7]
  ------------------
  293|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4}, "ClassicMcEliece_6960119pcf");
  294|      0|      case 0x6F496:
  ------------------
  |  Branch (294:7): [True: 0, False: 7]
  ------------------
  295|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5}, "ClassicMcEliece_8192128pc");
  296|      0|      case 0x6F497:
  ------------------
  |  Branch (296:7): [True: 0, False: 7]
  ------------------
  297|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6}, "ClassicMcEliece_8192128pcf");
  298|      0|      case 0x6F79D:
  ------------------
  |  Branch (298:7): [True: 0, False: 7]
  ------------------
  299|      0|         return if_match(oid, {2, 16, 840, 1, 113730, 1, 13}, "Certificate Comment");
  300|      0|      case 0x701A0:
  ------------------
  |  Branch (300:7): [True: 0, False: 7]
  ------------------
  301|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 2, 1}, "ECGDSA");
  302|      0|      case 0x70322:
  ------------------
  |  Branch (302:7): [True: 0, False: 7]
  ------------------
  303|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 1}, "ECGDSA/RIPEMD-160");
  304|      0|      case 0x70323:
  ------------------
  |  Branch (304:7): [True: 0, False: 7]
  ------------------
  305|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 2}, "ECGDSA/SHA-1");
  306|      0|      case 0x70324:
  ------------------
  |  Branch (306:7): [True: 0, False: 7]
  ------------------
  307|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 3}, "ECGDSA/SHA-224");
  308|      0|      case 0x70325:
  ------------------
  |  Branch (308:7): [True: 0, False: 7]
  ------------------
  309|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 4}, "ECGDSA/SHA-256");
  310|      0|      case 0x70326:
  ------------------
  |  Branch (310:7): [True: 0, False: 7]
  ------------------
  311|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 5}, "ECGDSA/SHA-384");
  312|      0|      case 0x70327:
  ------------------
  |  Branch (312:7): [True: 0, False: 7]
  ------------------
  313|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 5, 4, 6}, "ECGDSA/SHA-512");
  314|      0|      case 0x72B21:
  ------------------
  |  Branch (314:7): [True: 0, False: 7]
  ------------------
  315|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 1}, "GOST-34.10-2012-256");
  316|      0|      case 0x72B22:
  ------------------
  |  Branch (316:7): [True: 0, False: 7]
  ------------------
  317|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 1, 2}, "GOST-34.10-2012-512");
  318|      0|      case 0x72BE3:
  ------------------
  |  Branch (318:7): [True: 0, False: 7]
  ------------------
  319|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 2}, "Streebog-256");
  320|      0|      case 0x72BE4:
  ------------------
  |  Branch (320:7): [True: 0, False: 7]
  ------------------
  321|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 2, 3}, "Streebog-512");
  322|      0|      case 0x72CA4:
  ------------------
  |  Branch (322:7): [True: 0, False: 7]
  ------------------
  323|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 2}, "GOST-34.10-2012-256/Streebog-256");
  324|      0|      case 0x72CA5:
  ------------------
  |  Branch (324:7): [True: 0, False: 7]
  ------------------
  325|      0|         return if_match(oid, {1, 2, 643, 7, 1, 1, 3, 3}, "GOST-34.10-2012-512/Streebog-512");
  326|      0|      case 0x7C7C7:
  ------------------
  |  Branch (326:7): [True: 0, False: 7]
  ------------------
  327|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 1}, "PKCS9.X509Certificate");
  328|      0|      case 0x7C7C8:
  ------------------
  |  Branch (328:7): [True: 0, False: 7]
  ------------------
  329|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 22, 2}, "PKCS9.SDSICertificate");
  330|      0|      case 0x7C888:
  ------------------
  |  Branch (330:7): [True: 0, False: 7]
  ------------------
  331|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 23, 1}, "PKCS9.X509CRL");
  332|      0|      case 0x7E10F:
  ------------------
  |  Branch (332:7): [True: 0, False: 7]
  ------------------
  333|      0|         return if_match(oid, {2, 5, 4, 3}, "X520.CommonName");
  334|      0|      case 0x7E110:
  ------------------
  |  Branch (334:7): [True: 0, False: 7]
  ------------------
  335|      0|         return if_match(oid, {2, 5, 4, 4}, "X520.Surname");
  336|      0|      case 0x7E111:
  ------------------
  |  Branch (336:7): [True: 0, False: 7]
  ------------------
  337|      0|         return if_match(oid, {2, 5, 4, 5}, "X520.SerialNumber");
  338|      0|      case 0x7E112:
  ------------------
  |  Branch (338:7): [True: 0, False: 7]
  ------------------
  339|      0|         return if_match(oid, {2, 5, 4, 6}, "X520.Country");
  340|      0|      case 0x7E113:
  ------------------
  |  Branch (340:7): [True: 0, False: 7]
  ------------------
  341|      0|         return if_match(oid, {2, 5, 4, 7}, "X520.Locality");
  342|      0|      case 0x7E114:
  ------------------
  |  Branch (342:7): [True: 0, False: 7]
  ------------------
  343|      0|         return if_match(oid, {2, 5, 4, 8}, "X520.State");
  344|      0|      case 0x7E115:
  ------------------
  |  Branch (344:7): [True: 0, False: 7]
  ------------------
  345|      0|         return if_match(oid, {2, 5, 4, 9}, "X520.StreetAddress");
  346|      0|      case 0x7E116:
  ------------------
  |  Branch (346:7): [True: 0, False: 7]
  ------------------
  347|      0|         return if_match(oid, {2, 5, 4, 10}, "X520.Organization");
  348|      0|      case 0x7E117:
  ------------------
  |  Branch (348:7): [True: 0, False: 7]
  ------------------
  349|      0|         return if_match(oid, {2, 5, 4, 11}, "X520.OrganizationalUnit");
  350|      0|      case 0x7E118:
  ------------------
  |  Branch (350:7): [True: 0, False: 7]
  ------------------
  351|      0|         return if_match(oid, {2, 5, 4, 12}, "X520.Title");
  352|      0|      case 0x7E136:
  ------------------
  |  Branch (352:7): [True: 0, False: 7]
  ------------------
  353|      0|         return if_match(oid, {2, 5, 4, 42}, "X520.GivenName");
  354|      0|      case 0x7E137:
  ------------------
  |  Branch (354:7): [True: 0, False: 7]
  ------------------
  355|      0|         return if_match(oid, {2, 5, 4, 43}, "X520.Initials");
  356|      0|      case 0x7E138:
  ------------------
  |  Branch (356:7): [True: 0, False: 7]
  ------------------
  357|      0|         return if_match(oid, {2, 5, 4, 44}, "X520.GenerationalQualifier");
  358|      0|      case 0x7E13A:
  ------------------
  |  Branch (358:7): [True: 0, False: 7]
  ------------------
  359|      0|         return if_match(oid, {2, 5, 4, 46}, "X520.DNQualifier");
  360|      0|      case 0x7E14D:
  ------------------
  |  Branch (360:7): [True: 0, False: 7]
  ------------------
  361|      0|         return if_match(oid, {2, 5, 4, 65}, "X520.Pseudonym");
  362|      0|      case 0x7F3F3:
  ------------------
  |  Branch (362:7): [True: 0, False: 7]
  ------------------
  363|      0|         return if_match(oid, {2, 5, 29, 14}, "X509v3.SubjectKeyIdentifier");
  364|      0|      case 0x7F3F4:
  ------------------
  |  Branch (364:7): [True: 0, False: 7]
  ------------------
  365|      0|         return if_match(oid, {2, 5, 29, 15}, "X509v3.KeyUsage");
  366|      0|      case 0x7F3F5:
  ------------------
  |  Branch (366:7): [True: 0, False: 7]
  ------------------
  367|      0|         return if_match(oid, {2, 5, 29, 16}, "X509v3.PrivateKeyUsagePeriod");
  368|      0|      case 0x7F3F6:
  ------------------
  |  Branch (368:7): [True: 0, False: 7]
  ------------------
  369|      0|         return if_match(oid, {2, 5, 29, 17}, "X509v3.SubjectAlternativeName");
  370|      0|      case 0x7F3F7:
  ------------------
  |  Branch (370:7): [True: 0, False: 7]
  ------------------
  371|      0|         return if_match(oid, {2, 5, 29, 18}, "X509v3.IssuerAlternativeName");
  372|      0|      case 0x7F3F8:
  ------------------
  |  Branch (372:7): [True: 0, False: 7]
  ------------------
  373|      0|         return if_match(oid, {2, 5, 29, 19}, "X509v3.BasicConstraints");
  374|      0|      case 0x7F3F9:
  ------------------
  |  Branch (374:7): [True: 0, False: 7]
  ------------------
  375|      0|         return if_match(oid, {2, 5, 29, 20}, "X509v3.CRLNumber");
  376|      0|      case 0x7F3FA:
  ------------------
  |  Branch (376:7): [True: 0, False: 7]
  ------------------
  377|      0|         return if_match(oid, {2, 5, 29, 21}, "X509v3.ReasonCode");
  378|      0|      case 0x7F3FC:
  ------------------
  |  Branch (378:7): [True: 0, False: 7]
  ------------------
  379|      0|         return if_match(oid, {2, 5, 29, 23}, "X509v3.HoldInstructionCode");
  380|      0|      case 0x7F3FD:
  ------------------
  |  Branch (380:7): [True: 0, False: 7]
  ------------------
  381|      0|         return if_match(oid, {2, 5, 29, 24}, "X509v3.InvalidityDate");
  382|      0|      case 0x7F401:
  ------------------
  |  Branch (382:7): [True: 0, False: 7]
  ------------------
  383|      0|         return if_match(oid, {2, 5, 29, 28}, "X509v3.CRLIssuingDistributionPoint");
  384|      0|      case 0x7F403:
  ------------------
  |  Branch (384:7): [True: 0, False: 7]
  ------------------
  385|      0|         return if_match(oid, {2, 5, 29, 30}, "X509v3.NameConstraints");
  386|      0|      case 0x7F404:
  ------------------
  |  Branch (386:7): [True: 0, False: 7]
  ------------------
  387|      0|         return if_match(oid, {2, 5, 29, 31}, "X509v3.CRLDistributionPoints");
  388|      0|      case 0x7F405:
  ------------------
  |  Branch (388:7): [True: 0, False: 7]
  ------------------
  389|      0|         return if_match(oid, {2, 5, 29, 32}, "X509v3.CertificatePolicies");
  390|      0|      case 0x7F408:
  ------------------
  |  Branch (390:7): [True: 0, False: 7]
  ------------------
  391|      0|         return if_match(oid, {2, 5, 29, 35}, "X509v3.AuthorityKeyIdentifier");
  392|      0|      case 0x7F409:
  ------------------
  |  Branch (392:7): [True: 0, False: 7]
  ------------------
  393|      0|         return if_match(oid, {2, 5, 29, 36}, "X509v3.PolicyConstraints");
  394|      0|      case 0x7F40A:
  ------------------
  |  Branch (394:7): [True: 0, False: 7]
  ------------------
  395|      0|         return if_match(oid, {2, 5, 29, 37}, "X509v3.ExtendedKeyUsage");
  396|      0|      case 0x7F41D:
  ------------------
  |  Branch (396:7): [True: 0, False: 7]
  ------------------
  397|      0|         return if_match(oid, {2, 5, 29, 56}, "X509v3.NoRevocationAvailable");
  398|      0|      case 0x80B84:
  ------------------
  |  Branch (398:7): [True: 0, False: 7]
  ------------------
  399|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1}, "AES-128/OCB");
  400|      0|      case 0x80B85:
  ------------------
  |  Branch (400:7): [True: 0, False: 7]
  ------------------
  401|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2}, "AES-192/OCB");
  402|      0|      case 0x80B86:
  ------------------
  |  Branch (402:7): [True: 0, False: 7]
  ------------------
  403|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3}, "AES-256/OCB");
  404|      0|      case 0x80B87:
  ------------------
  |  Branch (404:7): [True: 0, False: 7]
  ------------------
  405|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4}, "Serpent/OCB");
  406|      0|      case 0x80B88:
  ------------------
  |  Branch (406:7): [True: 0, False: 7]
  ------------------
  407|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5}, "Twofish/OCB");
  408|      0|      case 0x80B89:
  ------------------
  |  Branch (408:7): [True: 0, False: 7]
  ------------------
  409|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6}, "Camellia-128/OCB");
  410|      0|      case 0x80B8A:
  ------------------
  |  Branch (410:7): [True: 0, False: 7]
  ------------------
  411|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7}, "Camellia-192/OCB");
  412|      0|      case 0x80B8B:
  ------------------
  |  Branch (412:7): [True: 0, False: 7]
  ------------------
  413|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8}, "Camellia-256/OCB");
  414|      0|      case 0x80D06:
  ------------------
  |  Branch (414:7): [True: 0, False: 7]
  ------------------
  415|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1}, "AES-128/SIV");
  416|      0|      case 0x80D07:
  ------------------
  |  Branch (416:7): [True: 0, False: 7]
  ------------------
  417|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2}, "AES-192/SIV");
  418|      0|      case 0x80D08:
  ------------------
  |  Branch (418:7): [True: 0, False: 7]
  ------------------
  419|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3}, "AES-256/SIV");
  420|      0|      case 0x80D09:
  ------------------
  |  Branch (420:7): [True: 0, False: 7]
  ------------------
  421|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4}, "Serpent/SIV");
  422|      0|      case 0x80D0A:
  ------------------
  |  Branch (422:7): [True: 0, False: 7]
  ------------------
  423|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5}, "Twofish/SIV");
  424|      0|      case 0x80D0B:
  ------------------
  |  Branch (424:7): [True: 0, False: 7]
  ------------------
  425|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6}, "Camellia-128/SIV");
  426|      0|      case 0x80D0C:
  ------------------
  |  Branch (426:7): [True: 0, False: 7]
  ------------------
  427|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7}, "Camellia-192/SIV");
  428|      0|      case 0x80D0D:
  ------------------
  |  Branch (428:7): [True: 0, False: 7]
  ------------------
  429|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8}, "Camellia-256/SIV");
  430|      0|      case 0x80D0E:
  ------------------
  |  Branch (430:7): [True: 0, False: 7]
  ------------------
  431|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9}, "SM4/SIV");
  432|      0|      case 0x84C6A:
  ------------------
  |  Branch (432:7): [True: 0, False: 7]
  ------------------
  433|      0|         return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 2}, "Camellia-128/CBC");
  434|      0|      case 0x84C6B:
  ------------------
  |  Branch (434:7): [True: 0, False: 7]
  ------------------
  435|      0|         return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 3}, "Camellia-192/CBC");
  436|      0|      case 0x84C6C:
  ------------------
  |  Branch (436:7): [True: 0, False: 7]
  ------------------
  437|      0|         return if_match(oid, {1, 2, 392, 200011, 61, 1, 1, 1, 4}, "Camellia-256/CBC");
  438|      0|      case 0x88CD3:
  ------------------
  |  Branch (438:7): [True: 0, False: 7]
  ------------------
  439|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 6}, "KeyWrap.TripleDES");
  440|      0|      case 0x88CD5:
  ------------------
  |  Branch (440:7): [True: 0, False: 7]
  ------------------
  441|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 8}, "Compression.Zlib");
  442|      0|      case 0x88CDE:
  ------------------
  |  Branch (442:7): [True: 0, False: 7]
  ------------------
  443|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 17}, "HSS-LMS");
  444|      0|      case 0x88CDF:
  ------------------
  |  Branch (444:7): [True: 0, False: 7]
  ------------------
  445|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 16, 3, 18}, "ChaCha20Poly1305");
  446|      0|      case 0x92296:
  ------------------
  |  Branch (446:7): [True: 0, False: 7]
  ------------------
  447|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 2}, "AES-128/CBC");
  448|      0|      case 0x92299:
  ------------------
  |  Branch (448:7): [True: 0, False: 7]
  ------------------
  449|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 5}, "KeyWrap.AES-128");
  450|      0|      case 0x9229A:
  ------------------
  |  Branch (450:7): [True: 0, False: 7]
  ------------------
  451|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 6}, "AES-128/GCM");
  452|      0|      case 0x9229B:
  ------------------
  |  Branch (452:7): [True: 0, False: 7]
  ------------------
  453|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 7}, "AES-128/CCM");
  454|      0|      case 0x922AA:
  ------------------
  |  Branch (454:7): [True: 0, False: 7]
  ------------------
  455|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 22}, "AES-192/CBC");
  456|      0|      case 0x922AD:
  ------------------
  |  Branch (456:7): [True: 0, False: 7]
  ------------------
  457|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 25}, "KeyWrap.AES-192");
  458|      0|      case 0x922AE:
  ------------------
  |  Branch (458:7): [True: 0, False: 7]
  ------------------
  459|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 26}, "AES-192/GCM");
  460|      0|      case 0x922AF:
  ------------------
  |  Branch (460:7): [True: 0, False: 7]
  ------------------
  461|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 27}, "AES-192/CCM");
  462|      0|      case 0x922BE:
  ------------------
  |  Branch (462:7): [True: 0, False: 7]
  ------------------
  463|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 42}, "AES-256/CBC");
  464|      0|      case 0x922C1:
  ------------------
  |  Branch (464:7): [True: 0, False: 7]
  ------------------
  465|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 45}, "KeyWrap.AES-256");
  466|      0|      case 0x922C2:
  ------------------
  |  Branch (466:7): [True: 0, False: 7]
  ------------------
  467|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 46}, "AES-256/GCM");
  468|      0|      case 0x922C3:
  ------------------
  |  Branch (468:7): [True: 0, False: 7]
  ------------------
  469|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 1, 47}, "AES-256/CCM");
  470|      0|      case 0x92356:
  ------------------
  |  Branch (470:7): [True: 0, False: 7]
  ------------------
  471|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 1}, "SHA-256");
  472|      0|      case 0x92357:
  ------------------
  |  Branch (472:7): [True: 0, False: 7]
  ------------------
  473|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 2}, "SHA-384");
  474|      0|      case 0x92358:
  ------------------
  |  Branch (474:7): [True: 0, False: 7]
  ------------------
  475|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 3}, "SHA-512");
  476|      0|      case 0x92359:
  ------------------
  |  Branch (476:7): [True: 0, False: 7]
  ------------------
  477|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 4}, "SHA-224");
  478|      0|      case 0x9235B:
  ------------------
  |  Branch (478:7): [True: 0, False: 7]
  ------------------
  479|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 6}, "SHA-512-256");
  480|      0|      case 0x9235C:
  ------------------
  |  Branch (480:7): [True: 0, False: 7]
  ------------------
  481|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 7}, "SHA-3(224)");
  482|      0|      case 0x9235D:
  ------------------
  |  Branch (482:7): [True: 0, False: 7]
  ------------------
  483|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 8}, "SHA-3(256)");
  484|      0|      case 0x9235E:
  ------------------
  |  Branch (484:7): [True: 0, False: 7]
  ------------------
  485|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 9}, "SHA-3(384)");
  486|      0|      case 0x9235F:
  ------------------
  |  Branch (486:7): [True: 0, False: 7]
  ------------------
  487|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 10}, "SHA-3(512)");
  488|      0|      case 0x92360:
  ------------------
  |  Branch (488:7): [True: 0, False: 7]
  ------------------
  489|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 11}, "SHAKE-128");
  490|      0|      case 0x92361:
  ------------------
  |  Branch (490:7): [True: 0, False: 7]
  ------------------
  491|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 2, 12}, "SHAKE-256");
  492|      0|      case 0x92417:
  ------------------
  |  Branch (492:7): [True: 0, False: 7]
  ------------------
  493|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 1}, "DSA/SHA-224");
  494|      0|      case 0x92418:
  ------------------
  |  Branch (494:7): [True: 0, False: 7]
  ------------------
  495|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 2}, "DSA/SHA-256");
  496|      0|      case 0x92419:
  ------------------
  |  Branch (496:7): [True: 0, False: 7]
  ------------------
  497|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 3}, "DSA/SHA-384");
  498|      0|      case 0x9241A:
  ------------------
  |  Branch (498:7): [True: 0, False: 7]
  ------------------
  499|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 4}, "DSA/SHA-512");
  500|      0|      case 0x9241B:
  ------------------
  |  Branch (500:7): [True: 0, False: 7]
  ------------------
  501|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 5}, "DSA/SHA-3(224)");
  502|      0|      case 0x9241C:
  ------------------
  |  Branch (502:7): [True: 0, False: 7]
  ------------------
  503|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 6}, "DSA/SHA-3(256)");
  504|      0|      case 0x9241D:
  ------------------
  |  Branch (504:7): [True: 0, False: 7]
  ------------------
  505|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 7}, "DSA/SHA-3(384)");
  506|      0|      case 0x9241E:
  ------------------
  |  Branch (506:7): [True: 0, False: 7]
  ------------------
  507|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 8}, "DSA/SHA-3(512)");
  508|      0|      case 0x9241F:
  ------------------
  |  Branch (508:7): [True: 0, False: 7]
  ------------------
  509|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 9}, "ECDSA/SHA-3(224)");
  510|      0|      case 0x92420:
  ------------------
  |  Branch (510:7): [True: 0, False: 7]
  ------------------
  511|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 10}, "ECDSA/SHA-3(256)");
  512|      0|      case 0x92421:
  ------------------
  |  Branch (512:7): [True: 0, False: 7]
  ------------------
  513|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 11}, "ECDSA/SHA-3(384)");
  514|      0|      case 0x92422:
  ------------------
  |  Branch (514:7): [True: 0, False: 7]
  ------------------
  515|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 12}, "ECDSA/SHA-3(512)");
  516|      0|      case 0x92423:
  ------------------
  |  Branch (516:7): [True: 0, False: 7]
  ------------------
  517|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 13}, "RSA/PKCS1v15(SHA-3(224))");
  518|      0|      case 0x92424:
  ------------------
  |  Branch (518:7): [True: 0, False: 7]
  ------------------
  519|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 14}, "RSA/PKCS1v15(SHA-3(256))");
  520|      0|      case 0x92425:
  ------------------
  |  Branch (520:7): [True: 0, False: 7]
  ------------------
  521|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 15}, "RSA/PKCS1v15(SHA-3(384))");
  522|      0|      case 0x92426:
  ------------------
  |  Branch (522:7): [True: 0, False: 7]
  ------------------
  523|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 16}, "RSA/PKCS1v15(SHA-3(512))");
  524|      0|      case 0x92427:
  ------------------
  |  Branch (524:7): [True: 0, False: 7]
  ------------------
  525|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 17}, "ML-DSA-4x4");
  526|      0|      case 0x92428:
  ------------------
  |  Branch (526:7): [True: 0, False: 7]
  ------------------
  527|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 18}, "ML-DSA-6x5");
  528|      0|      case 0x92429:
  ------------------
  |  Branch (528:7): [True: 0, False: 7]
  ------------------
  529|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 19}, "ML-DSA-8x7");
  530|      0|      case 0x9242A:
  ------------------
  |  Branch (530:7): [True: 0, False: 7]
  ------------------
  531|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 20}, "SLH-DSA-SHA2-128s");
  532|      0|      case 0x9242B:
  ------------------
  |  Branch (532:7): [True: 0, False: 7]
  ------------------
  533|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 21}, "SLH-DSA-SHA2-128f");
  534|      0|      case 0x9242C:
  ------------------
  |  Branch (534:7): [True: 0, False: 7]
  ------------------
  535|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 22}, "SLH-DSA-SHA2-192s");
  536|      0|      case 0x9242D:
  ------------------
  |  Branch (536:7): [True: 0, False: 7]
  ------------------
  537|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 23}, "SLH-DSA-SHA2-192f");
  538|      0|      case 0x9242E:
  ------------------
  |  Branch (538:7): [True: 0, False: 7]
  ------------------
  539|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 24}, "SLH-DSA-SHA2-256s");
  540|      0|      case 0x9242F:
  ------------------
  |  Branch (540:7): [True: 0, False: 7]
  ------------------
  541|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 25}, "SLH-DSA-SHA2-256f");
  542|      0|      case 0x92430:
  ------------------
  |  Branch (542:7): [True: 0, False: 7]
  ------------------
  543|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 26}, "SLH-DSA-SHAKE-128s");
  544|      0|      case 0x92431:
  ------------------
  |  Branch (544:7): [True: 0, False: 7]
  ------------------
  545|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 27}, "SLH-DSA-SHAKE-128f");
  546|      0|      case 0x92432:
  ------------------
  |  Branch (546:7): [True: 0, False: 7]
  ------------------
  547|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 28}, "SLH-DSA-SHAKE-192s");
  548|      0|      case 0x92433:
  ------------------
  |  Branch (548:7): [True: 0, False: 7]
  ------------------
  549|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 29}, "SLH-DSA-SHAKE-192f");
  550|      0|      case 0x92434:
  ------------------
  |  Branch (550:7): [True: 0, False: 7]
  ------------------
  551|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 30}, "SLH-DSA-SHAKE-256s");
  552|      0|      case 0x92435:
  ------------------
  |  Branch (552:7): [True: 0, False: 7]
  ------------------
  553|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 3, 31}, "SLH-DSA-SHAKE-256f");
  554|      0|      case 0x924D8:
  ------------------
  |  Branch (554:7): [True: 0, False: 7]
  ------------------
  555|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 1}, "ML-KEM-512");
  556|      0|      case 0x924D9:
  ------------------
  |  Branch (556:7): [True: 0, False: 7]
  ------------------
  557|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 2}, "ML-KEM-768");
  558|      0|      case 0x924DA:
  ------------------
  |  Branch (558:7): [True: 0, False: 7]
  ------------------
  559|      0|         return if_match(oid, {2, 16, 840, 1, 101, 3, 4, 4, 3}, "ML-KEM-1024");
  560|      0|      case 0x9479F:
  ------------------
  |  Branch (560:7): [True: 0, False: 7]
  ------------------
  561|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 1}, "PKIX.AuthorityInformationAccess");
  562|      0|      case 0x947A5:
  ------------------
  |  Branch (562:7): [True: 0, False: 7]
  ------------------
  563|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 7}, "PKIX.IpAddrBlocks");
  564|      0|      case 0x947A6:
  ------------------
  |  Branch (564:7): [True: 0, False: 7]
  ------------------
  565|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 8}, "PKIX.AutonomousSysIds");
  566|      0|      case 0x947B8:
  ------------------
  |  Branch (566:7): [True: 0, False: 7]
  ------------------
  567|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 1, 26}, "PKIX.TNAuthList");
  568|      0|      case 0x94921:
  ------------------
  |  Branch (568:7): [True: 0, False: 7]
  ------------------
  569|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 1}, "PKIX.ServerAuth");
  570|      0|      case 0x94922:
  ------------------
  |  Branch (570:7): [True: 0, False: 7]
  ------------------
  571|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 2}, "PKIX.ClientAuth");
  572|      0|      case 0x94923:
  ------------------
  |  Branch (572:7): [True: 0, False: 7]
  ------------------
  573|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 3}, "PKIX.CodeSigning");
  574|      0|      case 0x94924:
  ------------------
  |  Branch (574:7): [True: 0, False: 7]
  ------------------
  575|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 4}, "PKIX.EmailProtection");
  576|      0|      case 0x94925:
  ------------------
  |  Branch (576:7): [True: 0, False: 7]
  ------------------
  577|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 5}, "PKIX.IPsecEndSystem");
  578|      0|      case 0x94926:
  ------------------
  |  Branch (578:7): [True: 0, False: 7]
  ------------------
  579|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 6}, "PKIX.IPsecTunnel");
  580|      0|      case 0x94927:
  ------------------
  |  Branch (580:7): [True: 0, False: 7]
  ------------------
  581|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 7}, "PKIX.IPsecUser");
  582|      0|      case 0x94928:
  ------------------
  |  Branch (582:7): [True: 0, False: 7]
  ------------------
  583|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 8}, "PKIX.TimeStamping");
  584|      0|      case 0x94929:
  ------------------
  |  Branch (584:7): [True: 0, False: 7]
  ------------------
  585|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 3, 9}, "PKIX.OCSPSigning");
  586|      0|      case 0x94CEA:
  ------------------
  |  Branch (586:7): [True: 0, False: 7]
  ------------------
  587|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 8, 5}, "PKIX.XMPPAddr");
  588|      0|      case 0x954DB:
  ------------------
  |  Branch (588:7): [True: 0, False: 7]
  ------------------
  589|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 2}, "Microsoft SmartcardLogon");
  590|      0|      case 0x954DC:
  ------------------
  |  Branch (590:7): [True: 0, False: 7]
  ------------------
  591|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 311, 20, 2, 3}, "Microsoft UPN");
  592|      0|      case 0x96B0E:
  ------------------
  |  Branch (592:7): [True: 0, False: 7]
  ------------------
  593|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 1}, "PKIX.OCSP");
  594|      0|      case 0x96B0F:
  ------------------
  |  Branch (594:7): [True: 0, False: 7]
  ------------------
  595|      0|         return if_match(oid, {1, 3, 6, 1, 5, 5, 7, 48, 2}, "PKIX.CertificateAuthorityIssuers");
  596|      0|      case 0x96C77:
  ------------------
  |  Branch (596:7): [True: 0, False: 7]
  ------------------
  597|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 3}, "PBE-SHA1-3DES");
  598|      0|      case 0x96C78:
  ------------------
  |  Branch (598:7): [True: 0, False: 7]
  ------------------
  599|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 12, 1, 4}, "PBE-SHA1-2DES");
  600|      0|      case 0x9A008:
  ------------------
  |  Branch (600:7): [True: 0, False: 7]
  ------------------
  601|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 1}, "brainpool160r1");
  602|      0|      case 0x9A00A:
  ------------------
  |  Branch (602:7): [True: 0, False: 7]
  ------------------
  603|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 3}, "brainpool192r1");
  604|      0|      case 0x9A00C:
  ------------------
  |  Branch (604:7): [True: 0, False: 7]
  ------------------
  605|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 5}, "brainpool224r1");
  606|      1|      case 0x9A00E:
  ------------------
  |  Branch (606:7): [True: 1, False: 6]
  ------------------
  607|      1|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 7}, "brainpool256r1");
  608|      0|      case 0x9A010:
  ------------------
  |  Branch (608:7): [True: 0, False: 7]
  ------------------
  609|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 9}, "brainpool320r1");
  610|      0|      case 0x9A012:
  ------------------
  |  Branch (610:7): [True: 0, False: 7]
  ------------------
  611|      0|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 11}, "brainpool384r1");
  612|      1|      case 0x9A014:
  ------------------
  |  Branch (612:7): [True: 1, False: 6]
  ------------------
  613|      1|         return if_match(oid, {1, 3, 36, 3, 3, 2, 8, 1, 1, 13}, "brainpool512r1");
  614|      0|      case 0xA0D61:
  ------------------
  |  Branch (614:7): [True: 0, False: 7]
  ------------------
  615|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 3}, "McEliece");
  616|      0|      case 0xA0D63:
  ------------------
  |  Branch (616:7): [True: 0, False: 7]
  ------------------
  617|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 5}, "XMSS-draft6");
  618|      0|      case 0xA0D66:
  ------------------
  |  Branch (618:7): [True: 0, False: 7]
  ------------------
  619|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 8}, "XMSS-draft12");
  620|      0|      case 0xA0D6B:
  ------------------
  |  Branch (620:7): [True: 0, False: 7]
  ------------------
  621|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 1, 13}, "HSS-LMS-Private-Key");
  622|      0|      case 0xA0EE1:
  ------------------
  |  Branch (622:7): [True: 0, False: 7]
  ------------------
  623|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 1}, "Serpent/CBC");
  624|      0|      case 0xA0EE2:
  ------------------
  |  Branch (624:7): [True: 0, False: 7]
  ------------------
  625|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 2}, "Threefish-512/CBC");
  626|      0|      case 0xA0EE3:
  ------------------
  |  Branch (626:7): [True: 0, False: 7]
  ------------------
  627|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 3}, "Twofish/CBC");
  628|      0|      case 0xA0F45:
  ------------------
  |  Branch (628:7): [True: 0, False: 7]
  ------------------
  629|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 101}, "Serpent/GCM");
  630|      0|      case 0xA0F46:
  ------------------
  |  Branch (630:7): [True: 0, False: 7]
  ------------------
  631|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 3, 102}, "Twofish/GCM");
  632|      0|      case 0xA0FA2:
  ------------------
  |  Branch (632:7): [True: 0, False: 7]
  ------------------
  633|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 1}, "numsp256d1");
  634|      0|      case 0xA0FA3:
  ------------------
  |  Branch (634:7): [True: 0, False: 7]
  ------------------
  635|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 2}, "numsp384d1");
  636|      0|      case 0xA0FA4:
  ------------------
  |  Branch (636:7): [True: 0, False: 7]
  ------------------
  637|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 25258, 4, 3}, "numsp512d1");
  638|      0|      case 0xA244B:
  ------------------
  |  Branch (638:7): [True: 0, False: 7]
  ------------------
  639|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1}, "ClassicMcEliece_348864");
  640|      0|      case 0xA244C:
  ------------------
  |  Branch (640:7): [True: 0, False: 7]
  ------------------
  641|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2}, "ClassicMcEliece_348864f");
  642|      0|      case 0xA244D:
  ------------------
  |  Branch (642:7): [True: 0, False: 7]
  ------------------
  643|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3}, "ClassicMcEliece_460896");
  644|      0|      case 0xA244E:
  ------------------
  |  Branch (644:7): [True: 0, False: 7]
  ------------------
  645|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4}, "ClassicMcEliece_460896f");
  646|      0|      case 0xA244F:
  ------------------
  |  Branch (646:7): [True: 0, False: 7]
  ------------------
  647|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5}, "ClassicMcEliece_6688128");
  648|      0|      case 0xA2450:
  ------------------
  |  Branch (648:7): [True: 0, False: 7]
  ------------------
  649|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6}, "ClassicMcEliece_6688128f");
  650|      0|      case 0xA2451:
  ------------------
  |  Branch (650:7): [True: 0, False: 7]
  ------------------
  651|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7}, "ClassicMcEliece_6960119");
  652|      0|      case 0xA2452:
  ------------------
  |  Branch (652:7): [True: 0, False: 7]
  ------------------
  653|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8}, "ClassicMcEliece_6960119f");
  654|      0|      case 0xA2453:
  ------------------
  |  Branch (654:7): [True: 0, False: 7]
  ------------------
  655|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9}, "ClassicMcEliece_8192128");
  656|      0|      case 0xA2454:
  ------------------
  |  Branch (656:7): [True: 0, False: 7]
  ------------------
  657|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10}, "ClassicMcEliece_8192128f");
  658|      0|      case 0xAF989:
  ------------------
  |  Branch (658:7): [True: 0, False: 7]
  ------------------
  659|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 1}, "RSA");
  660|      0|      case 0xAF98A:
  ------------------
  |  Branch (660:7): [True: 0, False: 7]
  ------------------
  661|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 2}, "RSA/PKCS1v15(MD2)");
  662|      0|      case 0xAF98C:
  ------------------
  |  Branch (662:7): [True: 0, False: 7]
  ------------------
  663|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 4}, "RSA/PKCS1v15(MD5)");
  664|      0|      case 0xAF98D:
  ------------------
  |  Branch (664:7): [True: 0, False: 7]
  ------------------
  665|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 5}, "RSA/PKCS1v15(SHA-1)");
  666|      0|      case 0xAF98F:
  ------------------
  |  Branch (666:7): [True: 0, False: 7]
  ------------------
  667|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 7}, "RSA/OAEP");
  668|      0|      case 0xAF990:
  ------------------
  |  Branch (668:7): [True: 0, False: 7]
  ------------------
  669|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 8}, "MGF1");
  670|      0|      case 0xAF992:
  ------------------
  |  Branch (670:7): [True: 0, False: 7]
  ------------------
  671|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 10}, "RSA/PSS");
  672|      0|      case 0xAF993:
  ------------------
  |  Branch (672:7): [True: 0, False: 7]
  ------------------
  673|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 11}, "RSA/PKCS1v15(SHA-256)");
  674|      0|      case 0xAF994:
  ------------------
  |  Branch (674:7): [True: 0, False: 7]
  ------------------
  675|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 12}, "RSA/PKCS1v15(SHA-384)");
  676|      0|      case 0xAF995:
  ------------------
  |  Branch (676:7): [True: 0, False: 7]
  ------------------
  677|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 13}, "RSA/PKCS1v15(SHA-512)");
  678|      0|      case 0xAF996:
  ------------------
  |  Branch (678:7): [True: 0, False: 7]
  ------------------
  679|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 14}, "RSA/PKCS1v15(SHA-224)");
  680|      0|      case 0xAF998:
  ------------------
  |  Branch (680:7): [True: 0, False: 7]
  ------------------
  681|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 1, 16}, "RSA/PKCS1v15(SHA-512-256)");
  682|      0|      case 0xAFC98:
  ------------------
  |  Branch (682:7): [True: 0, False: 7]
  ------------------
  683|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 5, 12}, "PKCS5.PBKDF2");
  684|      0|      case 0xAFC99:
  ------------------
  |  Branch (684:7): [True: 0, False: 7]
  ------------------
  685|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 5, 13}, "PBE-PKCS5v20");
  686|      0|      case 0xAFE0F:
  ------------------
  |  Branch (686:7): [True: 0, False: 7]
  ------------------
  687|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 7, 1}, "PKCS7.Data");
  688|      0|      case 0xAFE14:
  ------------------
  |  Branch (688:7): [True: 0, False: 7]
  ------------------
  689|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 7, 6}, "PKCS7.EncryptedData");
  690|      0|      case 0xAFF91:
  ------------------
  |  Branch (690:7): [True: 0, False: 7]
  ------------------
  691|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 1}, "PKCS9.EmailAddress");
  692|      0|      case 0xAFF92:
  ------------------
  |  Branch (692:7): [True: 0, False: 7]
  ------------------
  693|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 2}, "PKCS9.UnstructuredName");
  694|      0|      case 0xAFF93:
  ------------------
  |  Branch (694:7): [True: 0, False: 7]
  ------------------
  695|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 3}, "PKCS9.ContentType");
  696|      0|      case 0xAFF94:
  ------------------
  |  Branch (696:7): [True: 0, False: 7]
  ------------------
  697|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 4}, "PKCS9.MessageDigest");
  698|      0|      case 0xAFF97:
  ------------------
  |  Branch (698:7): [True: 0, False: 7]
  ------------------
  699|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 7}, "PKCS9.ChallengePassword");
  700|      0|      case 0xAFF9E:
  ------------------
  |  Branch (700:7): [True: 0, False: 7]
  ------------------
  701|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 14}, "PKCS9.ExtensionRequest");
  702|      0|      case 0xAFFA4:
  ------------------
  |  Branch (702:7): [True: 0, False: 7]
  ------------------
  703|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 20}, "PKCS9.FriendlyName");
  704|      0|      case 0xAFFA5:
  ------------------
  |  Branch (704:7): [True: 0, False: 7]
  ------------------
  705|      0|         return if_match(oid, {1, 2, 840, 113549, 1, 9, 21}, "PKCS9.LocalKeyId");
  706|      0|      case 0xC0226:
  ------------------
  |  Branch (706:7): [True: 0, False: 7]
  ------------------
  707|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 4, 11}, "Scrypt");
  708|      0|      case 0xC0A67:
  ------------------
  |  Branch (708:7): [True: 0, False: 7]
  ------------------
  709|      0|         return if_match(oid, {1, 3, 6, 1, 4, 1, 11591, 15, 1}, "OpenPGP.Ed25519");
  710|      0|      case 0xC4CE5:
  ------------------
  |  Branch (710:7): [True: 0, False: 7]
  ------------------
  711|      0|         return if_match(oid, {1, 2, 643, 100, 1}, "GOST.OGRN");
  712|      0|      case 0xC4D53:
  ------------------
  |  Branch (712:7): [True: 0, False: 7]
  ------------------
  713|      0|         return if_match(oid, {1, 2, 643, 100, 111}, "GOST.SubjectSigningTool");
  714|      0|      case 0xC4D54:
  ------------------
  |  Branch (714:7): [True: 0, False: 7]
  ------------------
  715|      0|         return if_match(oid, {1, 2, 643, 100, 112}, "GOST.IssuerSigningTool");
  716|      1|      case 0xC9C50:
  ------------------
  |  Branch (716:7): [True: 1, False: 6]
  ------------------
  717|      1|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 1}, "secp192r1");
  718|      0|      case 0xC9C51:
  ------------------
  |  Branch (718:7): [True: 0, False: 7]
  ------------------
  719|      0|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 2}, "x962_p192v2");
  720|      0|      case 0xC9C52:
  ------------------
  |  Branch (720:7): [True: 0, False: 7]
  ------------------
  721|      0|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 3}, "x962_p192v3");
  722|      0|      case 0xC9C53:
  ------------------
  |  Branch (722:7): [True: 0, False: 7]
  ------------------
  723|      0|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 4}, "x962_p239v1");
  724|      0|      case 0xC9C54:
  ------------------
  |  Branch (724:7): [True: 0, False: 7]
  ------------------
  725|      0|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 5}, "x962_p239v2");
  726|      0|      case 0xC9C55:
  ------------------
  |  Branch (726:7): [True: 0, False: 7]
  ------------------
  727|      0|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 6}, "x962_p239v3");
  728|      1|      case 0xC9C56:
  ------------------
  |  Branch (728:7): [True: 1, False: 6]
  ------------------
  729|      1|         return if_match(oid, {1, 2, 840, 10045, 3, 1, 7}, "secp256r1");
  730|      0|      case 0xCFA13:
  ------------------
  |  Branch (730:7): [True: 0, False: 7]
  ------------------
  731|      0|         return if_match(oid, {1, 2, 840, 10040, 4, 1}, "DSA");
  732|      0|      case 0xCFA15:
  ------------------
  |  Branch (732:7): [True: 0, False: 7]
  ------------------
  733|      0|         return if_match(oid, {1, 2, 840, 10040, 4, 3}, "DSA/SHA-1");
  734|      0|      default:
  ------------------
  |  Branch (734:7): [True: 0, False: 7]
  ------------------
  735|      0|         return {};
  736|      7|   }
  737|      7|}
_ZN5Botan7OID_Map22lookup_static_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  740|      7|std::optional<OID> OID_Map::lookup_static_oid_name(std::string_view req) {
  741|      7|   const uint32_t hc = hash_oid_name(req);
  742|       |
  743|      7|   switch(hc) {
  744|      0|      case 0x00545:
  ------------------
  |  Branch (744:7): [True: 0, False: 7]
  ------------------
  745|      0|         return if_match(req, "Twofish/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 102});
  746|      0|      case 0x00CF3:
  ------------------
  |  Branch (746:7): [True: 0, False: 7]
  ------------------
  747|      0|         return if_match(req, "SphincsPlus-sha2-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 4});
  748|      0|      case 0x015FE:
  ------------------
  |  Branch (748:7): [True: 0, False: 7]
  ------------------
  749|      0|         return if_match(req, "FrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 1});
  750|      0|      case 0x01F9E:
  ------------------
  |  Branch (750:7): [True: 0, False: 7]
  ------------------
  751|      0|         return if_match(req, "MD5", {1, 2, 840, 113549, 2, 5});
  752|      0|      case 0x02293:
  ------------------
  |  Branch (752:7): [True: 0, False: 7]
  ------------------
  753|      0|         return if_match(req, "SphincsPlus-shake-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 4});
  754|      0|      case 0x02B93:
  ------------------
  |  Branch (754:7): [True: 0, False: 7]
  ------------------
  755|      0|         return if_match(req, "Microsoft SmartcardLogon", {1, 3, 6, 1, 4, 1, 311, 20, 2, 2});
  756|      0|      case 0x041D5:
  ------------------
  |  Branch (756:7): [True: 0, False: 7]
  ------------------
  757|      0|         return if_match(req, "secp160k1", {1, 3, 132, 0, 9});
  758|      0|      case 0x044B3:
  ------------------
  |  Branch (758:7): [True: 0, False: 7]
  ------------------
  759|      0|         return if_match(req, "Camellia-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 8});
  760|      0|      case 0x048B2:
  ------------------
  |  Branch (760:7): [True: 0, False: 7]
  ------------------
  761|      0|         return if_match(req, "secp160r1", {1, 3, 132, 0, 8});
  762|      0|      case 0x048B3:
  ------------------
  |  Branch (762:7): [True: 0, False: 7]
  ------------------
  763|      0|         return if_match(req, "secp160r2", {1, 3, 132, 0, 30});
  764|      0|      case 0x05CDA:
  ------------------
  |  Branch (764:7): [True: 0, False: 7]
  ------------------
  765|      0|         return if_match(req, "X520.Country", {2, 5, 4, 6});
  766|      0|      case 0x07783:
  ------------------
  |  Branch (766:7): [True: 0, False: 7]
  ------------------
  767|      0|         return if_match(req, "PKIX.ServerAuth", {1, 3, 6, 1, 5, 5, 7, 3, 1});
  768|      0|      case 0x086C7:
  ------------------
  |  Branch (768:7): [True: 0, False: 7]
  ------------------
  769|      0|         return if_match(req, "numsp384d1", {1, 3, 6, 1, 4, 1, 25258, 4, 2});
  770|      0|      case 0x08A92:
  ------------------
  |  Branch (770:7): [True: 0, False: 7]
  ------------------
  771|      0|         return if_match(req, "RSA/PKCS1v15(SHA-1)", {1, 2, 840, 113549, 1, 1, 5});
  772|      0|      case 0x09EA0:
  ------------------
  |  Branch (772:7): [True: 0, False: 7]
  ------------------
  773|      0|         return if_match(req, "DES/CBC", {1, 3, 14, 3, 2, 7});
  774|      0|      case 0x0B2D6:
  ------------------
  |  Branch (774:7): [True: 0, False: 7]
  ------------------
  775|      0|         return if_match(req, "ECDSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 12});
  776|      0|      case 0x0BA72:
  ------------------
  |  Branch (776:7): [True: 0, False: 7]
  ------------------
  777|      0|         return if_match(req, "SphincsPlus-sha2-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 1});
  778|      0|      case 0x0BE23:
  ------------------
  |  Branch (778:7): [True: 0, False: 7]
  ------------------
  779|      0|         return if_match(req, "ECGDSA", {1, 3, 36, 3, 3, 2, 5, 2, 1});
  780|      0|      case 0x0C109:
  ------------------
  |  Branch (780:7): [True: 0, False: 7]
  ------------------
  781|      0|         return if_match(req, "PKCS9.FriendlyName", {1, 2, 840, 113549, 1, 9, 20});
  782|      0|      case 0x0D012:
  ------------------
  |  Branch (782:7): [True: 0, False: 7]
  ------------------
  783|      0|         return if_match(req, "SphincsPlus-shake-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 1});
  784|      0|      case 0x0DCE9:
  ------------------
  |  Branch (784:7): [True: 0, False: 7]
  ------------------
  785|      0|         return if_match(req, "ClassicMcEliece_8192128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 10});
  786|      0|      case 0x0E52A:
  ------------------
  |  Branch (786:7): [True: 0, False: 7]
  ------------------
  787|      0|         return if_match(req, "numsp512d1", {1, 3, 6, 1, 4, 1, 25258, 4, 3});
  788|      0|      case 0x0F9CC:
  ------------------
  |  Branch (788:7): [True: 0, False: 7]
  ------------------
  789|      0|         return if_match(req, "PKCS9.UnstructuredName", {1, 2, 840, 113549, 1, 9, 2});
  790|      0|      case 0x0FF45:
  ------------------
  |  Branch (790:7): [True: 0, False: 7]
  ------------------
  791|      0|         return if_match(req, "Camellia-256/GCM", {0, 3, 4401, 5, 3, 1, 9, 46});
  792|      0|      case 0x1033D:
  ------------------
  |  Branch (792:7): [True: 0, False: 7]
  ------------------
  793|      0|         return if_match(req, "DSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 7});
  794|      0|      case 0x1139D:
  ------------------
  |  Branch (794:7): [True: 0, False: 7]
  ------------------
  795|      0|         return if_match(req, "secp192k1", {1, 3, 132, 0, 31});
  796|      0|      case 0x113D6:
  ------------------
  |  Branch (796:7): [True: 0, False: 7]
  ------------------
  797|      0|         return if_match(req, "X520.DNQualifier", {2, 5, 4, 46});
  798|      1|      case 0x11A7A:
  ------------------
  |  Branch (798:7): [True: 1, False: 6]
  ------------------
  799|      1|         return if_match(req, "secp192r1", {1, 2, 840, 10045, 3, 1, 1});
  800|      0|      case 0x12096:
  ------------------
  |  Branch (800:7): [True: 0, False: 7]
  ------------------
  801|      0|         return if_match(req, "SM2_Kex", {1, 2, 156, 10197, 1, 301, 2});
  802|      0|      case 0x13FC1:
  ------------------
  |  Branch (802:7): [True: 0, False: 7]
  ------------------
  803|      0|         return if_match(req, "X520.GenerationalQualifier", {2, 5, 4, 44});
  804|      0|      case 0x1445B:
  ------------------
  |  Branch (804:7): [True: 0, False: 7]
  ------------------
  805|      0|         return if_match(req, "PKCS5.PBKDF2", {1, 2, 840, 113549, 1, 5, 12});
  806|      0|      case 0x1495D:
  ------------------
  |  Branch (806:7): [True: 0, False: 7]
  ------------------
  807|      0|         return if_match(req, "eFrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 3});
  808|      0|      case 0x14E30:
  ------------------
  |  Branch (808:7): [True: 0, False: 7]
  ------------------
  809|      0|         return if_match(req, "ClassicMcEliece_460896", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 3});
  810|      0|      case 0x14FB1:
  ------------------
  |  Branch (810:7): [True: 0, False: 7]
  ------------------
  811|      0|         return if_match(req, "XMSS-draft12", {1, 3, 6, 1, 4, 1, 25258, 1, 8});
  812|      0|      case 0x156E3:
  ------------------
  |  Branch (812:7): [True: 0, False: 7]
  ------------------
  813|      0|         return if_match(req, "Compression.Zlib", {1, 2, 840, 113549, 1, 9, 16, 3, 8});
  814|      0|      case 0x1579E:
  ------------------
  |  Branch (814:7): [True: 0, False: 7]
  ------------------
  815|      0|         return if_match(req, "Streebog-512", {1, 2, 643, 7, 1, 1, 2, 3});
  816|      0|      case 0x1701A:
  ------------------
  |  Branch (816:7): [True: 0, False: 7]
  ------------------
  817|      0|         return if_match(req, "X509v3.AnyExtendedKeyUsage", {2, 5, 29, 37, 0});
  818|      0|      case 0x175EF:
  ------------------
  |  Branch (818:7): [True: 0, False: 7]
  ------------------
  819|      0|         return if_match(req, "Kyber-1024-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 3});
  820|      0|      case 0x17709:
  ------------------
  |  Branch (820:7): [True: 0, False: 7]
  ------------------
  821|      0|         return if_match(req, "X520.GivenName", {2, 5, 4, 42});
  822|      0|      case 0x17AD9:
  ------------------
  |  Branch (822:7): [True: 0, False: 7]
  ------------------
  823|      0|         return if_match(req, "RSA/PKCS1v15(SM3)", {1, 2, 156, 10197, 1, 504});
  824|      0|      case 0x17CE2:
  ------------------
  |  Branch (824:7): [True: 0, False: 7]
  ------------------
  825|      0|         return if_match(req, "SLH-DSA-SHA2-256f", {2, 16, 840, 1, 101, 3, 4, 3, 25});
  826|      0|      case 0x17CEF:
  ------------------
  |  Branch (826:7): [True: 0, False: 7]
  ------------------
  827|      0|         return if_match(req, "SLH-DSA-SHA2-256s", {2, 16, 840, 1, 101, 3, 4, 3, 24});
  828|      0|      case 0x18618:
  ------------------
  |  Branch (828:7): [True: 0, False: 7]
  ------------------
  829|      0|         return if_match(req, "FrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 2});
  830|      0|      case 0x19480:
  ------------------
  |  Branch (830:7): [True: 0, False: 7]
  ------------------
  831|      0|         return if_match(req, "eFrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 3});
  832|      0|      case 0x1958A:
  ------------------
  |  Branch (832:7): [True: 0, False: 7]
  ------------------
  833|      0|         return if_match(req, "X509v3.InvalidityDate", {2, 5, 29, 24});
  834|      0|      case 0x19851:
  ------------------
  |  Branch (834:7): [True: 0, False: 7]
  ------------------
  835|      0|         return if_match(req, "DSA/SHA-1", {1, 2, 840, 10040, 4, 3});
  836|      0|      case 0x1B2E7:
  ------------------
  |  Branch (836:7): [True: 0, False: 7]
  ------------------
  837|      0|         return if_match(req, "KeyWrap.AES-128", {2, 16, 840, 1, 101, 3, 4, 1, 5});
  838|      0|      case 0x1B9BE:
  ------------------
  |  Branch (838:7): [True: 0, False: 7]
  ------------------
  839|      0|         return if_match(req, "KeyWrap.AES-192", {2, 16, 840, 1, 101, 3, 4, 1, 25});
  840|      0|      case 0x1D439:
  ------------------
  |  Branch (840:7): [True: 0, False: 7]
  ------------------
  841|      0|         return if_match(req, "SphincsPlus-haraka-192f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 4});
  842|      0|      case 0x2065B:
  ------------------
  |  Branch (842:7): [True: 0, False: 7]
  ------------------
  843|      0|         return if_match(req, "KeyWrap.CAST-128", {1, 2, 840, 113533, 7, 66, 15});
  844|      0|      case 0x216A0:
  ------------------
  |  Branch (844:7): [True: 0, False: 7]
  ------------------
  845|      0|         return if_match(req, "ML-KEM-512", {2, 16, 840, 1, 101, 3, 4, 4, 1});
  846|      0|      case 0x2216B:
  ------------------
  |  Branch (846:7): [True: 0, False: 7]
  ------------------
  847|      0|         return if_match(req, "GOST-34.10-2012-512", {1, 2, 643, 7, 1, 1, 1, 2});
  848|      0|      case 0x22C2C:
  ------------------
  |  Branch (848:7): [True: 0, False: 7]
  ------------------
  849|      0|         return if_match(req, "ElGamal", {1, 3, 6, 1, 4, 1, 3029, 1, 2, 1});
  850|      0|      case 0x2559A:
  ------------------
  |  Branch (850:7): [True: 0, False: 7]
  ------------------
  851|      0|         return if_match(req, "X520.Initials", {2, 5, 4, 43});
  852|      0|      case 0x271AC:
  ------------------
  |  Branch (852:7): [True: 0, False: 7]
  ------------------
  853|      0|         return if_match(req, "PKIX.AutonomousSysIds", {1, 3, 6, 1, 5, 5, 7, 1, 8});
  854|      0|      case 0x2808B:
  ------------------
  |  Branch (854:7): [True: 0, False: 7]
  ------------------
  855|      0|         return if_match(req, "PKCS7.Data", {1, 2, 840, 113549, 1, 7, 1});
  856|      0|      case 0x281B8:
  ------------------
  |  Branch (856:7): [True: 0, False: 7]
  ------------------
  857|      0|         return if_match(req, "SphincsPlus-haraka-128s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 1});
  858|      0|      case 0x29999:
  ------------------
  |  Branch (858:7): [True: 0, False: 7]
  ------------------
  859|      0|         return if_match(req, "DSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 6});
  860|      0|      case 0x2A83D:
  ------------------
  |  Branch (860:7): [True: 0, False: 7]
  ------------------
  861|      0|         return if_match(req, "SHA-224", {2, 16, 840, 1, 101, 3, 4, 2, 4});
  862|      0|      case 0x2AB30:
  ------------------
  |  Branch (862:7): [True: 0, False: 7]
  ------------------
  863|      0|         return if_match(req, "SHA-256", {2, 16, 840, 1, 101, 3, 4, 2, 1});
  864|      0|      case 0x2ABEF:
  ------------------
  |  Branch (864:7): [True: 0, False: 7]
  ------------------
  865|      0|         return if_match(req, "KeyWrap.AES-256", {2, 16, 840, 1, 101, 3, 4, 1, 45});
  866|      0|      case 0x2BAEF:
  ------------------
  |  Branch (866:7): [True: 0, False: 7]
  ------------------
  867|      0|         return if_match(req, "SM2_Sig/SM3", {1, 2, 156, 10197, 1, 501});
  868|      0|      case 0x2C39A:
  ------------------
  |  Branch (868:7): [True: 0, False: 7]
  ------------------
  869|      0|         return if_match(req, "ECGDSA/RIPEMD-160", {1, 3, 36, 3, 3, 2, 5, 4, 1});
  870|      0|      case 0x2C54F:
  ------------------
  |  Branch (870:7): [True: 0, False: 7]
  ------------------
  871|      0|         return if_match(req, "ECDSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 9});
  872|      0|      case 0x2EEA6:
  ------------------
  |  Branch (872:7): [True: 0, False: 7]
  ------------------
  873|      0|         return if_match(req, "RSA/PKCS1v15(RIPEMD-160)", {1, 3, 36, 3, 3, 1, 2});
  874|      0|      case 0x2EFBA:
  ------------------
  |  Branch (874:7): [True: 0, False: 7]
  ------------------
  875|      0|         return if_match(req, "Kyber-512-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 1});
  876|      0|      case 0x2F0AD:
  ------------------
  |  Branch (876:7): [True: 0, False: 7]
  ------------------
  877|      0|         return if_match(req, "PKCS7.EncryptedData", {1, 2, 840, 113549, 1, 7, 6});
  878|      0|      case 0x2F219:
  ------------------
  |  Branch (878:7): [True: 0, False: 7]
  ------------------
  879|      0|         return if_match(req, "PBE-SHA1-2DES", {1, 2, 840, 113549, 1, 12, 1, 4});
  880|      0|      case 0x3133E:
  ------------------
  |  Branch (880:7): [True: 0, False: 7]
  ------------------
  881|      0|         return if_match(req, "SLH-DSA-SHA2-128f", {2, 16, 840, 1, 101, 3, 4, 3, 21});
  882|      0|      case 0x3134B:
  ------------------
  |  Branch (882:7): [True: 0, False: 7]
  ------------------
  883|      0|         return if_match(req, "SLH-DSA-SHA2-128s", {2, 16, 840, 1, 101, 3, 4, 3, 20});
  884|      0|      case 0x3160D:
  ------------------
  |  Branch (884:7): [True: 0, False: 7]
  ------------------
  885|      0|         return if_match(req, "RSA/PKCS1v15(SHA-3(224))", {2, 16, 840, 1, 101, 3, 4, 3, 13});
  886|      0|      case 0x319E0:
  ------------------
  |  Branch (886:7): [True: 0, False: 7]
  ------------------
  887|      0|         return if_match(req, "GOST-34.10-2012-256/Streebog-256", {1, 2, 643, 7, 1, 1, 3, 2});
  888|      0|      case 0x31B3D:
  ------------------
  |  Branch (888:7): [True: 0, False: 7]
  ------------------
  889|      0|         return if_match(req, "HMAC(SHA-512)", {1, 2, 840, 113549, 2, 11});
  890|      1|      case 0x31C6D:
  ------------------
  |  Branch (890:7): [True: 1, False: 6]
  ------------------
  891|      1|         return if_match(req, "secp384r1", {1, 3, 132, 0, 34});
  892|      0|      case 0x32899:
  ------------------
  |  Branch (892:7): [True: 0, False: 7]
  ------------------
  893|      0|         return if_match(req, "TripleDES/CBC", {1, 2, 840, 113549, 3, 7});
  894|      0|      case 0x33D04:
  ------------------
  |  Branch (894:7): [True: 0, False: 7]
  ------------------
  895|      0|         return if_match(req, "PKCS12.SecretBag", {1, 2, 840, 113549, 1, 12, 10, 1, 5});
  896|      0|      case 0x3615D:
  ------------------
  |  Branch (896:7): [True: 0, False: 7]
  ------------------
  897|      0|         return if_match(req, "FrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 2});
  898|      0|      case 0x361B8:
  ------------------
  |  Branch (898:7): [True: 0, False: 7]
  ------------------
  899|      0|         return if_match(req, "Ed25519", {1, 3, 101, 112});
  900|      0|      case 0x3649D:
  ------------------
  |  Branch (900:7): [True: 0, False: 7]
  ------------------
  901|      0|         return if_match(req, "SHAKE-128", {2, 16, 840, 1, 101, 3, 4, 2, 11});
  902|      0|      case 0x36693:
  ------------------
  |  Branch (902:7): [True: 0, False: 7]
  ------------------
  903|      0|         return if_match(req, "ClassicMcEliece_348864", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 1});
  904|      0|      case 0x373C7:
  ------------------
  |  Branch (904:7): [True: 0, False: 7]
  ------------------
  905|      0|         return if_match(req, "ML-DSA-4x4", {2, 16, 840, 1, 101, 3, 4, 3, 17});
  906|      0|      case 0x3750B:
  ------------------
  |  Branch (906:7): [True: 0, False: 7]
  ------------------
  907|      0|         return if_match(req, "ClassicMcEliece_8192128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 9});
  908|      0|      case 0x39890:
  ------------------
  |  Branch (908:7): [True: 0, False: 7]
  ------------------
  909|      0|         return if_match(req, "Ed448", {1, 3, 101, 113});
  910|      0|      case 0x3A438:
  ------------------
  |  Branch (910:7): [True: 0, False: 7]
  ------------------
  911|      0|         return if_match(req, "SHA-384", {2, 16, 840, 1, 101, 3, 4, 2, 2});
  912|      0|      case 0x3A963:
  ------------------
  |  Branch (912:7): [True: 0, False: 7]
  ------------------
  913|      0|         return if_match(req, "DH", {1, 2, 840, 10046, 2, 1});
  914|      0|      case 0x3AC83:
  ------------------
  |  Branch (914:7): [True: 0, False: 7]
  ------------------
  915|      0|         return if_match(req, "MGF1", {1, 2, 840, 113549, 1, 1, 8});
  916|      0|      case 0x3ACBA:
  ------------------
  |  Branch (916:7): [True: 0, False: 7]
  ------------------
  917|      0|         return if_match(req, "X509v3.IssuerAlternativeName", {2, 5, 29, 18});
  918|      0|      case 0x3B273:
  ------------------
  |  Branch (918:7): [True: 0, False: 7]
  ------------------
  919|      0|         return if_match(req, "KeyWrap.TripleDES", {1, 2, 840, 113549, 1, 9, 16, 3, 6});
  920|      0|      case 0x3B91E:
  ------------------
  |  Branch (920:7): [True: 0, False: 7]
  ------------------
  921|      0|         return if_match(req, "X509v3.PrivateKeyUsagePeriod", {2, 5, 29, 16});
  922|      0|      case 0x3BC8A:
  ------------------
  |  Branch (922:7): [True: 0, False: 7]
  ------------------
  923|      0|         return if_match(req, "SLH-DSA-SHAKE-192f", {2, 16, 840, 1, 101, 3, 4, 3, 29});
  924|      0|      case 0x3BC97:
  ------------------
  |  Branch (924:7): [True: 0, False: 7]
  ------------------
  925|      0|         return if_match(req, "SLH-DSA-SHAKE-192s", {2, 16, 840, 1, 101, 3, 4, 3, 28});
  926|      0|      case 0x3D127:
  ------------------
  |  Branch (926:7): [True: 0, False: 7]
  ------------------
  927|      0|         return if_match(req, "DSA", {1, 2, 840, 10040, 4, 1});
  928|      0|      case 0x3E249:
  ------------------
  |  Branch (928:7): [True: 0, False: 7]
  ------------------
  929|      0|         return if_match(req, "HSS-LMS", {1, 2, 840, 113549, 1, 9, 16, 3, 17});
  930|      0|      case 0x3E7D5:
  ------------------
  |  Branch (930:7): [True: 0, False: 7]
  ------------------
  931|      0|         return if_match(req, "RSA/PKCS1v15(SHA-3(256))", {2, 16, 840, 1, 101, 3, 4, 3, 14});
  932|      0|      case 0x3F748:
  ------------------
  |  Branch (932:7): [True: 0, False: 7]
  ------------------
  933|      0|         return if_match(req, "GOST.OGRN", {1, 2, 643, 100, 1});
  934|      0|      case 0x3F99F:
  ------------------
  |  Branch (934:7): [True: 0, False: 7]
  ------------------
  935|      0|         return if_match(req, "X509v3.BasicConstraints", {2, 5, 29, 19});
  936|      0|      case 0x40726:
  ------------------
  |  Branch (936:7): [True: 0, False: 7]
  ------------------
  937|      0|         return if_match(req, "SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 2, 10});
  938|      0|      case 0x407BF:
  ------------------
  |  Branch (938:7): [True: 0, False: 7]
  ------------------
  939|      0|         return if_match(req, "ML-KEM-768", {2, 16, 840, 1, 101, 3, 4, 4, 2});
  940|      0|      case 0x41334:
  ------------------
  |  Branch (940:7): [True: 0, False: 7]
  ------------------
  941|      0|         return if_match(req, "ECDSA/SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 3, 11});
  942|      0|      case 0x42DF3:
  ------------------
  |  Branch (942:7): [True: 0, False: 7]
  ------------------
  943|      0|         return if_match(req, "X509v3.CRLDistributionPoints", {2, 5, 29, 31});
  944|      0|      case 0x437FB:
  ------------------
  |  Branch (944:7): [True: 0, False: 7]
  ------------------
  945|      0|         return if_match(req, "brainpool160r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 1});
  946|      0|      case 0x441F5:
  ------------------
  |  Branch (946:7): [True: 0, False: 7]
  ------------------
  947|      0|         return if_match(req, "gost_256A", {1, 2, 643, 7, 1, 2, 1, 1, 1});
  948|      0|      case 0x441F6:
  ------------------
  |  Branch (948:7): [True: 0, False: 7]
  ------------------
  949|      0|         return if_match(req, "gost_256B", {1, 2, 643, 7, 1, 2, 1, 1, 2});
  950|      0|      case 0x44221:
  ------------------
  |  Branch (950:7): [True: 0, False: 7]
  ------------------
  951|      0|         return if_match(req, "GOST-34.10-2012-512/Streebog-512", {1, 2, 643, 7, 1, 1, 3, 3});
  952|      0|      case 0x44322:
  ------------------
  |  Branch (952:7): [True: 0, False: 7]
  ------------------
  953|      0|         return if_match(req, "ClassicMcEliece_6960119pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 3});
  954|      0|      case 0x44973:
  ------------------
  |  Branch (954:7): [True: 0, False: 7]
  ------------------
  955|      0|         return if_match(req, "Kyber-512-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 1});
  956|      0|      case 0x45C27:
  ------------------
  |  Branch (956:7): [True: 0, False: 7]
  ------------------
  957|      0|         return if_match(req, "RSA/PKCS1v15(SHA-512-256)", {1, 2, 840, 113549, 1, 1, 16});
  958|      0|      case 0x45C85:
  ------------------
  |  Branch (958:7): [True: 0, False: 7]
  ------------------
  959|      0|         return if_match(req, "X509v3.ReasonCode", {2, 5, 29, 21});
  960|      0|      case 0x45DA5:
  ------------------
  |  Branch (960:7): [True: 0, False: 7]
  ------------------
  961|      0|         return if_match(req, "SHAKE-256", {2, 16, 840, 1, 101, 3, 4, 2, 12});
  962|      0|      case 0x4663C:
  ------------------
  |  Branch (962:7): [True: 0, False: 7]
  ------------------
  963|      0|         return if_match(req, "X509v3.PolicyConstraints", {2, 5, 29, 36});
  964|      0|      case 0x480F7:
  ------------------
  |  Branch (964:7): [True: 0, False: 7]
  ------------------
  965|      0|         return if_match(req, "Serpent/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 4});
  966|      0|      case 0x48627:
  ------------------
  |  Branch (966:7): [True: 0, False: 7]
  ------------------
  967|      0|         return if_match(req, "Dilithium-4x4-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 1});
  968|      0|      case 0x48861:
  ------------------
  |  Branch (968:7): [True: 0, False: 7]
  ------------------
  969|      0|         return if_match(req, "ChaCha20Poly1305", {1, 2, 840, 113549, 1, 9, 16, 3, 18});
  970|      0|      case 0x4A292:
  ------------------
  |  Branch (970:7): [True: 0, False: 7]
  ------------------
  971|      0|         return if_match(req, "frp256v1", {1, 2, 250, 1, 223, 101, 256, 1});
  972|      0|      case 0x4A9EE:
  ------------------
  |  Branch (972:7): [True: 0, False: 7]
  ------------------
  973|      0|         return if_match(req, "ClassicMcEliece_6960119f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 8});
  974|      0|      case 0x4BF87:
  ------------------
  |  Branch (974:7): [True: 0, False: 7]
  ------------------
  975|      0|         return if_match(req, "PKIX.TNAuthList", {1, 3, 6, 1, 5, 5, 7, 1, 26});
  976|      0|      case 0x4C088:
  ------------------
  |  Branch (976:7): [True: 0, False: 7]
  ------------------
  977|      0|         return if_match(req, "eFrodoKEM-976-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 2});
  978|      0|      case 0x4C513:
  ------------------
  |  Branch (978:7): [True: 0, False: 7]
  ------------------
  979|      0|         return if_match(req, "DSA/SHA-224", {2, 16, 840, 1, 101, 3, 4, 3, 1});
  980|      0|      case 0x4C806:
  ------------------
  |  Branch (980:7): [True: 0, False: 7]
  ------------------
  981|      0|         return if_match(req, "DSA/SHA-256", {2, 16, 840, 1, 101, 3, 4, 3, 2});
  982|      0|      case 0x4D740:
  ------------------
  |  Branch (982:7): [True: 0, False: 7]
  ------------------
  983|      0|         return if_match(req, "X509v3.AnyPolicy", {2, 5, 29, 32, 0});
  984|      0|      case 0x4DE49:
  ------------------
  |  Branch (984:7): [True: 0, False: 7]
  ------------------
  985|      0|         return if_match(req, "RSA/PKCS1v15(SHA-512)", {1, 2, 840, 113549, 1, 1, 13});
  986|      0|      case 0x4ED5D:
  ------------------
  |  Branch (986:7): [True: 0, False: 7]
  ------------------
  987|      0|         return if_match(req, "CAST-128/CBC", {1, 2, 840, 113533, 7, 66, 10});
  988|      0|      case 0x4FCDC:
  ------------------
  |  Branch (988:7): [True: 0, False: 7]
  ------------------
  989|      0|         return if_match(req, "RSA", {1, 2, 840, 113549, 1, 1, 1});
  990|      0|      case 0x501CB:
  ------------------
  |  Branch (990:7): [True: 0, False: 7]
  ------------------
  991|      0|         return if_match(req, "ECDSA/SHA-224", {1, 2, 840, 10045, 4, 3, 1});
  992|      0|      case 0x50395:
  ------------------
  |  Branch (992:7): [True: 0, False: 7]
  ------------------
  993|      0|         return if_match(req, "GOST-34.10/GOST-R-34.11-94", {1, 2, 643, 2, 2, 3});
  994|      0|      case 0x504BE:
  ------------------
  |  Branch (994:7): [True: 0, False: 7]
  ------------------
  995|      0|         return if_match(req, "ECDSA/SHA-256", {1, 2, 840, 10045, 4, 3, 2});
  996|      0|      case 0x509C3:
  ------------------
  |  Branch (996:7): [True: 0, False: 7]
  ------------------
  997|      0|         return if_match(req, "brainpool192r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 3});
  998|      0|      case 0x509F9:
  ------------------
  |  Branch (998:7): [True: 0, False: 7]
  ------------------
  999|      0|         return if_match(req, "PKCS9.ContentType", {1, 2, 840, 113549, 1, 9, 3});
 1000|      0|      case 0x50B26:
  ------------------
  |  Branch (1000:7): [True: 0, False: 7]
  ------------------
 1001|      0|         return if_match(req, "FrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 1});
 1002|      0|      case 0x50D78:
  ------------------
  |  Branch (1002:7): [True: 0, False: 7]
  ------------------
 1003|      0|         return if_match(req, "x962_p192v2", {1, 2, 840, 10045, 3, 1, 2});
 1004|      0|      case 0x50D79:
  ------------------
  |  Branch (1004:7): [True: 0, False: 7]
  ------------------
 1005|      0|         return if_match(req, "x962_p192v3", {1, 2, 840, 10045, 3, 1, 3});
 1006|      0|      case 0x51DC6:
  ------------------
  |  Branch (1006:7): [True: 0, False: 7]
  ------------------
 1007|      0|         return if_match(req, "AES-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 1});
 1008|      0|      case 0x52DB6:
  ------------------
  |  Branch (1008:7): [True: 0, False: 7]
  ------------------
 1009|      0|         return if_match(req, "HMAC(SHA-224)", {1, 2, 840, 113549, 2, 8});
 1010|      0|      case 0x53E11:
  ------------------
  |  Branch (1010:7): [True: 0, False: 7]
  ------------------
 1011|      0|         return if_match(req, "FrodoKEM-1344-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 14, 3});
 1012|      0|      case 0x54012:
  ------------------
  |  Branch (1012:7): [True: 0, False: 7]
  ------------------
 1013|      0|         return if_match(req, "PKIX.TimeStamping", {1, 3, 6, 1, 5, 5, 7, 3, 8});
 1014|      0|      case 0x5407A:
  ------------------
  |  Branch (1014:7): [True: 0, False: 7]
  ------------------
 1015|      0|         return if_match(req, "Serpent/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 1});
 1016|      0|      case 0x5576D:
  ------------------
  |  Branch (1016:7): [True: 0, False: 7]
  ------------------
 1017|      0|         return if_match(req, "SphincsPlus-sha2-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 2});
 1018|      0|      case 0x55EF6:
  ------------------
  |  Branch (1018:7): [True: 0, False: 7]
  ------------------
 1019|      0|         return if_match(req, "AES-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 2});
 1020|      0|      case 0x55FFA:
  ------------------
  |  Branch (1020:7): [True: 0, False: 7]
  ------------------
 1021|      0|         return if_match(req, "ML-DSA-6x5", {2, 16, 840, 1, 101, 3, 4, 3, 18});
 1022|      0|      case 0x56826:
  ------------------
  |  Branch (1022:7): [True: 0, False: 7]
  ------------------
 1023|      0|         return if_match(req, "brainpool320r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 9});
 1024|      0|      case 0x56D0D:
  ------------------
  |  Branch (1024:7): [True: 0, False: 7]
  ------------------
 1025|      0|         return if_match(req, "SphincsPlus-shake-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 2});
 1026|      0|      case 0x57077:
  ------------------
  |  Branch (1026:7): [True: 0, False: 7]
  ------------------
 1027|      0|         return if_match(req, "XMSS-draft6", {1, 3, 6, 1, 4, 1, 25258, 1, 5});
 1028|      0|      case 0x5818B:
  ------------------
  |  Branch (1028:7): [True: 0, False: 7]
  ------------------
 1029|      0|         return if_match(req, "ECGDSA/SHA-224", {1, 3, 36, 3, 3, 2, 5, 4, 3});
 1030|      0|      case 0x5847E:
  ------------------
  |  Branch (1030:7): [True: 0, False: 7]
  ------------------
 1031|      0|         return if_match(req, "ECGDSA/SHA-256", {1, 3, 36, 3, 3, 2, 5, 4, 4});
 1032|      0|      case 0x5898B:
  ------------------
  |  Branch (1032:7): [True: 0, False: 7]
  ------------------
 1033|      0|         return if_match(req, "SHA-512", {2, 16, 840, 1, 101, 3, 4, 2, 3});
 1034|      0|      case 0x58991:
  ------------------
  |  Branch (1034:7): [True: 0, False: 7]
  ------------------
 1035|      0|         return if_match(req, "PKIX.OCSP.NoCheck", {1, 3, 6, 1, 5, 5, 7, 48, 1, 5});
 1036|      0|      case 0x59717:
  ------------------
  |  Branch (1036:7): [True: 0, False: 7]
  ------------------
 1037|      0|         return if_match(req, "X509v3.SubjectKeyIdentifier", {2, 5, 29, 14});
 1038|      0|      case 0x5A1E1:
  ------------------
  |  Branch (1038:7): [True: 0, False: 7]
  ------------------
 1039|      0|         return if_match(req, "PKCS12.KeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 1});
 1040|      0|      case 0x5A570:
  ------------------
  |  Branch (1040:7): [True: 0, False: 7]
  ------------------
 1041|      0|         return if_match(req, "X520.CommonName", {2, 5, 4, 3});
 1042|      0|      case 0x5A990:
  ------------------
  |  Branch (1042:7): [True: 0, False: 7]
  ------------------
 1043|      0|         return if_match(req, "ECDSA/SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 3, 10});
 1044|      0|      case 0x5AB0E:
  ------------------
  |  Branch (1044:7): [True: 0, False: 7]
  ------------------
 1045|      0|         return if_match(req, "SphincsPlus-sha2-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 5});
 1046|      0|      case 0x5AC4A:
  ------------------
  |  Branch (1046:7): [True: 0, False: 7]
  ------------------
 1047|      0|         return if_match(req, "X520.Surname", {2, 5, 4, 4});
 1048|      0|      case 0x5AF2C:
  ------------------
  |  Branch (1048:7): [True: 0, False: 7]
  ------------------
 1049|      0|         return if_match(req, "ClassicMcEliece_8192128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 5});
 1050|      0|      case 0x5BC39:
  ------------------
  |  Branch (1050:7): [True: 0, False: 7]
  ------------------
 1051|      0|         return if_match(req, "X509v3.KeyUsage", {2, 5, 29, 15});
 1052|      0|      case 0x5BDDB:
  ------------------
  |  Branch (1052:7): [True: 0, False: 7]
  ------------------
 1053|      0|         return if_match(req, "numsp256d1", {1, 3, 6, 1, 4, 1, 25258, 4, 1});
 1054|      0|      case 0x5C0AE:
  ------------------
  |  Branch (1054:7): [True: 0, False: 7]
  ------------------
 1055|      0|         return if_match(req, "SphincsPlus-shake-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 5});
 1056|      0|      case 0x5C10E:
  ------------------
  |  Branch (1056:7): [True: 0, False: 7]
  ------------------
 1057|      0|         return if_match(req, "DSA/SHA-384", {2, 16, 840, 1, 101, 3, 4, 3, 3});
 1058|      0|      case 0x5CFE5:
  ------------------
  |  Branch (1058:7): [True: 0, False: 7]
  ------------------
 1059|      0|         return if_match(req, "PKCS9.X509Certificate", {1, 2, 840, 113549, 1, 9, 22, 1});
 1060|      0|      case 0x5D1CF:
  ------------------
  |  Branch (1060:7): [True: 0, False: 7]
  ------------------
 1061|      0|         return if_match(req, "X520.SerialNumber", {2, 5, 4, 5});
 1062|      0|      case 0x5D375:
  ------------------
  |  Branch (1062:7): [True: 0, False: 7]
  ------------------
 1063|      0|         return if_match(req, "SM4/OCB", {1, 2, 156, 10197, 1, 104, 100});
 1064|      0|      case 0x5DD49:
  ------------------
  |  Branch (1064:7): [True: 0, False: 7]
  ------------------
 1065|      0|         return if_match(req, "AES-128/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 2});
 1066|      0|      case 0x5DE4E:
  ------------------
  |  Branch (1066:7): [True: 0, False: 7]
  ------------------
 1067|      0|         return if_match(req, "AES-128/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 7});
 1068|      0|      case 0x5DF23:
  ------------------
  |  Branch (1068:7): [True: 0, False: 7]
  ------------------
 1069|      0|         return if_match(req, "HMAC(SHA-512-256)", {1, 2, 840, 113549, 2, 13});
 1070|      0|      case 0x5ED04:
  ------------------
  |  Branch (1070:7): [True: 0, False: 7]
  ------------------
 1071|      0|         return if_match(req, "SM2", {1, 2, 156, 10197, 1, 301, 1});
 1072|      0|      case 0x5ED05:
  ------------------
  |  Branch (1072:7): [True: 0, False: 7]
  ------------------
 1073|      0|         return if_match(req, "SM3", {1, 2, 156, 10197, 1, 401});
 1074|      0|      case 0x5FDC6:
  ------------------
  |  Branch (1074:7): [True: 0, False: 7]
  ------------------
 1075|      0|         return if_match(req, "ECDSA/SHA-384", {1, 2, 840, 10045, 4, 3, 3});
 1076|      0|      case 0x6199F:
  ------------------
  |  Branch (1076:7): [True: 0, False: 7]
  ------------------
 1077|      0|         return if_match(req, "SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 2, 7});
 1078|      0|      case 0x61E79:
  ------------------
  |  Branch (1078:7): [True: 0, False: 7]
  ------------------
 1079|      0|         return if_match(req, "AES-192/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 22});
 1080|      0|      case 0x61F7E:
  ------------------
  |  Branch (1080:7): [True: 0, False: 7]
  ------------------
 1081|      0|         return if_match(req, "AES-192/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 27});
 1082|      0|      case 0x64947:
  ------------------
  |  Branch (1082:7): [True: 0, False: 7]
  ------------------
 1083|      0|         return if_match(req, "OpenPGP.Ed25519", {1, 3, 6, 1, 4, 1, 11591, 15, 1});
 1084|      0|      case 0x652E7:
  ------------------
  |  Branch (1084:7): [True: 0, False: 7]
  ------------------
 1085|      0|         return if_match(req, "sm2p256v1", {1, 2, 156, 10197, 1, 301});
 1086|      0|      case 0x6697B:
  ------------------
  |  Branch (1086:7): [True: 0, False: 7]
  ------------------
 1087|      0|         return if_match(req, "FrodoKEM-1344-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 15, 3});
 1088|      0|      case 0x67B2C:
  ------------------
  |  Branch (1088:7): [True: 0, False: 7]
  ------------------
 1089|      0|         return if_match(req, "X520.State", {2, 5, 4, 8});
 1090|      0|      case 0x67B9B:
  ------------------
  |  Branch (1090:7): [True: 0, False: 7]
  ------------------
 1091|      0|         return if_match(req, "HMAC(SHA-384)", {1, 2, 840, 113549, 2, 10});
 1092|      0|      case 0x67D86:
  ------------------
  |  Branch (1092:7): [True: 0, False: 7]
  ------------------
 1093|      0|         return if_match(req, "ECGDSA/SHA-384", {1, 3, 36, 3, 3, 2, 5, 4, 5});
 1094|      0|      case 0x68A0B:
  ------------------
  |  Branch (1094:7): [True: 0, False: 7]
  ------------------
 1095|      0|         return if_match(req, "Camellia-128/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 6});
 1096|      0|      case 0x68E33:
  ------------------
  |  Branch (1096:7): [True: 0, False: 7]
  ------------------
 1097|      0|         return if_match(req, "PKCS9.ExtensionRequest", {1, 2, 840, 113549, 1, 9, 14});
 1098|      0|      case 0x69126:
  ------------------
  |  Branch (1098:7): [True: 0, False: 7]
  ------------------
 1099|      0|         return if_match(req, "X509v3.SubjectAlternativeName", {2, 5, 29, 17});
 1100|      0|      case 0x692F8:
  ------------------
  |  Branch (1100:7): [True: 0, False: 7]
  ------------------
 1101|      0|         return if_match(req, "SM4/CBC", {1, 2, 156, 10197, 1, 104, 2});
 1102|      0|      case 0x695E1:
  ------------------
  |  Branch (1102:7): [True: 0, False: 7]
  ------------------
 1103|      0|         return if_match(req, "Dilithium-4x4-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 1});
 1104|      0|      case 0x696DC:
  ------------------
  |  Branch (1104:7): [True: 0, False: 7]
  ------------------
 1105|      0|         return if_match(req, "PKIX.IpAddrBlocks", {1, 3, 6, 1, 5, 5, 7, 1, 7});
 1106|      0|      case 0x6A7CA:
  ------------------
  |  Branch (1106:7): [True: 0, False: 7]
  ------------------
 1107|      0|         return if_match(req, "ECDSA", {1, 2, 840, 10045, 2, 1});
 1108|      0|      case 0x6BD26:
  ------------------
  |  Branch (1108:7): [True: 0, False: 7]
  ------------------
 1109|      0|         return if_match(req, "GOST.INN", {1, 2, 643, 3, 131, 1, 1});
 1110|      0|      case 0x6CB3B:
  ------------------
  |  Branch (1110:7): [True: 0, False: 7]
  ------------------
 1111|      0|         return if_match(req, "Camellia-192/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 7});
 1112|      0|      case 0x6E602:
  ------------------
  |  Branch (1112:7): [True: 0, False: 7]
  ------------------
 1113|      0|         return if_match(req, "Dilithium-8x7-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 3});
 1114|      0|      case 0x6F0C2:
  ------------------
  |  Branch (1114:7): [True: 0, False: 7]
  ------------------
 1115|      0|         return if_match(req, "RSA/PKCS1v15(SHA-224)", {1, 2, 840, 113549, 1, 1, 14});
 1116|      0|      case 0x6F9F8:
  ------------------
  |  Branch (1116:7): [True: 0, False: 7]
  ------------------
 1117|      0|         return if_match(req, "PKCS12.SafeContentsBag", {1, 2, 840, 113549, 1, 12, 10, 1, 6});
 1118|      0|      case 0x6FB26:
  ------------------
  |  Branch (1118:7): [True: 0, False: 7]
  ------------------
 1119|      0|         return if_match(req, "PKIX.AuthorityInformationAccess", {1, 3, 6, 1, 5, 5, 7, 1, 1});
 1120|      0|      case 0x70BB6:
  ------------------
  |  Branch (1120:7): [True: 0, False: 7]
  ------------------
 1121|      0|         return if_match(req, "brainpool384r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 11});
 1122|      0|      case 0x70EA6:
  ------------------
  |  Branch (1122:7): [True: 0, False: 7]
  ------------------
 1123|      0|         return if_match(req, "PKCS12.PKCS8ShroudedKeyBag", {1, 2, 840, 113549, 1, 12, 10, 1, 2});
 1124|      0|      case 0x71EB3:
  ------------------
  |  Branch (1124:7): [True: 0, False: 7]
  ------------------
 1125|      0|         return if_match(req, "SphincsPlus-haraka-128f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 2});
 1126|      0|      case 0x7382C:
  ------------------
  |  Branch (1126:7): [True: 0, False: 7]
  ------------------
 1127|      0|         return if_match(req, "ML-KEM-1024", {2, 16, 840, 1, 101, 3, 4, 4, 3});
 1128|      0|      case 0x743BD:
  ------------------
  |  Branch (1128:7): [True: 0, False: 7]
  ------------------
 1129|      0|         return if_match(req, "AES-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 3});
 1130|      0|      case 0x7498E:
  ------------------
  |  Branch (1130:7): [True: 0, False: 7]
  ------------------
 1131|      0|         return if_match(req, "Camellia-128/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 2});
 1132|      0|      case 0x74C2E:
  ------------------
  |  Branch (1132:7): [True: 0, False: 7]
  ------------------
 1133|      0|         return if_match(req, "ML-DSA-8x7", {2, 16, 840, 1, 101, 3, 4, 3, 19});
 1134|      0|      case 0x7505F:
  ------------------
  |  Branch (1134:7): [True: 0, False: 7]
  ------------------
 1135|      0|         return if_match(req, "PKIX.XMPPAddr", {1, 3, 6, 1, 5, 5, 7, 8, 5});
 1136|      0|      case 0x7517A:
  ------------------
  |  Branch (1136:7): [True: 0, False: 7]
  ------------------
 1137|      0|         return if_match(req, "RSA/PKCS1v15(MD2)", {1, 2, 840, 113549, 1, 1, 2});
 1138|      0|      case 0x7546B:
  ------------------
  |  Branch (1138:7): [True: 0, False: 7]
  ------------------
 1139|      0|         return if_match(req, "RSA/PKCS1v15(MD5)", {1, 2, 840, 113549, 1, 1, 4});
 1140|      0|      case 0x75921:
  ------------------
  |  Branch (1140:7): [True: 0, False: 7]
  ------------------
 1141|      0|         return if_match(req, "ClassicMcEliece_348864f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 2});
 1142|      0|      case 0x76784:
  ------------------
  |  Branch (1142:7): [True: 0, False: 7]
  ------------------
 1143|      0|         return if_match(req, "SHA-3(384)", {2, 16, 840, 1, 101, 3, 4, 2, 9});
 1144|      0|      case 0x768FD:
  ------------------
  |  Branch (1144:7): [True: 0, False: 7]
  ------------------
 1145|      0|         return if_match(req, "PKCS9.LocalKeyId", {1, 2, 840, 113549, 1, 9, 21});
 1146|      1|      case 0x76A19:
  ------------------
  |  Branch (1146:7): [True: 1, False: 6]
  ------------------
 1147|      1|         return if_match(req, "brainpool512r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 13});
 1148|      0|      case 0x77254:
  ------------------
  |  Branch (1148:7): [True: 0, False: 7]
  ------------------
 1149|      0|         return if_match(req, "SphincsPlus-haraka-256s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 5});
 1150|      0|      case 0x77ADC:
  ------------------
  |  Branch (1150:7): [True: 0, False: 7]
  ------------------
 1151|      0|         return if_match(req, "secp224k1", {1, 3, 132, 0, 32});
 1152|      1|      case 0x781B9:
  ------------------
  |  Branch (1152:7): [True: 1, False: 6]
  ------------------
 1153|      1|         return if_match(req, "secp224r1", {1, 3, 132, 0, 33});
 1154|      0|      case 0x78ABE:
  ------------------
  |  Branch (1154:7): [True: 0, False: 7]
  ------------------
 1155|      0|         return if_match(req, "Camellia-192/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 3});
 1156|      0|      case 0x792F2:
  ------------------
  |  Branch (1156:7): [True: 0, False: 7]
  ------------------
 1157|      0|         return if_match(req, "ClassicMcEliece_6688128pc", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 1});
 1158|      0|      case 0x7A661:
  ------------------
  |  Branch (1158:7): [True: 0, False: 7]
  ------------------
 1159|      0|         return if_match(req, "DSA/SHA-512", {2, 16, 840, 1, 101, 3, 4, 3, 4});
 1160|      0|      case 0x7A977:
  ------------------
  |  Branch (1160:7): [True: 0, False: 7]
  ------------------
 1161|      0|         return if_match(req, "X509v3.ExtendedKeyUsage", {2, 5, 29, 37});
 1162|      0|      case 0x7AE67:
  ------------------
  |  Branch (1162:7): [True: 0, False: 7]
  ------------------
 1163|      0|         return if_match(req, "SM2_Enc", {1, 2, 156, 10197, 1, 301, 3});
 1164|      0|      case 0x7B602:
  ------------------
  |  Branch (1164:7): [True: 0, False: 7]
  ------------------
 1165|      0|         return if_match(req, "Twofish/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 5});
 1166|      0|      case 0x7B9A1:
  ------------------
  |  Branch (1166:7): [True: 0, False: 7]
  ------------------
 1167|      0|         return if_match(req, "SphincsPlus-sha2-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 3});
 1168|      0|      case 0x7BB0A:
  ------------------
  |  Branch (1168:7): [True: 0, False: 7]
  ------------------
 1169|      0|         return if_match(req, "SLH-DSA-SHAKE-256f", {2, 16, 840, 1, 101, 3, 4, 3, 31});
 1170|      0|      case 0x7BB17:
  ------------------
  |  Branch (1170:7): [True: 0, False: 7]
  ------------------
 1171|      0|         return if_match(req, "SLH-DSA-SHAKE-256s", {2, 16, 840, 1, 101, 3, 4, 3, 30});
 1172|      0|      case 0x7BCF3:
  ------------------
  |  Branch (1172:7): [True: 0, False: 7]
  ------------------
 1173|      0|         return if_match(req, "PKIX.EmailProtection", {1, 3, 6, 1, 5, 5, 7, 3, 4});
 1174|      0|      case 0x7CC2C:
  ------------------
  |  Branch (1174:7): [True: 0, False: 7]
  ------------------
 1175|      0|         return if_match(req, "SHA-512-256", {2, 16, 840, 1, 101, 3, 4, 2, 6});
 1176|      0|      case 0x7CF41:
  ------------------
  |  Branch (1176:7): [True: 0, False: 7]
  ------------------
 1177|      0|         return if_match(req, "SphincsPlus-shake-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 3});
 1178|      0|      case 0x7DB91:
  ------------------
  |  Branch (1178:7): [True: 0, False: 7]
  ------------------
 1179|      0|         return if_match(req, "GOST-34.10", {1, 2, 643, 2, 2, 19});
 1180|      0|      case 0x7E319:
  ------------------
  |  Branch (1180:7): [True: 0, False: 7]
  ------------------
 1181|      0|         return if_match(req, "ECDSA/SHA-512", {1, 2, 840, 10045, 4, 3, 4});
 1182|      0|      case 0x7E874:
  ------------------
  |  Branch (1182:7): [True: 0, False: 7]
  ------------------
 1183|      0|         return if_match(req, "ClassicMcEliece_6688128f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 6});
 1184|      0|      case 0x7EAAF:
  ------------------
  |  Branch (1184:7): [True: 0, False: 7]
  ------------------
 1185|      0|         return if_match(req, "eFrodoKEM-640-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 1});
 1186|      0|      case 0x7F51F:
  ------------------
  |  Branch (1186:7): [True: 0, False: 7]
  ------------------
 1187|      0|         return if_match(req, "PKIX.IPsecTunnel", {1, 3, 6, 1, 5, 5, 7, 3, 6});
 1188|      0|      case 0x80272:
  ------------------
  |  Branch (1188:7): [True: 0, False: 7]
  ------------------
 1189|      0|         return if_match(req, "X520.Organization", {2, 5, 4, 10});
 1190|      0|      case 0x80340:
  ------------------
  |  Branch (1190:7): [True: 0, False: 7]
  ------------------
 1191|      0|         return if_match(req, "AES-256/CBC", {2, 16, 840, 1, 101, 3, 4, 1, 42});
 1192|      0|      case 0x80445:
  ------------------
  |  Branch (1192:7): [True: 0, False: 7]
  ------------------
 1193|      0|         return if_match(req, "AES-256/CCM", {2, 16, 840, 1, 101, 3, 4, 1, 47});
 1194|      0|      case 0x811F7:
  ------------------
  |  Branch (1194:7): [True: 0, False: 7]
  ------------------
 1195|      0|         return if_match(req, "HMAC(SHA-256)", {1, 2, 840, 113549, 2, 9});
 1196|      0|      case 0x82434:
  ------------------
  |  Branch (1196:7): [True: 0, False: 7]
  ------------------
 1197|      0|         return if_match(req, "PKCS9.X509CRL", {1, 2, 840, 113549, 1, 9, 23, 1});
 1198|      0|      case 0x82B47:
  ------------------
  |  Branch (1198:7): [True: 0, False: 7]
  ------------------
 1199|      0|         return if_match(req, "Threefish-512/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 2});
 1200|      0|      case 0x83EA7:
  ------------------
  |  Branch (1200:7): [True: 0, False: 7]
  ------------------
 1201|      0|         return if_match(req, "RSA/PKCS1v15(SHA-384)", {1, 2, 840, 113549, 1, 1, 12});
 1202|      0|      case 0x84596:
  ------------------
  |  Branch (1202:7): [True: 0, False: 7]
  ------------------
 1203|      0|         return if_match(req, "eFrodoKEM-640-AES", {1, 3, 6, 1, 4, 1, 25258, 1, 17, 1});
 1204|      0|      case 0x8469F:
  ------------------
  |  Branch (1204:7): [True: 0, False: 7]
  ------------------
 1205|      0|         return if_match(req, "ClassicMcEliece_6960119pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 4});
 1206|      0|      case 0x84CA4:
  ------------------
  |  Branch (1206:7): [True: 0, False: 7]
  ------------------
 1207|      0|         return if_match(req, "secp256k1", {1, 3, 132, 0, 10});
 1208|      1|      case 0x85381:
  ------------------
  |  Branch (1208:7): [True: 1, False: 6]
  ------------------
 1209|      1|         return if_match(req, "secp256r1", {1, 2, 840, 10045, 3, 1, 7});
 1210|      0|      case 0x854FC:
  ------------------
  |  Branch (1210:7): [True: 0, False: 7]
  ------------------
 1211|      0|         return if_match(req, "PKIX.IPsecUser", {1, 3, 6, 1, 5, 5, 7, 3, 7});
 1212|      0|      case 0x85F51:
  ------------------
  |  Branch (1212:7): [True: 0, False: 7]
  ------------------
 1213|      0|         return if_match(req, "Serpent/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 4});
 1214|      0|      case 0x862D9:
  ------------------
  |  Branch (1214:7): [True: 0, False: 7]
  ------------------
 1215|      0|         return if_match(req, "ECGDSA/SHA-512", {1, 3, 36, 3, 3, 2, 5, 4, 6});
 1216|      0|      case 0x87585:
  ------------------
  |  Branch (1216:7): [True: 0, False: 7]
  ------------------
 1217|      0|         return if_match(req, "Twofish/CBC", {1, 3, 6, 1, 4, 1, 25258, 3, 3});
 1218|      0|      case 0x877D1:
  ------------------
  |  Branch (1218:7): [True: 0, False: 7]
  ------------------
 1219|      0|         return if_match(req, "PKCS9.EmailAddress", {1, 2, 840, 113549, 1, 9, 1});
 1220|      0|      case 0x87D27:
  ------------------
  |  Branch (1220:7): [True: 0, False: 7]
  ------------------
 1221|      0|         return if_match(req, "PKIX.CertificateAuthorityIssuers", {1, 3, 6, 1, 5, 5, 7, 48, 2});
 1222|      0|      case 0x87E42:
  ------------------
  |  Branch (1222:7): [True: 0, False: 7]
  ------------------
 1223|      0|         return if_match(req, "X509v3.AuthorityKeyIdentifier", {2, 5, 29, 35});
 1224|      0|      case 0x889B1:
  ------------------
  |  Branch (1224:7): [True: 0, False: 7]
  ------------------
 1225|      0|         return if_match(req, "ECDSA/SHA-1", {1, 2, 840, 10045, 4, 1});
 1226|      0|      case 0x89658:
  ------------------
  |  Branch (1226:7): [True: 0, False: 7]
  ------------------
 1227|      0|         return if_match(req, "PBE-PKCS5v20", {1, 2, 840, 113549, 1, 5, 13});
 1228|      0|      case 0x8976D:
  ------------------
  |  Branch (1228:7): [True: 0, False: 7]
  ------------------
 1229|      0|         return if_match(req, "PKCS9.MessageDigest", {1, 2, 840, 113549, 1, 9, 4});
 1230|      0|      case 0x8B002:
  ------------------
  |  Branch (1230:7): [True: 0, False: 7]
  ------------------
 1231|      0|         return if_match(req, "Camellia-256/OCB", {1, 3, 6, 1, 4, 1, 25258, 3, 2, 8});
 1232|      0|      case 0x8B935:
  ------------------
  |  Branch (1232:7): [True: 0, False: 7]
  ------------------
 1233|      0|         return if_match(req, "ClassicMcEliece_6688128", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 5});
 1234|      0|      case 0x8BB11:
  ------------------
  |  Branch (1234:7): [True: 0, False: 7]
  ------------------
 1235|      0|         return if_match(req, "X509v3.NoRevocationAvailable", {2, 5, 29, 56});
 1236|      0|      case 0x8CE3D:
  ------------------
  |  Branch (1236:7): [True: 0, False: 7]
  ------------------
 1237|      0|         return if_match(req, "PKCS9.ChallengePassword", {1, 2, 840, 113549, 1, 9, 7});
 1238|      0|      case 0x8D45C:
  ------------------
  |  Branch (1238:7): [True: 0, False: 7]
  ------------------
 1239|      0|         return if_match(req, "ECKCDSA", {1, 0, 14888, 3, 0, 5});
 1240|      0|      case 0x8E0C1:
  ------------------
  |  Branch (1240:7): [True: 0, False: 7]
  ------------------
 1241|      0|         return if_match(req, "X509v3.CertificatePolicies", {2, 5, 29, 32});
 1242|      0|      case 0x8E39A:
  ------------------
  |  Branch (1242:7): [True: 0, False: 7]
  ------------------
 1243|      0|         return if_match(req, "HSS-LMS-Private-Key", {1, 3, 6, 1, 4, 1, 25258, 1, 13});
 1244|      0|      case 0x8EC51:
  ------------------
  |  Branch (1244:7): [True: 0, False: 7]
  ------------------
 1245|      0|         return if_match(req, "Kyber-768-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 2});
 1246|      0|      case 0x8F94A:
  ------------------
  |  Branch (1246:7): [True: 0, False: 7]
  ------------------
 1247|      0|         return if_match(req, "Dilithium-6x5-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 9, 2});
 1248|      0|      case 0x8FC20:
  ------------------
  |  Branch (1248:7): [True: 0, False: 7]
  ------------------
 1249|      0|         return if_match(req, "AES-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 1});
 1250|      0|      case 0x8FDE0:
  ------------------
  |  Branch (1250:7): [True: 0, False: 7]
  ------------------
 1251|      0|         return if_match(req, "SHA-3(256)", {2, 16, 840, 1, 101, 3, 4, 2, 8});
 1252|      0|      case 0x919E3:
  ------------------
  |  Branch (1252:7): [True: 0, False: 7]
  ------------------
 1253|      0|         return if_match(req, "Serpent/GCM", {1, 3, 6, 1, 4, 1, 25258, 3, 101});
 1254|      0|      case 0x91C1A:
  ------------------
  |  Branch (1254:7): [True: 0, False: 7]
  ------------------
 1255|      0|         return if_match(req, "X25519", {1, 3, 101, 110});
 1256|      0|      case 0x91DC4:
  ------------------
  |  Branch (1256:7): [True: 0, False: 7]
  ------------------
 1257|      0|         return if_match(req, "McEliece", {1, 3, 6, 1, 4, 1, 25258, 1, 3});
 1258|      0|      case 0x93467:
  ------------------
  |  Branch (1258:7): [True: 0, False: 7]
  ------------------
 1259|      0|         return if_match(req, "Dilithium-6x5-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 2});
 1260|      0|      case 0x93D50:
  ------------------
  |  Branch (1260:7): [True: 0, False: 7]
  ------------------
 1261|      0|         return if_match(req, "AES-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 2});
 1262|      0|      case 0x95166:
  ------------------
  |  Branch (1262:7): [True: 0, False: 7]
  ------------------
 1263|      0|         return if_match(req, "SLH-DSA-SHAKE-128f", {2, 16, 840, 1, 101, 3, 4, 3, 27});
 1264|      0|      case 0x95173:
  ------------------
  |  Branch (1264:7): [True: 0, False: 7]
  ------------------
 1265|      0|         return if_match(req, "SLH-DSA-SHAKE-128s", {2, 16, 840, 1, 101, 3, 4, 3, 26});
 1266|      0|      case 0x952D6:
  ------------------
  |  Branch (1266:7): [True: 0, False: 7]
  ------------------
 1267|      0|         return if_match(req, "PKIX.OCSP", {1, 3, 6, 1, 5, 5, 7, 48, 1});
 1268|      0|      case 0x959B9:
  ------------------
  |  Branch (1268:7): [True: 0, False: 7]
  ------------------
 1269|      0|         return if_match(req, "PKIX.IPsecEndSystem", {1, 3, 6, 1, 5, 5, 7, 3, 5});
 1270|      0|      case 0x96F85:
  ------------------
  |  Branch (1270:7): [True: 0, False: 7]
  ------------------
 1271|      0|         return if_match(req, "Camellia-256/CBC", {1, 2, 392, 200011, 61, 1, 1, 1, 4});
 1272|      0|      case 0x97D5E:
  ------------------
  |  Branch (1272:7): [True: 0, False: 7]
  ------------------
 1273|      0|         return if_match(req, "HMAC(SHA-1)", {1, 2, 840, 113549, 2, 7});
 1274|      0|      case 0x9805C:
  ------------------
  |  Branch (1274:7): [True: 0, False: 7]
  ------------------
 1275|      0|         return if_match(req, "SEED/CBC", {1, 2, 410, 200004, 1, 4});
 1276|      0|      case 0x980E7:
  ------------------
  |  Branch (1276:7): [True: 0, False: 7]
  ------------------
 1277|      0|         return if_match(req, "SphincsPlus-haraka-192s-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 3});
 1278|      0|      case 0x980F5:
  ------------------
  |  Branch (1278:7): [True: 0, False: 7]
  ------------------
 1279|      0|         return if_match(req, "GOST.SubjectSigningTool", {1, 2, 643, 100, 111});
 1280|      0|      case 0x98B03:
  ------------------
  |  Branch (1280:7): [True: 0, False: 7]
  ------------------
 1281|      0|         return if_match(req, "XMSS", {0, 4, 0, 127, 0, 15, 1, 1, 13, 0});
 1282|      0|      case 0x9A6B2:
  ------------------
  |  Branch (1282:7): [True: 0, False: 7]
  ------------------
 1283|      0|         return if_match(req, "ECKCDSA/SHA-1", {1, 2, 410, 200004, 1, 100, 4, 3});
 1284|      0|      case 0x9B1CF:
  ------------------
  |  Branch (1284:7): [True: 0, False: 7]
  ------------------
 1285|      0|         return if_match(req, "SM4/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 9});
 1286|      0|      case 0x9B6B2:
  ------------------
  |  Branch (1286:7): [True: 0, False: 7]
  ------------------
 1287|      0|         return if_match(req, "AES-128/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 6});
 1288|      0|      case 0x9B6BB:
  ------------------
  |  Branch (1288:7): [True: 0, False: 7]
  ------------------
 1289|      0|         return if_match(req, "X520.OrganizationalUnit", {2, 5, 4, 11});
 1290|      0|      case 0x9B851:
  ------------------
  |  Branch (1290:7): [True: 0, False: 7]
  ------------------
 1291|      0|         return if_match(req, "OpenPGP.Curve25519", {1, 3, 6, 1, 4, 1, 3029, 1, 5, 1});
 1292|      0|      case 0x9C80B:
  ------------------
  |  Branch (1292:7): [True: 0, False: 7]
  ------------------
 1293|      0|         return if_match(req, "SLH-DSA-SHA2-192f", {2, 16, 840, 1, 101, 3, 4, 3, 23});
 1294|      0|      case 0x9C818:
  ------------------
  |  Branch (1294:7): [True: 0, False: 7]
  ------------------
 1295|      0|         return if_match(req, "SLH-DSA-SHA2-192s", {2, 16, 840, 1, 101, 3, 4, 3, 22});
 1296|      0|      case 0x9CD2B:
  ------------------
  |  Branch (1296:7): [True: 0, False: 7]
  ------------------
 1297|      0|         return if_match(req, "Scrypt", {1, 3, 6, 1, 4, 1, 11591, 4, 11});
 1298|      0|      case 0x9CDE1:
  ------------------
  |  Branch (1298:7): [True: 0, False: 7]
  ------------------
 1299|      0|         return if_match(req, "GOST-34.10-2012-256/SHA-256", {1, 3, 6, 1, 4, 1, 25258, 1, 6, 1});
 1300|      0|      case 0x9CF73:
  ------------------
  |  Branch (1300:7): [True: 0, False: 7]
  ------------------
 1301|      0|         return if_match(req, "ClassicMcEliece_460896f", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 4});
 1302|      0|      case 0x9D354:
  ------------------
  |  Branch (1302:7): [True: 0, False: 7]
  ------------------
 1303|      0|         return if_match(req, "RIPEMD-160", {1, 3, 36, 3, 2, 1});
 1304|      0|      case 0x9D503:
  ------------------
  |  Branch (1304:7): [True: 0, False: 7]
  ------------------
 1305|      0|         return if_match(req, "RSA/PKCS1v15(SHA-256)", {1, 2, 840, 113549, 1, 1, 11});
 1306|      0|      case 0x9EC88:
  ------------------
  |  Branch (1306:7): [True: 0, False: 7]
  ------------------
 1307|      0|         return if_match(req, "DSA/SHA-3(512)", {2, 16, 840, 1, 101, 3, 4, 3, 8});
 1308|      0|      case 0x9EF36:
  ------------------
  |  Branch (1308:7): [True: 0, False: 7]
  ------------------
 1309|      0|         return if_match(req, "ClassicMcEliece_6960119", {1, 3, 6, 1, 4, 1, 22554, 5, 1, 7});
 1310|      0|      case 0x9F764:
  ------------------
  |  Branch (1310:7): [True: 0, False: 7]
  ------------------
 1311|      0|         return if_match(req, "X448", {1, 3, 101, 111});
 1312|      0|      case 0x9F7E2:
  ------------------
  |  Branch (1312:7): [True: 0, False: 7]
  ------------------
 1313|      0|         return if_match(req, "AES-192/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 26});
 1314|      0|      case 0x9F9C5:
  ------------------
  |  Branch (1314:7): [True: 0, False: 7]
  ------------------
 1315|      0|         return if_match(req, "ClassicMcEliece_6688128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 2});
 1316|      0|      case 0xA0805:
  ------------------
  |  Branch (1316:7): [True: 0, False: 7]
  ------------------
 1317|      0|         return if_match(req, "PKCS9.SDSICertificate", {1, 2, 840, 113549, 1, 9, 22, 2});
 1318|      0|      case 0xA2B5B:
  ------------------
  |  Branch (1318:7): [True: 0, False: 7]
  ------------------
 1319|      0|         return if_match(req, "X509v3.CRLNumber", {2, 5, 29, 20});
 1320|      0|      case 0xA3005:
  ------------------
  |  Branch (1320:7): [True: 0, False: 7]
  ------------------
 1321|      0|         return if_match(req, "X520.Title", {2, 5, 4, 12});
 1322|      0|      case 0xA323F:
  ------------------
  |  Branch (1322:7): [True: 0, False: 7]
  ------------------
 1323|      0|         return if_match(req, "X509v3.NameConstraints", {2, 5, 29, 30});
 1324|      0|      case 0xA3C55:
  ------------------
  |  Branch (1324:7): [True: 0, False: 7]
  ------------------
 1325|      0|         return if_match(req, "X520.Pseudonym", {2, 5, 4, 65});
 1326|      0|      case 0xA4809:
  ------------------
  |  Branch (1326:7): [True: 0, False: 7]
  ------------------
 1327|      0|         return if_match(req, "SphincsPlus-sha2-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 2, 6});
 1328|      1|      case 0xA57AF:
  ------------------
  |  Branch (1328:7): [True: 1, False: 6]
  ------------------
 1329|      1|         return if_match(req, "secp521r1", {1, 3, 132, 0, 35});
 1330|      0|      case 0xA5DA9:
  ------------------
  |  Branch (1330:7): [True: 0, False: 7]
  ------------------
 1331|      0|         return if_match(req, "SphincsPlus-shake-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 1, 6});
 1332|      0|      case 0xA6865:
  ------------------
  |  Branch (1332:7): [True: 0, False: 7]
  ------------------
 1333|      0|         return if_match(req, "Camellia-128/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 6});
 1334|      0|      case 0xA6C61:
  ------------------
  |  Branch (1334:7): [True: 0, False: 7]
  ------------------
 1335|      0|         return if_match(req, "SM4/GCM", {1, 2, 156, 10197, 1, 104, 8});
 1336|      0|      case 0xA8439:
  ------------------
  |  Branch (1336:7): [True: 0, False: 7]
  ------------------
 1337|      0|         return if_match(req, "PKCS12.CertBag", {1, 2, 840, 113549, 1, 12, 10, 1, 3});
 1338|      0|      case 0xA9061:
  ------------------
  |  Branch (1338:7): [True: 0, False: 7]
  ------------------
 1339|      0|         return if_match(req, "Kyber-768-90s-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 11, 2});
 1340|      0|      case 0xAA995:
  ------------------
  |  Branch (1340:7): [True: 0, False: 7]
  ------------------
 1341|      0|         return if_match(req, "Camellia-192/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 7});
 1342|      0|      case 0xAAE2B:
  ------------------
  |  Branch (1342:7): [True: 0, False: 7]
  ------------------
 1343|      0|         return if_match(req, "Dilithium-8x7-AES-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 10, 3});
 1344|      0|      case 0xABCED:
  ------------------
  |  Branch (1344:7): [True: 0, False: 7]
  ------------------
 1345|      0|         return if_match(req, "GOST.IssuerSigningTool", {1, 2, 643, 100, 112});
 1346|      0|      case 0xABD24:
  ------------------
  |  Branch (1346:7): [True: 0, False: 7]
  ------------------
 1347|      0|         return if_match(req, "RSA/OAEP", {1, 2, 840, 113549, 1, 1, 7});
 1348|      0|      case 0xAC2EC:
  ------------------
  |  Branch (1348:7): [True: 0, False: 7]
  ------------------
 1349|      0|         return if_match(req, "Streebog-256", {1, 2, 643, 7, 1, 1, 2, 2});
 1350|      0|      case 0xAC3DD:
  ------------------
  |  Branch (1350:7): [True: 0, False: 7]
  ------------------
 1351|      0|         return if_match(req, "Certificate Comment", {2, 16, 840, 1, 113730, 1, 13});
 1352|      0|      case 0xAC511:
  ------------------
  |  Branch (1352:7): [True: 0, False: 7]
  ------------------
 1353|      0|         return if_match(req, "PBE-SHA1-3DES", {1, 2, 840, 113549, 1, 12, 1, 3});
 1354|      0|      case 0xAE6FE:
  ------------------
  |  Branch (1354:7): [True: 0, False: 7]
  ------------------
 1355|      0|         return if_match(req, "PKIX.ClientAuth", {1, 3, 6, 1, 5, 5, 7, 3, 2});
 1356|      0|      case 0xAE8D3:
  ------------------
  |  Branch (1356:7): [True: 0, False: 7]
  ------------------
 1357|      0|         return if_match(req, "ClassicMcEliece_8192128pcf", {1, 3, 6, 1, 4, 1, 25258, 1, 18, 6});
 1358|      0|      case 0xAF476:
  ------------------
  |  Branch (1358:7): [True: 0, False: 7]
  ------------------
 1359|      0|         return if_match(req, "ECDH", {1, 3, 132, 1, 12});
 1360|      0|      case 0xAFA6A:
  ------------------
  |  Branch (1360:7): [True: 0, False: 7]
  ------------------
 1361|      0|         return if_match(req, "RSA/PKCS1v15(SHA-3(384))", {2, 16, 840, 1, 101, 3, 4, 3, 15});
 1362|      0|      case 0xB2217:
  ------------------
  |  Branch (1362:7): [True: 0, False: 7]
  ------------------
 1363|      0|         return if_match(req, "AES-256/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 3});
 1364|      0|      case 0xB22F7:
  ------------------
  |  Branch (1364:7): [True: 0, False: 7]
  ------------------
 1365|      0|         return if_match(req, "Camellia-128/GCM", {0, 3, 4401, 5, 3, 1, 9, 6});
 1366|      0|      case 0xB23DE:
  ------------------
  |  Branch (1366:7): [True: 0, False: 7]
  ------------------
 1367|      0|         return if_match(req, "X520.Locality", {2, 5, 4, 7});
 1368|      0|      case 0xB2FBD:
  ------------------
  |  Branch (1368:7): [True: 0, False: 7]
  ------------------
 1369|      0|         return if_match(req, "ECKCDSA/SHA-224", {1, 2, 410, 200004, 1, 100, 4, 4});
 1370|      0|      case 0xB32B0:
  ------------------
  |  Branch (1370:7): [True: 0, False: 7]
  ------------------
 1371|      0|         return if_match(req, "ECKCDSA/SHA-256", {1, 2, 410, 200004, 1, 100, 4, 5});
 1372|      0|      case 0xB360E:
  ------------------
  |  Branch (1372:7): [True: 0, False: 7]
  ------------------
 1373|      0|         return if_match(req, "eFrodoKEM-976-SHAKE", {1, 3, 6, 1, 4, 1, 25258, 1, 16, 2});
 1374|      0|      case 0xB4368:
  ------------------
  |  Branch (1374:7): [True: 0, False: 7]
  ------------------
 1375|      0|         return if_match(req, "ECGDSA/SHA-1", {1, 3, 36, 3, 3, 2, 5, 4, 2});
 1376|      0|      case 0xB58CD:
  ------------------
  |  Branch (1376:7): [True: 0, False: 7]
  ------------------
 1377|      0|         return if_match(req, "RSA/PKCS1v15(SHA-3(512))", {2, 16, 840, 1, 101, 3, 4, 3, 16});
 1378|      0|      case 0xB6427:
  ------------------
  |  Branch (1378:7): [True: 0, False: 7]
  ------------------
 1379|      0|         return if_match(req, "Camellia-192/GCM", {0, 3, 4401, 5, 3, 1, 9, 26});
 1380|      0|      case 0xB7102:
  ------------------
  |  Branch (1380:7): [True: 0, False: 7]
  ------------------
 1381|      0|         return if_match(req, "brainpool224r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 5});
 1382|      0|      case 0xB710D:
  ------------------
  |  Branch (1382:7): [True: 0, False: 7]
  ------------------
 1383|      0|         return if_match(req, "X509v3.CRLIssuingDistributionPoint", {2, 5, 29, 28});
 1384|      0|      case 0xB72D4:
  ------------------
  |  Branch (1384:7): [True: 0, False: 7]
  ------------------
 1385|      0|         return if_match(req, "Microsoft UPN", {1, 3, 6, 1, 4, 1, 311, 20, 2, 3});
 1386|      0|      case 0xB73A5:
  ------------------
  |  Branch (1386:7): [True: 0, False: 7]
  ------------------
 1387|      0|         return if_match(req, "RSA/PSS", {1, 2, 840, 113549, 1, 1, 10});
 1388|      0|      case 0xB84B3:
  ------------------
  |  Branch (1388:7): [True: 0, False: 7]
  ------------------
 1389|      0|         return if_match(req, "PKIX.CodeSigning", {1, 3, 6, 1, 5, 5, 7, 3, 3});
 1390|      0|      case 0xB8CB9:
  ------------------
  |  Branch (1390:7): [True: 0, False: 7]
  ------------------
 1391|      0|         return if_match(req, "GOST-34.10-2012-256", {1, 2, 643, 7, 1, 1, 1, 1});
 1392|      0|      case 0xB945C:
  ------------------
  |  Branch (1392:7): [True: 0, False: 7]
  ------------------
 1393|      0|         return if_match(req, "Twofish/SIV", {1, 3, 6, 1, 4, 1, 25258, 3, 4, 5});
 1394|      0|      case 0xB94E4:
  ------------------
  |  Branch (1394:7): [True: 0, False: 7]
  ------------------
 1395|      0|         return if_match(req, "gost_512A", {1, 2, 643, 7, 1, 2, 1, 2, 1});
 1396|      0|      case 0xB94E5:
  ------------------
  |  Branch (1396:7): [True: 0, False: 7]
  ------------------
 1397|      0|         return if_match(req, "gost_512B", {1, 2, 643, 7, 1, 2, 1, 2, 2});
 1398|      0|      case 0xBA1D8:
  ------------------
  |  Branch (1398:7): [True: 0, False: 7]
  ------------------
 1399|      0|         return if_match(req, "X520.StreetAddress", {2, 5, 4, 9});
 1400|      0|      case 0xBCB45:
  ------------------
  |  Branch (1400:7): [True: 0, False: 7]
  ------------------
 1401|      0|         return if_match(req, "PKCS12.CRLBag", {1, 2, 840, 113549, 1, 12, 10, 1, 4});
 1402|      0|      case 0xBCC82:
  ------------------
  |  Branch (1402:7): [True: 0, False: 7]
  ------------------
 1403|      0|         return if_match(req, "x962_p239v1", {1, 2, 840, 10045, 3, 1, 4});
 1404|      0|      case 0xBCC83:
  ------------------
  |  Branch (1404:7): [True: 0, False: 7]
  ------------------
 1405|      0|         return if_match(req, "x962_p239v2", {1, 2, 840, 10045, 3, 1, 5});
 1406|      0|      case 0xBCC84:
  ------------------
  |  Branch (1406:7): [True: 0, False: 7]
  ------------------
 1407|      0|         return if_match(req, "x962_p239v3", {1, 2, 840, 10045, 3, 1, 6});
 1408|      0|      case 0xBD92B:
  ------------------
  |  Branch (1408:7): [True: 0, False: 7]
  ------------------
 1409|      0|         return if_match(req, "X509v3.HoldInstructionCode", {2, 5, 29, 23});
 1410|      0|      case 0xBDCA9:
  ------------------
  |  Branch (1410:7): [True: 0, False: 7]
  ------------------
 1411|      0|         return if_match(req, "AES-256/GCM", {2, 16, 840, 1, 101, 3, 4, 1, 46});
 1412|      0|      case 0xBE48D:
  ------------------
  |  Branch (1412:7): [True: 0, False: 7]
  ------------------
 1413|      0|         return if_match(req, "PKIX.OCSP.BasicResponse", {1, 3, 6, 1, 5, 5, 7, 48, 1, 1});
 1414|      0|      case 0xBF71E:
  ------------------
  |  Branch (1414:7): [True: 0, False: 7]
  ------------------
 1415|      0|         return if_match(req, "Kyber-1024-r3", {1, 3, 6, 1, 4, 1, 25258, 1, 7, 3});
 1416|      0|      case 0xBFF01:
  ------------------
  |  Branch (1416:7): [True: 0, False: 7]
  ------------------
 1417|      0|         return if_match(req, "DSA/SHA-3(224)", {2, 16, 840, 1, 101, 3, 4, 3, 5});
 1418|      0|      case 0xC0F4F:
  ------------------
  |  Branch (1418:7): [True: 0, False: 7]
  ------------------
 1419|      0|         return if_match(req, "SphincsPlus-haraka-256f-r3.1", {1, 3, 6, 1, 4, 1, 25258, 1, 12, 3, 6});
 1420|      0|      case 0xC1875:
  ------------------
  |  Branch (1420:7): [True: 0, False: 7]
  ------------------
 1421|      0|         return if_match(req, "SHA-1", {1, 3, 14, 3, 2, 26});
 1422|      0|      case 0xC28D1:
  ------------------
  |  Branch (1422:7): [True: 0, False: 7]
  ------------------
 1423|      0|         return if_match(req, "PKIX.OCSPSigning", {1, 3, 6, 1, 5, 5, 7, 3, 9});
 1424|      1|      case 0xC42CA:
  ------------------
  |  Branch (1424:7): [True: 1, False: 6]
  ------------------
 1425|      1|         return if_match(req, "brainpool256r1", {1, 3, 36, 3, 3, 2, 8, 1, 1, 7});
 1426|      0|      default:
  ------------------
  |  Branch (1426:7): [True: 0, False: 7]
  ------------------
 1427|      0|         return {};
 1428|      7|   }
 1429|      7|}
_ZN5Botan7OID_Map16load_oid2str_mapEv:
 1431|      1|std::unordered_map<OID, std::string> OID_Map::load_oid2str_map() {
 1432|      1|   return {
 1433|      1|      {OID{2, 5, 8, 1, 1}, "RSA"},
 1434|      1|      {OID{1, 3, 6, 1, 4, 1, 8301, 3, 1, 2, 9, 0, 38}, "secp521r1"},
 1435|      1|      {OID{1, 2, 643, 2, 2, 35, 1}, "gost_256A"},
 1436|      1|      {OID{1, 2, 643, 2, 2, 36, 0}, "gost_256A"},
 1437|      1|   };
 1438|      1|}
_ZN5Botan7OID_Map16load_str2oid_mapEv:
 1440|      1|std::unordered_map<std::string, OID> OID_Map::load_str2oid_map() {
 1441|      1|   return {
 1442|      1|      {"Curve25519", OID{1, 3, 101, 110}},
 1443|      1|      {"SM2_Sig", OID{1, 2, 156, 10197, 1, 301, 1}},
 1444|      1|      {"RSA/EMSA3(MD2)", OID{1, 2, 840, 113549, 1, 1, 2}},
 1445|      1|      {"RSA/EMSA3(MD5)", OID{1, 2, 840, 113549, 1, 1, 4}},
 1446|      1|      {"RSA/EMSA3(SHA-1)", OID{1, 2, 840, 113549, 1, 1, 5}},
 1447|      1|      {"RSA/EMSA3(SHA-256)", OID{1, 2, 840, 113549, 1, 1, 11}},
 1448|      1|      {"RSA/EMSA3(SHA-384)", OID{1, 2, 840, 113549, 1, 1, 12}},
 1449|      1|      {"RSA/EMSA3(SHA-512)", OID{1, 2, 840, 113549, 1, 1, 13}},
 1450|      1|      {"RSA/EMSA3(SHA-224)", OID{1, 2, 840, 113549, 1, 1, 14}},
 1451|      1|      {"RSA/EMSA3(SHA-512-256)", OID{1, 2, 840, 113549, 1, 1, 16}},
 1452|      1|      {"RSA/EMSA3(SHA-3(224))", OID{2, 16, 840, 1, 101, 3, 4, 3, 13}},
 1453|      1|      {"RSA/EMSA3(SHA-3(256))", OID{2, 16, 840, 1, 101, 3, 4, 3, 14}},
 1454|      1|      {"RSA/EMSA3(SHA-3(384))", OID{2, 16, 840, 1, 101, 3, 4, 3, 15}},
 1455|      1|      {"RSA/EMSA3(SHA-3(512))", OID{2, 16, 840, 1, 101, 3, 4, 3, 16}},
 1456|      1|      {"RSA/EMSA3(SM3)", OID{1, 2, 156, 10197, 1, 504}},
 1457|      1|      {"RSA/EMSA3(RIPEMD-160)", OID{1, 3, 36, 3, 3, 1, 2}},
 1458|      1|      {"RSA/EMSA4", OID{1, 2, 840, 113549, 1, 1, 10}},
 1459|      1|      {"PBES2", OID{1, 2, 840, 113549, 1, 5, 13}},
 1460|      1|   };
 1461|      1|}
static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchERKNS_3OIDESt16initializer_listIjENSt3__117basic_string_viewIcNS6_11char_traitsIcEEEE:
   18|      7|std::optional<std::string_view> if_match(const OID& oid, std::initializer_list<uint32_t> val, std::string_view name) {
   19|      7|   if(oid.matches(val)) {
  ------------------
  |  Branch (19:7): [True: 7, False: 0]
  ------------------
   20|      7|      return name;
   21|      7|   } else {
   22|      0|      return {};
   23|      0|   }
   24|      7|}
static_oids.cpp:_ZN5Botan12_GLOBAL__N_113hash_oid_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   34|      7|uint32_t hash_oid_name(std::string_view s) {
   35|      7|   uint64_t hash = 0x8188B31879A4879A;
   36|       |
   37|     73|   for(const char c : s) {
  ------------------
  |  Branch (37:21): [True: 73, False: 7]
  ------------------
   38|     73|      hash *= 251;
   39|     73|      hash += c;
   40|     73|   }
   41|       |
   42|      7|   return static_cast<uint32_t>(hash % 805289);
   43|      7|}
static_oids.cpp:_ZN5Botan12_GLOBAL__N_18if_matchENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEES5_St16initializer_listIjE:
   26|      7|std::optional<OID> if_match(std::string_view req, std::string_view actual, std::initializer_list<uint32_t> oid) {
   27|      7|   if(req == actual) {
  ------------------
  |  Branch (27:7): [True: 7, False: 0]
  ------------------
   28|      7|      return OID(oid);
   29|      7|   } else {
   30|      0|      return {};
   31|      0|   }
   32|      7|}

_ZN5Botan10hex_decodeEPhPKcmRmb:
   72|     47|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, size_t& input_consumed, bool ignore_ws) {
   73|     47|   uint8_t* out_ptr = output;
   74|     47|   bool top_nibble = true;
   75|       |
   76|     47|   clear_mem(output, input_length / 2);
   77|       |
   78|  3.57k|   for(size_t i = 0; i != input_length; ++i) {
  ------------------
  |  Branch (78:22): [True: 3.52k, False: 47]
  ------------------
   79|  3.52k|      const uint8_t bin = hex_char_to_bin(input[i]);
   80|       |
   81|  3.52k|      if(bin >= 0x10) {
  ------------------
  |  Branch (81:10): [True: 0, False: 3.52k]
  ------------------
   82|      0|         if(bin == 0x80 && ignore_ws) {
  ------------------
  |  Branch (82:13): [True: 0, False: 0]
  |  Branch (82:28): [True: 0, False: 0]
  ------------------
   83|      0|            continue;
   84|      0|         }
   85|       |
   86|      0|         throw Invalid_Argument(fmt("hex_decode: invalid character '{}'", format_char_for_display(input[i])));
   87|      0|      }
   88|       |
   89|  3.52k|      if(top_nibble) {
  ------------------
  |  Branch (89:10): [True: 1.76k, False: 1.76k]
  ------------------
   90|  1.76k|         *out_ptr |= bin << 4;
   91|  1.76k|      } else {
   92|  1.76k|         *out_ptr |= bin;
   93|  1.76k|      }
   94|       |
   95|  3.52k|      top_nibble = !top_nibble;
   96|  3.52k|      if(top_nibble) {
  ------------------
  |  Branch (96:10): [True: 1.76k, False: 1.76k]
  ------------------
   97|  1.76k|         ++out_ptr;
   98|  1.76k|      }
   99|  3.52k|   }
  100|       |
  101|     47|   input_consumed = input_length;
  102|     47|   const size_t written = (out_ptr - output);
  103|       |
  104|       |   /*
  105|       |   * We only got half of a uint8_t at the end; zap the half-written
  106|       |   * output and mark it as unread
  107|       |   */
  108|     47|   if(!top_nibble) {
  ------------------
  |  Branch (108:7): [True: 0, False: 47]
  ------------------
  109|      0|      *out_ptr = 0;
  110|      0|      input_consumed -= 1;
  111|      0|   }
  112|       |
  113|     47|   return written;
  114|     47|}
_ZN5Botan10hex_decodeEPhPKcmb:
  116|     47|size_t hex_decode(uint8_t output[], const char input[], size_t input_length, bool ignore_ws) {
  117|     47|   size_t consumed = 0;
  118|     47|   const size_t written = hex_decode(output, input, input_length, consumed, ignore_ws);
  119|       |
  120|     47|   if(consumed != input_length) {
  ------------------
  |  Branch (120:7): [True: 0, False: 47]
  ------------------
  121|      0|      throw Invalid_Argument("hex_decode: input did not have full bytes");
  122|      0|   }
  123|       |
  124|     47|   return written;
  125|     47|}
_ZN5Botan17hex_decode_lockedEPKcmb:
  135|     47|secure_vector<uint8_t> hex_decode_locked(const char input[], size_t input_length, bool ignore_ws) {
  136|     47|   secure_vector<uint8_t> bin(1 + input_length / 2);
  137|       |
  138|     47|   const size_t written = hex_decode(bin.data(), input, input_length, ignore_ws);
  139|       |
  140|     47|   bin.resize(written);
  141|     47|   return bin;
  142|     47|}
_ZN5Botan17hex_decode_lockedENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEEb:
  144|     37|secure_vector<uint8_t> hex_decode_locked(std::string_view input, bool ignore_ws) {
  145|     37|   return hex_decode_locked(input.data(), input.size(), ignore_ws);
  146|     37|}
hex.cpp:_ZN5Botan12_GLOBAL__N_115hex_char_to_binEc:
   54|  3.52k|uint8_t hex_char_to_bin(char input) {
   55|       |   // Starts of valid value ranges (v_lo) and their lengths (v_range)
   56|  3.52k|   constexpr uint64_t v_lo = make_uint64(0, '0', 'a', 'A', ' ', '\n', '\t', '\r');
   57|  3.52k|   constexpr uint64_t v_range = make_uint64(0, 10, 6, 6, 1, 1, 1, 1);
   58|       |
   59|  3.52k|   const uint8_t x = static_cast<uint8_t>(input);
   60|  3.52k|   const uint64_t x8 = x * 0x0101010101010101;
   61|       |
   62|  3.52k|   const uint64_t v_mask = swar_in_range<uint64_t>(x8, v_lo, v_range) ^ 0x8000000000000000;
   63|       |
   64|       |   // This is the offset added to x to get the value we need
   65|  3.52k|   const uint64_t val_v = 0xd0a9c960767773 ^ static_cast<uint64_t>(0xFF - x) << 56;
   66|       |
   67|  3.52k|   return x + static_cast<uint8_t>(val_v >> (8 * index_of_first_set_byte(v_mask)));
   68|  3.52k|}

_ZN5Botan6BigInt17from_radix_digitsENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEEm:
  125|     42|BigInt BigInt::from_radix_digits(std::string_view digits, size_t radix) {
  126|     42|   if(radix == 16) {
  ------------------
  |  Branch (126:7): [True: 42, False: 0]
  ------------------
  127|     42|      secure_vector<uint8_t> binary;
  128|       |
  129|     42|      if(digits.size() % 2 == 1) {
  ------------------
  |  Branch (129:10): [True: 5, False: 37]
  ------------------
  130|       |         // Handle lack of leading 0
  131|      5|         const char buf0_with_leading_0[2] = {'0', digits[0]};
  132|       |
  133|      5|         binary = hex_decode_locked(buf0_with_leading_0, 2);
  134|       |
  135|      5|         if(digits.size() > 1) {
  ------------------
  |  Branch (135:13): [True: 5, False: 0]
  ------------------
  136|      5|            binary += hex_decode_locked(&digits[1], digits.size() - 1, false);
  137|      5|         }
  138|     37|      } else {
  139|     37|         binary = hex_decode_locked(digits, false);
  140|     37|      }
  141|       |
  142|     42|      return BigInt::from_bytes(binary);
  143|     42|   } else if(radix == 10) {
  ------------------
  |  Branch (143:14): [True: 0, False: 0]
  ------------------
  144|       |      // Use the largest power of 10 that fits in a word, accumulating
  145|       |      // groups of digits into word-sized chunks to minimize the number
  146|       |      // of multiprecision multiplications.
  147|      0|      constexpr word conversion_radix = decimal_conversion_radix();
  148|      0|      constexpr size_t radix_digits = decimal_conversion_radix_digits();
  149|       |
  150|      0|      BigInt r;
  151|       |
  152|       |      // Handle the initial partial block (if digit count is not a multiple of radix_digits)
  153|      0|      const size_t partial_block = digits.size() % radix_digits;
  154|       |
  155|      0|      if(partial_block > 0) {
  ------------------
  |  Branch (155:10): [True: 0, False: 0]
  ------------------
  156|      0|         word acc = 0;
  157|      0|         for(size_t i = 0; i < partial_block; ++i) {
  ------------------
  |  Branch (157:28): [True: 0, False: 0]
  ------------------
  158|      0|            const char c = digits[i];
  159|      0|            BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character");
  ------------------
  |  |   35|      0|   do {                                                          \
  |  |   36|      0|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|      0|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 0, False: 0]
  |  |  |  Branch (37:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
  160|      0|            acc = acc * 10 + static_cast<word>(c - '0');
  161|      0|         }
  162|      0|         r += acc;
  163|      0|      }
  164|       |
  165|       |      // Process full blocks of radix_digits
  166|      0|      for(size_t i = partial_block; i != digits.size(); i += radix_digits) {
  ------------------
  |  Branch (166:37): [True: 0, False: 0]
  ------------------
  167|      0|         word acc = 0;
  168|      0|         for(size_t j = 0; j < radix_digits; ++j) {
  ------------------
  |  Branch (168:28): [True: 0, False: 0]
  ------------------
  169|      0|            const char c = digits[i + j];
  170|      0|            BOTAN_ARG_CHECK(c >= '0' && c <= '9', "Invalid decimal character");
  ------------------
  |  |   35|      0|   do {                                                          \
  |  |   36|      0|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|      0|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 0, False: 0]
  |  |  |  Branch (37:12): [True: 0, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
  171|      0|            acc = acc * 10 + static_cast<word>(c - '0');
  172|      0|         }
  173|      0|         r *= conversion_radix;
  174|      0|         r += acc;
  175|      0|      }
  176|       |
  177|      0|      return r;
  178|      0|   } else {
  179|      0|      throw Invalid_Argument("BigInt::from_radix_digits unknown radix");
  180|      0|   }
  181|     42|}

_ZN5Botan6BigIntmIERKS0_:
   23|    101|BigInt& BigInt::operator-=(const BigInt& y) {
   24|    101|   if(&y == this) {
  ------------------
  |  Branch (24:7): [True: 0, False: 101]
  ------------------
   25|      0|      this->clear();
   26|      0|      this->set_sign(Positive);
   27|      0|      return *this;
   28|      0|   }
   29|    101|   return sub(y._data(), y.sig_words(), y.sign());
   30|    101|}
_ZN5Botan6BigInt3addEPKmmNS0_4SignE:
   32|    101|BigInt& BigInt::add(const word y[], size_t y_words, Sign y_sign) {
   33|    101|   const size_t x_sw = sig_words();
   34|       |
   35|    101|   grow_to(std::max(x_sw, y_words) + 1);
   36|       |
   37|    101|   if(sign() == y_sign) {
  ------------------
  |  Branch (37:7): [True: 0, False: 101]
  ------------------
   38|      0|      const word carry = bigint_add2(mutable_data(), size() - 1, y, y_words);
   39|      0|      mutable_data()[size() - 1] += carry;
   40|    101|   } else {
   41|    101|      const int32_t relative_size = bigint_cmp(_data(), x_sw, y, y_words);
   42|       |
   43|    101|      if(relative_size >= 0) {
  ------------------
  |  Branch (43:10): [True: 101, False: 0]
  ------------------
   44|       |         // *this >= y
   45|    101|         bigint_sub2(mutable_data(), x_sw, y, y_words);
   46|    101|      } else {
   47|       |         // *this < y: compute *this = y - *this
   48|      0|         bigint_sub2_rev(mutable_data(), y, y_words);
   49|      0|      }
   50|       |
   51|    101|      if(relative_size < 0) {
  ------------------
  |  Branch (51:10): [True: 0, False: 101]
  ------------------
   52|      0|         set_sign(y_sign);
   53|    101|      } else if(relative_size == 0) {
  ------------------
  |  Branch (53:17): [True: 0, False: 101]
  ------------------
   54|      0|         set_sign(Positive);
   55|      0|      }
   56|    101|   }
   57|       |
   58|    101|   return (*this);
   59|    101|}
_ZN5Botan6BigIntlSEm:
  269|      6|BigInt& BigInt::operator<<=(size_t shift) {
  270|      6|   if(shift >= 65536) {
  ------------------
  |  Branch (270:7): [True: 0, False: 6]
  ------------------
  271|      0|      throw Invalid_Argument("BigInt left shift count too large");
  272|      0|   }
  273|       |
  274|      6|   const size_t sw = sig_words();
  275|      6|   const size_t new_size = sw + (shift + WordInfo<word>::bits - 1) / WordInfo<word>::bits;
  276|       |
  277|      6|   m_data.grow_to(new_size);
  278|       |
  279|      6|   bigint_shl1(m_data.mutable_data(), new_size, sw, shift);
  280|       |
  281|      6|   return (*this);
  282|      6|}
_ZN5Botan6BigIntrSEm:
  287|    135|BigInt& BigInt::operator>>=(size_t shift) {
  288|    135|   bigint_shr1(m_data.mutable_data(), m_data.size(), shift);
  289|       |
  290|    135|   if(sig_words() == 0 && m_signedness == Negative) {
  ------------------
  |  Branch (290:7): [True: 0, False: 135]
  |  Branch (290:27): [True: 0, False: 0]
  ------------------
  291|      0|      m_signedness = Positive;
  292|      0|   }
  293|       |
  294|    135|   return (*this);
  295|    135|}

_ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE:
   20|     21|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_size, BigInt::Sign y_sign) {
   21|     21|   const size_t x_sw = x.sig_words();
   22|       |
   23|     21|   BigInt z = BigInt::with_capacity(std::max(x_sw, y_size) + 1);
   24|       |
   25|     21|   if(x.sign() == y_sign) {
  ------------------
  |  Branch (25:7): [True: 14, False: 7]
  ------------------
   26|     14|      const word carry = bigint_add3(z.mutable_data(), x._data(), x_sw, y, y_size);
   27|     14|      z.mutable_data()[std::max(x_sw, y_size)] += carry;
   28|     14|      z.set_sign(x.sign());
   29|     14|   } else {
   30|      7|      const int32_t relative_size = bigint_cmp(x.data(), x_sw, y, y_size);
   31|       |
   32|      7|      if(relative_size < 0) {
  ------------------
  |  Branch (32:10): [True: 0, False: 7]
  ------------------
   33|       |         // x < y so z = abs(y - x)
   34|       |         // NOLINTNEXTLINE(*-suspicious-call-argument) intentionally swapping x and y here
   35|      0|         bigint_sub3(z.mutable_data(), y, y_size, x.data(), x_sw);
   36|      0|         z.set_sign(y_sign);
   37|      7|      } else if(relative_size == 0) {
  ------------------
  |  Branch (37:17): [True: 0, False: 7]
  ------------------
   38|       |         // Positive zero (nothing to do in this case)
   39|      7|      } else {
   40|       |         /*
   41|       |         * We know at this point that x >= y so if y_size is larger than
   42|       |         * x_sw, we are guaranteed they are just leading zeros which can
   43|       |         * be ignored
   44|       |         */
   45|      7|         y_size = std::min(x_sw, y_size);
   46|      7|         bigint_sub3(z.mutable_data(), x.data(), x_sw, y, y_size);
   47|      7|         z.set_sign(x.sign());
   48|      7|      }
   49|      7|   }
   50|       |
   51|     21|   return z;
   52|     21|}
_ZN5BotanmlERKNS_6BigIntEm:
   90|     80|BigInt operator*(const BigInt& x, word y) {
   91|     80|   const size_t x_sw = x.sig_words();
   92|       |
   93|     80|   BigInt z = BigInt::with_capacity(x_sw + 1);
   94|       |
   95|     80|   if(x_sw > 0 && y > 0) {
  ------------------
  |  Branch (95:7): [True: 80, False: 0]
  |  Branch (95:19): [True: 80, False: 0]
  ------------------
   96|     80|      bigint_linmul3(z.mutable_data(), x._data(), x_sw, y);
   97|     80|      z.set_sign(x.sign());
   98|     80|   }
   99|       |
  100|     80|   return z;
  101|     80|}
_ZN5BotanlsERKNS_6BigIntEm:
  188|     21|BigInt operator<<(const BigInt& x, size_t shift) {
  189|     21|   if(shift >= 65536) {
  ------------------
  |  Branch (189:7): [True: 0, False: 21]
  ------------------
  190|      0|      throw Invalid_Argument("BigInt left shift count too large");
  191|      0|   }
  192|       |
  193|     21|   if(x.is_zero()) {
  ------------------
  |  Branch (193:7): [True: 0, False: 21]
  ------------------
  194|      0|      return BigInt::zero();
  195|      0|   }
  196|       |
  197|     21|   const size_t x_sw = x.sig_words();
  198|       |
  199|     21|   const size_t new_size = x_sw + shift / WordInfo<word>::bits + 1;
  200|     21|   BigInt y = BigInt::with_capacity(new_size);
  201|     21|   bigint_shl2(y.mutable_data(), new_size, x._data(), x_sw, shift);
  202|     21|   y.set_sign(x.sign());
  203|     21|   return y;
  204|     21|}

_ZN5Botan6BigIntC2Em:
   20|      7|BigInt::BigInt(uint64_t n) {
   21|      7|   if constexpr(sizeof(word) == 8) {
   22|      7|      m_data.set_word_at(0, static_cast<word>(n));
   23|       |   } else {
   24|       |      m_data.set_word_at(1, static_cast<word>(n >> 32));
   25|       |      m_data.set_word_at(0, static_cast<word>(n));
   26|       |   }
   27|      7|}
_ZN5Botan6BigInt13with_capacityEm:
   51|    136|BigInt BigInt::with_capacity(size_t size) {
   52|    136|   BigInt bn;
   53|    136|   bn.grow_to(size);
   54|    136|   return bn;
   55|    136|}
_ZN5Botan6BigInt11from_stringENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   57|     42|BigInt BigInt::from_string(std::string_view str) {
   58|     42|   size_t prefix_bytes = 0;
   59|     42|   bool negative = false;
   60|     42|   size_t radix = 10;
   61|       |
   62|     42|   if(!str.empty() && str[0] == '-') {
  ------------------
  |  Branch (62:7): [True: 42, False: 0]
  |  Branch (62:23): [True: 0, False: 42]
  ------------------
   63|      0|      prefix_bytes += 1;
   64|      0|      negative = true;
   65|      0|   }
   66|       |
   67|     42|   if(str.length() > prefix_bytes + 2 && str[prefix_bytes] == '0' && str[prefix_bytes + 1] == 'x') {
  ------------------
  |  Branch (67:7): [True: 42, False: 0]
  |  Branch (67:42): [True: 42, False: 0]
  |  Branch (67:70): [True: 42, False: 0]
  ------------------
   68|     42|      prefix_bytes += 2;
   69|     42|      radix = 16;
   70|     42|   }
   71|       |
   72|     42|   BigInt r = BigInt::from_radix_digits(str.substr(prefix_bytes), radix);
   73|       |
   74|     42|   if(negative) {
  ------------------
  |  Branch (74:7): [True: 0, False: 42]
  ------------------
   75|      0|      r.set_sign(Negative);
   76|     42|   } else {
   77|     42|      r.set_sign(Positive);
   78|     42|   }
   79|       |
   80|     42|   return r;
   81|     42|}
_ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
   83|     42|BigInt BigInt::from_bytes(std::span<const uint8_t> input) {
   84|     42|   BigInt r;
   85|     42|   r.assign_from_bytes(input);
   86|     42|   return r;
   87|     42|}
_ZNK5Botan6BigInt8cmp_wordEm:
  122|     28|int32_t BigInt::cmp_word(word other) const {
  123|     28|   if(signum() < 0) {
  ------------------
  |  Branch (123:7): [True: 0, False: 28]
  ------------------
  124|      0|      return -1;  // other is positive ...
  125|      0|   }
  126|       |
  127|     28|   const size_t sw = this->sig_words();
  128|     28|   if(sw > 1) {
  ------------------
  |  Branch (128:7): [True: 21, False: 7]
  ------------------
  129|     21|      return 1;  // must be larger since other is just one word ...
  130|     21|   }
  131|       |
  132|      7|   return bigint_cmp(this->_data(), sw, &other, 1);
  133|     28|}
_ZNK5Botan6BigInt3cmpERKS0_b:
  138|     14|int32_t BigInt::cmp(const BigInt& other, bool check_signs) const {
  139|     14|   if(check_signs) {
  ------------------
  |  Branch (139:7): [True: 14, False: 0]
  ------------------
  140|     14|      if(other.signum() >= 0 && this->signum() < 0) {
  ------------------
  |  Branch (140:10): [True: 14, False: 0]
  |  Branch (140:33): [True: 0, False: 14]
  ------------------
  141|      0|         return -1;
  142|      0|      }
  143|       |
  144|     14|      if(other.signum() < 0 && this->signum() >= 0) {
  ------------------
  |  Branch (144:10): [True: 0, False: 14]
  |  Branch (144:32): [True: 0, False: 0]
  ------------------
  145|      0|         return 1;
  146|      0|      }
  147|       |
  148|     14|      if(other.signum() < 0 && this->signum() < 0) {
  ------------------
  |  Branch (148:10): [True: 0, False: 14]
  |  Branch (148:32): [True: 0, False: 0]
  ------------------
  149|      0|         return (-bigint_cmp(this->_data(), this->size(), other._data(), other.size()));
  150|      0|      }
  151|     14|   }
  152|       |
  153|     14|   return bigint_cmp(this->_data(), this->size(), other._data(), other.size());
  154|     14|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  156|     14|bool BigInt::is_equal(const BigInt& other) const {
  157|     14|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (157:7): [True: 0, False: 14]
  ------------------
  158|      0|      return false;
  159|      0|   }
  160|       |
  161|     14|   return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool();
  162|     14|}
_ZNK5Botan6BigInt12is_less_thanERKS0_:
  164|      7|bool BigInt::is_less_than(const BigInt& other) const {
  165|      7|   if(this->signum() < 0 && other.signum() >= 0) {
  ------------------
  |  Branch (165:7): [True: 0, False: 7]
  |  Branch (165:29): [True: 0, False: 0]
  ------------------
  166|      0|      return true;
  167|      0|   }
  168|       |
  169|      7|   if(this->signum() >= 0 && other.signum() < 0) {
  ------------------
  |  Branch (169:7): [True: 7, False: 0]
  |  Branch (169:30): [True: 0, False: 7]
  ------------------
  170|      0|      return false;
  171|      0|   }
  172|       |
  173|      7|   if(other.signum() < 0 && this->signum() < 0) {
  ------------------
  |  Branch (173:7): [True: 0, False: 7]
  |  Branch (173:29): [True: 0, False: 0]
  ------------------
  174|      0|      return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool();
  175|      0|   }
  176|       |
  177|      7|   return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool();
  178|      7|}
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  191|     42|void BigInt::Data::set_to_zero() {
  192|     42|   m_reg.resize(m_reg.capacity());
  193|     42|   clear_mem(m_reg.data(), m_reg.size());
  194|     42|   m_sig_words = 0;
  195|     42|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  215|    497|size_t BigInt::Data::calc_sig_words() const {
  216|    497|   const size_t sz = m_reg.size();
  217|    497|   size_t sig = sz;
  218|       |
  219|    497|   word sub = 1;
  220|       |
  221|  8.39k|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (221:22): [True: 7.89k, False: 497]
  ------------------
  222|  7.89k|      const word w = m_reg[sz - i - 1];
  223|  7.89k|      sub &= ct_is_zero(w);
  224|  7.89k|      sig -= sub;
  225|  7.89k|   }
  226|       |
  227|       |   /*
  228|       |   * This depends on the data so is poisoned, but unpoison it here as
  229|       |   * later conditionals are made on the size.
  230|       |   */
  231|    497|   CT::unpoison(sig);
  232|       |
  233|    497|   return sig;
  234|    497|}
_ZNK5Botan6BigInt13top_bits_freeEv:
  298|     56|size_t BigInt::top_bits_free() const {
  299|     56|   const size_t words = sig_words();
  300|       |
  301|     56|   const word top_word = word_at(words - 1);
  302|     56|   const size_t bits_used = high_bit(CT::value_barrier(top_word));
  303|     56|   CT::unpoison(bits_used);
  304|     56|   return WordInfo<word>::bits - bits_used;
  305|     56|}
_ZNK5Botan6BigInt4bitsEv:
  307|     35|size_t BigInt::bits() const {
  308|     35|   const size_t words = sig_words();
  309|       |
  310|     35|   if(words == 0) {
  ------------------
  |  Branch (310:7): [True: 0, False: 35]
  ------------------
  311|      0|      return 0;
  312|      0|   }
  313|       |
  314|     35|   const size_t full_words = (words - 1) * WordInfo<word>::bits;
  315|     35|   const size_t top_bits = WordInfo<word>::bits - top_bits_free();
  316|       |
  317|     35|   return full_words + top_bits;
  318|     35|}
_ZN5Botan6BigInt12reduce_belowERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  329|     21|size_t BigInt::reduce_below(const BigInt& p, secure_vector<word>& ws) {
  330|     21|   if(p.signum() < 0 || this->signum() < 0) {
  ------------------
  |  Branch (330:7): [True: 0, False: 21]
  |  Branch (330:25): [True: 0, False: 21]
  ------------------
  331|      0|      throw Invalid_Argument("BigInt::reduce_below both values must be positive");
  332|      0|   }
  333|       |
  334|     21|   const size_t p_words = p.sig_words();
  335|       |
  336|     21|   if(size() < p_words + 1) {
  ------------------
  |  Branch (336:7): [True: 0, False: 21]
  ------------------
  337|      0|      grow_to(p_words + 1);
  338|      0|   }
  339|       |
  340|     21|   if(ws.size() < p_words + 1) {
  ------------------
  |  Branch (340:7): [True: 21, False: 0]
  ------------------
  341|     21|      ws.resize(p_words + 1);
  342|     21|   }
  343|       |
  344|     21|   clear_mem(ws.data(), ws.size());
  345|       |
  346|     21|   size_t reductions = 0;
  347|       |
  348|     21|   for(;;) {
  349|     21|      const word borrow = bigint_sub3(ws.data(), _data(), p_words + 1, p._data(), p_words);
  350|     21|      if(borrow > 0) {
  ------------------
  |  Branch (350:10): [True: 21, False: 0]
  ------------------
  351|     21|         break;
  352|     21|      }
  353|       |
  354|      0|      ++reductions;
  355|      0|      swap_reg(ws);
  356|      0|   }
  357|       |
  358|     21|   return reductions;
  359|     21|}
_ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
  425|     42|void BigInt::assign_from_bytes(std::span<const uint8_t> bytes) {
  426|     42|   clear();
  427|       |
  428|     42|   const size_t length = bytes.size();
  429|     42|   const size_t full_words = length / sizeof(word);
  430|     42|   const size_t extra_bytes = length % sizeof(word);
  431|       |
  432|     42|   secure_vector<word> reg((round_up(full_words + (extra_bytes > 0 ? 1 : 0), 8)));
  ------------------
  |  Branch (432:52): [True: 12, False: 30]
  ------------------
  433|       |
  434|    258|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (434:22): [True: 216, False: 42]
  ------------------
  435|    216|      reg[i] = load_be<word>(bytes.last<sizeof(word)>());
  436|    216|      bytes = bytes.first(bytes.size() - sizeof(word));
  437|    216|   }
  438|       |
  439|     42|   if(!bytes.empty()) {
  ------------------
  |  Branch (439:7): [True: 12, False: 30]
  ------------------
  440|     12|      BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size());
  ------------------
  |  |   77|     12|   do {                                                                     \
  |  |   78|     12|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     12|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 12]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     12|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 12]
  |  |  ------------------
  ------------------
  441|     12|      std::array<uint8_t, sizeof(word)> last_partial_word = {0};
  442|     12|      copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes);
  443|     12|      reg[full_words] = load_be<word>(last_partial_word);
  444|     12|   }
  445|       |
  446|     42|   m_data.swap(reg);
  447|     42|}
_ZNK5Botan6BigInt20_const_time_unpoisonEv:
  559|    542|void BigInt::_const_time_unpoison() const {
  560|    542|   CT::unpoison(m_data.const_data(), m_data.size());
  561|    542|}

_ZN5Botan20vartime_divide_pow2kEmRKNS_6BigIntE:
  232|     21|BigInt vartime_divide_pow2k(size_t k, const BigInt& y_arg) {
  233|     21|   constexpr size_t WB = WordInfo<word>::bits;
  234|       |
  235|     21|   BOTAN_ARG_CHECK(y_arg.signum() != 0, "Cannot divide by zero");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  236|     21|   BOTAN_ARG_CHECK(y_arg.signum() >= 0, "Negative divisor not supported");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  237|     21|   BOTAN_ARG_CHECK(k > 1, "Invalid k");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  238|       |
  239|     21|   BigInt y = y_arg;
  240|       |
  241|     21|   const size_t y_words = y.sig_words();
  242|       |
  243|     21|   BOTAN_ASSERT_NOMSG(y_words > 0);
  ------------------
  |  |   77|     21|   do {                                                                     \
  |  |   78|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     21|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  244|       |
  245|       |   // Calculate shifts needed to normalize y with high bit set
  246|     21|   const size_t shifts = y.top_bits_free();
  247|       |
  248|     21|   if(shifts > 0) {
  ------------------
  |  Branch (248:7): [True: 6, False: 15]
  ------------------
  249|      6|      y <<= shifts;
  250|      6|   }
  251|       |
  252|     21|   BigInt r;
  253|     21|   r.set_bit(k + shifts);  // (2^k) << shifts
  254|       |
  255|       |   // we know y has not changed size, since we only shifted up to set high bit
  256|     21|   const size_t t = y_words - 1;
  257|     21|   const size_t n = std::max(y_words, r.sig_words()) - 1;
  258|       |
  259|     21|   BOTAN_ASSERT_NOMSG(n >= t);
  ------------------
  |  |   77|     21|   do {                                                                     \
  |  |   78|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     21|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  260|       |
  261|     21|   BigInt q = BigInt::zero();
  262|     21|   q.grow_to(n - t + 1);
  263|       |
  264|     21|   word* q_words = q.mutable_data();
  265|       |
  266|     21|   BigInt shifted_y = y << (WB * (n - t));
  267|       |
  268|       |   // Set q_{n-t} to number of times r > shifted_y
  269|     21|   secure_vector<word> ws;
  270|     21|   q_words[n - t] = r.reduce_below(shifted_y, ws);
  271|       |
  272|     21|   const word y_t0 = y.word_at(t);
  273|     21|   const word y_t1 = y.word_at(t - 1);
  274|     21|   BOTAN_DEBUG_ASSERT((y_t0 >> (WB - 1)) == 1);
  ------------------
  |  |  130|     21|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|     21|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 21]
  |  |  ------------------
  ------------------
  275|       |
  276|     21|   const divide_precomp div_y_t0(y_t0);
  277|       |
  278|    156|   for(size_t i = n; i != t; --i) {
  ------------------
  |  Branch (278:22): [True: 135, False: 21]
  ------------------
  279|    135|      const word x_i0 = r.word_at(i);
  280|    135|      const word x_i1 = r.word_at(i - 1);
  281|    135|      const word x_i2 = r.word_at(i - 2);
  282|       |
  283|    135|      word qit = (x_i0 == y_t0) ? WordInfo<word>::max : div_y_t0.vartime_div_2to1(x_i0, x_i1);
  ------------------
  |  Branch (283:18): [True: 2, False: 133]
  ------------------
  284|       |
  285|       |      // Per HAC 14.23, this operation is required at most twice
  286|    151|      for(size_t j = 0; j != 2; ++j) {
  ------------------
  |  Branch (286:25): [True: 151, False: 0]
  ------------------
  287|    151|         if(division_check_vartime(qit, y_t0, y_t1, x_i0, x_i1, x_i2)) {
  ------------------
  |  Branch (287:13): [True: 16, False: 135]
  ------------------
  288|     16|            BOTAN_ASSERT_NOMSG(qit > 0);
  ------------------
  |  |   77|     16|   do {                                                                     \
  |  |   78|     16|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     16|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 16]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     16|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 16]
  |  |  ------------------
  ------------------
  289|     16|            qit--;
  290|    135|         } else {
  291|    135|            break;
  292|    135|         }
  293|    151|      }
  294|       |
  295|    135|      shifted_y >>= WB;
  296|       |      // Now shifted_y == y << (WB * (i-t-1))
  297|       |
  298|       |      /*
  299|       |      * Special case qit == 0 and qit == 1 which occurs relatively often here due to a
  300|       |      * combination of the fixed 2^k and in many cases the typical structure of
  301|       |      * public moduli (as this function is called by Barrett_Reduction::for_public_modulus).
  302|       |      *
  303|       |      * Over the test suite, about 5% of loop iterations have qit == 1 and 10% have qit == 0
  304|       |      */
  305|       |
  306|    135|      if(qit != 0) {
  ------------------
  |  Branch (306:10): [True: 101, False: 34]
  ------------------
  307|    101|         if(qit == 1) {
  ------------------
  |  Branch (307:13): [True: 21, False: 80]
  ------------------
  308|     21|            r -= shifted_y;
  309|     80|         } else {
  310|     80|            r -= qit * shifted_y;
  311|     80|         }
  312|       |
  313|    101|         if(r.signum() < 0) {
  ------------------
  |  Branch (313:13): [True: 0, False: 101]
  ------------------
  314|      0|            BOTAN_ASSERT_NOMSG(qit > 0);
  ------------------
  |  |   77|      0|   do {                                                                     \
  |  |   78|      0|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      0|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
  315|      0|            qit--;
  316|      0|            r += shifted_y;
  317|      0|            BOTAN_ASSERT_NOMSG(r.signum() >= 0);
  ------------------
  |  |   77|      0|   do {                                                                     \
  |  |   78|      0|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      0|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 0]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
  318|      0|         }
  319|    101|      }
  320|       |
  321|    135|      q_words[i - t - 1] = qit;
  322|    135|   }
  323|       |
  324|     21|   return q;
  325|     21|}
divide.cpp:_ZN5Botan12_GLOBAL__N_122division_check_vartimeEmmmmmm:
   34|    151|inline bool division_check_vartime(word q, word y2, word y1, word x3, word x2, word x1) {
   35|       |   /*
   36|       |   Compute (y3,y2,y1) = (y2,y1) * q
   37|       |   and return true if (y3,y2,y1) > (x3,x2,x1)
   38|       |   */
   39|       |
   40|    151|   word y3 = 0;
   41|    151|   y1 = word_madd2(q, y1, &y3);
   42|    151|   y2 = word_madd2(q, y2, &y3);
   43|       |
   44|    151|   if(x3 != y3) {
  ------------------
  |  Branch (44:7): [True: 73, False: 78]
  ------------------
   45|     73|      return (y3 > x3);
   46|     73|   }
   47|     78|   if(x2 != y2) {
  ------------------
  |  Branch (47:7): [True: 54, False: 24]
  ------------------
   48|     54|      return (y2 > x2);
   49|     54|   }
   50|     24|   return (y1 > x1);
   51|     78|}

_ZN5Botan17bigint_comba_sqr4EPmPKm:
   17|  1.57M|void bigint_comba_sqr4(word z[8], const word x[4]) {
   18|  1.57M|   word3<word> accum;
   19|       |
   20|  1.57M|   accum.mul(x[0], x[0]);
   21|  1.57M|   z[0] = accum.extract();
   22|  1.57M|   accum.mul_x2(x[0], x[1]);
   23|  1.57M|   z[1] = accum.extract();
   24|  1.57M|   accum.mul_x2(x[0], x[2]);
   25|  1.57M|   accum.mul(x[1], x[1]);
   26|  1.57M|   z[2] = accum.extract();
   27|  1.57M|   accum.mul_x2(x[0], x[3]);
   28|  1.57M|   accum.mul_x2(x[1], x[2]);
   29|  1.57M|   z[3] = accum.extract();
   30|  1.57M|   accum.mul_x2(x[1], x[3]);
   31|  1.57M|   accum.mul(x[2], x[2]);
   32|  1.57M|   z[4] = accum.extract();
   33|  1.57M|   accum.mul_x2(x[2], x[3]);
   34|  1.57M|   z[5] = accum.extract();
   35|  1.57M|   accum.mul(x[3], x[3]);
   36|  1.57M|   z[6] = accum.extract();
   37|  1.57M|   z[7] = accum.extract();
   38|  1.57M|}
_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   43|   154k|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   44|   154k|   word3<word> accum;
   45|       |
   46|   154k|   accum.mul(x[0], y[0]);
   47|   154k|   z[0] = accum.extract();
   48|   154k|   accum.mul(x[0], y[1]);
   49|   154k|   accum.mul(x[1], y[0]);
   50|   154k|   z[1] = accum.extract();
   51|   154k|   accum.mul(x[0], y[2]);
   52|   154k|   accum.mul(x[1], y[1]);
   53|   154k|   accum.mul(x[2], y[0]);
   54|   154k|   z[2] = accum.extract();
   55|   154k|   accum.mul(x[0], y[3]);
   56|   154k|   accum.mul(x[1], y[2]);
   57|   154k|   accum.mul(x[2], y[1]);
   58|   154k|   accum.mul(x[3], y[0]);
   59|   154k|   z[3] = accum.extract();
   60|   154k|   accum.mul(x[1], y[3]);
   61|   154k|   accum.mul(x[2], y[2]);
   62|   154k|   accum.mul(x[3], y[1]);
   63|   154k|   z[4] = accum.extract();
   64|   154k|   accum.mul(x[2], y[3]);
   65|   154k|   accum.mul(x[3], y[2]);
   66|   154k|   z[5] = accum.extract();
   67|   154k|   accum.mul(x[3], y[3]);
   68|   154k|   z[6] = accum.extract();
   69|   154k|   z[7] = accum.extract();
   70|   154k|}
_ZN5Botan17bigint_comba_sqr6EPmPKm:
   75|  76.1k|void bigint_comba_sqr6(word z[12], const word x[6]) {
   76|  76.1k|   word3<word> accum;
   77|       |
   78|  76.1k|   accum.mul(x[0], x[0]);
   79|  76.1k|   z[0] = accum.extract();
   80|  76.1k|   accum.mul_x2(x[0], x[1]);
   81|  76.1k|   z[1] = accum.extract();
   82|  76.1k|   accum.mul_x2(x[0], x[2]);
   83|  76.1k|   accum.mul(x[1], x[1]);
   84|  76.1k|   z[2] = accum.extract();
   85|  76.1k|   accum.mul_x2(x[0], x[3]);
   86|  76.1k|   accum.mul_x2(x[1], x[2]);
   87|  76.1k|   z[3] = accum.extract();
   88|  76.1k|   accum.mul_x2(x[0], x[4]);
   89|  76.1k|   accum.mul_x2(x[1], x[3]);
   90|  76.1k|   accum.mul(x[2], x[2]);
   91|  76.1k|   z[4] = accum.extract();
   92|  76.1k|   accum.mul_x2(x[0], x[5]);
   93|  76.1k|   accum.mul_x2(x[1], x[4]);
   94|  76.1k|   accum.mul_x2(x[2], x[3]);
   95|  76.1k|   z[5] = accum.extract();
   96|  76.1k|   accum.mul_x2(x[1], x[5]);
   97|  76.1k|   accum.mul_x2(x[2], x[4]);
   98|  76.1k|   accum.mul(x[3], x[3]);
   99|  76.1k|   z[6] = accum.extract();
  100|  76.1k|   accum.mul_x2(x[2], x[5]);
  101|  76.1k|   accum.mul_x2(x[3], x[4]);
  102|  76.1k|   z[7] = accum.extract();
  103|  76.1k|   accum.mul_x2(x[3], x[5]);
  104|  76.1k|   accum.mul(x[4], x[4]);
  105|  76.1k|   z[8] = accum.extract();
  106|  76.1k|   accum.mul_x2(x[4], x[5]);
  107|  76.1k|   z[9] = accum.extract();
  108|  76.1k|   accum.mul(x[5], x[5]);
  109|  76.1k|   z[10] = accum.extract();
  110|  76.1k|   z[11] = accum.extract();
  111|  76.1k|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  116|  34.7k|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  117|  34.7k|   word3<word> accum;
  118|       |
  119|  34.7k|   accum.mul(x[0], y[0]);
  120|  34.7k|   z[0] = accum.extract();
  121|  34.7k|   accum.mul(x[0], y[1]);
  122|  34.7k|   accum.mul(x[1], y[0]);
  123|  34.7k|   z[1] = accum.extract();
  124|  34.7k|   accum.mul(x[0], y[2]);
  125|  34.7k|   accum.mul(x[1], y[1]);
  126|  34.7k|   accum.mul(x[2], y[0]);
  127|  34.7k|   z[2] = accum.extract();
  128|  34.7k|   accum.mul(x[0], y[3]);
  129|  34.7k|   accum.mul(x[1], y[2]);
  130|  34.7k|   accum.mul(x[2], y[1]);
  131|  34.7k|   accum.mul(x[3], y[0]);
  132|  34.7k|   z[3] = accum.extract();
  133|  34.7k|   accum.mul(x[0], y[4]);
  134|  34.7k|   accum.mul(x[1], y[3]);
  135|  34.7k|   accum.mul(x[2], y[2]);
  136|  34.7k|   accum.mul(x[3], y[1]);
  137|  34.7k|   accum.mul(x[4], y[0]);
  138|  34.7k|   z[4] = accum.extract();
  139|  34.7k|   accum.mul(x[0], y[5]);
  140|  34.7k|   accum.mul(x[1], y[4]);
  141|  34.7k|   accum.mul(x[2], y[3]);
  142|  34.7k|   accum.mul(x[3], y[2]);
  143|  34.7k|   accum.mul(x[4], y[1]);
  144|  34.7k|   accum.mul(x[5], y[0]);
  145|  34.7k|   z[5] = accum.extract();
  146|  34.7k|   accum.mul(x[1], y[5]);
  147|  34.7k|   accum.mul(x[2], y[4]);
  148|  34.7k|   accum.mul(x[3], y[3]);
  149|  34.7k|   accum.mul(x[4], y[2]);
  150|  34.7k|   accum.mul(x[5], y[1]);
  151|  34.7k|   z[6] = accum.extract();
  152|  34.7k|   accum.mul(x[2], y[5]);
  153|  34.7k|   accum.mul(x[3], y[4]);
  154|  34.7k|   accum.mul(x[4], y[3]);
  155|  34.7k|   accum.mul(x[5], y[2]);
  156|  34.7k|   z[7] = accum.extract();
  157|  34.7k|   accum.mul(x[3], y[5]);
  158|  34.7k|   accum.mul(x[4], y[4]);
  159|  34.7k|   accum.mul(x[5], y[3]);
  160|  34.7k|   z[8] = accum.extract();
  161|  34.7k|   accum.mul(x[4], y[5]);
  162|  34.7k|   accum.mul(x[5], y[4]);
  163|  34.7k|   z[9] = accum.extract();
  164|  34.7k|   accum.mul(x[5], y[5]);
  165|  34.7k|   z[10] = accum.extract();
  166|  34.7k|   z[11] = accum.extract();
  167|  34.7k|}
_ZN5Botan17bigint_comba_sqr8EPmPKm:
  293|   144k|void bigint_comba_sqr8(word z[16], const word x[8]) {
  294|   144k|   word3<word> accum;
  295|       |
  296|   144k|   accum.mul(x[0], x[0]);
  297|   144k|   z[0] = accum.extract();
  298|   144k|   accum.mul_x2(x[0], x[1]);
  299|   144k|   z[1] = accum.extract();
  300|   144k|   accum.mul_x2(x[0], x[2]);
  301|   144k|   accum.mul(x[1], x[1]);
  302|   144k|   z[2] = accum.extract();
  303|   144k|   accum.mul_x2(x[0], x[3]);
  304|   144k|   accum.mul_x2(x[1], x[2]);
  305|   144k|   z[3] = accum.extract();
  306|   144k|   accum.mul_x2(x[0], x[4]);
  307|   144k|   accum.mul_x2(x[1], x[3]);
  308|   144k|   accum.mul(x[2], x[2]);
  309|   144k|   z[4] = accum.extract();
  310|   144k|   accum.mul_x2(x[0], x[5]);
  311|   144k|   accum.mul_x2(x[1], x[4]);
  312|   144k|   accum.mul_x2(x[2], x[3]);
  313|   144k|   z[5] = accum.extract();
  314|   144k|   accum.mul_x2(x[0], x[6]);
  315|   144k|   accum.mul_x2(x[1], x[5]);
  316|   144k|   accum.mul_x2(x[2], x[4]);
  317|   144k|   accum.mul(x[3], x[3]);
  318|   144k|   z[6] = accum.extract();
  319|   144k|   accum.mul_x2(x[0], x[7]);
  320|   144k|   accum.mul_x2(x[1], x[6]);
  321|   144k|   accum.mul_x2(x[2], x[5]);
  322|   144k|   accum.mul_x2(x[3], x[4]);
  323|   144k|   z[7] = accum.extract();
  324|   144k|   accum.mul_x2(x[1], x[7]);
  325|   144k|   accum.mul_x2(x[2], x[6]);
  326|   144k|   accum.mul_x2(x[3], x[5]);
  327|   144k|   accum.mul(x[4], x[4]);
  328|   144k|   z[8] = accum.extract();
  329|   144k|   accum.mul_x2(x[2], x[7]);
  330|   144k|   accum.mul_x2(x[3], x[6]);
  331|   144k|   accum.mul_x2(x[4], x[5]);
  332|   144k|   z[9] = accum.extract();
  333|   144k|   accum.mul_x2(x[3], x[7]);
  334|   144k|   accum.mul_x2(x[4], x[6]);
  335|   144k|   accum.mul(x[5], x[5]);
  336|   144k|   z[10] = accum.extract();
  337|   144k|   accum.mul_x2(x[4], x[7]);
  338|   144k|   accum.mul_x2(x[5], x[6]);
  339|   144k|   z[11] = accum.extract();
  340|   144k|   accum.mul_x2(x[5], x[7]);
  341|   144k|   accum.mul(x[6], x[6]);
  342|   144k|   z[12] = accum.extract();
  343|   144k|   accum.mul_x2(x[6], x[7]);
  344|   144k|   z[13] = accum.extract();
  345|   144k|   accum.mul(x[7], x[7]);
  346|   144k|   z[14] = accum.extract();
  347|   144k|   z[15] = accum.extract();
  348|   144k|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  353|  70.0k|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  354|  70.0k|   word3<word> accum;
  355|       |
  356|  70.0k|   accum.mul(x[0], y[0]);
  357|  70.0k|   z[0] = accum.extract();
  358|  70.0k|   accum.mul(x[0], y[1]);
  359|  70.0k|   accum.mul(x[1], y[0]);
  360|  70.0k|   z[1] = accum.extract();
  361|  70.0k|   accum.mul(x[0], y[2]);
  362|  70.0k|   accum.mul(x[1], y[1]);
  363|  70.0k|   accum.mul(x[2], y[0]);
  364|  70.0k|   z[2] = accum.extract();
  365|  70.0k|   accum.mul(x[0], y[3]);
  366|  70.0k|   accum.mul(x[1], y[2]);
  367|  70.0k|   accum.mul(x[2], y[1]);
  368|  70.0k|   accum.mul(x[3], y[0]);
  369|  70.0k|   z[3] = accum.extract();
  370|  70.0k|   accum.mul(x[0], y[4]);
  371|  70.0k|   accum.mul(x[1], y[3]);
  372|  70.0k|   accum.mul(x[2], y[2]);
  373|  70.0k|   accum.mul(x[3], y[1]);
  374|  70.0k|   accum.mul(x[4], y[0]);
  375|  70.0k|   z[4] = accum.extract();
  376|  70.0k|   accum.mul(x[0], y[5]);
  377|  70.0k|   accum.mul(x[1], y[4]);
  378|  70.0k|   accum.mul(x[2], y[3]);
  379|  70.0k|   accum.mul(x[3], y[2]);
  380|  70.0k|   accum.mul(x[4], y[1]);
  381|  70.0k|   accum.mul(x[5], y[0]);
  382|  70.0k|   z[5] = accum.extract();
  383|  70.0k|   accum.mul(x[0], y[6]);
  384|  70.0k|   accum.mul(x[1], y[5]);
  385|  70.0k|   accum.mul(x[2], y[4]);
  386|  70.0k|   accum.mul(x[3], y[3]);
  387|  70.0k|   accum.mul(x[4], y[2]);
  388|  70.0k|   accum.mul(x[5], y[1]);
  389|  70.0k|   accum.mul(x[6], y[0]);
  390|  70.0k|   z[6] = accum.extract();
  391|  70.0k|   accum.mul(x[0], y[7]);
  392|  70.0k|   accum.mul(x[1], y[6]);
  393|  70.0k|   accum.mul(x[2], y[5]);
  394|  70.0k|   accum.mul(x[3], y[4]);
  395|  70.0k|   accum.mul(x[4], y[3]);
  396|  70.0k|   accum.mul(x[5], y[2]);
  397|  70.0k|   accum.mul(x[6], y[1]);
  398|  70.0k|   accum.mul(x[7], y[0]);
  399|  70.0k|   z[7] = accum.extract();
  400|  70.0k|   accum.mul(x[1], y[7]);
  401|  70.0k|   accum.mul(x[2], y[6]);
  402|  70.0k|   accum.mul(x[3], y[5]);
  403|  70.0k|   accum.mul(x[4], y[4]);
  404|  70.0k|   accum.mul(x[5], y[3]);
  405|  70.0k|   accum.mul(x[6], y[2]);
  406|  70.0k|   accum.mul(x[7], y[1]);
  407|  70.0k|   z[8] = accum.extract();
  408|  70.0k|   accum.mul(x[2], y[7]);
  409|  70.0k|   accum.mul(x[3], y[6]);
  410|  70.0k|   accum.mul(x[4], y[5]);
  411|  70.0k|   accum.mul(x[5], y[4]);
  412|  70.0k|   accum.mul(x[6], y[3]);
  413|  70.0k|   accum.mul(x[7], y[2]);
  414|  70.0k|   z[9] = accum.extract();
  415|  70.0k|   accum.mul(x[3], y[7]);
  416|  70.0k|   accum.mul(x[4], y[6]);
  417|  70.0k|   accum.mul(x[5], y[5]);
  418|  70.0k|   accum.mul(x[6], y[4]);
  419|  70.0k|   accum.mul(x[7], y[3]);
  420|  70.0k|   z[10] = accum.extract();
  421|  70.0k|   accum.mul(x[4], y[7]);
  422|  70.0k|   accum.mul(x[5], y[6]);
  423|  70.0k|   accum.mul(x[6], y[5]);
  424|  70.0k|   accum.mul(x[7], y[4]);
  425|  70.0k|   z[11] = accum.extract();
  426|  70.0k|   accum.mul(x[5], y[7]);
  427|  70.0k|   accum.mul(x[6], y[6]);
  428|  70.0k|   accum.mul(x[7], y[5]);
  429|  70.0k|   z[12] = accum.extract();
  430|  70.0k|   accum.mul(x[6], y[7]);
  431|  70.0k|   accum.mul(x[7], y[6]);
  432|  70.0k|   z[13] = accum.extract();
  433|  70.0k|   accum.mul(x[7], y[7]);
  434|  70.0k|   z[14] = accum.extract();
  435|  70.0k|   z[15] = accum.extract();
  436|  70.0k|}
_ZN5Botan17bigint_comba_sqr9EPmPKm:
  441|   210k|void bigint_comba_sqr9(word z[18], const word x[9]) {
  442|   210k|   word3<word> accum;
  443|       |
  444|   210k|   accum.mul(x[0], x[0]);
  445|   210k|   z[0] = accum.extract();
  446|   210k|   accum.mul_x2(x[0], x[1]);
  447|   210k|   z[1] = accum.extract();
  448|   210k|   accum.mul_x2(x[0], x[2]);
  449|   210k|   accum.mul(x[1], x[1]);
  450|   210k|   z[2] = accum.extract();
  451|   210k|   accum.mul_x2(x[0], x[3]);
  452|   210k|   accum.mul_x2(x[1], x[2]);
  453|   210k|   z[3] = accum.extract();
  454|   210k|   accum.mul_x2(x[0], x[4]);
  455|   210k|   accum.mul_x2(x[1], x[3]);
  456|   210k|   accum.mul(x[2], x[2]);
  457|   210k|   z[4] = accum.extract();
  458|   210k|   accum.mul_x2(x[0], x[5]);
  459|   210k|   accum.mul_x2(x[1], x[4]);
  460|   210k|   accum.mul_x2(x[2], x[3]);
  461|   210k|   z[5] = accum.extract();
  462|   210k|   accum.mul_x2(x[0], x[6]);
  463|   210k|   accum.mul_x2(x[1], x[5]);
  464|   210k|   accum.mul_x2(x[2], x[4]);
  465|   210k|   accum.mul(x[3], x[3]);
  466|   210k|   z[6] = accum.extract();
  467|   210k|   accum.mul_x2(x[0], x[7]);
  468|   210k|   accum.mul_x2(x[1], x[6]);
  469|   210k|   accum.mul_x2(x[2], x[5]);
  470|   210k|   accum.mul_x2(x[3], x[4]);
  471|   210k|   z[7] = accum.extract();
  472|   210k|   accum.mul_x2(x[0], x[8]);
  473|   210k|   accum.mul_x2(x[1], x[7]);
  474|   210k|   accum.mul_x2(x[2], x[6]);
  475|   210k|   accum.mul_x2(x[3], x[5]);
  476|   210k|   accum.mul(x[4], x[4]);
  477|   210k|   z[8] = accum.extract();
  478|   210k|   accum.mul_x2(x[1], x[8]);
  479|   210k|   accum.mul_x2(x[2], x[7]);
  480|   210k|   accum.mul_x2(x[3], x[6]);
  481|   210k|   accum.mul_x2(x[4], x[5]);
  482|   210k|   z[9] = accum.extract();
  483|   210k|   accum.mul_x2(x[2], x[8]);
  484|   210k|   accum.mul_x2(x[3], x[7]);
  485|   210k|   accum.mul_x2(x[4], x[6]);
  486|   210k|   accum.mul(x[5], x[5]);
  487|   210k|   z[10] = accum.extract();
  488|   210k|   accum.mul_x2(x[3], x[8]);
  489|   210k|   accum.mul_x2(x[4], x[7]);
  490|   210k|   accum.mul_x2(x[5], x[6]);
  491|   210k|   z[11] = accum.extract();
  492|   210k|   accum.mul_x2(x[4], x[8]);
  493|   210k|   accum.mul_x2(x[5], x[7]);
  494|   210k|   accum.mul(x[6], x[6]);
  495|   210k|   z[12] = accum.extract();
  496|   210k|   accum.mul_x2(x[5], x[8]);
  497|   210k|   accum.mul_x2(x[6], x[7]);
  498|   210k|   z[13] = accum.extract();
  499|   210k|   accum.mul_x2(x[6], x[8]);
  500|   210k|   accum.mul(x[7], x[7]);
  501|   210k|   z[14] = accum.extract();
  502|   210k|   accum.mul_x2(x[7], x[8]);
  503|   210k|   z[15] = accum.extract();
  504|   210k|   accum.mul(x[8], x[8]);
  505|   210k|   z[16] = accum.extract();
  506|   210k|   z[17] = accum.extract();
  507|   210k|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  512|  43.2k|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  513|  43.2k|   word3<word> accum;
  514|       |
  515|  43.2k|   accum.mul(x[0], y[0]);
  516|  43.2k|   z[0] = accum.extract();
  517|  43.2k|   accum.mul(x[0], y[1]);
  518|  43.2k|   accum.mul(x[1], y[0]);
  519|  43.2k|   z[1] = accum.extract();
  520|  43.2k|   accum.mul(x[0], y[2]);
  521|  43.2k|   accum.mul(x[1], y[1]);
  522|  43.2k|   accum.mul(x[2], y[0]);
  523|  43.2k|   z[2] = accum.extract();
  524|  43.2k|   accum.mul(x[0], y[3]);
  525|  43.2k|   accum.mul(x[1], y[2]);
  526|  43.2k|   accum.mul(x[2], y[1]);
  527|  43.2k|   accum.mul(x[3], y[0]);
  528|  43.2k|   z[3] = accum.extract();
  529|  43.2k|   accum.mul(x[0], y[4]);
  530|  43.2k|   accum.mul(x[1], y[3]);
  531|  43.2k|   accum.mul(x[2], y[2]);
  532|  43.2k|   accum.mul(x[3], y[1]);
  533|  43.2k|   accum.mul(x[4], y[0]);
  534|  43.2k|   z[4] = accum.extract();
  535|  43.2k|   accum.mul(x[0], y[5]);
  536|  43.2k|   accum.mul(x[1], y[4]);
  537|  43.2k|   accum.mul(x[2], y[3]);
  538|  43.2k|   accum.mul(x[3], y[2]);
  539|  43.2k|   accum.mul(x[4], y[1]);
  540|  43.2k|   accum.mul(x[5], y[0]);
  541|  43.2k|   z[5] = accum.extract();
  542|  43.2k|   accum.mul(x[0], y[6]);
  543|  43.2k|   accum.mul(x[1], y[5]);
  544|  43.2k|   accum.mul(x[2], y[4]);
  545|  43.2k|   accum.mul(x[3], y[3]);
  546|  43.2k|   accum.mul(x[4], y[2]);
  547|  43.2k|   accum.mul(x[5], y[1]);
  548|  43.2k|   accum.mul(x[6], y[0]);
  549|  43.2k|   z[6] = accum.extract();
  550|  43.2k|   accum.mul(x[0], y[7]);
  551|  43.2k|   accum.mul(x[1], y[6]);
  552|  43.2k|   accum.mul(x[2], y[5]);
  553|  43.2k|   accum.mul(x[3], y[4]);
  554|  43.2k|   accum.mul(x[4], y[3]);
  555|  43.2k|   accum.mul(x[5], y[2]);
  556|  43.2k|   accum.mul(x[6], y[1]);
  557|  43.2k|   accum.mul(x[7], y[0]);
  558|  43.2k|   z[7] = accum.extract();
  559|  43.2k|   accum.mul(x[0], y[8]);
  560|  43.2k|   accum.mul(x[1], y[7]);
  561|  43.2k|   accum.mul(x[2], y[6]);
  562|  43.2k|   accum.mul(x[3], y[5]);
  563|  43.2k|   accum.mul(x[4], y[4]);
  564|  43.2k|   accum.mul(x[5], y[3]);
  565|  43.2k|   accum.mul(x[6], y[2]);
  566|  43.2k|   accum.mul(x[7], y[1]);
  567|  43.2k|   accum.mul(x[8], y[0]);
  568|  43.2k|   z[8] = accum.extract();
  569|  43.2k|   accum.mul(x[1], y[8]);
  570|  43.2k|   accum.mul(x[2], y[7]);
  571|  43.2k|   accum.mul(x[3], y[6]);
  572|  43.2k|   accum.mul(x[4], y[5]);
  573|  43.2k|   accum.mul(x[5], y[4]);
  574|  43.2k|   accum.mul(x[6], y[3]);
  575|  43.2k|   accum.mul(x[7], y[2]);
  576|  43.2k|   accum.mul(x[8], y[1]);
  577|  43.2k|   z[9] = accum.extract();
  578|  43.2k|   accum.mul(x[2], y[8]);
  579|  43.2k|   accum.mul(x[3], y[7]);
  580|  43.2k|   accum.mul(x[4], y[6]);
  581|  43.2k|   accum.mul(x[5], y[5]);
  582|  43.2k|   accum.mul(x[6], y[4]);
  583|  43.2k|   accum.mul(x[7], y[3]);
  584|  43.2k|   accum.mul(x[8], y[2]);
  585|  43.2k|   z[10] = accum.extract();
  586|  43.2k|   accum.mul(x[3], y[8]);
  587|  43.2k|   accum.mul(x[4], y[7]);
  588|  43.2k|   accum.mul(x[5], y[6]);
  589|  43.2k|   accum.mul(x[6], y[5]);
  590|  43.2k|   accum.mul(x[7], y[4]);
  591|  43.2k|   accum.mul(x[8], y[3]);
  592|  43.2k|   z[11] = accum.extract();
  593|  43.2k|   accum.mul(x[4], y[8]);
  594|  43.2k|   accum.mul(x[5], y[7]);
  595|  43.2k|   accum.mul(x[6], y[6]);
  596|  43.2k|   accum.mul(x[7], y[5]);
  597|  43.2k|   accum.mul(x[8], y[4]);
  598|  43.2k|   z[12] = accum.extract();
  599|  43.2k|   accum.mul(x[5], y[8]);
  600|  43.2k|   accum.mul(x[6], y[7]);
  601|  43.2k|   accum.mul(x[7], y[6]);
  602|  43.2k|   accum.mul(x[8], y[5]);
  603|  43.2k|   z[13] = accum.extract();
  604|  43.2k|   accum.mul(x[6], y[8]);
  605|  43.2k|   accum.mul(x[7], y[7]);
  606|  43.2k|   accum.mul(x[8], y[6]);
  607|  43.2k|   z[14] = accum.extract();
  608|  43.2k|   accum.mul(x[7], y[8]);
  609|  43.2k|   accum.mul(x[8], y[7]);
  610|  43.2k|   z[15] = accum.extract();
  611|  43.2k|   accum.mul(x[8], y[8]);
  612|  43.2k|   z[16] = accum.extract();
  613|  43.2k|   z[17] = accum.extract();
  614|  43.2k|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|     21|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|     21|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 21]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|     21|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|     21|   zeroize_buffer(z, z_size);
   28|       |
   29|    188|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 167, False: 21]
  ------------------
   30|    167|      const word y_i = y[i];
   31|       |
   32|    167|      word carry = 0;
   33|       |
   34|    319|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 152, False: 167]
  ------------------
   35|    152|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|    152|      }
   37|       |
   38|    516|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 349, False: 167]
  ------------------
   39|    349|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|    349|      }
   41|       |
   42|    167|      z[x_size + i] = carry;
   43|    167|   }
   44|     21|}
_ZN5Botan12basecase_sqrEPmmPKmm:
   46|      3|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) {
   47|      3|   if(z_size < 2 * x_size) {
  ------------------
  |  Branch (47:7): [True: 0, False: 3]
  ------------------
   48|      0|      throw Invalid_Argument("basecase_sqr z_size too small");
   49|      0|   }
   50|       |
   51|      3|   const size_t x_size_8 = x_size - (x_size % 8);
   52|       |
   53|      3|   zeroize_buffer(z, z_size);
   54|       |
   55|     12|   for(size_t i = 0; i != x_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 9, False: 3]
  ------------------
   56|      9|      const word x_i = x[i];
   57|       |
   58|      9|      word carry = 0;
   59|       |
   60|      9|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (60:25): [True: 0, False: 9]
  ------------------
   61|      0|         carry = word8_madd3(z + i + j, x + j, x_i, carry);
   62|      0|      }
   63|       |
   64|     36|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (64:32): [True: 27, False: 9]
  ------------------
   65|     27|         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
   66|     27|      }
   67|       |
   68|      9|      z[x_size + i] = carry;
   69|      9|   }
   70|      3|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  292|    161|                size_t ws_size) {
  293|    161|   zeroize_buffer(z, z_size);
  294|       |
  295|    161|   if(x_sw == 1) {
  ------------------
  |  Branch (295:7): [True: 0, False: 161]
  ------------------
  296|      0|      bigint_linmul3(z, y, y_sw, x[0]);
  297|    161|   } else if(y_sw == 1) {
  ------------------
  |  Branch (297:14): [True: 0, False: 161]
  ------------------
  298|      0|      bigint_linmul3(z, x, x_sw, y[0]);
  299|    161|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (299:14): [True: 39, False: 122]
  ------------------
  300|     39|      bigint_comba_mul4(z, x, y);
  301|    122|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (301:14): [True: 55, False: 67]
  ------------------
  302|     55|      bigint_comba_mul6(z, x, y);
  303|     67|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (303:14): [True: 23, False: 44]
  ------------------
  304|     23|      bigint_comba_mul8(z, x, y);
  305|     44|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (305:14): [True: 23, False: 21]
  ------------------
  306|     23|      bigint_comba_mul9(z, x, y);
  307|     23|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (307:14): [True: 0, False: 21]
  ------------------
  308|      0|      bigint_comba_mul16(z, x, y);
  309|     21|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (309:14): [True: 0, False: 21]
  ------------------
  310|      0|      bigint_comba_mul24(z, x, y);
  311|     21|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (311:14): [True: 21, False: 0]
  |  Branch (311:53): [True: 0, False: 0]
  |  Branch (311:92): [True: 0, False: 0]
  ------------------
  312|     21|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  313|     21|   } else {
  314|      0|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  315|       |
  316|      0|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (316:10): [True: 0, False: 0]
  |  Branch (316:19): [True: 0, False: 0]
  |  Branch (316:38): [True: 0, False: 0]
  ------------------
  317|      0|         karatsuba_mul(z, x, y, N, workspace);
  318|      0|      } else {
  319|      0|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  320|      0|      }
  321|      0|   }
  322|    161|}
_ZN5Botan10bigint_sqrEPmmPKmmmS0_m:
  327|     21|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) {
  328|     21|   zeroize_buffer(z, z_size);
  329|       |
  330|     21|   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
  ------------------
  |  |   64|     21|   do {                                                                                 \
  |  |   65|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   66|     21|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (66:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   67|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   68|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   69|      0|      }                                                                                 \
  |  |   70|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (70:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  331|       |
  332|     21|   if(x_sw == 1) {
  ------------------
  |  Branch (332:7): [True: 0, False: 21]
  ------------------
  333|      0|      bigint_linmul3(z, x, x_sw, x[0]);
  334|     21|   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (334:14): [True: 9, False: 12]
  ------------------
  335|      9|      bigint_comba_sqr4(z, x);
  336|     12|   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (336:14): [True: 3, False: 9]
  ------------------
  337|      3|      bigint_comba_sqr6(z, x);
  338|      9|   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (338:14): [True: 3, False: 6]
  ------------------
  339|      3|      bigint_comba_sqr8(z, x);
  340|      6|   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (340:14): [True: 3, False: 3]
  ------------------
  341|      3|      bigint_comba_sqr9(z, x);
  342|      3|   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (342:14): [True: 0, False: 3]
  ------------------
  343|      0|      bigint_comba_sqr16(z, x);
  344|      3|   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (344:14): [True: 0, False: 3]
  ------------------
  345|      0|      bigint_comba_sqr24(z, x);
  346|      3|   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (346:14): [True: 3, False: 0]
  |  Branch (346:53): [True: 0, False: 0]
  ------------------
  347|      3|      basecase_sqr(z, z_size, x, x_sw);
  348|      3|   } else {
  349|      0|      const size_t N = karatsuba_size(z_size, x_size, x_sw);
  350|       |
  351|      0|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (351:10): [True: 0, False: 0]
  |  Branch (351:19): [True: 0, False: 0]
  |  Branch (351:38): [True: 0, False: 0]
  ------------------
  352|      0|         karatsuba_sqr(z, x, N, workspace);
  353|      0|      } else {
  354|      0|         basecase_sqr(z, z_size, x, x_sw);
  355|      0|      }
  356|      0|   }
  357|     21|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  272|    161|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    161|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 44, False: 117]
  |  Branch (273:26): [True: 44, False: 0]
  |  Branch (273:42): [True: 44, False: 0]
  |  Branch (273:56): [True: 44, False: 0]
  |  Branch (273:72): [True: 39, False: 5]
  ------------------
  274|    161|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  272|    122|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    122|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 60, False: 62]
  |  Branch (273:26): [True: 60, False: 0]
  |  Branch (273:42): [True: 60, False: 0]
  |  Branch (273:56): [True: 60, False: 0]
  |  Branch (273:72): [True: 55, False: 5]
  ------------------
  274|    122|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  272|     67|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|     67|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 28, False: 39]
  |  Branch (273:26): [True: 28, False: 0]
  |  Branch (273:42): [True: 28, False: 0]
  |  Branch (273:56): [True: 28, False: 0]
  |  Branch (273:72): [True: 23, False: 5]
  ------------------
  274|     67|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  272|     44|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|     44|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 28, False: 16]
  |  Branch (273:26): [True: 24, False: 4]
  |  Branch (273:42): [True: 24, False: 0]
  |  Branch (273:56): [True: 24, False: 0]
  |  Branch (273:72): [True: 23, False: 1]
  ------------------
  274|     44|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  272|     21|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|     21|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 21, False: 0]
  |  Branch (273:26): [True: 8, False: 13]
  |  Branch (273:42): [True: 8, False: 0]
  |  Branch (273:56): [True: 8, False: 0]
  |  Branch (273:72): [True: 0, False: 8]
  ------------------
  274|     21|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  272|     21|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|     21|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 21, False: 0]
  |  Branch (273:26): [True: 0, False: 21]
  |  Branch (273:42): [True: 0, False: 0]
  |  Branch (273:56): [True: 0, False: 0]
  |  Branch (273:72): [True: 0, False: 0]
  ------------------
  274|     21|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm:
  277|     21|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|     21|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 12, False: 9]
  |  Branch (278:26): [True: 12, False: 0]
  |  Branch (278:42): [True: 9, False: 3]
  ------------------
  279|     21|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm:
  277|     12|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|     12|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 6, False: 6]
  |  Branch (278:26): [True: 6, False: 0]
  |  Branch (278:42): [True: 3, False: 3]
  ------------------
  279|     12|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm:
  277|      9|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|      9|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 6, False: 3]
  |  Branch (278:26): [True: 6, False: 0]
  |  Branch (278:42): [True: 3, False: 3]
  ------------------
  279|      9|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm:
  277|      6|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|      6|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 6, False: 0]
  |  Branch (278:26): [True: 4, False: 2]
  |  Branch (278:42): [True: 3, False: 1]
  ------------------
  279|      6|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm:
  277|      3|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|      3|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 3, False: 0]
  |  Branch (278:26): [True: 0, False: 3]
  |  Branch (278:42): [True: 0, False: 0]
  ------------------
  279|      3|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm:
  277|      3|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|      3|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 3, False: 0]
  |  Branch (278:26): [True: 0, False: 3]
  |  Branch (278:42): [True: 0, False: 0]
  ------------------
  279|      3|}

_ZN5Botan25bigint_monty_redc_genericEPmPKmmS2_mmS0_:
   91|      8|   word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) {
   92|      8|   BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
  ------------------
  |  |   35|      8|   do {                                                          \
  |  |   36|      8|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     16|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 8, False: 0]
  |  |  |  Branch (37:12): [True: 8, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|      8|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 8]
  |  |  ------------------
  ------------------
   93|       |
   94|      8|   word3<word> accum;
   95|       |
   96|      8|   accum.add(z[0]);
   97|       |
   98|      8|   ws[0] = accum.monty_step(p[0], p_dash);
   99|       |
  100|     48|   for(size_t i = 1; i != p_size; ++i) {
  ------------------
  |  Branch (100:22): [True: 40, False: 8]
  ------------------
  101|     40|      mul_rev_range(accum, ws, p, i);
  102|     40|      accum.add(z[i]);
  103|     40|      ws[i] = accum.monty_step(p[0], p_dash);
  104|     40|   }
  105|       |
  106|     48|   for(size_t i = 0; i != p_size - 1; ++i) {
  ------------------
  |  Branch (106:22): [True: 40, False: 8]
  ------------------
  107|     40|      mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1));
  108|     40|      accum.add(z[p_size + i]);
  109|     40|      ws[i] = accum.extract();
  110|     40|   }
  111|       |
  112|      8|   accum.add(z[2 * p_size - 1]);
  113|       |
  114|      8|   ws[p_size - 1] = accum.extract();
  115|       |   // w1 is the final part, which is not stored in the workspace
  116|      8|   const word w1 = accum.extract();
  117|       |
  118|       |   /*
  119|       |   * The result might need to be reduced mod p. To avoid a timing
  120|       |   * channel, always perform the subtraction. If in the computation
  121|       |   * of x - p a borrow is required then x was already < p.
  122|       |   *
  123|       |   * x starts at ws[0] and is p_size bytes long plus a possible high
  124|       |   * digit left over in w1.
  125|       |   *
  126|       |   * x - p starts at z[0] and is also p_size bytes long
  127|       |   *
  128|       |   * If borrow was set after the subtraction, then x was already less
  129|       |   * than p and the subtraction was not needed. In that case overwrite
  130|       |   * z[0:p_size] with the original x in ws[0:p_size].
  131|       |   *
  132|       |   * We only copy out p_size in the final step because we know
  133|       |   * the Montgomery result is < P
  134|       |   */
  135|       |
  136|      8|   bigint_monty_maybe_sub(p_size, r, w1, ws, p);
  137|      8|}
mp_monty.cpp:_ZN5Botan12_GLOBAL__N_113mul_rev_rangeERNS_5word3ImEEPKmS5_m:
   18|     80|BOTAN_FORCE_INLINE void mul_rev_range(word3<word>& accum, const word ws[], const word p[], size_t bound) {
   19|       |   /*
   20|       |   Unrolled version of:
   21|       |
   22|       |   for(size_t i = 0; i < bound; ++i) {
   23|       |      accum.mul(ws[i], p[bound - i]);
   24|       |   }
   25|       |   */
   26|       |
   27|     80|   size_t lower = 0;
   28|    200|   while(lower < bound) {
  ------------------
  |  Branch (28:10): [True: 120, False: 80]
  ------------------
   29|    120|      const size_t upper = bound - lower;
   30|       |
   31|    120|      if(upper >= 16) {
  ------------------
  |  Branch (31:10): [True: 0, False: 120]
  ------------------
   32|      0|         accum.mul(ws[lower], p[upper]);
   33|      0|         accum.mul(ws[lower + 1], p[upper - 1]);
   34|      0|         accum.mul(ws[lower + 2], p[upper - 2]);
   35|      0|         accum.mul(ws[lower + 3], p[upper - 3]);
   36|      0|         accum.mul(ws[lower + 4], p[upper - 4]);
   37|      0|         accum.mul(ws[lower + 5], p[upper - 5]);
   38|      0|         accum.mul(ws[lower + 6], p[upper - 6]);
   39|      0|         accum.mul(ws[lower + 7], p[upper - 7]);
   40|      0|         accum.mul(ws[lower + 8], p[upper - 8]);
   41|      0|         accum.mul(ws[lower + 9], p[upper - 9]);
   42|      0|         accum.mul(ws[lower + 10], p[upper - 10]);
   43|      0|         accum.mul(ws[lower + 11], p[upper - 11]);
   44|      0|         accum.mul(ws[lower + 12], p[upper - 12]);
   45|      0|         accum.mul(ws[lower + 13], p[upper - 13]);
   46|      0|         accum.mul(ws[lower + 14], p[upper - 14]);
   47|      0|         accum.mul(ws[lower + 15], p[upper - 15]);
   48|      0|         lower += 16;
   49|    120|      } else if(upper >= 8) {
  ------------------
  |  Branch (49:17): [True: 8, False: 112]
  ------------------
   50|      8|         accum.mul(ws[lower], p[upper]);
   51|      8|         accum.mul(ws[lower + 1], p[upper - 1]);
   52|      8|         accum.mul(ws[lower + 2], p[upper - 2]);
   53|      8|         accum.mul(ws[lower + 3], p[upper - 3]);
   54|      8|         accum.mul(ws[lower + 4], p[upper - 4]);
   55|      8|         accum.mul(ws[lower + 5], p[upper - 5]);
   56|      8|         accum.mul(ws[lower + 6], p[upper - 6]);
   57|      8|         accum.mul(ws[lower + 7], p[upper - 7]);
   58|      8|         lower += 8;
   59|    112|      } else if(upper >= 4) {
  ------------------
  |  Branch (59:17): [True: 32, False: 80]
  ------------------
   60|     32|         accum.mul(ws[lower], p[upper]);
   61|     32|         accum.mul(ws[lower + 1], p[upper - 1]);
   62|     32|         accum.mul(ws[lower + 2], p[upper - 2]);
   63|     32|         accum.mul(ws[lower + 3], p[upper - 3]);
   64|     32|         lower += 4;
   65|     80|      } else if(upper >= 2) {
  ------------------
  |  Branch (65:17): [True: 40, False: 40]
  ------------------
   66|     40|         accum.mul(ws[lower], p[upper]);
   67|     40|         accum.mul(ws[lower + 1], p[upper - 1]);
   68|     40|         lower += 2;
   69|     40|      } else {
   70|     40|         accum.mul(ws[lower], p[upper]);
   71|     40|         lower += 1;
   72|     40|      }
   73|    120|   }
   74|     80|}

_ZN5Botan19bigint_monty_redc_4EPmPKmS2_mS0_:
   12|   149k|void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4]) {
   13|   149k|   word3<word> accum;
   14|   149k|   accum.add(z[0]);
   15|   149k|   ws[0] = accum.monty_step(p[0], p_dash);
   16|   149k|   accum.mul(ws[0], p[1]);
   17|   149k|   accum.add(z[1]);
   18|   149k|   ws[1] = accum.monty_step(p[0], p_dash);
   19|   149k|   accum.mul(ws[0], p[2]);
   20|   149k|   accum.mul(ws[1], p[1]);
   21|   149k|   accum.add(z[2]);
   22|   149k|   ws[2] = accum.monty_step(p[0], p_dash);
   23|   149k|   accum.mul(ws[0], p[3]);
   24|   149k|   accum.mul(ws[1], p[2]);
   25|   149k|   accum.mul(ws[2], p[1]);
   26|   149k|   accum.add(z[3]);
   27|   149k|   ws[3] = accum.monty_step(p[0], p_dash);
   28|   149k|   accum.mul(ws[1], p[3]);
   29|   149k|   accum.mul(ws[2], p[2]);
   30|   149k|   accum.mul(ws[3], p[1]);
   31|   149k|   accum.add(z[4]);
   32|   149k|   ws[0] = accum.extract();
   33|   149k|   accum.mul(ws[2], p[3]);
   34|   149k|   accum.mul(ws[3], p[2]);
   35|   149k|   accum.add(z[5]);
   36|   149k|   ws[1] = accum.extract();
   37|   149k|   accum.mul(ws[3], p[3]);
   38|   149k|   accum.add(z[6]);
   39|   149k|   ws[2] = accum.extract();
   40|   149k|   accum.add(z[7]);
   41|   149k|   ws[3] = accum.extract();
   42|   149k|   const word w1 = accum.extract();
   43|   149k|   bigint_monty_maybe_sub<4>(r, w1, ws, p);
   44|   149k|}
_ZN5Botan19bigint_monty_redc_6EPmPKmS2_mS0_:
   46|      4|void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6]) {
   47|      4|   word3<word> accum;
   48|      4|   accum.add(z[0]);
   49|      4|   ws[0] = accum.monty_step(p[0], p_dash);
   50|      4|   accum.mul(ws[0], p[1]);
   51|      4|   accum.add(z[1]);
   52|      4|   ws[1] = accum.monty_step(p[0], p_dash);
   53|      4|   accum.mul(ws[0], p[2]);
   54|      4|   accum.mul(ws[1], p[1]);
   55|      4|   accum.add(z[2]);
   56|      4|   ws[2] = accum.monty_step(p[0], p_dash);
   57|      4|   accum.mul(ws[0], p[3]);
   58|      4|   accum.mul(ws[1], p[2]);
   59|      4|   accum.mul(ws[2], p[1]);
   60|      4|   accum.add(z[3]);
   61|      4|   ws[3] = accum.monty_step(p[0], p_dash);
   62|      4|   accum.mul(ws[0], p[4]);
   63|      4|   accum.mul(ws[1], p[3]);
   64|      4|   accum.mul(ws[2], p[2]);
   65|      4|   accum.mul(ws[3], p[1]);
   66|      4|   accum.add(z[4]);
   67|      4|   ws[4] = accum.monty_step(p[0], p_dash);
   68|      4|   accum.mul(ws[0], p[5]);
   69|      4|   accum.mul(ws[1], p[4]);
   70|      4|   accum.mul(ws[2], p[3]);
   71|      4|   accum.mul(ws[3], p[2]);
   72|      4|   accum.mul(ws[4], p[1]);
   73|      4|   accum.add(z[5]);
   74|      4|   ws[5] = accum.monty_step(p[0], p_dash);
   75|      4|   accum.mul(ws[1], p[5]);
   76|      4|   accum.mul(ws[2], p[4]);
   77|      4|   accum.mul(ws[3], p[3]);
   78|      4|   accum.mul(ws[4], p[2]);
   79|      4|   accum.mul(ws[5], p[1]);
   80|      4|   accum.add(z[6]);
   81|      4|   ws[0] = accum.extract();
   82|      4|   accum.mul(ws[2], p[5]);
   83|      4|   accum.mul(ws[3], p[4]);
   84|      4|   accum.mul(ws[4], p[3]);
   85|      4|   accum.mul(ws[5], p[2]);
   86|      4|   accum.add(z[7]);
   87|      4|   ws[1] = accum.extract();
   88|      4|   accum.mul(ws[3], p[5]);
   89|      4|   accum.mul(ws[4], p[4]);
   90|      4|   accum.mul(ws[5], p[3]);
   91|      4|   accum.add(z[8]);
   92|      4|   ws[2] = accum.extract();
   93|      4|   accum.mul(ws[4], p[5]);
   94|      4|   accum.mul(ws[5], p[4]);
   95|      4|   accum.add(z[9]);
   96|      4|   ws[3] = accum.extract();
   97|      4|   accum.mul(ws[5], p[5]);
   98|      4|   accum.add(z[10]);
   99|      4|   ws[4] = accum.extract();
  100|      4|   accum.add(z[11]);
  101|      4|   ws[5] = accum.extract();
  102|      4|   const word w1 = accum.extract();
  103|      4|   bigint_monty_maybe_sub<6>(r, w1, ws, p);
  104|      4|}
_ZN5Botan19bigint_monty_redc_8EPmPKmS2_mS0_:
  106|   214k|void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8]) {
  107|   214k|   word3<word> accum;
  108|   214k|   accum.add(z[0]);
  109|   214k|   ws[0] = accum.monty_step(p[0], p_dash);
  110|   214k|   accum.mul(ws[0], p[1]);
  111|   214k|   accum.add(z[1]);
  112|   214k|   ws[1] = accum.monty_step(p[0], p_dash);
  113|   214k|   accum.mul(ws[0], p[2]);
  114|   214k|   accum.mul(ws[1], p[1]);
  115|   214k|   accum.add(z[2]);
  116|   214k|   ws[2] = accum.monty_step(p[0], p_dash);
  117|   214k|   accum.mul(ws[0], p[3]);
  118|   214k|   accum.mul(ws[1], p[2]);
  119|   214k|   accum.mul(ws[2], p[1]);
  120|   214k|   accum.add(z[3]);
  121|   214k|   ws[3] = accum.monty_step(p[0], p_dash);
  122|   214k|   accum.mul(ws[0], p[4]);
  123|   214k|   accum.mul(ws[1], p[3]);
  124|   214k|   accum.mul(ws[2], p[2]);
  125|   214k|   accum.mul(ws[3], p[1]);
  126|   214k|   accum.add(z[4]);
  127|   214k|   ws[4] = accum.monty_step(p[0], p_dash);
  128|   214k|   accum.mul(ws[0], p[5]);
  129|   214k|   accum.mul(ws[1], p[4]);
  130|   214k|   accum.mul(ws[2], p[3]);
  131|   214k|   accum.mul(ws[3], p[2]);
  132|   214k|   accum.mul(ws[4], p[1]);
  133|   214k|   accum.add(z[5]);
  134|   214k|   ws[5] = accum.monty_step(p[0], p_dash);
  135|   214k|   accum.mul(ws[0], p[6]);
  136|   214k|   accum.mul(ws[1], p[5]);
  137|   214k|   accum.mul(ws[2], p[4]);
  138|   214k|   accum.mul(ws[3], p[3]);
  139|   214k|   accum.mul(ws[4], p[2]);
  140|   214k|   accum.mul(ws[5], p[1]);
  141|   214k|   accum.add(z[6]);
  142|   214k|   ws[6] = accum.monty_step(p[0], p_dash);
  143|   214k|   accum.mul(ws[0], p[7]);
  144|   214k|   accum.mul(ws[1], p[6]);
  145|   214k|   accum.mul(ws[2], p[5]);
  146|   214k|   accum.mul(ws[3], p[4]);
  147|   214k|   accum.mul(ws[4], p[3]);
  148|   214k|   accum.mul(ws[5], p[2]);
  149|   214k|   accum.mul(ws[6], p[1]);
  150|   214k|   accum.add(z[7]);
  151|   214k|   ws[7] = accum.monty_step(p[0], p_dash);
  152|   214k|   accum.mul(ws[1], p[7]);
  153|   214k|   accum.mul(ws[2], p[6]);
  154|   214k|   accum.mul(ws[3], p[5]);
  155|   214k|   accum.mul(ws[4], p[4]);
  156|   214k|   accum.mul(ws[5], p[3]);
  157|   214k|   accum.mul(ws[6], p[2]);
  158|   214k|   accum.mul(ws[7], p[1]);
  159|   214k|   accum.add(z[8]);
  160|   214k|   ws[0] = accum.extract();
  161|   214k|   accum.mul(ws[2], p[7]);
  162|   214k|   accum.mul(ws[3], p[6]);
  163|   214k|   accum.mul(ws[4], p[5]);
  164|   214k|   accum.mul(ws[5], p[4]);
  165|   214k|   accum.mul(ws[6], p[3]);
  166|   214k|   accum.mul(ws[7], p[2]);
  167|   214k|   accum.add(z[9]);
  168|   214k|   ws[1] = accum.extract();
  169|   214k|   accum.mul(ws[3], p[7]);
  170|   214k|   accum.mul(ws[4], p[6]);
  171|   214k|   accum.mul(ws[5], p[5]);
  172|   214k|   accum.mul(ws[6], p[4]);
  173|   214k|   accum.mul(ws[7], p[3]);
  174|   214k|   accum.add(z[10]);
  175|   214k|   ws[2] = accum.extract();
  176|   214k|   accum.mul(ws[4], p[7]);
  177|   214k|   accum.mul(ws[5], p[6]);
  178|   214k|   accum.mul(ws[6], p[5]);
  179|   214k|   accum.mul(ws[7], p[4]);
  180|   214k|   accum.add(z[11]);
  181|   214k|   ws[3] = accum.extract();
  182|   214k|   accum.mul(ws[5], p[7]);
  183|   214k|   accum.mul(ws[6], p[6]);
  184|   214k|   accum.mul(ws[7], p[5]);
  185|   214k|   accum.add(z[12]);
  186|   214k|   ws[4] = accum.extract();
  187|   214k|   accum.mul(ws[6], p[7]);
  188|   214k|   accum.mul(ws[7], p[6]);
  189|   214k|   accum.add(z[13]);
  190|   214k|   ws[5] = accum.extract();
  191|   214k|   accum.mul(ws[7], p[7]);
  192|   214k|   accum.add(z[14]);
  193|   214k|   ws[6] = accum.extract();
  194|   214k|   accum.add(z[15]);
  195|   214k|   ws[7] = accum.extract();
  196|   214k|   const word w1 = accum.extract();
  197|   214k|   bigint_monty_maybe_sub<8>(r, w1, ws, p);
  198|   214k|}

_ZN5Botan17Barrett_ReductionC2ERKNS_6BigIntES1_m:
   17|     21|      m_modulus(m), m_mu(std::move(mu)), m_mod_words(mw), m_modulus_bits(m.bits()) {
   18|       |   // Give some extra space for Karatsuba
   19|     21|   m_modulus.grow_to(m_mod_words + 8);
   20|     21|   m_mu.grow_to(m_mod_words + 8);
   21|     21|}
_ZN5Botan17Barrett_Reduction18for_public_modulusERKNS_6BigIntE:
   33|     21|Barrett_Reduction Barrett_Reduction::for_public_modulus(const BigInt& mod) {
   34|     21|   BOTAN_ARG_CHECK(mod.signum() > 0, "Modulus must be positive");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
   35|       |
   36|     21|   const size_t mod_words = mod.sig_words();
   37|       |
   38|       |   // Compute mu = floor(2^{2k} / m)
   39|     21|   const size_t mu_bits = 2 * WordInfo<word>::bits * mod_words;
   40|     21|   return Barrett_Reduction(mod, vartime_divide_pow2k(mu_bits, mod), mod_words);
   41|     21|}
_ZNK5Botan17Barrett_Reduction8multiplyERKNS_6BigIntES3_:
  159|     21|BigInt Barrett_Reduction::multiply(const BigInt& x, const BigInt& y) const {
  160|     21|   BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett multiply");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  161|     21|   BOTAN_ARG_CHECK(acceptable_barrett_input(y, m_modulus).as_bool(), "Invalid y param for Barrett multiply");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  162|       |
  163|     21|   secure_vector<word> ws(2 * (m_mod_words + 2));
  164|     21|   secure_vector<word> xy(2 * m_mod_words);
  165|       |
  166|     21|   bigint_mul(xy.data(),
  167|     21|              xy.size(),
  168|     21|              x._data(),
  169|     21|              x.size(),
  170|     21|              std::min(x.size(), m_mod_words),
  171|     21|              y._data(),
  172|     21|              y.size(),
  173|     21|              std::min(y.size(), m_mod_words),
  174|     21|              ws.data(),
  175|     21|              ws.size());
  176|       |
  177|     21|   return barrett_reduce(m_mod_words, m_modulus, m_mu, xy, ws);
  178|     21|}
_ZNK5Botan17Barrett_Reduction6squareERKNS_6BigIntE:
  180|     21|BigInt Barrett_Reduction::square(const BigInt& x) const {
  181|     21|   BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett square");
  ------------------
  |  |   35|     21|   do {                                                          \
  |  |   36|     21|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     21|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 21]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     21|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 21]
  |  |  ------------------
  ------------------
  182|       |
  183|     21|   secure_vector<word> ws(2 * (m_mod_words + 2));
  184|     21|   secure_vector<word> x2(2 * m_mod_words);
  185|       |
  186|     21|   bigint_sqr(x2.data(), x2.size(), x._data(), x.size(), std::min(x.size(), m_mod_words), ws.data(), ws.size());
  187|       |
  188|     21|   return barrett_reduce(m_mod_words, m_modulus, m_mu, x2, ws);
  189|     21|}
_ZNK5Botan17Barrett_Reduction6reduceERKNS_6BigIntE:
  191|     14|BigInt Barrett_Reduction::reduce(const BigInt& x) const {
  192|     14|   BOTAN_ARG_CHECK(x.signum() >= 0, "Argument must be non-negative");
  ------------------
  |  |   35|     14|   do {                                                          \
  |  |   36|     14|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     14|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 14]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     14|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 14]
  |  |  ------------------
  ------------------
  193|       |
  194|     14|   const size_t x_sw = x.sig_words();
  195|     14|   BOTAN_ARG_CHECK(x_sw <= 2 * m_mod_words, "Argument is too large for Barrett reduction");
  ------------------
  |  |   35|     14|   do {                                                          \
  |  |   36|     14|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     14|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 14]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     14|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 14]
  |  |  ------------------
  ------------------
  196|       |
  197|     14|   x.grow_to(2 * m_mod_words);
  198|       |
  199|     14|   secure_vector<word> ws;
  200|     14|   return barrett_reduce(m_mod_words, m_modulus, m_mu, x._as_span(), ws);
  201|     14|}
barrett.cpp:_ZN5Botan12_GLOBAL__N_124acceptable_barrett_inputERKNS_6BigIntES3_:
  151|     63|CT::Choice acceptable_barrett_input(const BigInt& x, const BigInt& modulus) {
  152|     63|   auto x_is_positive = CT::Choice::from_int(static_cast<uint32_t>(x.signum() >= 0));
  153|     63|   auto x_lt_mod = bigint_ct_is_lt(x._data(), x.size(), modulus._data(), modulus.sig_words()).as_choice();
  154|     63|   return x_is_positive && x_lt_mod;
  155|     63|}
barrett.cpp:_ZN5Botan12_GLOBAL__N_114barrett_reduceEmRKNS_6BigIntES3_NSt3__14spanIKmLm18446744073709551615EEERNS4_6vectorImNS_16secure_allocatorImEEEE:
   54|     56|   size_t mod_words, const BigInt& modulus, const BigInt& mu, std::span<const word> x_words, secure_vector<word>& ws) {
   55|     56|   BOTAN_ASSERT_NOMSG(modulus.sig_words() == mod_words);
  ------------------
  |  |   77|     56|   do {                                                                     \
  |  |   78|     56|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     56|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 56]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     56|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 56]
  |  |  ------------------
  ------------------
   56|       |
   57|       |   // Caller must expand input to be at least this size
   58|     56|   BOTAN_ASSERT_NOMSG(x_words.size() >= 2 * mod_words);
  ------------------
  |  |   77|     56|   do {                                                                     \
  |  |   78|     56|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     56|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 56]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     56|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 56]
  |  |  ------------------
  ------------------
   59|       |
   60|       |   // Normally mod_words + 1 but can be + 2 if the modulus is a power of 2
   61|     56|   const size_t mu_words = mu.sig_words();
   62|     56|   BOTAN_ASSERT_NOMSG(mu_words <= mod_words + 2);
  ------------------
  |  |   77|     56|   do {                                                                     \
  |  |   78|     56|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     56|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 56]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     56|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 56]
  |  |  ------------------
  ------------------
   63|       |
   64|     56|   if(ws.size() < 2 * (mod_words + 2)) {
  ------------------
  |  Branch (64:7): [True: 14, False: 42]
  ------------------
   65|     14|      ws.resize(2 * (mod_words + 2));
   66|     14|   }
   67|       |
   68|     56|   CT::poison(x_words);
   69|       |
   70|       |   /*
   71|       |   * Following the notation of Handbook of Applied Cryptography
   72|       |   * Algorithm 14.42 "Barrett modular reduction", page 604
   73|       |   * <https://cacr.uwaterloo.ca/hac/about/chap14.pdf>
   74|       |   *
   75|       |   * Using `mu` for μ in the code
   76|       |   */
   77|       |
   78|       |   // Compute q1 = floor(x / 2^(k - 1)) which is equivalent to ignoring the low (k-1) words
   79|       |
   80|       |   // 2 * mod_words + 1 is sufficient, extra is to enable Karatsuba
   81|     56|   secure_vector<word> r(2 * mu_words + 2);
   82|       |
   83|     56|   copy_mem(r.data(), x_words.data() + (mod_words - 1), mod_words + 1);
   84|       |
   85|       |   // Now compute q2 = q1 * μ
   86|       |
   87|       |   // We allocate more size than required since this allows Karatsuba more often;
   88|       |   // just `mu_words + (mod_words + 1)` is sufficient
   89|     56|   const size_t q2_size = 2 * mu_words + 2;
   90|       |
   91|     56|   secure_vector<word> q2(q2_size);
   92|       |
   93|     56|   bigint_mul(
   94|     56|      q2.data(), q2.size(), r.data(), r.size(), mod_words + 1, mu._data(), mu.size(), mu_words, ws.data(), ws.size());
   95|       |
   96|       |   // Compute r2 = (floor(q2 / b^(k+1)) * m) mod 2^(k+1)
   97|       |   // The division/floor is again effected by just ignoring the low k + 1 words
   98|     56|   bigint_mul(r.data(),
   99|     56|              r.size(),
  100|     56|              &q2[mod_words + 1],  // ignoring the low mod_words + 1 words of the first product
  101|     56|              q2.size() - (mod_words + 1),
  102|     56|              mod_words + 1,
  103|     56|              modulus._data(),
  104|     56|              modulus.size(),
  105|     56|              mod_words,
  106|     56|              ws.data(),
  107|     56|              ws.size());
  108|       |
  109|       |   // Clear the high words of the product, equivalent to computing mod 2^(k+1)
  110|       |   // TODO add masked mul to avoid computing high bits at all
  111|     56|   clear_mem(std::span{r}.subspan(mod_words + 1));
  112|       |
  113|       |   // Compute r = r1 - r2
  114|       |
  115|       |   // The return value of bigint_sub_abs isn't quite right for what we need here so first compare
  116|     56|   const int32_t relative_size = bigint_cmp(r.data(), mod_words + 1, x_words.data(), mod_words + 1);
  117|       |
  118|     56|   bigint_sub_abs(r.data(), r.data(), x_words.data(), mod_words + 1, ws.data());
  119|       |
  120|       |   /*
  121|       |   If r is negative then we have to set r to r + 2^(k+1)
  122|       |
  123|       |   However for r negative computing this sum is equivalent to computing 2^(k+1) - abs(r)
  124|       |   */
  125|     56|   clear_mem(ws.data(), mod_words + 2);
  126|     56|   ws[mod_words + 1] = 1;
  127|     56|   bigint_sub2(ws.data(), mod_words + 2, r.data(), mod_words + 2);
  128|       |
  129|       |   // If relative_size > 0 then assign r to 2^(k+1) - r
  130|     56|   CT::Mask<word>::is_equal(static_cast<word>(relative_size), 1).select_n(r.data(), ws.data(), r.data(), mod_words + 2);
  131|       |
  132|       |   /*
  133|       |   * Per HAC Note 14.44 (ii) "step 4 is repeated at most twice since 0 ≤ r < 3m"
  134|       |   */
  135|     56|   const size_t bound = 2;
  136|       |
  137|     56|   BOTAN_ASSERT_NOMSG(r.size() >= mod_words + 1);
  ------------------
  |  |   77|     56|   do {                                                                     \
  |  |   78|     56|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|     56|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 56]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|     56|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 56]
  |  |  ------------------
  ------------------
  138|    168|   for(size_t i = 0; i != bound; ++i) {
  ------------------
  |  Branch (138:22): [True: 112, False: 56]
  ------------------
  139|    112|      const word borrow = bigint_sub3(ws.data(), r.data(), mod_words + 1, modulus._data(), mod_words);
  140|    112|      CT::Mask<word>::is_zero(borrow).select_n(r.data(), ws.data(), r.data(), mod_words + 1);
  141|    112|   }
  142|       |
  143|     56|   CT::unpoison(q2);
  144|     56|   CT::unpoison(r);
  145|     56|   CT::unpoison(ws);
  146|     56|   CT::unpoison(x_words);
  147|       |
  148|     56|   return BigInt::_from_words(r);
  149|     56|}

_ZN5Botan17Montgomery_Params4DataC2ERKNS_6BigIntERKNS_17Barrett_ReductionE:
   40|      7|Montgomery_Params::Data::Data(const BigInt& p, const Barrett_Reduction& mod_p) {
   41|      7|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (41:7): [True: 0, False: 7]
  |  Branch (41:22): [True: 0, False: 7]
  ------------------
   42|      0|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   43|      0|   }
   44|       |
   45|      7|   m_p = p;
   46|      7|   m_p_words = m_p.sig_words();
   47|      7|   m_p_dash = monty_inverse(m_p.word_at(0));
   48|       |
   49|      7|   const BigInt r = BigInt::power_of_2(m_p_words * WordInfo<word>::bits);
   50|       |
   51|      7|   m_r1 = mod_p.reduce(r);
   52|      7|   m_r2 = mod_p.square(m_r1);
   53|      7|   m_r3 = mod_p.multiply(m_r1, m_r2);
   54|       |
   55|       |   // Barrett should be at least zero prefixing up to modulus size
   56|      7|   BOTAN_ASSERT_NOMSG(m_r1.size() >= m_p_words);
  ------------------
  |  |   77|      7|   do {                                                                     \
  |  |   78|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      7|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
   57|      7|   BOTAN_ASSERT_NOMSG(m_r2.size() >= m_p_words);
  ------------------
  |  |   77|      7|   do {                                                                     \
  |  |   78|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      7|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
   58|      7|   BOTAN_ASSERT_NOMSG(m_r3.size() >= m_p_words);
  ------------------
  |  |   77|      7|   do {                                                                     \
  |  |   78|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   79|      7|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (79:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   80|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   81|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   82|      0|      }                                                                     \
  |  |   83|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
   59|      7|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_17Barrett_ReductionE:
   62|      7|      m_data(std::make_shared<Data>(p, mod_p)) {}
_ZNK5Botan17Montgomery_Params3mulERKNS_6BigIntES3_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   90|     14|BigInt Montgomery_Params::mul(const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
   91|     14|   const size_t p_size = this->p_words();
   92|     14|   BigInt z = BigInt::with_capacity(2 * p_size);
   93|     14|   this->mul(z, x, y, ws);
   94|     14|   return z;
   95|     14|}
_ZNK5Botan17Montgomery_Params3mulERNS_6BigIntERKS1_S4_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
   97|     14|void Montgomery_Params::mul(BigInt& z, const BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
   98|     14|   BOTAN_ARG_CHECK(&z != &x && &z != &y, "Montgomery_Params::mul output must not alias inputs");
  ------------------
  |  |   35|     14|   do {                                                          \
  |  |   36|     14|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|     28|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 14, False: 0]
  |  |  |  Branch (37:12): [True: 14, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|     14|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 14]
  |  |  ------------------
  ------------------
   99|       |
  100|     14|   const size_t p_size = this->p_words();
  101|       |
  102|     14|   if(ws.size() < 2 * p_size) {
  ------------------
  |  Branch (102:7): [True: 7, False: 7]
  ------------------
  103|      7|      ws.resize(2 * p_size);
  104|      7|   }
  105|       |
  106|     14|   BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size);
  ------------------
  |  |  130|     14|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|     14|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 14]
  |  |  ------------------
  ------------------
  107|     14|   BOTAN_DEBUG_ASSERT(y.sig_words() <= p_size);
  ------------------
  |  |  130|     14|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|     14|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 14]
  |  |  ------------------
  ------------------
  108|       |
  109|     14|   if(z.size() < 2 * p_size) {
  ------------------
  |  Branch (109:7): [True: 0, False: 14]
  ------------------
  110|      0|      z.grow_to(2 * p_size);
  111|      0|   }
  112|       |
  113|     14|   bigint_mul(z.mutable_data(),
  114|     14|              z.size(),
  115|     14|              x._data(),
  116|     14|              x.size(),
  117|     14|              std::min(p_size, x.size()),
  118|     14|              y._data(),
  119|     14|              y.size(),
  120|     14|              std::min(p_size, y.size()),
  121|     14|              ws.data(),
  122|     14|              ws.size());
  123|       |
  124|     14|   bigint_monty_redc_inplace(z.mutable_data(), this->p()._data(), p_size, this->p_dash(), ws.data(), ws.size());
  125|     14|}
_ZNK5Botan17Montgomery_Params6mul_byERNS_6BigIntERKS1_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  157|     14|void Montgomery_Params::mul_by(BigInt& x, const BigInt& y, secure_vector<word>& ws) const {
  158|     14|   const size_t p_size = this->p_words();
  159|       |
  160|     14|   if(ws.size() < 4 * p_size) {
  ------------------
  |  Branch (160:7): [True: 7, False: 7]
  ------------------
  161|      7|      ws.resize(4 * p_size);
  162|      7|   }
  163|       |
  164|     14|   word* z_data = ws.data();
  165|     14|   word* ws_data = &ws[2 * p_size];
  166|       |
  167|     14|   BOTAN_DEBUG_ASSERT(x.sig_words() <= p_size);
  ------------------
  |  |  130|     14|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|     14|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 14]
  |  |  ------------------
  ------------------
  168|       |
  169|     14|   bigint_mul(z_data,
  170|     14|              2 * p_size,
  171|     14|              x._data(),
  172|     14|              x.size(),
  173|     14|              std::min(p_size, x.size()),
  174|     14|              y._data(),
  175|     14|              y.size(),
  176|     14|              std::min(p_size, y.size()),
  177|     14|              ws_data,
  178|     14|              2 * p_size);
  179|       |
  180|     14|   bigint_monty_redc_inplace(z_data, this->p()._data(), p_size, this->p_dash(), ws_data, 2 * p_size);
  181|       |
  182|     14|   if(x.size() < 2 * p_size) {
  ------------------
  |  Branch (182:7): [True: 6, False: 8]
  ------------------
  183|      6|      x.grow_to(2 * p_size);
  184|      6|   }
  185|     14|   copy_mem(x.mutable_data(), z_data, 2 * p_size);
  186|     14|}

_ZN5Botan6PCurve15PrimeOrderCurve15for_named_curveENSt3__117basic_string_viewIcNS2_11char_traitsIcEEEE:
   32|      7|std::shared_ptr<const PrimeOrderCurve> PrimeOrderCurve::for_named_curve(std::string_view name) {
   33|      7|#if defined(BOTAN_HAS_PCURVES_SECP256R1)
   34|      7|   if(name == "secp256r1") {
  ------------------
  |  Branch (34:7): [True: 1, False: 6]
  ------------------
   35|      1|      return PCurveInstance::secp256r1();
   36|      1|   }
   37|      6|#endif
   38|       |
   39|      6|#if defined(BOTAN_HAS_PCURVES_SECP384R1)
   40|      6|   if(name == "secp384r1") {
  ------------------
  |  Branch (40:7): [True: 1, False: 5]
  ------------------
   41|      1|      return PCurveInstance::secp384r1();
   42|      1|   }
   43|      5|#endif
   44|       |
   45|      5|#if defined(BOTAN_HAS_PCURVES_SECP521R1)
   46|      5|   if(name == "secp521r1") {
  ------------------
  |  Branch (46:7): [True: 1, False: 4]
  ------------------
   47|      1|      return PCurveInstance::secp521r1();
   48|      1|   }
   49|      4|#endif
   50|       |
   51|      4|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1)
   52|      4|   if(name == "brainpool256r1") {
  ------------------
  |  Branch (52:7): [True: 1, False: 3]
  ------------------
   53|      1|      return PCurveInstance::brainpool256r1();
   54|      1|   }
   55|      3|#endif
   56|       |
   57|      3|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1)
   58|      3|   if(name == "brainpool384r1") {
  ------------------
  |  Branch (58:7): [True: 0, False: 3]
  ------------------
   59|      0|      return PCurveInstance::brainpool384r1();
   60|      0|   }
   61|      3|#endif
   62|       |
   63|      3|#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1)
   64|      3|   if(name == "brainpool512r1") {
  ------------------
  |  Branch (64:7): [True: 1, False: 2]
  ------------------
   65|      1|      return PCurveInstance::brainpool512r1();
   66|      1|   }
   67|      2|#endif
   68|       |
   69|      2|#if defined(BOTAN_HAS_PCURVES_FRP256V1)
   70|      2|   if(name == "frp256v1") {
  ------------------
  |  Branch (70:7): [True: 0, False: 2]
  ------------------
   71|      0|      return PCurveInstance::frp256v1();
   72|      0|   }
   73|      2|#endif
   74|       |
   75|      2|#if defined(BOTAN_HAS_PCURVES_SECP192R1)
   76|      2|   if(name == "secp192r1") {
  ------------------
  |  Branch (76:7): [True: 1, False: 1]
  ------------------
   77|      1|      return PCurveInstance::secp192r1();
   78|      1|   }
   79|      1|#endif
   80|       |
   81|      1|#if defined(BOTAN_HAS_PCURVES_SECP224R1)
   82|      1|   if(name == "secp224r1") {
  ------------------
  |  Branch (82:7): [True: 1, False: 0]
  ------------------
   83|      1|      return PCurveInstance::secp224r1();
   84|      1|   }
   85|      0|#endif
   86|       |
   87|      0|#if defined(BOTAN_HAS_PCURVES_SECP256K1)
   88|      0|   if(name == "secp256k1") {
  ------------------
  |  Branch (88:7): [True: 0, False: 0]
  ------------------
   89|      0|      return PCurveInstance::secp256k1();
   90|      0|   }
   91|      0|#endif
   92|       |
   93|      0|#if defined(BOTAN_HAS_PCURVES_SM2P256V1)
   94|      0|   if(name == "sm2p256v1") {
  ------------------
  |  Branch (94:7): [True: 0, False: 0]
  ------------------
   95|      0|      return PCurveInstance::sm2p256v1();
   96|      0|   }
   97|      0|#endif
   98|       |
   99|      0|#if defined(BOTAN_HAS_PCURVES_NUMSP512D1)
  100|      0|   if(name == "numsp512d1") {
  ------------------
  |  Branch (100:7): [True: 0, False: 0]
  ------------------
  101|      0|      return PCurveInstance::numsp512d1();
  102|      0|   }
  103|      0|#endif
  104|       |
  105|      0|   BOTAN_UNUSED(name);
  ------------------
  |  |  144|      0|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
  106|      0|   return {};
  107|      0|}

_ZN5Botan6PCurve14PCurveInstance14brainpool256r1Ev:
   36|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::brainpool256r1() {
   37|      1|   return PrimeOrderCurveImpl<brainpool256r1::Curve>::instance();
   38|      1|}

_ZN5Botan6PCurve14PCurveInstance14brainpool512r1Ev:
   36|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::brainpool512r1() {
   37|      1|   return PrimeOrderCurveImpl<brainpool512r1::Curve>::instance();
   38|      1|}

_ZN5Botan6PCurve14PCurveInstance9secp192r1Ev:
  180|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::secp192r1() {
  181|      1|   return PrimeOrderCurveImpl<secp192r1::Curve>::instance();
  182|      1|}
pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv:
   93|    180|      constexpr static std::array<W, N> one() { return std::array<W, N>{1}; }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm6EEE:
   25|  64.8k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
   26|  64.8k|         if constexpr(std::same_as<W, uint64_t> && WordInfo<W>::dword_is_native) {
   27|  64.8k|            using dword = typename WordInfo<W>::dword;
   28|       |
   29|  64.8k|            const dword S01 = dword(z[0]) + z[3] + z[5];
   30|  64.8k|            const dword S23 = dword(z[1]) + z[3] + z[4] + z[5];
   31|  64.8k|            const dword S45 = dword(z[2]) + z[4] + z[5];
   32|       |
   33|  64.8k|            std::array<W, N> r = {};
   34|       |
   35|  64.8k|            dword S = S01;
   36|  64.8k|            r[0] = static_cast<uint64_t>(S);
   37|  64.8k|            S >>= 64;
   38|       |
   39|  64.8k|            S += S23;
   40|  64.8k|            r[1] = static_cast<uint64_t>(S);
   41|  64.8k|            S >>= 64;
   42|       |
   43|  64.8k|            S += S45;
   44|  64.8k|            r[2] = static_cast<uint64_t>(S);
   45|  64.8k|            S >>= 64;
   46|       |
   47|  64.8k|            BOTAN_DEBUG_ASSERT(S <= 3);
  ------------------
  |  |  130|  64.8k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  64.8k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 64.8k]
  |  |  ------------------
  ------------------
   48|       |
   49|  64.8k|            solinas_correct_redc<N>(r, P, p192_mul_mod_192(static_cast<W>(S)));
   50|       |
   51|  64.8k|            return r;
   52|  64.8k|         }
   53|       |
   54|      0|         const int64_t X00 = get_uint32(z.data(), 0);
   55|  64.8k|         const int64_t X01 = get_uint32(z.data(), 1);
   56|  64.8k|         const int64_t X02 = get_uint32(z.data(), 2);
   57|  64.8k|         const int64_t X03 = get_uint32(z.data(), 3);
   58|  64.8k|         const int64_t X04 = get_uint32(z.data(), 4);
   59|  64.8k|         const int64_t X05 = get_uint32(z.data(), 5);
   60|  64.8k|         const int64_t X06 = get_uint32(z.data(), 6);
   61|  64.8k|         const int64_t X07 = get_uint32(z.data(), 7);
   62|  64.8k|         const int64_t X08 = get_uint32(z.data(), 8);
   63|  64.8k|         const int64_t X09 = get_uint32(z.data(), 9);
   64|  64.8k|         const int64_t X10 = get_uint32(z.data(), 10);
   65|  64.8k|         const int64_t X11 = get_uint32(z.data(), 11);
   66|       |
   67|  64.8k|         const int64_t S0 = X00 + X06 + X10;
   68|  64.8k|         const int64_t S1 = X01 + X07 + X11;
   69|  64.8k|         const int64_t S2 = X02 + X06 + X08 + X10;
   70|  64.8k|         const int64_t S3 = X03 + X07 + X09 + X11;
   71|  64.8k|         const int64_t S4 = X04 + X08 + X10;
   72|  64.8k|         const int64_t S5 = X05 + X09 + X11;
   73|       |
   74|  64.8k|         std::array<W, N> r = {};
   75|       |
   76|  64.8k|         SolinasAccum sum(r);
   77|       |
   78|  64.8k|         sum.accum(S0);
   79|  64.8k|         sum.accum(S1);
   80|  64.8k|         sum.accum(S2);
   81|  64.8k|         sum.accum(S3);
   82|  64.8k|         sum.accum(S4);
   83|  64.8k|         sum.accum(S5);
   84|  64.8k|         const auto S = sum.final_carry(0);
   85|       |
   86|  64.8k|         BOTAN_DEBUG_ASSERT(S <= 3);
  ------------------
  |  |  130|  64.8k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  64.8k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 64.8k]
  |  |  ------------------
  ------------------
   87|       |
   88|  64.8k|         solinas_correct_redc<N>(r, P, p192_mul_mod_192(S));
   89|       |
   90|  64.8k|         return r;
   91|  64.8k|      }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE16p192_mul_mod_192Em:
  105|  64.8k|      constexpr static std::array<W, N> p192_mul_mod_192(W i) {
  106|  64.8k|         static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
  107|       |
  108|       |         // For small i, multiples of P-192 have a simple structure so it's faster to
  109|       |         // compute the value directly vs a (constant time) table lookup
  110|       |
  111|  64.8k|         auto r = P;
  112|       |
  113|       |         if constexpr(WordInfo<W>::bits == 32) {
  114|       |            r[2] -= i;
  115|       |            r[0] -= i;
  116|  64.8k|         } else {
  117|  64.8k|            r[1] -= i;
  118|  64.8k|            r[0] -= i;
  119|  64.8k|         }
  120|  64.8k|         return r;
  121|  64.8k|      }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm3EEE:
   99|    529|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) { return z; }
pcurves_secp192r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp192r112Secp192r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm3EEE:
   95|    341|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) { return x; }

_ZN5Botan6PCurve14PCurveInstance9secp224r1Ev:
  223|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::secp224r1() {
  224|      1|   return PrimeOrderCurveImpl<secp224r1::Curve>::instance();
  225|      1|}
pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv:
   69|  27.1k|      constexpr static std::array<W, N> one() { return std::array<W, N>{1}; }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE:
   25|  1.44M|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
   26|  1.44M|         const int64_t X00 = get_uint32(z.data(), 0);
   27|  1.44M|         const int64_t X01 = get_uint32(z.data(), 1);
   28|  1.44M|         const int64_t X02 = get_uint32(z.data(), 2);
   29|  1.44M|         const int64_t X03 = get_uint32(z.data(), 3);
   30|  1.44M|         const int64_t X04 = get_uint32(z.data(), 4);
   31|  1.44M|         const int64_t X05 = get_uint32(z.data(), 5);
   32|  1.44M|         const int64_t X06 = get_uint32(z.data(), 6);
   33|  1.44M|         const int64_t X07 = get_uint32(z.data(), 7);
   34|  1.44M|         const int64_t X08 = get_uint32(z.data(), 8);
   35|  1.44M|         const int64_t X09 = get_uint32(z.data(), 9);
   36|  1.44M|         const int64_t X10 = get_uint32(z.data(), 10);
   37|  1.44M|         const int64_t X11 = get_uint32(z.data(), 11);
   38|  1.44M|         const int64_t X12 = get_uint32(z.data(), 12);
   39|  1.44M|         const int64_t X13 = get_uint32(z.data(), 13);
   40|       |
   41|  1.44M|         const int64_t S0 = 0x00000001 + X00 - X07 - X11;
   42|  1.44M|         const int64_t S1 = 0x00000000 + X01 - X08 - X12;
   43|  1.44M|         const int64_t S2 = 0x00000000 + X02 - X09 - X13;
   44|  1.44M|         const int64_t S3 = 0xFFFFFFFF + X03 + X07 + X11 - X10;
   45|  1.44M|         const int64_t S4 = 0xFFFFFFFF + X04 + X08 + X12 - X11;
   46|  1.44M|         const int64_t S5 = 0xFFFFFFFF + X05 + X09 + X13 - X12;
   47|  1.44M|         const int64_t S6 = 0xFFFFFFFF + X06 + X10 - X13;
   48|       |
   49|  1.44M|         std::array<W, N> r = {};
   50|       |
   51|  1.44M|         SolinasAccum sum(r);
   52|       |
   53|  1.44M|         sum.accum(S0);
   54|  1.44M|         sum.accum(S1);
   55|  1.44M|         sum.accum(S2);
   56|  1.44M|         sum.accum(S3);
   57|  1.44M|         sum.accum(S4);
   58|  1.44M|         sum.accum(S5);
   59|  1.44M|         sum.accum(S6);
   60|  1.44M|         const auto S = sum.final_carry(0);
   61|       |
   62|  1.44M|         BOTAN_DEBUG_ASSERT(S <= 2);
  ------------------
  |  |  130|  1.44M|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|  1.44M|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 1.44M]
  |  |  ------------------
  ------------------
   63|       |
   64|  1.44M|         solinas_correct_redc<N>(r, P, p224_mul_mod_224(S));
   65|       |
   66|  1.44M|         return r;
   67|  1.44M|      }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE16p224_mul_mod_224Em:
   81|  1.44M|      constexpr static std::array<W, N> p224_mul_mod_224(W i) {
   82|  1.44M|         static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
   83|       |
   84|       |         // For small i, multiples of P-224 have a simple structure so it's faster to
   85|       |         // compute the value directly vs a (constant time) table lookup
   86|       |
   87|  1.44M|         auto r = P;
   88|       |
   89|       |         if constexpr(WordInfo<W>::bits == 32) {
   90|       |            r[3] -= i;
   91|       |            r[0] += i;
   92|  1.44M|         } else {
   93|  1.44M|            const W i32 = i << 32;
   94|  1.44M|            r[1] -= i32;
   95|  1.44M|            r[0] += i;
   96|  1.44M|         }
   97|  1.44M|         return r;
   98|  1.44M|      }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE:
   75|    577|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) { return z; }
pcurves_secp224r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp224r112Secp224r1RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE:
   71|    445|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) { return x; }

_ZN5Botan6PCurve14PCurveInstance9secp256r1Ev:
  268|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::secp256r1() {
  269|      1|   return PrimeOrderCurveImpl<secp256r1::Curve>::instance();
  270|      1|}
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE3oneEv:
   77|      1|      constexpr static std::array<W, N> one() { return std::array<W, N>{1}; }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm8EEE:
   27|   131k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
   28|   131k|         const int64_t X00 = get_uint32(z.data(), 0);
   29|   131k|         const int64_t X01 = get_uint32(z.data(), 1);
   30|   131k|         const int64_t X02 = get_uint32(z.data(), 2);
   31|   131k|         const int64_t X03 = get_uint32(z.data(), 3);
   32|   131k|         const int64_t X04 = get_uint32(z.data(), 4);
   33|   131k|         const int64_t X05 = get_uint32(z.data(), 5);
   34|   131k|         const int64_t X06 = get_uint32(z.data(), 6);
   35|   131k|         const int64_t X07 = get_uint32(z.data(), 7);
   36|   131k|         const int64_t X08 = get_uint32(z.data(), 8);
   37|   131k|         const int64_t X09 = get_uint32(z.data(), 9);
   38|   131k|         const int64_t X10 = get_uint32(z.data(), 10);
   39|   131k|         const int64_t X11 = get_uint32(z.data(), 11);
   40|   131k|         const int64_t X12 = get_uint32(z.data(), 12);
   41|   131k|         const int64_t X13 = get_uint32(z.data(), 13);
   42|   131k|         const int64_t X14 = get_uint32(z.data(), 14);
   43|   131k|         const int64_t X15 = get_uint32(z.data(), 15);
   44|       |
   45|       |         // See SP 800-186 section G.1.2
   46|   131k|         const int64_t S0 = P256_4[0] + X00 + X08 + X09 - (X11 + X12 + X13 + X14);
   47|   131k|         const int64_t S1 = P256_4[1] + X01 + X09 + X10 - (X12 + X13 + X14 + X15);
   48|   131k|         const int64_t S2 = P256_4[2] + X02 + X10 + X11 - (X13 + X14 + X15);
   49|   131k|         const int64_t S3 = P256_4[3] + X03 + 2 * (X11 + X12) + X13 - (X15 + X08 + X09);
   50|   131k|         const int64_t S4 = P256_4[4] + X04 + 2 * (X12 + X13) + X14 - (X09 + X10);
   51|   131k|         const int64_t S5 = P256_4[5] + X05 + 2 * (X13 + X14) + X15 - (X10 + X11);
   52|   131k|         const int64_t S6 = P256_4[6] + X06 + X13 + X14 * 3 + X15 * 2 - (X08 + X09);
   53|   131k|         const int64_t S7 = P256_4[7] + X07 + X15 * 3 + X08 - (X10 + X11 + X12 + X13);
   54|   131k|         const int64_t S8 = P256_4[8];
   55|       |
   56|   131k|         std::array<W, N> r = {};
   57|       |
   58|   131k|         SolinasAccum sum(r);
   59|       |
   60|   131k|         sum.accum(S0);
   61|   131k|         sum.accum(S1);
   62|   131k|         sum.accum(S2);
   63|   131k|         sum.accum(S3);
   64|   131k|         sum.accum(S4);
   65|   131k|         sum.accum(S5);
   66|   131k|         sum.accum(S6);
   67|   131k|         sum.accum(S7);
   68|   131k|         const auto S = sum.final_carry(S8);
   69|       |
   70|   131k|         BOTAN_DEBUG_ASSERT(S <= 8);
  ------------------
  |  |  130|   131k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|   131k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 131k]
  |  |  ------------------
  ------------------
   71|       |
   72|   131k|         solinas_correct_redc<N>(r, P, p256_mul_mod_256(S));
   73|       |
   74|   131k|         return r;
   75|   131k|      }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE16p256_mul_mod_256Em:
   89|   131k|      constexpr static std::array<W, N> p256_mul_mod_256(W i) {
   90|   131k|         static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
   91|       |
   92|       |         // For small i, multiples of P-256 have a simple structure so it's faster to
   93|       |         // compute the value directly vs a (constant time) table lookup
   94|       |
   95|   131k|         auto r = P;
   96|       |         if constexpr(WordInfo<W>::bits == 32) {
   97|       |            r[7] -= i;
   98|       |            r[6] += i;
   99|       |            r[3] += i;
  100|       |            r[0] -= i;
  101|   131k|         } else {
  102|   131k|            const uint64_t i32 = static_cast<uint64_t>(i) << 32;
  103|   131k|            r[3] -= i32;
  104|   131k|            r[3] += i;
  105|   131k|            r[1] += i32;
  106|   131k|            r[0] -= i;
  107|   131k|         }
  108|   131k|         return r;
  109|   131k|      }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm4EEE:
   83|    847|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) { return z; }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp256r1RepINS_13EllipticCurveINS1_9secp256r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm4EEE:
   79|    552|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) { return x; }
pcurves_secp256r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp256r15Curve7fe_sqrtERKNS_6IntModINS1_12Secp256r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE:
  165|    386|      static constexpr FieldElement fe_sqrt(const FieldElement& x) {
  166|       |         // Generated using addchain
  167|    386|         auto z = x.square();
  168|    386|         z *= x;
  169|    386|         auto t0 = z;
  170|    386|         t0.square_n(2);
  171|    386|         z *= t0;
  172|    386|         t0 = z;
  173|    386|         t0.square_n(4);
  174|    386|         z *= t0;
  175|    386|         t0 = z;
  176|    386|         t0.square_n(8);
  177|    386|         z *= t0;
  178|    386|         t0 = z;
  179|    386|         t0.square_n(16);
  180|    386|         z *= t0;
  181|    386|         z.square_n(32);
  182|    386|         z *= x;
  183|    386|         z.square_n(96);
  184|    386|         z *= x;
  185|    386|         z.square_n(94);
  186|    386|         return z;
  187|    386|      }

_ZN5Botan6PCurve14PCurveInstance9secp384r1Ev:
  343|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::secp384r1() {
  344|      1|   return PrimeOrderCurveImpl<secp384r1::Curve>::instance();
  345|      1|}
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE3oneEv:
   88|      1|      constexpr static std::array<W, N> one() { return std::array<W, N>{1}; }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE4redcERKNSt3__15arrayImLm12EEE:
   23|   110k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
   24|   110k|         const int64_t X00 = get_uint32(z.data(), 0);
   25|   110k|         const int64_t X01 = get_uint32(z.data(), 1);
   26|   110k|         const int64_t X02 = get_uint32(z.data(), 2);
   27|   110k|         const int64_t X03 = get_uint32(z.data(), 3);
   28|   110k|         const int64_t X04 = get_uint32(z.data(), 4);
   29|   110k|         const int64_t X05 = get_uint32(z.data(), 5);
   30|   110k|         const int64_t X06 = get_uint32(z.data(), 6);
   31|   110k|         const int64_t X07 = get_uint32(z.data(), 7);
   32|   110k|         const int64_t X08 = get_uint32(z.data(), 8);
   33|   110k|         const int64_t X09 = get_uint32(z.data(), 9);
   34|   110k|         const int64_t X10 = get_uint32(z.data(), 10);
   35|   110k|         const int64_t X11 = get_uint32(z.data(), 11);
   36|   110k|         const int64_t X12 = get_uint32(z.data(), 12);
   37|   110k|         const int64_t X13 = get_uint32(z.data(), 13);
   38|   110k|         const int64_t X14 = get_uint32(z.data(), 14);
   39|   110k|         const int64_t X15 = get_uint32(z.data(), 15);
   40|   110k|         const int64_t X16 = get_uint32(z.data(), 16);
   41|   110k|         const int64_t X17 = get_uint32(z.data(), 17);
   42|   110k|         const int64_t X18 = get_uint32(z.data(), 18);
   43|   110k|         const int64_t X19 = get_uint32(z.data(), 19);
   44|   110k|         const int64_t X20 = get_uint32(z.data(), 20);
   45|   110k|         const int64_t X21 = get_uint32(z.data(), 21);
   46|   110k|         const int64_t X22 = get_uint32(z.data(), 22);
   47|   110k|         const int64_t X23 = get_uint32(z.data(), 23);
   48|       |
   49|       |         // One copy of P-384 is added to prevent underflow
   50|   110k|         const int64_t S0 = 0xFFFFFFFF + X00 + X12 + X20 + X21 - X23;
   51|   110k|         const int64_t S1 = 0x00000000 + X01 + X13 + X22 + X23 - X12 - X20;
   52|   110k|         const int64_t S2 = 0x00000000 + X02 + X14 + X23 - X13 - X21;
   53|   110k|         const int64_t S3 = 0xFFFFFFFF + X03 + X12 + X15 + X20 + X21 - X14 - X22 - X23;
   54|   110k|         const int64_t S4 = 0xFFFFFFFE + X04 + X12 + X13 + X16 + X20 + X21 * 2 + X22 - X15 - X23 * 2;
   55|   110k|         const int64_t S5 = 0xFFFFFFFF + X05 + X13 + X14 + X17 + X21 + X22 * 2 + X23 - X16;
   56|   110k|         const int64_t S6 = 0xFFFFFFFF + X06 + X14 + X15 + X18 + X22 + X23 * 2 - X17;
   57|   110k|         const int64_t S7 = 0xFFFFFFFF + X07 + X15 + X16 + X19 + X23 - X18;
   58|   110k|         const int64_t S8 = 0xFFFFFFFF + X08 + X16 + X17 + X20 - X19;
   59|   110k|         const int64_t S9 = 0xFFFFFFFF + X09 + X17 + X18 + X21 - X20;
   60|   110k|         const int64_t SA = 0xFFFFFFFF + X10 + X18 + X19 + X22 - X21;
   61|   110k|         const int64_t SB = 0xFFFFFFFF + X11 + X19 + X20 + X23 - X22;
   62|       |
   63|   110k|         std::array<W, N> r = {};
   64|       |
   65|   110k|         SolinasAccum sum(r);
   66|       |
   67|   110k|         sum.accum(S0);
   68|   110k|         sum.accum(S1);
   69|   110k|         sum.accum(S2);
   70|   110k|         sum.accum(S3);
   71|   110k|         sum.accum(S4);
   72|   110k|         sum.accum(S5);
   73|   110k|         sum.accum(S6);
   74|   110k|         sum.accum(S7);
   75|   110k|         sum.accum(S8);
   76|   110k|         sum.accum(S9);
   77|   110k|         sum.accum(SA);
   78|   110k|         sum.accum(SB);
   79|   110k|         const auto S = sum.final_carry(0);
   80|       |
   81|   110k|         BOTAN_DEBUG_ASSERT(S <= 4);
  ------------------
  |  |  130|   110k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  131|   110k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (131:15): [Folded, False: 110k]
  |  |  ------------------
  ------------------
   82|       |
   83|   110k|         solinas_correct_redc<N>(r, P, p384_mul_mod_384(S));
   84|       |
   85|   110k|         return r;
   86|   110k|      }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE16p384_mul_mod_384Em:
  100|   110k|      constexpr static std::array<W, N> p384_mul_mod_384(W i) {
  101|   110k|         static_assert(WordInfo<W>::bits == 32 || WordInfo<W>::bits == 64);
  102|       |
  103|       |         // For small i, multiples of P-384 have a simple structure so it's faster to
  104|       |         // compute the value directly vs a (constant time) table lookup
  105|       |
  106|   110k|         auto r = P;
  107|       |         if constexpr(WordInfo<W>::bits == 32) {
  108|       |            r[4] -= i;
  109|       |            r[3] -= i;
  110|       |            r[1] += i;
  111|       |            r[0] -= i;
  112|   110k|         } else {
  113|   110k|            const uint64_t i32 = static_cast<uint64_t>(i) << 32;
  114|   110k|            r[2] -= i;
  115|   110k|            r[1] -= i32;
  116|   110k|            r[0] += i32;
  117|   110k|            r[0] -= i;
  118|   110k|         }
  119|   110k|         return r;
  120|   110k|      }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE8from_repERKNSt3__15arrayImLm6EEE:
   94|    499|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) { return z; }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_112Secp384r1RepINS_13EllipticCurveINS1_9secp384r16ParamsES2_E11FieldParamsEE6to_repERKNSt3__15arrayImLm6EEE:
   90|    286|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) { return x; }
pcurves_secp384r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp384r15Curve7fe_sqrtERKNS_6IntModINS1_12Secp384r1RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE:
  183|    168|      static constexpr FieldElement fe_sqrt(const FieldElement& x) {
  184|       |         // Generated using https://github.com/mmcloughlin/addchain
  185|       |
  186|    168|         auto z = x.square();
  187|    168|         z *= x;
  188|    168|         z = z.square();
  189|    168|         auto t0 = x * z;
  190|    168|         z = t0;
  191|    168|         z.square_n(3);
  192|    168|         auto t1 = t0 * z;
  193|    168|         auto t2 = t1.square();
  194|    168|         z = t2 * x;
  195|    168|         t2.square_n(5);
  196|    168|         t1 *= t2;
  197|    168|         t2 = t1;
  198|    168|         t2.square_n(12);
  199|    168|         t1 *= t2;
  200|    168|         t1.square_n(7);
  201|    168|         t1 *= z;
  202|    168|         z = t1.square();
  203|    168|         z *= x;
  204|    168|         t2 = z;
  205|    168|         t2.square_n(31);
  206|    168|         t1 *= t2;
  207|    168|         t2 = t1;
  208|    168|         t2.square_n(63);
  209|    168|         t1 *= t2;
  210|    168|         t2 = t1;
  211|    168|         t2.square_n(126);
  212|    168|         t1 *= t2;
  213|    168|         t1.square_n(3);
  214|    168|         t0 *= t1;
  215|    168|         t0.square_n(33);
  216|    168|         z *= t0;
  217|    168|         z.square_n(64);
  218|    168|         z *= x;
  219|    168|         z.square_n(30);
  220|    168|         return z;
  221|    168|      }

_ZN5Botan6PCurve14PCurveInstance9secp521r1Ev:
  291|      1|std::shared_ptr<const PrimeOrderCurve> PCurveInstance::secp521r1() {
  292|      1|   return PrimeOrderCurveImpl<secp521r1::Curve>::instance();
  293|      1|}
pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE3oneEv:
   24|      1|      constexpr static std::array<W, N> one() { return std::array<W, N>{1}; }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEE:
   26|   253k|      constexpr static std::array<W, N> redc(const std::array<W, 2 * N>& z) {
   27|       |         // Regardless of word size (32 or 64) the top word is 9 bits long
   28|   253k|         constexpr W TOP_BITS = static_cast<W>(0x1FF);
   29|       |         // The 23 or 55 bits that should be cleared in the top word
   30|   253k|         constexpr W CLEARED_TOP_BITS = WordInfo<W>::max ^ TOP_BITS;
   31|       |
   32|       |         /*
   33|       |         * Extract the high part of z (z >> 521)
   34|       |         */
   35|   253k|         std::array<W, N> t;  // NOLINT(*-member-init)
   36|       |
   37|  2.53M|         for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (37:28): [True: 2.28M, False: 253k]
  ------------------
   38|  2.28M|            t[i] = z[(N - 1) + i] >> 9;
   39|  2.28M|         }
   40|       |
   41|  2.28M|         for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (41:28): [True: 2.03M, False: 253k]
  ------------------
   42|  2.03M|            t[i] |= z[(N - 1) + i + 1] << (WordInfo<W>::bits - 9);
   43|  2.03M|         }
   44|       |
   45|       |         // Now t += z & (2**521-1)
   46|   253k|         W carry = 0;
   47|  2.28M|         for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (47:28): [True: 2.03M, False: 253k]
  ------------------
   48|  2.03M|            t[i] = word_add(t[i], z[i], &carry);
   49|  2.03M|         }
   50|       |
   51|       |         // Now add the (partial) top words; this can't carry out
   52|       |         // since both inputs are at most 2**9-1
   53|   253k|         t[N - 1] += (z[N - 1] & TOP_BITS) + carry;
   54|       |
   55|       |         /*
   56|       |         Since the modulus P is exactly 2**521 - 1 the only way the computed
   57|       |         result can be larger than P is if the top word is larger than TOP_BITS
   58|       |
   59|       |         Since TOP_BITS has the low 9 bits set, we can check if t[N - 1] > TOP_BITS
   60|       |         by checking if t[N - 1] >> 9 has any bits set. Doing it this way is
   61|       |         faster than a standard comparison since CT::Mask::is_gt requires
   62|       |         several bit operations.
   63|       |         */
   64|       |
   65|   253k|         const W is_over_p521 = ~CT::Mask<W>::is_zero(t[N - 1] >> 9).value();
   66|       |
   67|       |         /*
   68|       |         * Also must detect/handle x == P
   69|       |         */
   70|   253k|         const W is_eq_p521 = [&]() {
   71|   253k|            W sum = WordInfo<W>::max;
   72|   253k|            for(size_t i = 0; i != N - 1; ++i) {
   73|   253k|               sum &= t[i];
   74|   253k|            }
   75|   253k|            sum &= (CLEARED_TOP_BITS | t[N - 1]);
   76|       |
   77|   253k|            return CT::Mask<W>::is_zero(sum ^ WordInfo<W>::max).value();
   78|   253k|         }();
   79|       |
   80|   253k|         const W need_sub = is_over_p521 | is_eq_p521;
   81|       |
   82|   253k|         W borrow = 0;
   83|  2.28M|         for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (83:28): [True: 2.03M, False: 253k]
  ------------------
   84|  2.03M|            t[i] = word_sub(t[i], need_sub & WordInfo<W>::max, &borrow);
   85|  2.03M|         }
   86|   253k|         t[N - 1] = word_sub(t[N - 1], need_sub & TOP_BITS, &borrow);
   87|       |
   88|   253k|         return t;
   89|   253k|      }
pcurves_secp521r1.cpp:_ZZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE4redcERKNSt3__15arrayImLm18EEEENKUlvE_clEv:
   70|   253k|         const W is_eq_p521 = [&]() {
   71|   253k|            W sum = WordInfo<W>::max;
   72|  2.28M|            for(size_t i = 0; i != N - 1; ++i) {
  ------------------
  |  Branch (72:31): [True: 2.03M, False: 253k]
  ------------------
   73|  2.03M|               sum &= t[i];
   74|  2.03M|            }
   75|   253k|            sum &= (CLEARED_TOP_BITS | t[N - 1]);
   76|       |
   77|   253k|            return CT::Mask<W>::is_zero(sum ^ WordInfo<W>::max).value();
   78|   253k|         }();
pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE8from_repERKNSt3__15arrayImLm9EEE:
   95|    973|      constexpr static std::array<W, N> from_rep(const std::array<W, N>& z) { return z; }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r17P521RepINS_13EllipticCurveINS2_6ParamsES3_E11FieldParamsEE6to_repERKNSt3__15arrayImLm9EEE:
   91|    641|      constexpr static std::array<W, N> to_rep(const std::array<W, N>& x) { return x; }
pcurves_secp521r1.cpp:_ZN5Botan6PCurve12_GLOBAL__N_19secp521r15Curve7fe_sqrtERKNS_6IntModINS2_7P521RepINS_13EllipticCurveINS2_6ParamsES5_E11FieldParamsEEEEE:
  155|    374|      static constexpr FieldElement fe_sqrt(const FieldElement& x) {
  156|    374|         auto z = x;
  157|    374|         z.square_n(519);
  158|    374|         return z;
  159|    374|      }

_ZN5Botan14EC_AffinePointC2ERKNS_8EC_GroupENSt3__14spanIKhLm18446744073709551615EEE:
   36|  16.5k|EC_AffinePoint::EC_AffinePoint(const EC_Group& group, std::span<const uint8_t> bytes) {
   37|  16.5k|   m_point = group._data()->point_deserialize(bytes);
   38|  16.5k|   if(!m_point) {
  ------------------
  |  Branch (38:7): [True: 15.0k, False: 1.52k]
  ------------------
   39|  15.0k|      throw Decoding_Error("Failed to deserialize elliptic curve point");
   40|  15.0k|   }
   41|  16.5k|}
_ZN5Botan14EC_AffinePointD2Ev:
  148|  1.52k|EC_AffinePoint::~EC_AffinePoint() = default;

_ZN5Botan8EC_Group13ec_group_dataEv:
  231|      7|EC_Group_Data_Map& EC_Group::ec_group_data() {
  232|       |   /*
  233|       |   * This exists purely to ensure the allocator is constructed before g_ec_data,
  234|       |   * which ensures that its destructor runs after ~g_ec_data is complete.
  235|       |   */
  236|       |
  237|      7|   static const Allocator_Initializer g_init_allocator;
  238|      7|   static EC_Group_Data_Map g_ec_data;
  239|      7|   return g_ec_data;
  240|      7|}
_ZN5Botan8EC_Group18load_EC_group_infoEPKcS2_S2_S2_S2_S2_RKNS_3OIDE:
  254|      7|                                                            const OID& oid) {
  255|      7|   BOTAN_ARG_CHECK(oid.has_value(), "EC_Group::load_EC_group_info OID must be set");
  ------------------
  |  |   35|      7|   do {                                                          \
  |  |   36|      7|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|      7|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 7]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
  256|       |
  257|      7|   const BigInt p(p_str);
  258|      7|   const BigInt a(a_str);
  259|      7|   const BigInt b(b_str);
  260|      7|   const BigInt g_x(g_x_str);
  261|      7|   const BigInt g_y(g_y_str);
  262|      7|   const BigInt order(order_str);
  263|      7|   const BigInt cofactor(1);  // implicit
  264|       |
  265|      7|   return EC_Group_Data::create(p, a, b, g_x, g_y, order, cofactor, oid, EC_Group_Source::Builtin);
  266|      7|}
_ZN5Botan8EC_GroupD2Ev:
  412|      7|EC_Group::~EC_Group() = default;
_ZN5Botan8EC_GroupC2EONSt3__110shared_ptrINS_13EC_Group_DataEEE:
  419|      7|EC_Group::EC_Group(std::shared_ptr<EC_Group_Data>&& data) : m_data(std::move(data)) {}
_ZN5Botan8EC_Group9from_nameENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  478|      7|EC_Group EC_Group::from_name(std::string_view name) {
  479|      7|   std::shared_ptr<EC_Group_Data> data;
  480|       |
  481|      7|   if(auto oid = OID::from_name(name)) {
  ------------------
  |  Branch (481:12): [True: 7, False: 0]
  ------------------
  482|      7|      data = ec_group_data().lookup(oid.value());
  483|      7|   }
  484|       |
  485|      7|   if(!data) {
  ------------------
  |  Branch (485:7): [True: 0, False: 7]
  ------------------
  486|      0|      throw Invalid_Argument(fmt("Unknown EC_Group '{}'", name));
  487|      0|   }
  488|       |
  489|      7|   return EC_Group(std::move(data));
  490|      7|}
_ZN5Botan17EC_Group_Data_Map6lookupERKNS_3OIDE:
   54|      7|      std::shared_ptr<EC_Group_Data> lookup(const OID& oid) {
   55|      7|         const lock_guard_type<mutex_type> lock(m_mutex);
   56|       |
   57|     21|         for(auto i : m_registered_curves) {
  ------------------
  |  Branch (57:21): [True: 21, False: 7]
  ------------------
   58|     21|            if(i->oid() == oid) {
  ------------------
  |  Branch (58:16): [True: 0, False: 21]
  ------------------
   59|      0|               return i;
   60|      0|            }
   61|     21|         }
   62|       |
   63|       |         // Not found, check hardcoded data
   64|      7|         std::shared_ptr<EC_Group_Data> data = EC_Group::EC_group_info(oid);
   65|       |
   66|      7|         if(data) {
  ------------------
  |  Branch (66:13): [True: 7, False: 0]
  ------------------
   67|       |            // The requested OID may be an alias for a curve whose canonical OID differs
   68|       |            // TODO(Botan4) remove this once we require exactly one canonical OID per curve
   69|      7|            if(data->oid() != oid) {
  ------------------
  |  Branch (69:16): [True: 0, False: 7]
  ------------------
   70|      0|               for(const auto& i : m_registered_curves) {
  ------------------
  |  Branch (70:34): [True: 0, False: 0]
  ------------------
   71|      0|                  if(i->oid() == data->oid()) {
  ------------------
  |  Branch (71:22): [True: 0, False: 0]
  ------------------
   72|      0|                     return i;
   73|      0|                  }
   74|      0|               }
   75|      0|            }
   76|       |
   77|      7|            m_registered_curves.push_back(data);
   78|      7|            return data;
   79|      7|         }
   80|       |
   81|       |         // Nope, unknown curve
   82|      0|         return std::shared_ptr<EC_Group_Data>();
   83|      7|      }

_ZN5Botan13EC_Group_DataD2Ev:
   27|      7|EC_Group_Data::~EC_Group_Data() = default;
_ZN5Botan13EC_Group_DataC2ERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE:
   39|      7|      m_p(p),
   40|      7|      m_a(a),
   41|      7|      m_b(b),
   42|      7|      m_g_x(g_x),
   43|      7|      m_g_y(g_y),
   44|      7|      m_order(order),
   45|      7|      m_cofactor(cofactor),
   46|       |#if defined(BOTAN_HAS_LEGACY_EC_POINT)
   47|      7|      m_mod_field(Barrett_Reduction::for_public_modulus(p)),
   48|      7|      m_mod_order(Barrett_Reduction::for_public_modulus(order)),
   49|      7|      m_monty(m_p, m_mod_field),
   50|       |#endif
   51|      7|      m_oid(oid),
   52|      7|      m_p_words(p.sig_words()),
   53|      7|      m_p_bits(p.bits()),
   54|      7|      m_order_bits(order.bits()),
   55|      7|      m_order_bytes((m_order_bits + 7) / 8),
   56|      7|      m_a_is_minus_3(a == p - 3),
   57|      7|      m_a_is_zero(a.is_zero()),
   58|      7|      m_has_cofactor(m_cofactor != 1),
   59|      7|      m_order_is_less_than_p(m_order < p),
   60|      7|      m_source(source) {
   61|       |   // Verify the generator (x, y) satisfies y^2 = x^3 + a*x + b (mod p)
   62|      7|   auto mod_p = Barrett_Reduction::for_public_modulus(p);
   63|      7|   const BigInt y2 = mod_p.square(g_y);
   64|      7|   const BigInt x3_ax_b = mod_p.reduce(mod_p.cube(g_x) + mod_p.multiply(a, g_x) + b);
   65|      7|   if(y2 != x3_ax_b) {
  ------------------
  |  Branch (65:7): [True: 0, False: 7]
  ------------------
   66|      0|      throw Invalid_Argument("EC_Group generator is not on the curve");
   67|      0|   }
   68|       |
   69|       |   // TODO(Botan4) we can assume/assert the OID is set
   70|      7|   if(!m_oid.empty()) {
  ------------------
  |  Branch (70:7): [True: 7, False: 0]
  ------------------
   71|      7|      DER_Encoder der(m_der_named_curve);
   72|      7|      der.encode(m_oid);
   73|       |
   74|      7|      const std::string name = m_oid.human_name_or_empty();
   75|      7|      if(!name.empty()) {
  ------------------
  |  Branch (75:10): [True: 7, False: 0]
  ------------------
   76|       |         // returns nullptr if unknown or not supported
   77|      7|         m_pcurve = PCurve::PrimeOrderCurve::for_named_curve(name);
   78|      7|      }
   79|      7|      if(m_pcurve) {
  ------------------
  |  Branch (79:10): [True: 7, False: 0]
  ------------------
   80|      7|         m_engine = EC_Group_Engine::Optimized;
   81|      7|      }
   82|      7|   }
   83|       |
   84|       |   // Try a generic pcurves instance
   85|      7|   if(!m_pcurve && !m_has_cofactor) {
  ------------------
  |  Branch (85:7): [True: 0, False: 7]
  |  Branch (85:20): [True: 0, False: 0]
  ------------------
   86|      0|      m_pcurve = PCurve::PrimeOrderCurve::from_params(p, a, b, g_x, g_y, order);
   87|      0|      if(m_pcurve) {
  ------------------
  |  Branch (87:10): [True: 0, False: 0]
  ------------------
   88|      0|         m_engine = EC_Group_Engine::Generic;
   89|      0|      }
   90|       |      // possibly still null here, if parameters unsuitable or if the
   91|       |      // pcurves_generic module wasn't included in the build
   92|      0|   }
   93|       |
   94|      7|#if defined(BOTAN_HAS_LEGACY_EC_POINT)
   95|      7|   secure_vector<word> ws;
   96|      7|   m_a_r = m_monty.mul(a, m_monty.R2(), ws);
   97|      7|   m_b_r = m_monty.mul(b, m_monty.R2(), ws);
   98|      7|   if(!m_pcurve) {
  ------------------
  |  Branch (98:7): [True: 0, False: 7]
  ------------------
   99|      0|      m_engine = EC_Group_Engine::Legacy;
  100|      0|   }
  101|       |#else
  102|       |   if(!m_pcurve) {
  103|       |      if(m_oid.empty()) {
  104|       |         throw Not_Implemented("EC_Group this group is not supported in this build configuration");
  105|       |      } else {
  106|       |         throw Not_Implemented(
  107|       |            fmt("EC_Group the group {} is not supported in this build configuration", oid.to_string()));
  108|       |      }
  109|       |   }
  110|       |#endif
  111|      7|}
_ZN5Botan13EC_Group_Data6createERKNS_6BigIntES3_S3_S3_S3_S3_S3_RKNS_3OIDENS_15EC_Group_SourceE:
  121|      7|                                                     EC_Group_Source source) {
  122|      7|   auto group = std::make_shared<EC_Group_Data>(p, a, b, g_x, g_y, order, cofactor, oid, source);
  123|       |
  124|      7|#if defined(BOTAN_HAS_LEGACY_EC_POINT)
  125|      7|   group->m_curve = CurveGFp(group.get());
  126|      7|   group->m_base_point = EC_Point(group->m_curve, g_x, g_y);
  127|      7|   if(!group->m_pcurve) {
  ------------------
  |  Branch (127:7): [True: 0, False: 7]
  ------------------
  128|      0|      group->m_base_mult = std::make_unique<EC_Point_Base_Point_Precompute>(group->m_base_point, group->m_mod_order);
  129|      0|   }
  130|      7|#endif
  131|       |
  132|      7|   return group;
  133|      7|}
_ZNK5Botan13EC_Group_Data17point_deserializeENSt3__14spanIKhLm18446744073709551615EEE:
  384|  17.9k|std::unique_ptr<EC_AffinePoint_Data> EC_Group_Data::point_deserialize(std::span<const uint8_t> bytes) const {
  385|       |   // The deprecated "hybrid" point format
  386|       |   // TODO(Botan4) remove this
  387|  17.9k|   if(bytes.size() >= 1 + 2 * 4 && (bytes[0] == 0x06 || bytes[0] == 0x07)) {
  ------------------
  |  Branch (387:7): [True: 17.8k, False: 128]
  |  Branch (387:37): [True: 952, False: 16.8k]
  |  Branch (387:57): [True: 456, False: 16.4k]
  ------------------
  388|  1.40k|      const bool hdr_y_is_even = bytes[0] == 0x06;
  389|  1.40k|      const bool y_is_even = (bytes.back() & 0x01) == 0;
  390|       |
  391|  1.40k|      if(hdr_y_is_even == y_is_even) {
  ------------------
  |  Branch (391:10): [True: 1.36k, False: 40]
  ------------------
  392|  1.36k|         std::vector<uint8_t> sec1(bytes.begin(), bytes.end());
  393|  1.36k|         sec1[0] = 0x04;
  394|  1.36k|         return this->point_deserialize(sec1);
  395|  1.36k|      }
  396|  1.40k|   }
  397|       |
  398|  16.5k|   try {
  399|  16.5k|      if(m_pcurve) {
  ------------------
  |  Branch (399:10): [True: 16.5k, False: 0]
  ------------------
  400|  16.5k|         if(auto pt = m_pcurve->deserialize_point(bytes)) {
  ------------------
  |  Branch (400:18): [True: 1.52k, False: 15.0k]
  ------------------
  401|  1.52k|            return std::make_unique<EC_AffinePoint_Data_PC>(shared_from_this(), std::move(*pt));
  402|  15.0k|         } else {
  403|  15.0k|            return {};
  404|  15.0k|         }
  405|  16.5k|      } else {
  406|      0|#if defined(BOTAN_HAS_LEGACY_EC_POINT)
  407|      0|         auto pt = Botan::OS2ECP(bytes, m_curve);
  408|      0|         return std::make_unique<EC_AffinePoint_Data_BN>(shared_from_this(), std::move(pt));
  409|       |#else
  410|       |         throw Not_Implemented("Legacy EC interfaces disabled in this build configuration");
  411|       |#endif
  412|      0|      }
  413|  16.5k|   } catch(...) {
  414|      0|      return {};
  415|      0|   }
  416|  16.5k|}

_ZN5Botan22EC_AffinePoint_Data_PCC2ENSt3__110shared_ptrIKNS_13EC_Group_DataEEENS_6PCurve15PrimeOrderCurve11AffinePointE:
   88|  1.52k|      m_group(std::move(group)), m_pt(std::move(pt)) {
   89|  1.52k|   const auto& pcurve = m_group->pcurve();
   90|       |
   91|  1.52k|   if(!pcurve.affine_point_is_identity(m_pt)) {
  ------------------
  |  Branch (91:7): [True: 1.51k, False: 8]
  ------------------
   92|  1.51k|      m_xy.resize(1 + 2 * field_element_bytes());
   93|  1.51k|      pcurve.serialize_point(m_xy, m_pt);
   94|  1.51k|   }
   95|  1.52k|}
_ZNK5Botan22EC_AffinePoint_Data_PC19field_element_bytesEv:
  129|  1.51k|size_t EC_AffinePoint_Data_PC::field_element_bytes() const {
  130|  1.51k|   return m_group->pcurve().field_element_bytes();
  131|  1.51k|}

_ZN5Botan8EC_Group13EC_group_infoERKNS_3OIDE:
   16|      7|std::shared_ptr<EC_Group_Data> EC_Group::EC_group_info(const OID& oid) {
   17|       |   // secp256r1
   18|      7|   if(oid == OID{1, 2, 840, 10045, 3, 1, 7}) {
  ------------------
  |  Branch (18:7): [True: 1, False: 6]
  ------------------
   19|      1|      return load_EC_group_info(
   20|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
   21|      1|         "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
   22|      1|         "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
   23|      1|         "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
   24|      1|         "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
   25|      1|         "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
   26|      1|         oid);
   27|      1|   }
   28|       |
   29|       |   // secp384r1
   30|      6|   if(oid == OID{1, 3, 132, 0, 34}) {
  ------------------
  |  Branch (30:7): [True: 1, False: 5]
  ------------------
   31|      1|      return load_EC_group_info(
   32|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
   33|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
   34|      1|         "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
   35|      1|         "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
   36|      1|         "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
   37|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
   38|      1|         oid);
   39|      1|   }
   40|       |
   41|       |   // secp521r1
   42|      5|   if(oid == OID{1, 3, 132, 0, 35}) {
  ------------------
  |  Branch (42:7): [True: 1, False: 4]
  ------------------
   43|      1|      return load_EC_group_info(
   44|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
   45|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
   46|      1|         "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
   47|      1|         "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
   48|      1|         "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
   49|      1|         "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
   50|      1|         oid);
   51|      1|   }
   52|       |
   53|       |   // brainpool160r1
   54|      4|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 1}) {
  ------------------
  |  Branch (54:7): [True: 0, False: 4]
  ------------------
   55|      0|      return load_EC_group_info(
   56|      0|         "0xE95E4A5F737059DC60DFC7AD95B3D8139515620F",
   57|      0|         "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
   58|      0|         "0x1E589A8595423412134FAA2DBDEC95C8D8675E58",
   59|      0|         "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
   60|      0|         "0x1667CB477A1A8EC338F94741669C976316DA6321",
   61|      0|         "0xE95E4A5F737059DC60DF5991D45029409E60FC09",
   62|      0|         oid);
   63|      0|   }
   64|       |
   65|       |   // brainpool192r1
   66|      4|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 3}) {
  ------------------
  |  Branch (66:7): [True: 0, False: 4]
  ------------------
   67|      0|      return load_EC_group_info(
   68|      0|         "0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
   69|      0|         "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
   70|      0|         "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
   71|      0|         "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
   72|      0|         "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
   73|      0|         "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
   74|      0|         oid);
   75|      0|   }
   76|       |
   77|       |   // brainpool224r1
   78|      4|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 5}) {
  ------------------
  |  Branch (78:7): [True: 0, False: 4]
  ------------------
   79|      0|      return load_EC_group_info(
   80|      0|         "0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
   81|      0|         "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
   82|      0|         "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
   83|      0|         "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
   84|      0|         "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
   85|      0|         "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
   86|      0|         oid);
   87|      0|   }
   88|       |
   89|       |   // brainpool256r1
   90|      4|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 7}) {
  ------------------
  |  Branch (90:7): [True: 1, False: 3]
  ------------------
   91|      1|      return load_EC_group_info(
   92|      1|         "0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
   93|      1|         "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
   94|      1|         "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
   95|      1|         "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
   96|      1|         "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
   97|      1|         "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
   98|      1|         oid);
   99|      1|   }
  100|       |
  101|       |   // brainpool320r1
  102|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 9}) {
  ------------------
  |  Branch (102:7): [True: 0, False: 3]
  ------------------
  103|      0|      return load_EC_group_info(
  104|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
  105|      0|         "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
  106|      0|         "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
  107|      0|         "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
  108|      0|         "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
  109|      0|         "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
  110|      0|         oid);
  111|      0|   }
  112|       |
  113|       |   // brainpool384r1
  114|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 11}) {
  ------------------
  |  Branch (114:7): [True: 0, False: 3]
  ------------------
  115|      0|      return load_EC_group_info(
  116|      0|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
  117|      0|         "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
  118|      0|         "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
  119|      0|         "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
  120|      0|         "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
  121|      0|         "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
  122|      0|         oid);
  123|      0|   }
  124|       |
  125|       |   // brainpool512r1
  126|      3|   if(oid == OID{1, 3, 36, 3, 3, 2, 8, 1, 1, 13}) {
  ------------------
  |  Branch (126:7): [True: 1, False: 2]
  ------------------
  127|      1|      return load_EC_group_info(
  128|      1|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
  129|      1|         "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
  130|      1|         "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
  131|      1|         "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
  132|      1|         "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
  133|      1|         "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
  134|      1|         oid);
  135|      1|   }
  136|       |
  137|       |   // frp256v1
  138|      2|   if(oid == OID{1, 2, 250, 1, 223, 101, 256, 1}) {
  ------------------
  |  Branch (138:7): [True: 0, False: 2]
  ------------------
  139|      0|      return load_EC_group_info(
  140|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03",
  141|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00",
  142|      0|         "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F",
  143|      0|         "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF",
  144|      0|         "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB",
  145|      0|         "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1",
  146|      0|         oid);
  147|      0|   }
  148|       |
  149|       |   // gost_256A
  150|      2|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 1, 1} || oid == OID{1, 2, 643, 2, 2, 35, 1} || oid == OID{1, 2, 643, 2, 2, 36, 0}) {
  ------------------
  |  Branch (150:7): [True: 0, False: 2]
  |  Branch (150:7): [True: 0, False: 2]
  |  Branch (150:50): [True: 0, False: 2]
  |  Branch (150:88): [True: 0, False: 2]
  ------------------
  151|      0|      return load_EC_group_info(
  152|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97",
  153|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94",
  154|      0|         "0xA6",
  155|      0|         "0x1",
  156|      0|         "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14",
  157|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893",
  158|      0|         OID{1, 2, 643, 7, 1, 2, 1, 1, 1});
  159|      0|   }
  160|       |
  161|       |   // gost_512A
  162|      2|   if(oid == OID{1, 2, 643, 7, 1, 2, 1, 2, 1}) {
  ------------------
  |  Branch (162:7): [True: 0, False: 2]
  ------------------
  163|      0|      return load_EC_group_info(
  164|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7",
  165|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4",
  166|      0|         "0xE8C2505DEDFC86DDC1BD0B2B6667F1DA34B82574761CB0E879BD081CFD0B6265EE3CB090F30D27614CB4574010DA90DD862EF9D4EBEE4761503190785A71C760",
  167|      0|         "0x3",
  168|      0|         "0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064FDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235F5B889A589CB5215F2A4",
  169|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2B85DCACDB1411F10B275",
  170|      0|         oid);
  171|      0|   }
  172|       |
  173|       |   // secp160k1
  174|      2|   if(oid == OID{1, 3, 132, 0, 9}) {
  ------------------
  |  Branch (174:7): [True: 0, False: 2]
  ------------------
  175|      0|      return load_EC_group_info(
  176|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  177|      0|         "0x0",
  178|      0|         "0x7",
  179|      0|         "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
  180|      0|         "0x938CF935318FDCED6BC28286531733C3F03C4FEE",
  181|      0|         "0x100000000000000000001B8FA16DFAB9ACA16B6B3",
  182|      0|         oid);
  183|      0|   }
  184|       |
  185|       |   // secp160r1
  186|      2|   if(oid == OID{1, 3, 132, 0, 8}) {
  ------------------
  |  Branch (186:7): [True: 0, False: 2]
  ------------------
  187|      0|      return load_EC_group_info(
  188|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
  189|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
  190|      0|         "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
  191|      0|         "0x4A96B5688EF573284664698968C38BB913CBFC82",
  192|      0|         "0x23A628553168947D59DCC912042351377AC5FB32",
  193|      0|         "0x100000000000000000001F4C8F927AED3CA752257",
  194|      0|         oid);
  195|      0|   }
  196|       |
  197|       |   // secp160r2
  198|      2|   if(oid == OID{1, 3, 132, 0, 30}) {
  ------------------
  |  Branch (198:7): [True: 0, False: 2]
  ------------------
  199|      0|      return load_EC_group_info(
  200|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
  201|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
  202|      0|         "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA",
  203|      0|         "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D",
  204|      0|         "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
  205|      0|         "0x100000000000000000000351EE786A818F3A1A16B",
  206|      0|         oid);
  207|      0|   }
  208|       |
  209|       |   // secp192k1
  210|      2|   if(oid == OID{1, 3, 132, 0, 31}) {
  ------------------
  |  Branch (210:7): [True: 0, False: 2]
  ------------------
  211|      0|      return load_EC_group_info(
  212|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
  213|      0|         "0x0",
  214|      0|         "0x3",
  215|      0|         "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
  216|      0|         "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
  217|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
  218|      0|         oid);
  219|      0|   }
  220|       |
  221|       |   // secp192r1
  222|      2|   if(oid == OID{1, 2, 840, 10045, 3, 1, 1}) {
  ------------------
  |  Branch (222:7): [True: 1, False: 1]
  ------------------
  223|      1|      return load_EC_group_info(
  224|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  225|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  226|      1|         "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
  227|      1|         "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
  228|      1|         "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
  229|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
  230|      1|         oid);
  231|      1|   }
  232|       |
  233|       |   // secp224k1
  234|      1|   if(oid == OID{1, 3, 132, 0, 32}) {
  ------------------
  |  Branch (234:7): [True: 0, False: 1]
  ------------------
  235|      0|      return load_EC_group_info(
  236|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
  237|      0|         "0x0",
  238|      0|         "0x5",
  239|      0|         "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
  240|      0|         "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
  241|      0|         "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
  242|      0|         oid);
  243|      0|   }
  244|       |
  245|       |   // secp224r1
  246|      1|   if(oid == OID{1, 3, 132, 0, 33}) {
  ------------------
  |  Branch (246:7): [True: 1, False: 0]
  ------------------
  247|      1|      return load_EC_group_info(
  248|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
  249|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
  250|      1|         "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
  251|      1|         "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
  252|      1|         "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
  253|      1|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
  254|      1|         oid);
  255|      1|   }
  256|       |
  257|       |   // secp256k1
  258|      0|   if(oid == OID{1, 3, 132, 0, 10}) {
  ------------------
  |  Branch (258:7): [True: 0, False: 0]
  ------------------
  259|      0|      return load_EC_group_info(
  260|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
  261|      0|         "0x0",
  262|      0|         "0x7",
  263|      0|         "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
  264|      0|         "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
  265|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
  266|      0|         oid);
  267|      0|   }
  268|       |
  269|       |   // sm2p256v1
  270|      0|   if(oid == OID{1, 2, 156, 10197, 1, 301}) {
  ------------------
  |  Branch (270:7): [True: 0, False: 0]
  ------------------
  271|      0|      return load_EC_group_info(
  272|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF",
  273|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC",
  274|      0|         "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93",
  275|      0|         "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7",
  276|      0|         "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0",
  277|      0|         "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123",
  278|      0|         oid);
  279|      0|   }
  280|       |
  281|       |   // x962_p192v2
  282|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 2}) {
  ------------------
  |  Branch (282:7): [True: 0, False: 0]
  ------------------
  283|      0|      return load_EC_group_info(
  284|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  285|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  286|      0|         "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
  287|      0|         "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
  288|      0|         "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15",
  289|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",
  290|      0|         oid);
  291|      0|   }
  292|       |
  293|       |   // x962_p192v3
  294|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 3}) {
  ------------------
  |  Branch (294:7): [True: 0, False: 0]
  ------------------
  295|      0|      return load_EC_group_info(
  296|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
  297|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
  298|      0|         "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
  299|      0|         "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
  300|      0|         "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0",
  301|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",
  302|      0|         oid);
  303|      0|   }
  304|       |
  305|       |   // x962_p239v1
  306|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 4}) {
  ------------------
  |  Branch (306:7): [True: 0, False: 0]
  ------------------
  307|      0|      return load_EC_group_info(
  308|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  309|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  310|      0|         "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
  311|      0|         "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
  312|      0|         "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE",
  313|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",
  314|      0|         oid);
  315|      0|   }
  316|       |
  317|       |   // x962_p239v2
  318|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 5}) {
  ------------------
  |  Branch (318:7): [True: 0, False: 0]
  ------------------
  319|      0|      return load_EC_group_info(
  320|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  321|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  322|      0|         "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
  323|      0|         "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
  324|      0|         "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA",
  325|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",
  326|      0|         oid);
  327|      0|   }
  328|       |
  329|       |   // x962_p239v3
  330|      0|   if(oid == OID{1, 2, 840, 10045, 3, 1, 6}) {
  ------------------
  |  Branch (330:7): [True: 0, False: 0]
  ------------------
  331|      0|      return load_EC_group_info(
  332|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
  333|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
  334|      0|         "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
  335|      0|         "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
  336|      0|         "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3",
  337|      0|         "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",
  338|      0|         oid);
  339|      0|   }
  340|       |
  341|       |   // numsp512d1
  342|      0|   if(oid == OID{1, 3, 6, 1, 4, 1, 25258, 4, 3}) {
  ------------------
  |  Branch (342:7): [True: 0, False: 0]
  ------------------
  343|      0|      return load_EC_group_info(
  344|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC7",
  345|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC4",
  346|      0|         "0x1D99B",
  347|      0|         "0x2",
  348|      0|         "0x1C282EB23327F9711952C250EA61AD53FCC13031CF6DD336E0B9328433AFBDD8CC5A1C1F0C716FDC724DDE537C2B0ADB00BB3D08DC83755B205CC30D7F83CF28",
  349|      0|         "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B3CA4FB94E7831B4FC258ED97D0BDC63B568B36607CD243CE153F390433555D",
  350|      0|         oid);
  351|      0|   }
  352|       |
  353|      0|   return std::shared_ptr<EC_Group_Data>();
  354|      0|}

_ZN5Botan8CurveGFpC2EPKNS_13EC_Group_DataE:
   28|      7|CurveGFp::CurveGFp(const EC_Group_Data* group) : m_group(group) {
   29|      7|   BOTAN_ASSERT_NONNULL(m_group);
  ------------------
  |  |  116|      7|   do {                                                                                   \
  |  |  117|      7|      if((ptr) == nullptr) {                                                              \
  |  |  ------------------
  |  |  |  Branch (117:10): [True: 0, False: 7]
  |  |  ------------------
  |  |  118|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                              \
  |  |  119|      0|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |  120|      0|      }                                                                                   \
  |  |  121|      7|   } while(0)
  |  |  ------------------
  |  |  |  Branch (121:12): [Folded, False: 7]
  |  |  ------------------
  ------------------
   30|      7|}
_ZNK5Botan8CurveGFp5groupEv:
   32|     14|const EC_Group_Data& CurveGFp::group() const {
   33|     14|   BOTAN_ASSERT_NONNULL(m_group);
  ------------------
  |  |  116|     14|   do {                                                                                   \
  |  |  117|     14|      if((ptr) == nullptr) {                                                              \
  |  |  ------------------
  |  |  |  Branch (117:10): [True: 0, False: 14]
  |  |  ------------------
  |  |  118|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                              \
  |  |  119|      0|         Botan::assertion_failure(#ptr " is not null", "", __func__, __FILE__, __LINE__); \
  |  |  120|      0|      }                                                                                   \
  |  |  121|     14|   } while(0)
  |  |  ------------------
  |  |  |  Branch (121:12): [Folded, False: 14]
  |  |  ------------------
  ------------------
   34|     14|   return *m_group;
   35|     14|}
_ZN5Botan8EC_PointC2ERKNS_8CurveGFpENS_6BigIntES4_:
  115|      7|      m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) {
  116|      7|   const auto& group = m_curve.group();
  117|       |
  118|      7|   if(m_x < 0 || m_x >= group.p()) {
  ------------------
  |  Branch (118:7): [True: 0, False: 7]
  |  Branch (118:18): [True: 0, False: 7]
  ------------------
  119|      0|      throw Invalid_Argument("Invalid EC_Point affine x");
  120|      0|   }
  121|      7|   if(m_y < 0 || m_y >= group.p()) {
  ------------------
  |  Branch (121:7): [True: 0, False: 7]
  |  Branch (121:18): [True: 0, False: 7]
  ------------------
  122|      0|      throw Invalid_Argument("Invalid EC_Point affine y");
  123|      0|   }
  124|       |
  125|      7|   secure_vector<word> monty_ws(monty_ws_size(group));
  126|       |
  127|      7|   to_rep(group, m_x, monty_ws);
  128|      7|   to_rep(group, m_y, monty_ws);
  129|      7|}
_ZN5Botan8EC_Point4swapERS0_:
  792|      7|void EC_Point::swap(EC_Point& other) noexcept {
  793|      7|   m_curve.swap(other.m_curve);
  794|      7|   m_x.swap(other.m_x);
  795|      7|   m_y.swap(other.m_y);
  796|      7|   m_z.swap(other.m_z);
  797|      7|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_113monty_ws_sizeERKNS_13EC_Group_DataE:
  102|      7|size_t monty_ws_size(const EC_Group_Data& group) {
  103|      7|   return 2 * group.p_words();
  104|      7|}
ec_point.cpp:_ZN5Botan12_GLOBAL__N_16to_repERKNS_13EC_Group_DataERNS_6BigIntERNSt3__16vectorImNS_16secure_allocatorImEEEE:
   55|     14|void to_rep(const EC_Group_Data& group, BigInt& x, secure_vector<word>& ws) {
   56|     14|   group.monty().mul_by(x, group.monty().R2(), ws);
   57|     14|}

_ZN5Botan15allocate_memoryEmm:
   21|  2.21k|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   22|  2.21k|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (22:7): [True: 0, False: 2.21k]
  |  Branch (22:21): [True: 0, False: 2.21k]
  ------------------
   23|      0|      return nullptr;
   24|      0|   }
   25|       |
   26|       |   // Some calloc implementations do not check for overflow (?!?)
   27|  2.21k|   if(!checked_mul(elems, elem_size).has_value()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 2.21k]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   33|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   34|       |      return p;
   35|       |   }
   36|       |#endif
   37|       |
   38|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   39|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   40|       |#else
   41|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   42|  2.21k|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc,*-owning-memory)
   43|  2.21k|#endif
   44|  2.21k|   if(ptr == nullptr) {
  ------------------
  |  Branch (44:7): [True: 0, False: 2.21k]
  ------------------
   45|      0|      [[unlikely]] throw std::bad_alloc();
   46|      0|   }
   47|  2.21k|   return ptr;
   48|  2.21k|}
_ZN5Botan17deallocate_memoryEPvmm:
   50|  2.21k|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   51|  2.21k|   if(p == nullptr) {
  ------------------
  |  Branch (51:7): [True: 0, False: 2.21k]
  ------------------
   52|      0|      [[unlikely]] return;
   53|      0|   }
   54|       |
   55|  2.21k|   secure_scrub_memory(p, elems * elem_size);
   56|       |
   57|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   58|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   59|       |      return;
   60|       |   }
   61|       |#endif
   62|       |
   63|  2.21k|   std::free(p);  // NOLINT(*-no-malloc,*-owning-memory)
   64|  2.21k|}
_ZN5Botan20initialize_allocatorEv:
   66|      1|void initialize_allocator() {
   67|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   68|       |   mlock_allocator::instance();
   69|       |#endif
   70|      1|}

_ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   71|  15.0k|Exception::Exception(std::string_view msg) : m_msg(msg) {}
_ZN5Botan14Decoding_ErrorC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
  125|  15.0k|Decoding_Error::Decoding_Error(std::string_view name) : Exception(name) {}

_ZN5Botan19secure_scrub_memoryEPvm:
   25|  2.21k|void secure_scrub_memory(void* ptr, size_t n) {
   26|  2.21k|   return secure_zeroize_buffer(ptr, n);
   27|  2.21k|}
_ZN5Botan21secure_zeroize_bufferEPvm:
   29|  2.21k|void secure_zeroize_buffer(void* ptr, size_t n) {
   30|  2.21k|   if(n == 0) {
  ------------------
  |  Branch (30:7): [True: 0, False: 2.21k]
  ------------------
   31|      0|      return;
   32|      0|   }
   33|       |
   34|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   35|       |   ::RtlSecureZeroMemory(ptr, n);
   36|       |
   37|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   38|  2.21k|   ::explicit_bzero(ptr, n);
   39|       |
   40|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   41|       |   (void)::explicit_memset(ptr, 0, n);
   42|       |
   43|       |#else
   44|       |   /*
   45|       |   * Call memset through a static volatile pointer, which the compiler should
   46|       |   * not elide. This construct should be safe in conforming compilers, but who
   47|       |   * knows. This has been checked to generate the expected code, which saves the
   48|       |   * memset address in the data segment and unconditionally loads and jumps to
   49|       |   * that address, with the following targets:
   50|       |   *
   51|       |   * x86-64: Clang 19, GCC 6, 11, 13, 14
   52|       |   * riscv64: GCC 14
   53|       |   * aarch64: GCC 14
   54|       |   * armv7: GCC 14
   55|       |   *
   56|       |   * Actually all of them generated the expected jump even without marking the
   57|       |   * function pointer as volatile. However this seems worth including as an
   58|       |   * additional precaution.
   59|       |   */
   60|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   61|       |   (memset_ptr)(ptr, 0, n);
   62|       |#endif
   63|  2.21k|}